Data security transmission system based on cloud computing

Abstract

The invention relates to the technical field of data transmission, and discloses a secure data transmission system based on cloud computing, which comprises a cloud computing platform, the cloud computing platform is connected with a data encryption module, an access control module, a transmission channel module, a log module, a security audit and log analysis module, a security vulnerability management and repair module and a data transmission module. The method comprises the following steps: detecting, verifying and recording information of a user terminal, an IP (Internet Protocol) and the like, pre-auditing transmission data, performing data transmission work again after a security reply is obtained, adjusting the speed in a transmission process according to the grade of a user, and performing key authentication on the user terminal in the transmission process at regular time, so as to ensure the safety of the user. And after error information is obtained, data transmission is stopped in time, the obtained data is limited, and the data security is protected.

Description

Technical Field

[0001] The present invention belongs to the technical field of data transmission, and in particular relates to a data security transmission system based on cloud computing. Background Art

[0002] With the rapid development of Internet technology, networking and informatization are expanding day by day. In the process of network information transmission, the terminal needs to provide a large amount of data information from the server, and also needs to provide relevant data to the server. Sometimes it even needs to provide the user's personal information to the server. Due to the open nature of the Internet, the information interaction between the terminal and the server is carried out in a relatively unsafe environment, and there is no guarantee that the transmitted data will not be intercepted, tampered with or forged. The security of information transmission has become a focus of attention, and there are more and more encryption schemes for data transmission. At present, the encryption and decryption schemes for data usually use fixed keys for encryption and decryption, which has a low security level. Once the key is cracked, it will cause great harm. For this reason, we propose a data security transmission system based on cloud computing. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a data security transmission system based on cloud computing, which effectively solves the above problems.

[0004] To achieve the above object, the present invention provides the following technical solutions: a data security transmission system based on cloud computing, comprising a cloud computing platform, wherein the cloud computing platform is connected with a data encryption module, an access control module, a transmission channel module, a log module, a security audit and log analysis module, a security vulnerability management and repair module, and a data transmission module;

[0005] Data encryption module, which is used to encrypt data stored in the cloud. Encryption is performed before data transmission and decryption is performed after data transmission is completed. This can prevent data from being illegally obtained or tampered with during transmission and storage. Only personnel holding the corresponding key can decrypt the data, thereby ensuring the confidentiality and integrity of the data;

[0006] Access control module, which is used to restrict, manage and authenticate members who access the cloud. Strict identity authentication and authority management standards are set in advance. Identity authentication is required when the user's device accesses the cloud, and then different permissions are opened according to the verified identity to ensure that only authorized personnel can access cloud resources. At the same time, different access rights are set according to business needs to achieve refined security management. The user first sends a network registration message to the security server to request identity authentication; the peer access mode configured by the security server is dynamic. When the security terminal is connected, the identity of the security terminal is verified based on the shared key or certificate combined with the algorithm. The security terminal key lifetime is 5-10 minutes. After 5-10 minutes, a new key is automatically negotiated. Even in the process of data transmission, key authentication is still required. If the key authentication fails, the data in transmission will be suspended and the transmission channel will be closed;

[0007] The transmission channel module establishes a transmission channel, performs secure encryption channel negotiation after identity authentication between the security terminal and the security server, and the target gateway receives a signaling sent by the service network entity through the target network entity and carrying an indication of establishing a data forwarding tunnel and the address of the service gateway, and obtains the address of the service gateway. The target gateway is a target gateway in a high-speed packet data network, and the service gateway is a service gateway in an evolved universal mobile communication system terrestrial radio access network E-UTRAN. The target gateway establishes a data forwarding tunnel to the service gateway according to the address of the service gateway, and the target gateway verifies the source address of the received data according to the address of the service gateway, and receives the data if the verification is successful.

[0008] A log module, which is used to record various operation data in the cloud computing environment and system operation data;

[0009] Security audit and log analysis module, which can timely discover abnormal behaviors and potential security risks by collecting, analyzing and mining system logs in a cloud computing environment, and perform vulnerability scanning and risk assessment regularly;

[0010] Security vulnerability management and repair module, which is used to manage and repair security vulnerabilities detected by the security audit and log analysis module and take corresponding measures to repair them, thereby improving the security of the system;

[0011] Data transmission module: After the transmission channel module establishes a tunnel, the data packet sent by the network disk is first forwarded to the security server through the router, repackaged and signed, and encrypted and sent to the security terminal. After receiving the data packet, the security terminal first decrypts it and verifies the signature information. After the verification is passed, the original data packet is sent to the user terminal. If the user terminal generates an operation response, the security terminal will repackage and encapsulate it, and send the response with the digital signature information to the security server. After verification, the security server sends the original response to the communication server. The data transmission module is connected to the pre-transmission module and the verification module;

[0012] Pre-transmission module: The pre-transmission module is used to extract part of the data to be transmitted, and then transmit the data. After the transmission is completed, the transmitted data is tested by the verification module to check whether the transmitted data is normal;

[0013] Verification module: The verification module is used to verify the data after transmission, return a part of the received data for data comparison, and verify whether the data of the other party is correct based on the detection results.

[0014] Preferably, the cloud computing platform is connected to a DDoS attack defense module, which is used to defend against DDoS attacks. Cloud computing platforms often become targets of DDoS attacks. In order to cope with this threat, cloud computing platforms adopt a distributed defense architecture, which effectively resists DDoS attacks by real-time monitoring of traffic, filtering malicious requests, and enabling load balancing, thereby ensuring the availability and stability of services.

[0015] Preferably, the cloud computing platform is connected to a security compliance and supervision module, which is used to modify and correct operating rules and service regulations according to different application regions. In the field of cloud computing, compliance and supervision are equally important. In order to meet the legal and regulatory requirements of different countries and regions, cloud computing providers need to follow a series of security standards and specifications, such as ISO27001, GDPR, etc. At the same time, they also need to regularly undergo third-party audits and inspections to ensure the security and compliance of cloud computing platform services.

[0016] Preferably, the access control module is connected to an identity authentication module, which adopts a multi-factor authentication method to perform identity authentication through an advanced hash algorithm combined with a password, a neural network model of biometric recognition, and a dynamic matching technology of a hardware token to generate an identity authentication report.

[0017] Preferably, the access control module is connected to a key management module, which uses an elliptic curve-based encryption algorithm and blockchain technology to ensure secure lifecycle management of keys and produce an encrypted key token based on the identity authentication report; the key management module includes a key generation submodule, a key storage submodule, and a key update submodule; the key generation submodule uses elliptic curve encryption technology to establish an encryption key through the SM2 algorithm based on the identity authentication report and generates a key generation report; the key storage submodule uses the Merkle Patricia tree technology to persistently store keys in the blockchain based on the key generation report and generates a key storage record; the key update submodule: based on the key storage record, uses PFS forward secrecy technology to ensure the timeliness and security of the key and generates an encrypted key token.

[0018] Preferably, the data transmission module is connected to a data classification module, which is used to obtain the retrieval download information of the target data for transmission level CS analysis, and classify the target data according to the transmission level CS; if the transmission level CS is greater than a preset transmission threshold, the target data is marked as core data, and encrypted transmission of the core data is initiated; the data encryption module is used to encrypt the core data, and transmit the core encrypted data stream to the data transmission module.

[0019] Preferably, the data transmission module is connected to a user level module, and the user level module is used to classify users into levels. After receiving data request information for the data set to be transmitted from the user terminal, the data transmission method is determined by the user's level. The data transmission method includes: determining the transmission speed of the data set to be transmitted according to the permission characteristics of the data request end, wherein the transmission speed is configured to be in direct proportion to the permission characteristics.

[0020] Preferably, the transmission channel module is connected to a blank information module, and the blank information module is used to transmit information to the user terminal in the cloud, thereby obtaining the data format of the transmission channel. The length of the blank information is not shorter than the length of the new signal transmission data, and the format carrier of the blank information does not contain directional information.

[0021] Preferably, the data transmission module is connected to a warning module, and when the warning module detects a problem with the user terminal, it will remind through an alarm. If the user terminal is damaged or disconnected, the security service end will issue a real-time alarm.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1. The present invention can make data transmission safer. When receiving a data transmission request from a user terminal, the information, IP and other information of the user terminal are detected, verified and recorded, and then the transmission data is pre-audited. After receiving a safe reply, the data transmission is performed again. During the transmission process, the speed is adjusted according to the level of the user. At the same time, the user terminal is key authenticated at regular intervals during the transmission process. After receiving an error message, the data transmission is stopped in time, and the data obtained is limited to protect the data security.

[0024] 2. During the use of the present invention, the data packet sent by the working network disk is first forwarded to the security server through the router, repackaged and signed, and sent to the security terminal after encryption. The security terminal decrypts it after receiving it and verifies the signature information. After the verification, the original data packet is sent to the user terminal. Through the security terminal, the signature verification, message forwarding, and certificate initialization security functions of the information are realized, thereby ensuring the non-repudiation and integrity of the transmitted information, preventing unauthorized tampering, and realizing the centralized management function of the security terminal equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0026] In the attached picture:

[0027] Figure 1 This is a system block diagram of the present invention. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0029] See also Figure 1 , a data security transmission system based on cloud computing, including a cloud computing platform, the cloud computing platform is connected with a data encryption module, an access control module, a transmission channel module, a log module, a security audit and log analysis module, a security vulnerability management and repair module, and a data transmission module;

[0030] Data encryption module: The data encryption module is used to encrypt the data stored in the cloud. It encrypts the data before transmission and decrypts it after the data is transmitted. This can prevent the data from being illegally obtained or tampered with during transmission and storage. Only people holding the corresponding keys can decrypt the data, thus ensuring the confidentiality and integrity of the data.

[0031] Access control module: The access control module is used to restrict, manage and authenticate members who access the cloud. Strict identity authentication and permission management standards are set in advance. When users' devices access the cloud, they need to undergo identity authentication, and then different permissions are opened according to the verified identity to ensure that only authorized personnel can access cloud resources. At the same time, different access permissions are set according to business needs to achieve refined security management. Users first send a network registration message to the security server to request identity authentication. The peer access mode configured by the security server is dynamic. When the security terminal is connected, the identity of the security terminal is verified based on the shared key or certificate combined with the algorithm. The key lifespan of the security terminal is 5-10 minutes. After 5-10 minutes, a new key is automatically negotiated. Even in the process of data transmission, key authentication is still required. If the key authentication fails, the data in transmission will be paused and the transmission channel will be closed.

[0032] The transmission channel module establishes a transmission channel. After the security terminal and the security server pass identity authentication, a secure encryption channel negotiation is performed. The target gateway receives a signaling sent by the service network entity through the target network entity, which carries an indication of establishing a data forwarding tunnel and the address of the service gateway, and obtains the address of the service gateway. The target gateway is a target gateway in a high-speed packet data network, and the service gateway is a service gateway in an Evolved Universal Mobile Telecommunications System Terrestrial Radio Access Network E-UTRAN. The target gateway establishes a data forwarding tunnel to the service gateway according to the address of the service gateway. The target gateway verifies the source address of the received data according to the address of the service gateway, and receives the data if the verification is successful.

[0033] Log module: The log module is used to record various operation data in the cloud computing environment and system operation data;

[0034] Security audit and log analysis module: In cloud computing environment, the security audit and log analysis module can timely discover abnormal behaviors and potential security risks by collecting, analyzing and mining system logs, and conduct regular vulnerability scanning and risk assessment;

[0035] Security vulnerability management and repair module: The security vulnerability management and repair module is used to manage and repair security vulnerabilities detected by the security audit and log analysis modules and take corresponding measures to repair them, thereby improving the security of the system;

[0036] Data transmission module: After the transmission channel module establishes a tunnel, the data packet sent by the network disk is first forwarded to the security server through the router, repackaged and signed, and encrypted and sent to the security terminal. After receiving the data packet, the security terminal first decrypts it and verifies the signature information. After the verification is passed, the original data packet is sent to the user terminal. If the user terminal generates an operation response, the security terminal will repackage and encapsulate it, and send the response with the digital signature information to the security server. After verification, the security server sends the original response to the communication server. The data transmission module is connected to the pre-transmission module and the verification module.

[0037] Pre-transmission module: The pre-transmission module is used to extract part of the data to be transmitted, and then transmit the data. After the transmission is completed, the verification module detects the transmitted data to check whether the transmitted data is normal;

[0038] Verification module: The verification module is used to verify the data after transmission, return part of the received data for data comparison, and verify whether the other party's data is correct based on the test results.

[0039] The cloud computing platform is connected to a DDoS attack defense module, which is used to defend against DDoS attacks. Cloud computing platforms often become targets of DDoS attacks. In order to cope with this threat, the cloud computing platform adopts a distributed defense architecture, which effectively resists DDoS attacks by real-time monitoring of traffic, filtering malicious requests, and enabling load balancing, ensuring the availability and stability of services. The cloud computing platform is connected to a security compliance and supervision module, which is used to modify and correct operating rules and service regulations according to different application regions. In the field of cloud computing, compliance and supervision are equally important. In order to meet the legal and regulatory requirements of different countries and regions, cloud computing providers need to follow a series of security standards and specifications, such as ISO27001, GDPR, etc. At the same time, they also need to regularly accept third-party audits and inspections to ensure the security and compliance of cloud computing platform services. The access control module is connected to an identity authentication module, which adopts a multi-factor authentication method, which is implemented through advanced hash algorithms combined with passwords, neural network models for biometric recognition, and dynamic matching technology for hardware tokens. The access control module is connected to the key management module. The management module uses the encryption algorithm based on the elliptic curve and the blockchain technology according to the authentication report to ensure the secure lifecycle management of the key and produce the encryption key token. The key management module includes a key generation submodule, a key storage submodule and a key update submodule. The key generation submodule uses the elliptic curve encryption technology to establish the encryption key through the SM2 algorithm based on the authentication report and generates the key generation report. The key storage submodule uses the Merkle Patricia tree technology to persistently store the key in the blockchain according to the key generation report and generates the key storage record. The key update submodule: according to the key storage record, the PFS forward secrecy technology is used to ensure the timeliness and security of the key and generate the encryption key token. The data transmission module is connected to the data classification module. The data classification module is used to obtain the retrieval download information of the target data for transmission level CS analysis and classify the target data according to the transmission level CS. If the transmission level CS is greater than the preset transmission threshold, the target data is marked as core data and the encrypted transmission of the core data is initiated.The data encryption module is used to encrypt the core data and transmit the core encrypted data stream to the data transmission module. The data transmission module is connected to a user level module. The user level module is used to classify users. After receiving data request information for the data set to be transmitted from the user terminal, the data transmission method is determined by the user level. The data transmission method includes: determining the transmission speed of the data set to be transmitted according to the authority characteristics of the data request end, wherein the transmission speed is configured to be in direct proportion to the authority characteristics. The transmission channel module is connected to a blank information module. The blank information module is used to transmit information to the user terminal from the cloud, and then obtain the data format of the transmission channel. The length of the blank information is not shorter than the length of the new signal transmission data, and the format carrier of the blank information does not contain directional information. The data transmission module is connected to a warning module. When the warning module detects a problem with the user terminal, it will remind through an alarm. If the user terminal is damaged or disconnected, the security service end will issue a real-time alarm.

[0040] The present invention can make data transmission safer. When receiving a data transmission request from a user terminal, the information, IP and other information of the user terminal are detected, verified and recorded, and then the transmission data is pre-audited. After receiving a safety reply, the data transmission is performed again. During the transmission process, the speed is adjusted according to the level of the user. At the same time, the user terminal is key authenticated at regular intervals during the transmission process. After receiving an error message, the data transmission is stopped in time, and the data obtained is limited to protect the data security.

[0041] During the use of the present invention, the data packet sent by the working network disk is first forwarded to the security server through the router, repackaged and signed, and sent to the security terminal after encryption. After receiving the data packet, the security terminal decrypts it first and verifies the signature information. After the verification, the original data packet is sent to the user terminal. Through the security terminal, the signature verification, message forwarding, and certificate initialization security functions of the information are realized, thereby ensuring the non-repudiation and integrity of the transmitted information, preventing unauthorized tampering, and realizing the centralized management function of the security terminal equipment.

Claims

1. A data security transmission system based on cloud computing, characterized by: It includes a cloud computing platform, which is connected to a data encryption module, an access control module, a transmission channel module, a log module, a security audit and log analysis module, a security vulnerability management and repair module, and a data transmission module; Data encryption module, which is used to encrypt data stored in the cloud. Encryption is performed before data transmission and decryption is performed after data transmission is completed. This can prevent data from being illegally obtained or tampered with during transmission and storage. Only personnel holding the corresponding key can decrypt the data, thereby ensuring the confidentiality and integrity of the data; Access control module, which is used to restrict, manage and authenticate members who access the cloud. Strict identity authentication and authority management standards are set in advance. Identity authentication is required when the user's device accesses the cloud, and then different permissions are opened according to the verified identity to ensure that only authorized personnel can access cloud resources. At the same time, different access rights are set according to business needs to achieve refined security management. The user first sends a network registration message to the security server to request identity authentication; the peer access mode configured by the security server is dynamic. When the security terminal is connected, the identity of the security terminal is verified based on the shared key or certificate combined with the algorithm. The security terminal key lifetime is 5-10 minutes. After 5-10 minutes, a new key is automatically negotiated. Even in the process of data transmission, key authentication is still required. If the key authentication fails, the data in transmission will be suspended and the transmission channel will be closed; The transmission channel module establishes a transmission channel, performs secure encryption channel negotiation after identity authentication between the security terminal and the security server, and the target gateway receives a signaling sent by the service network entity through the target network entity and carrying an indication of establishing a data forwarding tunnel and the address of the service gateway, and obtains the address of the service gateway. The target gateway is a target gateway in a high-speed packet data network, and the service gateway is a service gateway in an evolved universal mobile communication system terrestrial radio access network E-UTRAN. The target gateway establishes a data forwarding tunnel to the service gateway according to the address of the service gateway, and the target gateway verifies the source address of the received data according to the address of the service gateway, and receives the data if the verification is successful. A log module, which is used to record various operation data in the cloud computing environment and system operation data; Security audit and log analysis module, which can timely discover abnormal behaviors and potential security risks by collecting, analyzing and mining system logs in a cloud computing environment, and perform vulnerability scanning and risk assessment regularly; Security vulnerability management and repair module, which is used to manage and repair security vulnerabilities detected by the security audit and log analysis module and take corresponding measures to repair them, thereby improving the security of the system; Data transmission module: After the transmission channel module establishes a tunnel, the data packet sent by the network disk is first forwarded to the security server through the router, repackaged and signed, and encrypted and sent to the security terminal. After receiving the data packet, the security terminal first decrypts it and verifies the signature information. After the verification is passed, the original data packet is sent to the user terminal. If the user terminal generates an operation response, the security terminal will repackage and encapsulate it, and send the response with the digital signature information to the security server. After verification, the security server sends the original response to the communication server. The data transmission module is connected to the pre-transmission module and the verification module; Pre-transmission module: The pre-transmission module is used to extract part of the data to be transmitted, and then transmit the data. After the transmission is completed, the transmitted data is tested by the verification module to check whether the transmitted data is normal; Verification module: The verification module is used to verify the data after transmission, return a part of the received data for data comparison, and verify whether the data of the other party is correct based on the detection results.

2. The data security transmission system based on cloud computing according to claim 1 is characterized in that: The cloud computing platform is connected to a DDoS attack defense module, which is used to defend against DDoS attacks. Cloud computing platforms are often the target of DDoS attacks. In order to cope with this threat, the cloud computing platform adopts a distributed defense architecture, which effectively resists DDoS attacks by real-time monitoring of traffic, filtering malicious requests, and enabling load balancing, thereby ensuring the availability and stability of services.

3. The data security transmission system based on cloud computing according to claim 1 is characterized in that: The cloud computing platform is connected to a security compliance and supervision module, which is used to modify and correct operating rules and service regulations according to different application regions. In the field of cloud computing, compliance and supervision are equally important. In order to meet the legal and regulatory requirements of different countries and regions, cloud computing providers need to follow a series of security standards and specifications, such as ISO27001, GDPR, etc. At the same time, they also need to regularly accept third-party audits and inspections to ensure the security and compliance of cloud computing platform services.

4. The data security transmission system based on cloud computing according to claim 1 is characterized in that: The access control module is connected to an identity authentication module, which adopts a multi-factor authentication method to perform identity authentication through an advanced hash algorithm combined with a password, a neural network model of biometric identification, and a dynamic matching technology of a hardware token to generate an identity authentication report.

5. The data security transmission system based on cloud computing according to claim 1 is characterized by: The access control module is connected to a key management module, which uses an elliptic curve-based encryption algorithm and blockchain technology to ensure secure lifecycle management of keys and generate encryption key tokens according to the identity authentication report; The key management module includes a key generation submodule, a key storage submodule, and a key update submodule; The key generation submodule uses elliptic curve encryption technology to establish an encryption key through the SM2 algorithm based on the identity authentication report and generates a key generation report. The key storage submodule uses the Merkle Patricia tree technology to persistently store the key in the blockchain based on the key generation report and generates a key storage record. The key update submodule: based on the key storage record, uses the PFS forward secrecy technology to ensure the timeliness and security of the key and generates an encryption key token.

6. The data security transmission system based on cloud computing according to claim 1 is characterized by: The data transmission module is connected to a data classification module, and the data classification module is used to obtain the retrieval download information of the target data to perform transmission level CS analysis, and classify the target data according to the transmission level CS; If the transmission level CS is greater than a preset transmission threshold, the target data is marked as core data, and encrypted transmission of the core data is initiated; the data encryption module is used to encrypt the core data and transmit the core encrypted data stream to the data transmission module.

7. The data security transmission system based on cloud computing according to claim 1 is characterized in that: The data transmission module is connected to a user level module, which is used to classify users into levels. After receiving data request information for a data set to be transmitted from a user terminal, a data transmission method is determined according to the user's level. The data transmission method includes: determining a transmission speed of the data set to be transmitted according to the authority characteristics of the data requesting end, wherein the transmission speed is configured to be in direct proportion to the authority characteristics.

8. The data security transmission system based on cloud computing according to claim 1 is characterized by: The transmission channel module is connected to a blank information module, which is used to transmit information to the user terminal in the cloud, and then obtain the data format of the transmission channel. The length of the blank information is not shorter than the length of the new signal transmission data, and the format carrier of the blank information does not contain directional information.

9. The data security transmission system based on cloud computing according to claim 1 is characterized by: The data transmission module is connected to a warning module. When the warning module detects a problem with the user terminal, it will remind through an alarm. If the user terminal is damaged or disconnected, the security service end will issue a real-time alarm.

Images