Cloud host data access security processing method and system

Abstract

The invention relates to the technical field of cloud host data security, in particular to a cloud host data access security processing method and system. According to the technical scheme, the method comprises the following steps of: key generation based on dynamic encryption and identity fusion: collecting multi-factor identity data of a user, extracting features, constructing and training a dynamic key generation model by utilizing a generative adversarial network, generating an encryption key through the model based on the real-time multi-factor identity data of the user, and an encryption channel based on elliptic curve cryptography is adopted to split the secret key and then distribute the secret key to the cloud host and the user side equipment. According to the invention, through key generation of dynamic encryption and identity fusion, key storage and management based on the block chain and key use behavior monitoring and anomaly detection based on artificial intelligence, the data access security of the cloud host is comprehensively improved, the risks of data leakage, tampering and abuse are effectively prevented, and the security of the cloud host is improved. And reliable protection and rapid abnormal response to the whole data access process are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud host data security, and in particular to a cloud host data access security processing method and system. Background Art

[0002] In a cloud hosting environment, data is usually stored in a cloud data center and accessed through the Internet. Users can log in to the cloud host using a specific account and password through various terminal devices, such as computers and mobile phones, and read, modify, and delete the data stored therein. In order to ensure the security of data access, cloud hosting service providers usually adopt a series of security measures, such as identity authentication, access control, and data encryption.

[0003] Identity authentication is the first line of defense for cloud host data access security. Common identity authentication methods include username / password authentication, dynamic password authentication, and biometric authentication. Username / password authentication is the most basic authentication method, but there are security risks such as password leakage and weak passwords. Dynamic password authentication increases the security of passwords by generating a one-time dynamic password, but requires users to carry additional devices for generating dynamic passwords, such as tokens, which is not very convenient to use. Biometric authentication, such as fingerprint recognition and facial recognition, has high security and convenience, but there is also the risk of biometrics being forged or stolen, and in some cases it may be affected by environmental factors, resulting in authentication failure.

[0004] Access control is the core link of cloud host data access security, which determines which users can access which data and what operations they can perform. The traditional access control model is mainly based on role-based access control (RBAC), which controls data access by assigning different roles to users and granting corresponding permissions to roles. However, in a cloud host environment, user roles and permissions may change frequently as business needs change, and the traditional RBAC model is difficult to meet this dynamic requirement. In addition, cloud hosts usually support multi-tenant mode, and the data of different tenants needs to be isolated and access controlled, but the existing access control technology still has some shortcomings in terms of security and performance in a multi-tenant environment.

[0005] Data encryption is an important means to ensure the security of cloud host data, but it faces the problem of key management in practical applications. On the one hand, static keys are vulnerable to brute force attacks, especially with the continuous improvement of computing power, the security of traditional fixed key encryption methods has gradually decreased. On the other hand, there are also risks in the distribution and storage of keys. If the key is intercepted during transmission or leaked during storage, the entire data encryption system will be useless. Moreover, in a large-scale cloud host environment, how to efficiently generate and manage unique keys for each data access instance is also a problem that needs to be solved.

[0006] In summary, the present application proposes a cloud host data access security processing method and system. Summary of the invention

[0007] The purpose of the present invention is to address the problem in the background technology that cloud host data access cannot efficiently generate and manage unique keys for each data access instance, and to propose a cloud host data access security processing method and system.

[0008] The technical solution of the present invention is a cloud host data access security processing method, comprising the following method steps: Key generation based on dynamic encryption and identity fusion: Collect user multi-factor identity data and extract features, use generative adversarial networks to build and train a dynamic key generation model, generate encryption keys based on user real-time multi-factor identity data through the model, and use an encrypted channel based on elliptic curve cryptography to split the keys and distribute them to the cloud host and user-end devices; Key storage and management based on blockchain: Build a private blockchain network and adopt the Byzantine fault-tolerant consensus algorithm. After the cloud host receives and encrypts the key, it stores the encrypted key and related information in the blockchain. When the cloud host uses the key, it obtains and decrypts the key after verifying the request based on the consensus mechanism. The audit node audits the key usage based on the set threshold; Key usage behavior monitoring and anomaly detection based on artificial intelligence: collect key usage related data and perform feature engineering processing, build and train a long short-term memory network anomaly detection model, input the feature vector of key usage data collected in real time into the model, and determine whether to trigger the abnormal response mechanism based on the set abnormal probability threshold. If triggered, suspend related data operations, notify the administrator and initiate emergency data protection measures.

[0009] Optionally, the multi-factor identity data collection includes collecting the user's fingerprint image, facial image, voice signal, device information, network environment information and timestamp, wherein the fingerprint image extracts detail feature points and converts them into feature vectors, the facial image extracts features through a convolutional neural network and flattens them into a one-dimensional vector, the voice signal uses Mel-frequency cepstral coefficients to extract voice feature vectors, and the device information and network environment information are encoded and processed.

[0010] Optionally, the generator network of the generative adversarial network adopts a multi-layer fully connected neural network, the number of neurons in the input layer is equal to the dimension of the multi-factor identity feature vector, the number of neurons in the output layer is equal to the key length, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the ReLU function; the discriminator network also adopts a multi-layer fully connected neural network, the number of neurons in the input layer is equal to the key length, the number of neurons in the output layer is 1, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the LeakyReLU function, and the stochastic gradient descent algorithm is adopted during training, the learning rate is 0.001, and the momentum is 0.9.

[0011] Optionally, the elliptic curve cryptography uses a specific elliptic curve equation, and the cloud host and the user-end device have their own public and private key pairs. After the key is split, it is transmitted through different paths and verified at the receiving end. Specifically, the key is split into two parts, which are XORed with the hash value of the other party's public key and then transmitted. The receiving end recovers the key by XORing with the hash value of its own public key.

[0012] Optionally, the nodes of the private blockchain network include cloud host cluster nodes, key management servers and audit nodes. Each node has a unique identity and a public-private key pair. A practical Byzantine fault-tolerant algorithm is used as a consensus mechanism. In the key storage request processing process, including request broadcast, signature verification, view change, and pre-preparation, preparation, and submission stages, the key storage operation is executed when more than 2n / 3 nodes agree to submit.

[0013] Optionally, in the blockchain-based key storage and management, the key encryption storage includes using a symmetric encryption algorithm based on the cloud host identity to initially encrypt the key, and then using the blockchain network public key to encrypt it again, and the key-related information stored in the blockchain is used to construct a data structure and calculate a hash value as transaction storage, wherein the symmetric encryption algorithm adopts the AES algorithm, and the key is the hash value of the cloud host identity.

[0014] Optionally, in the blockchain-based key storage and management, when the key usage audit is performed, the audit node monitors the key usage transactions, and when the cloud host key usage frequency exceeds the set threshold of 10 times / second, an alarm is triggered and the administrator is notified.

[0015] Optionally, in the artificial intelligence-based key usage behavior monitoring and anomaly detection, the data collection and feature engineering include collecting key usage frequency, usage time interval, data source and destination IP addresses, data operation volume and system log information, normalizing the key usage frequency, converting the IP address into geographic location code and network type code, setting a flag for login failure records according to a set threshold of 3 times / minute, and combining them into a feature vector.

[0016] Optionally, in the artificial intelligence-based key usage behavior monitoring and anomaly detection, the number of input layer neurons of the long short-term memory network anomaly detection model is equal to the feature vector dimension, the middle hidden layer adopts a layer of LSTM units with a number of 64, followed by a fully connected layer with a number of 32 neurons, the activation function adopts the Sigmoid function, and the cross entropy loss function and Adam optimization algorithm are used for training, and the learning rate , , , ; When the anomaly probability value output by the anomaly detection model exceeds the set threshold of 0.6, the anomaly response mechanism is triggered. The anomaly response mechanism includes suspending data operations, notifying administrators and providing detailed reports, and initiating emergency data protection measures.

[0017] In a second aspect, the present application provides a cloud host data access security processing system, including: Key generation module: used to collect user multi-factor identity data and extract features, build and train a dynamic key generation model using a generative adversarial network, generate encryption keys based on the user's real-time multi-factor identity data through the model, and use an encrypted channel based on elliptic curve cryptography to split the keys and distribute them to the cloud host and user-end devices; Key storage and management module: used to build a private blockchain network, using the Byzantine fault-tolerant consensus algorithm. After the cloud host receives and encrypts the key, it stores the encrypted key and related information in the blockchain. When the cloud host uses the key, it obtains and decrypts the key after verifying the request based on the consensus mechanism. The audit node audits the key usage based on the set threshold; Key usage behavior monitoring and anomaly detection module: used to collect key usage related data and perform feature engineering processing, build and train the long short-term memory network anomaly detection model, input the feature vector of key usage data collected in real time into the model, and determine whether to trigger the abnormal response mechanism based on the set abnormal probability threshold. If triggered, suspend related data operations, notify the administrator and initiate emergency data protection measures.

[0018] Compared with the prior art, the present invention has at least one of the following beneficial technical effects: The present invention generates dynamic keys by combining multi-factor identity data, enhancing key security and cracking difficulty, and ensuring data access security. Based on elliptic curve cryptography, the encryption channel splits the transmission key to ensure the confidentiality and integrity of key transmission.

[0019] Furthermore, through the private blockchain network and the Byzantine fault-tolerant consensus algorithm, the key storage can be made tamper-proof and resistant to single-point failures, and multiple nodes can participate in the verification of the storage process. By monitoring the key usage behavior through the artificial intelligence model, anomalies can be detected in a timely manner and the response mechanism can be triggered, thereby reducing the risk of data leakage and quickly dealing with security threats.

[0020] Furthermore, through dynamic encryption and identity-integrated key generation, blockchain-based key storage and management, and artificial intelligence-based key usage behavior monitoring and anomaly detection, the security of cloud host data access can be comprehensively improved, effectively preventing the risks of data leakage, tampering and abuse, and achieving reliable protection of the entire data access process and rapid exception response. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 The present invention is a flow chart of a cloud host data access security processing method; Figure 2 The schematic diagram of a cloud host data access security processing system is shown in FIG. DETAILED DESCRIPTION

[0022] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and specific embodiments.

[0023] like Figure 1 As shown, a cloud host data access security processing method proposed by the present invention is described in detail below.

[0024] 1. Key Generation Based on Dynamic Encryption and Identity Fusion Multi-factor identity collection and feature extraction During the cloud host user login phase, a variety of biometric information is collected, including fingerprint images, facial images, and voice signals. For fingerprint images, the fingerprint recognition algorithm is used to extract the detailed feature points of the fingerprint, including endpoints and bifurcation points, and convert them into feature vectors. ,in Represents the ith fingerprint feature value. For facial images, feature extraction is performed through a convolutional neural network (CNN). Let the feature map obtained after the facial image passes through CNN be M, and flatten it into a one-dimensional vector ,in, Represents the jth facial feature value. For speech signals, the Mel-frequency cepstral coefficient (MFCC) is used to extract speech features and obtain the speech feature vector ,in Indicates At the same time, collect the device information when the user logs in, including the device model , operating system version , network environment information and current timestamp , network environment information including IP address Region , Network access type . Encode this information and convert the device model and operating system version into a digital code and , convert the network access type to binary code , converting the region information into a geographic location code Finally, we get the multi-factor identity feature vector .

[0025] Dynamic key generation model construction and training Extraction-based multi-factor identity features , build a dynamic key generation model. The Generative Adversarial Network (GAN) architecture is adopted, in which the generator network Multi-factor identity features Generate candidate values ​​for encryption keys as input The generator network structure can adopt a multi-layer fully connected neural network. Suppose the number of neurons in the input layer of the generator network is (equal to the multi-factor identity feature vector The number of neurons in the output layer is , Equal to the length of the key, take =256, the middle hidden layer uses several layers of fully connected layers with gradually decreasing number of neurons, and the activation function of each layer uses the ReLU function. It is responsible for judging the generated key candidate value Whether it meets the safety requirements. The discriminator network structure also uses a multi-layer fully connected neural network, and the number of neurons in the input layer is , is the key length, the number of neurons in the output layer is 1, which indicates the security score of the key. The middle hidden layer uses several fully connected layers with a gradually decreasing number of neurons, and the activation function uses the LeakyReLU function.

[0026] Training objective function: Generator The goal is to maximize the discriminator The probability of misjudgment of the key generated by it is .

[0027] Discriminator The goal is to accurately distinguish the real security key (sampled from a secure keystore) and the keys generated by the generator ,Right now .

[0028] The dynamic key generation model is trained using a large amount of historical security access data and simulated attack data. During the training process, the stochastic gradient descent (SGD) algorithm is used, and the learning rate = 0.001, Momentum =0.9, and continuously adjust the parameters of the generator and the discriminator so that the generator can generate high-quality dynamic keys and the discriminator can accurately evaluate the security of the keys.

[0029] Real-time key generation and distribution When a user makes a cloud host data access request, the system uses the currently collected multi-factor identity data to , generate encryption keys in real time through the trained dynamic key generation model .

[0030] The generated key is distributed using an encrypted channel based on elliptic curve cryptography (ECC). Let the elliptic curve equation be , =1, =1 in a certain finite field superior, is a large prime number, and the public key of the cloud host is , the private key is , the public key of the user device is , the private key is . Split into and Two parts, including , represents the exclusive OR operation, is a hash function, such as SHA-256, . Through the path Transfer to the cloud host, Through the path Transmitted to the user's device. The cloud host receives After that, calculate , the user end device receives After that, calculate , and verify the key to ensure the security of the key during the distribution process.

[0031] 2. Blockchain-based key storage and management Blockchain network construction and initialization Build a private blockchain network dedicated to cloud host key storage and management. The nodes in the network include the nodes in the cloud host cluster , , Key Management Server And dedicated audit nodes During the initialization phase of the blockchain network, each node is assigned a unique identity. and a public-private key pair , used for communication between nodes and data signature verification.

[0032] Determine the consensus mechanism of the blockchain and adopt the Byzantine Fault Tolerance (BFT) consensus algorithm, such as the Practical Byzantine Fault Tolerance (PBFT) algorithm. In the PBFT algorithm, let the total number of nodes be n. When a newly generated key needs to be stored, a key storage request is broadcast to the blockchain network , including request information r, node signature , Sign represents the signature function. After receiving the request, other nodes first verify the validity of the signature, and then enter the view change phase and the pre-preparation, preparation, and submission phases. In the pre-preparation phase, the master node (Elected) will request Broadcast to other replica nodes. After receiving the message, the replica nodes enter the preparation phase and broadcast the preparation message to other nodes. If a node receives more than 2n / 3 identical prepare messages, it enters the commit phase and broadcasts the commit message. , the key storage operation will be executed only when the node receives more than 2n / 3 identical commit messages.

[0033] Key storage and encrypted records When the cloud host receives the dynamically generated key After that, the key is encrypted and stored in the blockchain storage area of ​​the local node. First, use the cloud host identity The symmetric encryption algorithm uses the AES algorithm, and the key is , As the hash function, the key is initially encrypted to obtain . Then use the public key in the blockchain network The initially encrypted key is encrypted again to obtain , Enc represents the public key encryption function, which ensures the security of the key in the storage link.

[0034] At the same time, the relevant information of the key is recorded on the blockchain, including the time when the key was generated. , User , associated cloud host resources As well as the encryption algorithm and parameter information of the key. This information is constructed into a data structure , calculate its hash value , is a hash function, such as SHA-3, and As a blockchain transaction Part of it is stored in the blockchain ledger, which is tamper-proof and traceable.

[0035] Key usage and auditing When the cloud host needs to use a key for data encryption or decryption operations, it first sends a key usage request to the blockchain network. , which includes the cloud host's authentication information , Data operation type (encryption or decryption) and the hash value of the data to be operated , The nodes in the blockchain network verify the request according to the consensus mechanism. After the verification is passed, the cloud host node obtains the encrypted key from the local blockchain storage area. , using the private key Decrypt to get , Dec represents the private key decryption function, and then uses the symmetric key Decryption operation is performed to obtain , and then use the decrypted key to encrypt or decrypt the data.

[0036] Audit Node Responsible for real-time auditing of key usage in the blockchain network. Audit nodes monitor key usage transactions on the blockchain. , check whether the key usage complies with the cloud host's security policy and compliance requirements. Set the key usage frequency threshold = 10 times / second, if a cloud host is found to use the key more frequently than , the audit node will trigger an alarm and notify the security administrator for further investigation to prevent the key from being abused or stolen.

[0037] 3. Key usage behavior monitoring and anomaly detection based on artificial intelligence Data collection and feature engineering During the operation of the cloud host, data related to key usage is continuously collected, including the frequency of key usage. , Use time interval , the source and destination IP addresses used and , Data operation volume And system log information related to key usage, login failure records , system error message e. Perform feature engineering on the collected data to convert the raw data into feature vectors that can be used by the machine learning model.

[0038] For the key usage frequency characteristics , normalized , The maximum normal frequency is set. = 5 times / second. For IP address features, convert them into corresponding geographic location codes and and network type code and . For login failure records in the system log , set the login failure threshold = 3 times / minute, if , then set a flag =1, otherwise = 0. Combine these features into a feature vector .

[0039] Anomaly detection model construction and training The long short-term memory network (LSTM) in deep learning is used to build a key usage behavior anomaly detection model. The number of neurons in the input layer of the LSTM network is the feature vector Dimensions , the number of neurons in the output layer is 1, indicating the abnormal probability value of key usage behavior The middle hidden layer uses one LSTM unit with the number of units being , = 64, followed by a fully connected layer with the number of neurons , =32, and the activation function uses the Sigmoid function.

[0040] The training data includes normal and abnormal key usage data samples, labeled , 0 means normal, 1 means abnormal, and the cross entropy loss function is used: , Among them, N is the number of training samples, and the Adam optimization algorithm is used for training. The learning rate , , , ,Through a large amount of training data, the LSTM model learns the characteristic differences between normal and abnormal key usage behaviors, so that it can accurately detect potential abnormal situations.

[0041] Real-time monitoring and response mechanism When the cloud host is running, the key usage data feature vector collected in real time is used Input into the trained LSTM anomaly detection model, and the model outputs the abnormal probability value of key usage behavior in real time . Set the anomaly probability threshold =0.6, when the abnormal probability value Exceed When the system triggers the abnormal response mechanism.

[0042] The abnormal response mechanism includes immediately suspending relevant data operations involving abnormal keys, notifying security administrators, and providing detailed abnormal information reports, which include relevant information about abnormal keys, characteristic descriptions of abnormal behaviors, and analysis of possible attack sources. At the same time, emergency data protection measures are initiated, such as backing up relevant data, isolating cloud hosts, or restricting network access, etc., to prevent further data leakage or destruction and ensure the security and integrity of cloud host data access.

[0043] like Figure 2 As shown, this embodiment provides a cloud host data access security processing system, including: Key generation module: used to collect user multi-factor identity data and extract features, use generative adversarial networks to build and train dynamic key generation models, generate encryption keys through the model based on user real-time multi-factor identity data, and use encryption channels based on elliptic curve cryptography to split the keys and distribute them to cloud hosts and user-end devices; the multi-factor identity data collection includes collecting user fingerprint images, facial images, voice signals, device information, network environment information and timestamps, wherein the fingerprint image extracts detail feature points and converts them into feature vectors, the facial image extracts features through convolutional neural networks and flattens them into one-dimensional vectors, the voice signal uses Mel frequency cepstral coefficients to extract voice feature vectors, and the device information and network environment information are encoded and processed; the generator network of the generative adversarial network uses a multi-layer fully connected neural network, and the number of neurons in the input layer is equal to the multi-factor identity feature vector dimension The number of neurons in the output layer is equal to the key length, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the ReLU function; the discriminator network also adopts a multi-layer fully connected neural network, the number of neurons in the input layer is equal to the key length, the number of neurons in the output layer is 1, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the LeakyReLU function. The stochastic gradient descent algorithm is used for training, the learning rate is 0.001, and the momentum is 0.9; the elliptic curve cryptography adopts a specific elliptic curve equation, the cloud host and the user end device have their own public and private key pairs, and the key is split and transmitted through different paths and verified at the receiving end. Specifically, the key is split into two parts, each of which is XORed with the hash value of the other party's public key and then transmitted, and the receiving end recovers the key by XORing with the hash value of its own public key; Key storage and management module: used to build a private blockchain network, using the Byzantine fault-tolerant consensus algorithm. After the cloud host receives and encrypts the key, it stores the encrypted key and related information in the blockchain. When the cloud host uses the key, it obtains and decrypts the key after verifying the request based on the consensus mechanism. The audit node audits the key usage based on the set threshold. The nodes of the private blockchain network include cloud host cluster nodes, key management servers and audit nodes. Each node has a unique identity and a public-private key pair. The practical Byzantine fault-tolerant algorithm is used as the consensus mechanism. In the key storage request processing process, including request broadcast, signature verification, view change In the pre-preparation, preparation and submission stages, the key storage operation is performed when more than 2n / 3 nodes agree to submit; the key encryption storage includes using a symmetric encryption algorithm based on the cloud host identity to initially encrypt the key, and then using the blockchain network public key to encrypt it again, and the key-related information stored in the blockchain is used to construct a data structure and calculate a hash value as transaction storage, wherein the symmetric encryption algorithm uses the AES algorithm, and the key is the hash value of the cloud host identity; during the key usage audit, the audit node monitors the key usage transaction, and when the cloud host key usage frequency exceeds the set threshold of 10 times / second, an alarm is triggered and the administrator is notified; Key usage behavior monitoring and anomaly detection module: used to collect key usage related data and perform feature engineering processing, build and train a long short-term memory network anomaly detection model, input the key usage data feature vector collected in real time into the model, and determine whether to trigger the abnormal response mechanism based on the set abnormal probability threshold. If triggered, the relevant data operation is suspended, the administrator is notified, and emergency data protection measures are initiated; the data collection and feature engineering include collecting key usage frequency, usage time interval, data source and destination IP addresses, data operation volume and system log information, normalizing the key usage frequency, converting the IP address into a geographic location code and a network type code, setting a flag bit for login failure records based on a set threshold of 3 times / minute, and combining them into a feature vector; the number of neurons in the input layer of the long short-term memory network anomaly detection model is equal to the feature vector dimension, the middle hidden layer uses a layer of LSTM units with a number of 64, followed by a fully connected layer with a number of 32 neurons, the activation function uses the Sigmoid function, and the cross entropy loss function and Adam optimization algorithm are used for training, and the learning rate is ; When the abnormal probability value output by the anomaly detection model exceeds the set threshold of 0.6, the abnormal response mechanism is triggered. The abnormal response mechanism includes suspending data operations, notifying administrators and providing detailed reports, and initiating emergency data protection measures.

[0044] The above specific embodiments are only several optional embodiments of the present invention. Based on the technical solutions of the present invention and the relevant inspirations of the above embodiments, those skilled in the art can make various alternative improvements and combinations to the above specific embodiments.

Claims

1. A cloud host data access security processing method, characterized in that: The method comprises the following steps: Key generation based on dynamic encryption and identity fusion: Collect user multi-factor identity data and extract features, use generative adversarial networks to build and train a dynamic key generation model, generate encryption keys based on user real-time multi-factor identity data through the model, and use an encrypted channel based on elliptic curve cryptography to split the keys and distribute them to the cloud host and user-end devices; Key storage and management based on blockchain: Build a private blockchain network and adopt the Byzantine fault-tolerant consensus algorithm. After the cloud host receives and encrypts the key, it stores the encrypted key and related information in the blockchain. When the cloud host uses the key, it obtains and decrypts the key after verifying the request based on the consensus mechanism. The audit node audits the key usage based on the set threshold; Key usage behavior monitoring and anomaly detection based on artificial intelligence: collect key usage related data and perform feature engineering processing, build and train a long short-term memory network anomaly detection model, input the feature vector of key usage data collected in real time into the model, and determine whether to trigger the abnormal response mechanism based on the set abnormal probability threshold. If triggered, suspend related data operations, notify the administrator and initiate emergency data protection measures.

2. A cloud host data access security processing method according to claim 1, characterized in that: The multi-factor identity data collection includes collecting the user's fingerprint image, facial image, voice signal, device information, network environment information and timestamp, wherein the fingerprint image extracts detail feature points and converts them into feature vectors, the facial image extracts features through a convolutional neural network and flattens them into a one-dimensional vector, the voice signal uses Mel frequency cepstral coefficients to extract voice feature vectors, and the device information and network environment information are encoded and processed.

3. A cloud host data access security processing method according to claim 2, characterized in that: The generator network of the generative adversarial network adopts a multi-layer fully connected neural network, the number of neurons in the input layer is equal to the dimension of the multi-factor identity feature vector, the number of neurons in the output layer is equal to the key length, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the ReLU function; the discriminator network also adopts a multi-layer fully connected neural network, the number of neurons in the input layer is equal to the key length, the number of neurons in the output layer is 1, the middle hidden layer adopts several layers of fully connected layers with a gradually decreasing number of neurons, and the activation function adopts the LeakyReLU function, and the stochastic gradient descent algorithm is used for training, the learning rate is 0.001, and the momentum is 0.

9.

4. A cloud host data access security processing method according to claim 3, characterized in that: The elliptic curve cryptography adopts a specific elliptic curve equation. The cloud host and the user terminal device have their own public and private key pairs. After the key is split, it is transmitted through different paths and verified at the receiving end. Specifically, the key is split into two parts, and the two parts are XORed with the hash value of the other party's public key and then transmitted. The receiving end recovers the key by XORing with the hash value of its own public key.

5. A cloud host data access security processing method according to claim 4, characterized in that: The nodes of the private blockchain network include cloud host cluster nodes, key management servers and audit nodes. Each node has a unique identity and a public-private key pair. A practical Byzantine fault-tolerant algorithm is used as a consensus mechanism. The key storage request processing process includes request broadcast, signature verification, view change, and pre-preparation, preparation, and submission stages. The key storage operation is executed when more than 2n / 3 nodes agree to submit.

6. A cloud host data access security processing method according to claim 1, characterized in that: In the blockchain-based key storage and management, the key encryption storage includes using a symmetric encryption algorithm based on the cloud host identity to initially encrypt the key, and then using the blockchain network public key to encrypt it again. The key-related information stored in the blockchain constructs a data structure and calculates a hash value as transaction storage, wherein the symmetric encryption algorithm adopts the AES algorithm, and the key is the hash value of the cloud host identity.

7. A cloud host data access security processing method according to claim 6, characterized in that: In the blockchain-based key storage and management, during the key usage audit, the audit node monitors the key usage transactions, and when the cloud host key usage frequency exceeds the set threshold of 10 times / second, an alarm is triggered and the administrator is notified.

8. A cloud host data access security processing method according to claim 1, characterized in that: In the artificial intelligence-based key usage behavior monitoring and anomaly detection, the data collection and feature engineering include collecting key usage frequency, usage time interval, data source and destination IP addresses, data operation volume and system log information, normalizing the key usage frequency, converting the IP address into geographic location code and network type code, setting a flag for login failure records based on the set threshold of 3 times / minute, and combining them into a feature vector.

9. A cloud host data access security processing method according to claim 8, characterized in that: In the artificial intelligence-based key usage behavior monitoring and anomaly detection, the number of neurons in the input layer of the long short-term memory network anomaly detection model is equal to the feature vector dimension, the middle hidden layer uses a layer of LSTM units with a number of 64, followed by a fully connected layer with a number of 32 neurons, the activation function uses the Sigmoid function, and the cross entropy loss function and Adam optimization algorithm are used for training, and the learning rate , , , ; When the anomaly probability value output by the anomaly detection model exceeds the set threshold of 0.6, the anomaly response mechanism is triggered. The anomaly response mechanism includes suspending data operations, notifying administrators and providing detailed reports, and initiating emergency data protection measures.

10. A cloud host data access security processing system, characterized in that: include: Key generation module: used to collect user multi-factor identity data and extract features, build and train a dynamic key generation model using a generative adversarial network, generate encryption keys based on the user's real-time multi-factor identity data through the model, and use an encrypted channel based on elliptic curve cryptography to split the keys and distribute them to the cloud host and user-end devices; Key storage and management module: used to build a private blockchain network, using the Byzantine fault-tolerant consensus algorithm. After the cloud host receives and encrypts the key, it stores the encrypted key and related information in the blockchain. When the cloud host uses the key, it obtains and decrypts the key after verifying the request based on the consensus mechanism. The audit node audits the key usage based on the set threshold; Key usage behavior monitoring and anomaly detection module: used to collect key usage related data and perform feature engineering processing, build and train the long short-term memory network anomaly detection model, input the feature vector of key usage data collected in real time into the model, and determine whether to trigger the abnormal response mechanism based on the set abnormal probability threshold. If triggered, suspend related data operations, notify the administrator and initiate emergency data protection measures.

Images