Data security management method and system based on cloud computing

Abstract

The invention discloses a data security management method and system based on cloud computing, and relates to the technical field of data management, and the method comprises the following steps: S1, making a security policy; s2, performing security assessment on the cloud infrastructure; s3, performing identity authentication and access control; s4, data encryption and key management; s5, data classification and level-to-level management; s6, data leakage detection and defense; s7, performing auditing and compliance management; s8, abnormal behavior monitoring and threat response; and S9, an elastic backup and recovery mechanism. According to the data security governance method and system based on cloud computing, the elasticity and dynamic response capability of data security are remarkably improved by setting the distributed key management system and the intelligent monitoring model. The distributed key management system dispersedly stores the keys in different physical areas, so that the risk of single-point fault and attack is reduced; the AI-based intelligent behavior monitoring system analyzes user behaviors in real time, predicts abnormal operation and automatically responds.

Description

Technical Field

[0001] The present invention relates to the technical field of data management, and in particular to a data security management method and system based on cloud computing. Background Art

[0002] With the rapid development of cloud computing, more and more enterprises are migrating their core businesses to the cloud to improve resource utilization efficiency and business agility. However, data security issues in cloud environments are becoming increasingly prominent. Due to the distributed storage and transmission of data in the cloud, enterprises face challenges such as data leakage, unauthorized access, and compliance issues. Traditional security measures often rely on localized physical isolation and control, while in cloud computing, data storage and computing resources are shared, which makes data protection more complicated.

[0003] In order to cope with these challenges, cloud computing data security governance methods have gradually developed, involving data encryption, identity authentication, access control, data classification management and other measures. However, existing technical solutions still have significant deficiencies in data key management and other aspects. For example:

[0004] Centralized key management: Traditional key management systems mostly adopt a centralized architecture, where keys are stored in a single node or a specific area, making them easy targets for attackers. Once the key management system is compromised, the entire data encryption system will be affected, making data security unsafe.

[0005] Behavior monitoring lags: Existing abnormal behavior detection systems are mostly based on fixed rules and historical data, and cannot adapt to the dynamic changes of user behavior in real time, which can easily lead to missed reports or false reports. At the same time, they cannot prevent potential attacks in advance by predicting future behavior patterns. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a data security management method and system based on cloud computing to solve the problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides the following technical solution: a data security management method based on cloud computing, comprising the following steps:

[0008] S1. Security strategy formulation

[0009] Clarify the specific needs of the enterprise, analyze the potential risks faced by data in the cloud environment, and formulate data security strategies;

[0010] S2. Security Assessment of Cloud Infrastructure

[0011] Evaluate cloud service providers’ infrastructure security measures, including physical security, network security, and virtualization technology security;

[0012] S3, Authentication and Access Control

[0013] Authentication mechanism based on behavioral analysis, managing user access rights through multi-factor authentication (MFA) and role-based access control (RBAC). The cloud environment dynamically assigns permissions based on different user roles, monitors users' daily activities and identifies abnormal behaviors;

[0014] S4. Data encryption and key management

[0015] Data is encrypted using a strong encryption algorithm at rest and in transit. Based on a distributed key management system, the key is divided into multiple parts and stored in different areas to prevent single point failure or attack;

[0016] S5. Data classification and hierarchical management

[0017] By classifying data into sensitive and non-sensitive categories, different levels of protection measures are adopted for different categories of data, and hierarchical management is carried out, such as strict access control and encryption of sensitive data, reducing the security overhead of non-sensitive data;

[0018] S6. Data leakage detection and prevention

[0019] Deploy a data leakage detection (DLP) system in the cloud environment to monitor data flow in real time, detect abnormal data transmission or access behavior, and automatically block and report it;

[0020] S7. Audit and Compliance Management

[0021] Through automated audit tools, we continuously monitor various operational behaviors in the cloud environment, and use blockchain technology to store audit records in an unalterable manner to ensure the authenticity and transparency of audit data.

[0022] S8. Abnormal behavior monitoring and threat response

[0023] Build an AI-based intelligent monitoring model to analyze user behavior patterns, automatically identify suspicious activities and trigger alerts; set up an automated threat response model, and combine it with the incident response plan (IRP) to automatically take measures when threats occur, such as blocking accounts and isolating servers;

[0024] S9. Elastic backup and recovery mechanism

[0025] Adopt a cross-regional multi-copy backup strategy and use the elastic resources of cloud computing to automatically perform regular verification and recovery tests on the backed up data to ensure the integrity and availability of the backup data.

[0026] To further optimize the technical solution, in step S1, a security policy suitable for the enterprise is formulated by analyzing data flows, user roles, access rights and sensitive information;

[0027] Security strategies include determining data security priorities, specific protection objects such as personal information, transaction data, and related compliance requirements such as GDPR and HIPAA.

[0028] To further optimize the technical solution, in step S2, the security assessment also includes checking the cloud firewall, DDoS protection, and encryption mechanism to identify any weak links that may be attacked;

[0029] At the same time, assess whether there are multi-tenant risks to ensure data isolation between different tenants.

[0030] To further optimize the technical solution, in step S3, the identity authentication mechanism based on behavior analysis monitors the user's daily activities and identifies the user's behavior patterns;

[0031] We also analyze user behavior, such as:

[0032] The user's daily work habits: including the time, location, device, network, and frequency of access;

[0033] The user's behavior patterns in the system: such as the way the mouse moves, the keyboard input speed, the clicking habits, and the order in which specific files and system resources are accessed;

[0034] Workflow and access path: Based on the user's historical operations, a model is built to understand the normal access pattern and path;

[0035] Through the established model, the system analyzes user operations in real time. If there is inconsistent behavior with the usual, such as sudden access from a different location, using an unusual device, or performing unusual data operations, the system will identify potential anomalies and trigger an alarm.

[0036] Further optimizing the technical solution, the distributed key management system includes a key decomposition and distribution model, a distributed storage, an optimization model, and an encryption and decryption model;

[0037] In the key decomposition and distribution model,

[0038] Assume there is a master key ( ), which is decomposed into multiple sub-keys through a distributed method ( ) and are stored in different nodes for key decomposition. The formula is as follows:

[0039]

[0040] in,

[0041] ( ) is a polynomial function used to generate key fragments;

[0042] ( ) is the master key you wish to protect;

[0043] ( ) is the minimum number of subkeys required to recover the master key, i.e., the threshold;

[0044] ( ) is the participant number, representing different nodes;

[0045] ( ) is a randomly generated coefficient used to protect the security of the key;

[0046] In the distributed storage,

[0047] Each node ( ) stores a key fragment ( ), that is, the polynomial in ( ) at the value; in order to recover the master key ( ), at least ( ) nodes provide their key fragments, and the original polynomial is restored through interpolation to obtain ( );

[0048] Using the Lagrange interpolation formula to recover the master key ( ), then:

[0049]

[0050] Further optimizing the technical solution, in the distributed key management system, optimization measures are taken based on the optimization model, assuming that the storage security of each key fragment in different geographical areas has different weights ( ), representing the security of the area or the likelihood of being attacked;

[0051] ( ) indicates a storage node ( )’s security probability, the larger the probability, the more secure the node is;

[0052] ( ) represents the availability or response time of each node. The smaller the value, the faster the node can provide key fragments.

[0053] Construct an optimization formula and select the best ( ) nodes to rebuild the key:

[0054]

[0055] in,( ) is a weight parameter that balances security and response speed;

[0056] When data is stored or transmitted, the master key ( ) to encrypt or decrypt, the encryption process is expressed as:

[0057]

[0058] in,( ) is the original data, ( ) is the encryption function, ( ) is the encrypted ciphertext;

[0059] When access to a key is required, it is obtained from multiple nodes ( ) key fragments, using the Lagrange interpolation formula to recover ( ), and then perform the decryption operation:

[0060]

[0061] in,( ) is the decryption function.

[0062] To further optimize the technical solution, in step S6, based on the elasticity of cloud computing, the DLP system automatically expands and dynamically adjusts the monitoring range according to the increase in data traffic;

[0063] And through AI and big data analysis technology, potential internal threats and external attacks can be detected in real time.

[0064] To further optimize the technical solution, in step S8, based on the AI-based intelligent monitoring model, it is assumed that the user's behavior data is represented by a vector, using ( ) indicates that the user is at time ( ), such as login location, access resource type, and access frequency. The behavior feature set is expressed as:

[0065]

[0066] in,( ) means the first ) behavioral characteristics, ( ) is the number of behavioral features;

[0067] By building a prediction method based on time series, we can predict the next moment ( )Normal user behavior( ), and by calculating the actual behavior ( ) and predictive behavior ( ) to detect anomalies. Anomaly detection is expressed as follows:

[0068]

[0069] in,( ) indicates time ( ) time behavioral abnormality score, ( ) represents a distance metric, such as Euclidean distance or cosine similarity, if ( ) exceeds a preset threshold ( ), the behavior is considered abnormal and an alarm is triggered.

[0070] To further optimize the technical solution, the intelligent monitoring model introduces a dynamically adjusted threshold value ( ) to optimize the model, the threshold adjustment model is:

[0071]

[0072] in,( ) is the sensitivity level of the operation or data. The more sensitive the data ( ) is higher; ( ) is an adjustment parameter that controls the range of the threshold and is adjusted dynamically according to demand.

[0073] A cloud computing-based data security governance system is constructed based on the above-mentioned cloud computing-based data security governance method, including a security policy module, a security assessment module, an identity authentication module, a data encryption module, a data management module, a data detection module, a data audit module, and a data backup module;

[0074] The security policy module formulates an overall cloud data security strategy based on the business needs and data characteristics of the enterprise; the security assessment module conducts a comprehensive assessment of the security measures of the cloud service provider; when users use cloud resources, the identity authentication module strictly controls the user's access rights through behavioral analysis; all data is encrypted and protected by the data encryption module and automatically classified by the data management module;

[0075] The system runs data detection modules in real time to monitor data flow and prevent leakage incidents, and promptly identify and respond to abnormal activities;

[0076] During the entire data security management process, the data audit module keeps audit records; in the event of data loss, the data backup module ensures that data can be quickly restored

[0077] Compared with the prior art, the present invention provides a data security management method and system based on cloud computing, which has the following beneficial effects:

[0078] This cloud computing-based data security governance method and system significantly improves the elasticity and dynamic response capabilities of data security by setting up a distributed key management system and an AI-based intelligent monitoring model. The distributed key management system stores keys in different physical areas, reducing the risk of single point failures and attacks; while the AI-based intelligent monitoring system analyzes user behavior in real time, predicts abnormal operations and responds automatically, making security protection more intelligent and accurate, and automatically adjusts according to business needs to ensure that the system can effectively respond to data security threats in a complex and changing cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A schematic diagram of a data security management method based on cloud computing proposed by the present invention;

[0080] Figure 2 A schematic diagram of a model of a distributed key management system in a cloud computing-based data security management method proposed by the present invention;

[0081] Figure 3 A schematic diagram of the process of a distributed key management system in a cloud computing-based data security management method proposed by the present invention;

[0082] Figure 4 A schematic diagram of the process of an intelligent monitoring model in a data security management method based on cloud computing proposed by the present invention;

[0083] Figure 5 This is a schematic diagram of the structure of cloud service provider evaluation in a cloud computing-based data security governance system proposed by the present invention;

[0084] Figure 6 A schematic diagram of the structure used by users in a cloud computing-based data security management system proposed by the present invention. DETAILED DESCRIPTION

[0085] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0086] Embodiment 1:

[0087] See also Figure 1 , a data security governance method based on cloud computing, comprising the following steps:

[0088] S1. Security strategy formulation

[0089] Clarify the specific needs of the enterprise, analyze the potential risks faced by data in the cloud environment, and formulate data security strategies.

[0090] In this embodiment, a security policy suitable for the enterprise is formulated by analyzing data flows, user roles, access rights, and sensitive information;

[0091] Security strategies include determining data security priorities, specific protection objects such as personal information, transaction data, and related compliance requirements such as GDPR and HIPAA.

[0092] Closely align security strategies with corporate business goals to ensure that security measures are not overly complex or out of touch with actual needs.

[0093] S2. Security Assessment of Cloud Infrastructure

[0094] Evaluate the infrastructure security measures of cloud service providers, including physical security, network security, and virtualization technology security. Ensure that service providers comply with relevant security standards (such as ISO 27001, SOC 2, etc.).

[0095] In this embodiment, the security assessment also includes checking the cloud firewall, DDoS protection, and encryption mechanisms to identify any weak links that may be attacked;

[0096] At the same time, assess whether there are multi-tenant risks to ensure data isolation between different tenants.

[0097] S3, Authentication and Access Control

[0098] The authentication mechanism based on behavioral analysis manages user access rights through multi-factor authentication (MFA) and role-based access control (RBAC). The cloud environment dynamically allocates permissions according to the roles of different users, monitors users' daily activities and identifies abnormal behaviors.

[0099] In this embodiment, the identity authentication mechanism based on behavioral analysis monitors the user's daily activities and identifies the user's behavior patterns;

[0100] We also analyze user behavior, such as:

[0101] The user's daily work habits: including the time, location, device, network, and frequency of access;

[0102] The user's behavior patterns in the system: such as the way the mouse moves, the keyboard input speed, the clicking habits, and the order in which specific files and system resources are accessed;

[0103] Workflow and access path: Based on the user's historical operations, a model is built to understand the normal access pattern and path;

[0104] Through the established model, the system analyzes user operations in real time. If there is inconsistent behavior with the usual, such as sudden access from a different location, using an unusual device, or performing unusual data operations, the system will identify potential anomalies and trigger an alarm.

[0105] It can automatically upgrade authentication requirements when anomalies are detected, such as requiring multi-factor authentication or temporarily blocking an account. Unlike traditional rule-based systems, behavioral analysis relies on machine learning and big data analysis, so it can continuously adapt to changes in user behavior, identify potential threats and respond. Compared with traditional static identity authentication, behavior-based authentication can reduce false positives because it is based on the user's personalized behavior patterns.

[0106] S4. Data encryption and key management

[0107] Data is encrypted using a strong encryption algorithm (such as AES-256) at rest and in transit. Based on a distributed key management system, the key is divided into multiple parts and stored in different areas to prevent single point failure or attack.

[0108] like Figure 2 As shown, in this embodiment, the distributed key management system includes a key decomposition and distribution model, a distributed storage, an optimization model, and an encryption and decryption model;

[0109] In the key decomposition and distribution model,

[0110] Assume there is a master key ( ), which is decomposed into multiple sub-keys through a distributed method ( ) and are stored in different nodes for key decomposition. The formula is as follows:

[0111]

[0112] in,

[0113] ( ) is a polynomial function used to generate key fragments;

[0114] ( ) is the master key you wish to protect;

[0115] ( ) is the minimum number of subkeys required to recover the master key, i.e., the threshold;

[0116] ( ) is the participant number, representing different nodes;

[0117] ( ) is a randomly generated coefficient used to protect the security of the key;

[0118] In the distributed storage,

[0119] Each node ( ) stores a key fragment ( ), that is, the polynomial in ( ) at the value; in order to recover the master key ( ), at least ( ) nodes provide their key fragments, and the original polynomial is restored through interpolation to obtain ( );

[0120] Using the Lagrange interpolation formula to recover the master key ( ), then:

[0121]

[0122] In the distributed key management system, optimization measures are taken based on the optimization model, assuming that the storage security of each key fragment in different geographical areas has different weights ( ), representing the security of the area or the likelihood of being attacked;

[0123] ( ) indicates a storage node ( )’s security probability, the larger the probability, the more secure the node is;

[0124] ( ) represents the availability or response time of each node. The smaller the value, the faster the node can provide key fragments.

[0125] Construct an optimization formula and select the best ( ) nodes to rebuild the key:

[0126]

[0127] in,( ) is a weight parameter that balances security and response speed;

[0128] When data is stored or transmitted, the master key ( ) to encrypt or decrypt, the encryption process is expressed as:

[0129]

[0130] in,( ) is the original data, ( ) is the encryption function, ( ) is the encrypted ciphertext;

[0131] When access to a key is required, it is obtained from multiple nodes ( ) key fragments, using the Lagrange interpolation formula to recover ( ), and then perform the decryption operation:

[0132]

[0133] in,( ) is the decryption function.

[0134] like Figure 3 As shown, the distributed key management system, when in use, includes:

[0135] Data encryption and distribution: In a cloud environment, data is encrypted using a master key ( ) to ensure the privacy of data when it is stored in the cloud. In order to prevent key leakage, distributed key management is adopted to divide the master key into multiple parts and store them in different nodes.

[0136] Key storage and defense: Each fragment of the key is stored on a different cloud node and is physically isolated. If a node is attacked, the attacker can only obtain part of the key and cannot decrypt the data through a single node.

[0137] Key recovery and decryption: When data needs to be decrypted, the client obtains enough key fragments from multiple storage nodes, uses the Lagrange interpolation formula to recover the complete key, and then uses the master key ( ) to decrypt the data.

[0138] Security and performance optimization: Through the optimization model, the system can select the optimal key fragment combination according to the security and response time of the node, ensuring that the data decryption process is both secure and efficient. As business scenarios change, such as the increase in data volume or the improvement of security requirements, the key distribution and fragment selection strategy can be dynamically adjusted.

[0139] By breaking down the master key into multiple sub-keys and storing them in a distributed manner, the security of key management is ensured. At the same time, through the optimization model, the system can find the best balance between security and performance to meet the needs of different business scenarios.

[0140] S5. Data classification and hierarchical management

[0141] By classifying data into different categories, such as sensitive and non-sensitive, different levels of protection measures are taken for different categories of data, and hierarchical management is carried out, such as strict access control and encryption of sensitive data, reducing the security overhead of non-sensitive data.

[0142] S6. Data leakage detection and prevention

[0143] Deploy a data leakage detection (DLP) system in the cloud environment to monitor data flow in real time, detect abnormal data transmission or access behavior, and automatically block and report it.

[0144] In this embodiment, based on the elasticity of cloud computing, the DLP system automatically expands and dynamically adjusts the monitoring scope according to the increase in data traffic;

[0145] And through AI and big data analysis technology, potential internal threats and external attacks can be detected in real time.

[0146] S7. Audit and Compliance Management

[0147] Through automated audit tools, various operational behaviors in the cloud environment are continuously monitored, and blockchain technology is used to store audit records in an unalterable manner to ensure the authenticity and transparency of audit data.

[0148] In this embodiment, the decentralized nature of blockchain can ensure that no tampering occurs when audit information is shared among multiple parties, thereby enhancing the credibility of the audit.

[0149] S8. Abnormal behavior monitoring and threat response

[0150] Build an AI-based intelligent monitoring model to analyze user behavior patterns, automatically identify suspicious activities and trigger alerts. Set up an automated threat response model and combine it with an incident response plan (IRP) to automatically take measures when threats occur, such as blocking accounts and isolating servers.

[0151] In this embodiment, based on the AI ​​intelligent monitoring model, it is assumed that the user's behavior data is represented by a vector, using ( ) indicates that the user is at time ( ), such as login location, access resource type, and access frequency. The behavior feature set is expressed as:

[0152]

[0153] in,( ) means the first ) behavioral characteristics, ( ) is the number of behavioral features;

[0154] By building a prediction method based on time series, we can predict the next moment ( )Normal user behavior( ), and by calculating the actual behavior ( ) and predictive behavior ( ) to detect anomalies. Anomaly detection is expressed as follows:

[0155]

[0156] in,( ) indicates time ( ) time behavioral abnormality score, ( ) represents a distance metric, such as Euclidean distance or cosine similarity, if ( ) exceeds a preset threshold ( ), the behavior is considered abnormal and an alarm is triggered.

[0157] The intelligent monitoring model introduces a dynamically adjusted threshold when predicting the difference between the behavior and the actual behavior ( ) to optimize the model, the threshold adjustment model is:

[0158]

[0159] in,( ) is the sensitivity level of the operation or data. The more sensitive the data ( ) is higher; ( ) is an adjustment parameter that controls the range of the threshold and is adjusted dynamically according to demand.

[0160] like Figure 4 As shown, the intelligent monitoring model, when used, includes:

[0161] Behavior data collection: The system will collect user behavior data in real time ( ), such as login location, time of access, specific systems and resources accessed, etc.

[0162] Behavior prediction: Predict the next moment through AI models (such as LSTM) ) behavior patterns, the system has a set of "normal" behavior benchmarks for each user.

[0163] Anomaly Detection: Actual Behavior ( ) and predictive behavior ( ) ) exceeds the threshold ( ), the system will identify abnormal behavior. This could mean unauthorized access, external attack, or malicious action by an insider.

[0164] Response and disposal: When abnormal behavior is detected, the system will automatically take measures, such as blocking accounts, limiting operation permissions, notifying administrators, etc. Threshold ( ) to optimize the system model: by continuously monitoring and adjusting the parameters of the model ( ) and threshold ( ), the system can be optimized as business needs change. As more data accumulates, the predictive ability of the AI ​​model will continue to improve, and the false positive and false negative rates will gradually decrease.

[0165] S9. Elastic backup and recovery mechanism

[0166] Adopt a cross-regional multi-copy backup strategy and use the elastic resources of cloud computing to automatically perform regular verification and recovery tests on the backed up data to ensure the integrity and availability of the backup data.

[0167] Embodiment 2:

[0168] See also Figure 5 and Figure 6 , a data security management system based on cloud computing is constructed based on the data security management method based on cloud computing described in Example 1, including a security policy module, a security assessment module, an identity authentication module, a data encryption module, a data management module, a data detection module, a data audit module, and a data backup module;

[0169] The security policy module formulates an overall cloud data security strategy based on the business needs and data characteristics of the enterprise; the security assessment module conducts a comprehensive assessment of the security measures of the cloud service provider; when users use cloud resources, the identity authentication module strictly controls the user's access rights through behavioral analysis; all data is encrypted and protected by the data encryption module and automatically classified by the data management module;

[0170] The system runs data detection modules in real time to monitor data flow and prevent leakage incidents, and promptly identify and respond to abnormal activities;

[0171] During the entire data security management process, the data audit module keeps audit records; in the event of data loss, the data backup module ensures that the data can be quickly restored.

[0172] The beneficial effects of the present invention are:

[0173] This cloud computing-based data security governance method and system significantly improves the elasticity and dynamic response capabilities of data security by setting up a distributed key management system and an AI-based intelligent monitoring model. The distributed key management system stores keys in different physical areas, reducing the risk of single point failures and attacks; while the AI-based intelligent monitoring system analyzes user behavior in real time, predicts abnormal operations and responds automatically, making security protection more intelligent and accurate, and automatically adjusts according to business needs to ensure that the system can effectively respond to data security threats in a complex and changing cloud environment.

[0174] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0175] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data security management method based on cloud computing, characterized in that: The following steps are involved: S1. Security strategy formulation Clarify the specific needs of the enterprise, analyze the potential risks faced by data in the cloud environment, and formulate data security strategies; S2. Security Assessment of Cloud Infrastructure Evaluate cloud service providers’ infrastructure security measures, including physical security, network security, and virtualization technology security; S3, Authentication and Access Control Authentication mechanism based on behavioral analysis, managing user access rights through multi-factor authentication (MFA) and role-based access control (RBAC). The cloud environment dynamically assigns permissions based on different user roles, monitors users' daily activities and identifies abnormal behaviors; S4. Data encryption and key management Data is encrypted using a strong encryption algorithm at rest and in transit. Based on a distributed key management system, the key is divided into multiple parts and stored in different areas to prevent single point failure or attack; S5. Data classification and hierarchical management By classifying data into sensitive and non-sensitive categories, different levels of protection measures are adopted for different categories of data, and hierarchical management is carried out, such as strict access control and encryption of sensitive data, reducing the security overhead of non-sensitive data; S6. Data leakage detection and prevention Deploy a data leakage detection (DLP) system in the cloud environment to monitor data flow in real time, detect abnormal data transmission or access behavior, and automatically block and report it; S7. Audit and Compliance Management Through automated audit tools, we continuously monitor various operational behaviors in the cloud environment, and use blockchain technology to store audit records in an unalterable manner to ensure the authenticity and transparency of audit data. S8. Abnormal behavior monitoring and threat response Build an AI-based intelligent monitoring model to analyze user behavior patterns, automatically identify suspicious activities and trigger alerts; set up an automated threat response model, and combine it with the incident response plan (IRP) to automatically take measures when threats occur, such as blocking accounts and isolating servers; S9. Elastic backup and recovery mechanism Adopt a cross-regional multi-copy backup strategy, take advantage of the elastic resources of cloud computing, and automatically perform regular verification and recovery tests on the backed up data to ensure the integrity and availability of the backup data.

2. According to the data security management method based on cloud computing in claim 1, it is characterized in that: In step S1, a security policy suitable for the enterprise is formulated by analyzing data flows, user roles, access rights and sensitive information; Security strategies include determining data security priorities, specific protection objects such as personal information, transaction data, and related compliance requirements such as GDPR and HIPAA.

3. According to the data security management method based on cloud computing according to claim 1, it is characterized in that: In step S2, the security assessment also includes checking the cloud firewall, DDoS protection, and encryption mechanism to identify any weak links that may be attacked; At the same time, assess whether there are multi-tenant risks to ensure data isolation between different tenants.

4. According to the data security management method based on cloud computing in claim 1, it is characterized in that: In step S3, the identity authentication mechanism based on behavior analysis monitors the user's daily activities and identifies the user's behavior patterns; We also analyze user behavior, such as: The user's daily work habits: including the time, location, device, network, and frequency of access; The user's behavior patterns in the system: such as the way the mouse moves, the keyboard input speed, the clicking habits, and the order in which specific files and system resources are accessed; Workflow and access path: Based on the user's historical operations, a model is built to understand the normal access pattern and path; Through the established model, the system analyzes user operations in real time. If there is inconsistent behavior with the usual, such as sudden access from a different location, using an unusual device, or performing unusual data operations, the system will identify potential anomalies and trigger an alarm.

5. According to the data security management method based on cloud computing in claim 1, it is characterized in that: The distributed key management system includes a key decomposition and distribution model, a distributed storage, an optimization model, and an encryption and decryption model; In the key decomposition and distribution model, Assume there is a master key ( ), which is decomposed into multiple sub-keys through a distributed method ( ) and are stored in different nodes for key decomposition. The formula is as follows: ； in, ( ) is a polynomial function used to generate key fragments; ( ) is the master key you wish to protect; ( ) is the minimum number of subkeys required to recover the master key, i.e., the threshold; ( ) is the participant number, representing different nodes; ( ) is a randomly generated coefficient used to protect the security of the key; In the distributed storage, Each node ( ) stores a key fragment ( ), that is, the polynomial in ( ) at the value; in order to recover the master key ( ), at least ( ) nodes provide their key fragments, and the original polynomial is restored through interpolation to obtain ( ); Using the Lagrange interpolation formula to recover the master key ( ), then: 。 6. A data security management method based on cloud computing according to claim 5, characterized in that: In the distributed key management system, optimization measures are taken based on the optimization model, assuming that the storage security of each key fragment in different geographical areas has different weights ( ), representing the security of the area or the likelihood of being attacked; ( ) indicates a storage node ( )’s security probability, the larger the probability, the more secure the node is; ( ) represents the availability or response time of each node. The smaller the value, the faster the node can provide key fragments. Construct an optimization formula and select the best ( ) nodes to rebuild the key: ； in,( ) is a weight parameter that balances security and response speed; When data is stored or transmitted, the master key ( ) to encrypt or decrypt, the encryption process is expressed as: ； in,( ) is the original data, ( ) is the encryption function, ( ) is the encrypted ciphertext; When access to a key is required, it is obtained from multiple nodes ( ) key fragments, using the Lagrange interpolation formula to recover ( ), and then perform the decryption operation: ； in,( ) is the decryption function.

7. The data security management method based on cloud computing according to claim 1 is characterized in that: In step S6, based on the elasticity of cloud computing, the DLP system automatically expands and dynamically adjusts the monitoring range according to the increase in data traffic; And through AI and big data analysis technology, potential internal threats and external attacks can be detected in real time.

8. The data security management method based on cloud computing according to claim 1 is characterized in that: In step S8, based on the AI-based intelligent monitoring model, it is assumed that the user's behavior data is represented by a vector, using ( ) indicates that the user is at time ( ), such as login location, access resource type, and access frequency. The behavior feature set is expressed as: ； in,( ) means the first ) behavioral characteristics, ( ) is the number of behavioral features; By building a prediction method based on time series, we can predict the next moment ( )Normal user behavior( ), and by calculating the actual behavior ( ) and predictive behavior ( ) to detect anomalies. Anomaly detection is expressed as follows: ； in,( ) indicates time ( ) time behavioral abnormality score, ( ) represents a distance metric, such as Euclidean distance or cosine similarity, if ( ) exceeds a preset threshold ( ), the behavior is considered abnormal and an alarm is triggered.

9. The data security management method based on cloud computing according to claim 8 is characterized in that: The intelligent monitoring model introduces a dynamically adjusted threshold value ( ) to optimize the model, the threshold adjustment model is: ； in,( ) is the sensitivity level of the operation or data. The more sensitive the data ( ) is higher; ( ) is an adjustment parameter that controls the range of the threshold and is adjusted dynamically according to demand.

10. A data security management system based on cloud computing, constructed based on the data security management method based on cloud computing according to claims 1-9, characterized in that: Including security policy module, security assessment module, identity authentication module, data encryption module, data management module, data detection module, data audit module, data backup module; The security policy module formulates an overall cloud data security strategy based on the business needs and data characteristics of the enterprise; the security assessment module conducts a comprehensive assessment of the security measures of the cloud service provider; when users use cloud resources, the identity authentication module strictly controls the user's access rights through behavioral analysis; all data is encrypted and protected by the data encryption module and automatically classified by the data management module; The system runs data detection modules in real time to monitor data flow and prevent leakage incidents, and promptly identify and respond to abnormal activities; During the entire data security governance process, the data audit module keeps audit records; In the event of data loss, the data backup module ensures that data can be quickly restored.

Images