Data storage method

Abstract

The invention relates to the technical field of computer security, in particular to a data storage method which comprises the following steps: S10, identifying and verifying data; the data identification and verification comprises data classification and data verification; s20, encrypting and storing the data; the data encryption storage comprises data encryption and data storage; and S30, a real-time behavior monitoring and tamper-proof mechanism. Through the combination of data encryption and decentralized storage, the risk of data leakage and tampering is effectively reduced; according to the method, symmetric encryption and asymmetric encryption technologies are reasonably combined, and decentralized storage is introduced, so that the calculation pressure in a traditional public key encryption storage scheme is reduced, and the storage efficiency is improved; a distributed storage and redundancy mechanism is adopted, so that the fault-tolerant capability of the system can be improved, and the influence of a single-point fault on data security is avoided; through a multiple backup and redundancy storage mechanism, it is ensured that data can be quickly recovered when attacked or lost.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to a data storage method. Background Art

[0002] With the continuous development of information technology, data storage technology is widely used in various industries. Especially for the storage and management of sensitive data, it is crucial to protect data from unauthorized access and leakage.

[0003] Existing storage methods generally use encryption technology or access control mechanisms to ensure data security. However, these technologies often have problems such as complex key management, low encryption efficiency, and waste of storage space. Therefore, a new storage method is urgently needed to improve storage efficiency and security while ensuring data security. Summary of the invention

[0004] In view of the above-mentioned shortcomings of the prior art, the present invention provides a data storage method, which can effectively solve the problems of complex key management, low encryption efficiency and waste of storage space in the prior art.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: The present invention provides a data storage method, comprising the steps of: S10, Data Identification and Verification The data identification and verification include data classification and data verification; S20, data encryption storage The data encryption storage includes data encryption and data storage; S30, real-time behavior monitoring and anti-tampering mechanism The real-time behavior monitoring and anti-tampering mechanism includes storage area access behavior analysis and anomaly detection and anti-tampering mechanism design; S40, intelligent access control and rights management The intelligent access control and authority management include fine-grained access control and data security assessment; S50, multiple backup and redundant storage The multiple backup and redundant storage include a combination of local backup and remote backup, regular backup and RAID (redundant disk array); S60, hardware protection against physical attacks The hardware protection against physical attacks includes security protection and self-destruction mechanisms.

[0006] According to the above-mentioned data storage method, the data verification adopts an identity authentication mechanism, including but not limited to fingerprint recognition, iris scanning, password or two-factor authentication for sensitive data, to confirm the authorized user of the stored data.

[0007] According to the above data storage method, the data encryption uses a symmetric encryption algorithm (such as AES) or an asymmetric encryption algorithm (such as RSA) to encrypt the data.

[0008] According to the above-mentioned data storage method, the data storage adopts decentralized storage and data segmentation and heterogeneous storage.

[0009] According to the above data storage method, the decentralized storage is to store data in a distributed manner instead of centrally storing it in a single server or data center. Instead, the decentralized storage network (such as IPFS, Filecoin, etc.) is used for distributed storage. Each storage node can only store part of the encrypted fragments of the data, ensuring that even if a node is attacked or leaked, the attacker cannot obtain the complete sensitive data. The integrity and high availability of the data are ensured through a redundancy mechanism. The data segmentation and heterogeneous storage is to segment the stored data and perform distributed storage among multiple heterogeneous storage platforms to further enhance the security and anti-attack capabilities of data storage. Each data segment uses a different storage platform to increase the difficulty of data loss or leakage.

[0010] According to the above-mentioned data storage method, the storage area access behavior analysis and anomaly detection is to record detailed logs of all read and write operations, file creation, modification, deletion and other behaviors, including the visitor's identity, timestamp, operation type, operation content, etc. The records can be saved in a structured log format (such as JSON, CSV) or a standardized log format (such as Syslog) for subsequent analysis.

[0011] According to the above-mentioned data storage method, the anti-tampering mechanism design generates a hash value (such as SHA-256) for the key data in storage, regularly checks the integrity of the data, and uses a public key infrastructure (PKI) to digitally sign important files or data blocks to ensure that the data has not been tampered with during storage or transmission.

[0012] According to the above data storage method, the fine-grained access control usually allows dynamic adjustment of access rights in different environments or times. In the ABAC model, access decisions not only depend on the user's identity and role, but also involve the user's attributes, resource attributes and environmental conditions. Fine-grained access control not only controls whether a user can access a resource, but also controls the user's specific operations on the resource. Fine-grained access control depends on defined access control policies. These policies can be refined based on multiple factors such as roles, user attributes, resource attributes, operation types, time, etc., and have the right to view and edit project data within a specified time period, but can only view but not edit in other time periods.

[0013] According to the above-mentioned data storage method, the self-destruction mechanism is a security protection function of the storage device. When the storage device detects illegal access, physical intrusion or security attack, it will take automated measures to completely destroy or encrypt the stored data to prevent data leakage. The self-destruction mechanism usually includes data deletion, encryption self-destruction and physical destruction. The mechanism monitors signs of external attacks or unauthorized access behaviors, triggers self-destruction or self-clearing operations, thereby ensuring that the stored data will not be stolen.

[0014] Compared with the known prior art, the technical solution provided by the present invention has the following beneficial effects: 1. Improve data security: The combination of data encryption and decentralized storage effectively reduces the risk of data leakage and tampering, ensuring the privacy, integrity and availability of data; through multiple protection measures such as encrypted storage, real-time monitoring, and behavioral analysis, it effectively prevents unauthorized access and tampering.

[0015] 2. Reduce technical complexity: By reasonably combining symmetric encryption and asymmetric encryption technologies and introducing decentralized storage, the computing pressure in traditional public key encryption storage solutions is reduced and storage efficiency is improved.

[0016] 3. Enhanced data access control and auditing: The introduction of smart contract mechanism can provide refined control over data access and provide complete audit logs to ensure the compliance of data access.

[0017] 4. Improve storage performance and reliability: Distributed storage and redundancy mechanisms can improve the system's fault tolerance and avoid the impact of single point failures on data security.

[0018] 5. Enhanced data recoverability: Through multiple backups and redundant storage mechanisms, ensure that data can be quickly recovered when attacked or lost.

[0019] 6. Reduced physical security risks: Hardware encryption and anti-tampering measures effectively resist physical attacks and improve the overall security of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0023] The present invention will be further described below with reference to embodiments.

[0024] Embodiment: Refer to Figure 1 , a data storage method, including the steps: S10, data identification and verification The data identification and verification include data classification and data verification; data classification refers to classifying the input data into different categories or groups according to predetermined rules or criteria. Through classification, data can be stored according to different uses, formats, or importance, thereby improving storage efficiency, optimizing data retrieval, and reducing the complexity of subsequent processing.

[0025] The data verification uses an authentication mechanism. For sensitive data, including but not limited to fingerprint recognition, iris scanning, passwords, or two-factor authentication, to confirm the authorized users of the stored data. Before data storage, the intelligent recognition module first classifies and verifies the stored data. This module preprocesses the data according to information such as the type, source, and destination of the data. Only the verified data can be stored in a specific area.

[0026] S20, data encrypted storage The data encrypted storage includes data encryption and data storage; the data encryption uses a symmetric encryption algorithm (such as AES) or an asymmetric encryption algorithm (such as RSA) to encrypt the data. Through encryption, even if the storage medium is stolen, it cannot be read by unauthorized personnel. The core idea of symmetric encryption is that the same key is used in the encryption and decryption processes. The encrypting party uses the key to encrypt the plaintext to generate ciphertext; the receiving party uses the same key to decrypt the ciphertext to restore the plaintext. The generation process of the asymmetric encryption algorithm is as follows: Select two large prime numbers pp and qq; Calculate n = p×qn = p×q (modulus), and nn will be part of the public key and the private key; Calculate φ(n)=(p−1)(q−1)φ(n)=(p−1)(q−1) (Euler's totient function value); Select an integer ee (1 < e < φ(n)φ(n)) such that ee is relatively prime to φ(n)φ(n); ee is part of the public key; Calculate dd so that e×d≡1 (mod φ(n))e×d≡1 (mod φ(n)), that is, dd is the private key; Symmetric encryption is suitable for scenarios where large amounts of data need to be encrypted quickly, but key management and distribution are its biggest challenges. Asymmetric encryption solves the problems of key distribution and management and is particularly suitable for key exchange, authentication, and digital signatures, but is slower in encryption and decryption speeds.

[0027] The data storage adopts decentralized storage, data segmentation and heterogeneous storage. Data is no longer stored in a single server or data center, but distributedly stored using decentralized storage networks (such as IPFS, Filecoin, etc.). Each storage node can only store part of the encrypted fragments of the data, ensuring that even if a node is attacked or leaked, the attacker cannot obtain the complete sensitive data, and the integrity and high availability of the data are ensured through redundancy mechanisms; the stored data is segmented and distributedly stored among multiple heterogeneous storage platforms to further enhance the security and anti-attack capabilities of data storage. Each data segment uses a different storage platform to increase the difficulty of data loss or leakage.

[0028] S30, real-time behavior monitoring and anti-tampering mechanism The real-time behavior monitoring and anti-tampering mechanism includes storage area access behavior analysis and anomaly detection and anti-tampering mechanism design; the storage area access behavior analysis and anomaly detection is to record all read and write operations, file creation, modification, deletion and other behaviors in detail, including the visitor's identity, timestamp, operation type, operation content, etc. The records can be saved in a structured log format (such as JSON, CSV) or a standardized log format (such as Syslog) for subsequent analysis. The log file itself needs to take appropriate protection measures, such as encrypted storage, permission control, anti-tampering mechanism, etc., to ensure the security and integrity of the log file, and establish a normal access behavior model for system users through machine learning algorithms or rule-based detection methods. This includes access frequency, access time, access method, access data type, etc. Once abnormal behavior that does not conform to the normal behavior model is detected, such as unauthorized access, abnormal access frequency, illegal data reading / writing, etc., an alarm is immediately issued and detailed information is recorded for further analysis. Combined with the event management system (SIEM) and automated response tools, it can send alarms to administrators in real time and provide actionable suggestions or automated response measures (such as temporary bans, detailed log records, audit backtracking, etc.).

[0029] The anti-tampering mechanism design is to generate a hash value (such as SHA-256) for the key data in storage, check the integrity of the data regularly, and use the public key infrastructure (PKI) to digitally sign important files or data blocks to ensure that the data has not been tampered with during storage or transmission. The log record itself also needs an anti-tampering design. The log file can be encrypted and stored or a log signature mechanism can be used to ensure that the log record cannot be modified or deleted later. The log is chained and stored using blockchain technology (such as Hash chain) to enhance the log's tamper-proof nature. A distributed storage architecture, such as a distributed file system (such as Ceph, HDFS) or object storage (such as Amazon S3), can be used to enhance data security through data redundancy and multi-node mechanisms to prevent single point failures or tampering. Blockchain technology is used to store and protect sensitive data. The decentralized and tamper-proof characteristics of blockchain ensure that once the data is written into the system, it cannot be modified or deleted. It is especially suitable for the storage of sensitive information such as financial data and contracts. For extremely important storage areas, a hardware encryption module is used to enhance the anti-tampering capability. The key management and encryption capabilities provided by the hardware encryption module are more secure than software encryption.

[0030] S40, intelligent access control and rights management The intelligent access control and authority management include fine-grained access control and data security assessment; the fine-grained access control usually allows dynamic adjustment of access rights in different environments or times. In the ABAC model, access decisions not only depend on the identity and role of the user, but also involve the attributes of the user, the attributes of the resource, and environmental conditions. Fine-grained access control not only controls whether a user can access a resource, but also controls the specific operations of the user on the resource. Fine-grained access control depends on defined access control policies. These policies can be refined based on multiple factors such as roles, user attributes, resource attributes, operation types, time, etc., and users have the right to view and edit project data within a specified time period, but can only view but not edit in other time periods.

[0031] Data security assessment is to conduct security assessment on the information that needs to be stored. Security assessment is an important step to ensure that the system and data are protected from threats and attacks. It requires systematic identification, assessment, and response to potential security risks, timely measures to repair vulnerabilities, and continuous improvement of security. In order to improve the effectiveness and reliability of the assessment, the assessment should cover multiple levels such as technology, security strategy, and personnel management, and be combined with appropriate tools and standards.

[0032] S50, multiple backup and redundant storage The multiple backups and redundant storage include a combination of local backup and remote backup, regular backup and RAID (redundant disk array); multiple backups refer to storing data on multiple different storage media or locations simultaneously to ensure that in the event of data loss, damage or disaster, the data can be restored from other backups. Multiple backups can reduce the threat of single point failures to data security. Backups are performed on local devices (such as hard disks, tapes, USB flash drives), and data is also backed up to remote storage devices (such as cloud storage or remote servers). This approach can cope with different types of disasters, such as hardware failures or natural disasters; set up regular automatic backup strategies, usually setting backup cycles based on the importance and update frequency of the data, such as daily, weekly or monthly backups.

[0033] RAID (Redundant Array of Independent Disks): RAID is a technology that combines multiple hard disks into a logical unit, and achieves data redundancy through data distribution, mirroring or verification. Common RAID levels include: RAID 1: Mirror redundancy, data is completely copied to another hard disk. One hard disk failure will not lose data, but the storage efficiency is low; RAID 5: Use data striping and parity to achieve redundancy, data can be restored in the event of a hard disk failure, and the storage efficiency is high; RAID6: Similar to RAID 5, but can tolerate two hard disk failures, providing higher fault tolerance; RAID 10 (RAID 1+0): Combines the advantages of RAID1 and RAID 0, with both mirror redundancy and striped data storage, and good performance and redundancy.

[0034] Multiple backups and redundant storage have different purposes. Multiple backups focus on long-term data storage and disaster recovery, usually achieved through off-site storage and regular backups. It focuses more on preventing data loss rather than just hardware failures. Redundant storage focuses mainly on providing data fault tolerance at the hardware level, using multiple hard disks or storage devices to ensure that data remains available when a single device fails. It focuses more on real-time data availability and system stability.

[0035] S60, hardware protection against physical attacks The hardware protection against physical attacks includes security protection and self-destruction mechanism. The self-destruction mechanism is a security protection function of the storage device. When the storage device detects illegal access, physical intrusion or security attack, it will take automated measures to completely destroy or encrypt the stored data to prevent data leakage. The self-destruction mechanism usually includes data deletion, encryption self-destruction and physical destruction. The mechanism triggers self-destruction or self-clearing operations by monitoring signs of external attacks or unauthorized access behaviors, thereby ensuring that the stored data will not be stolen. The storage device will support the self-destruction mechanism. When an external illegal attack is detected, the system will automatically clear the data to prevent data leakage.

[0036] The present invention also combines hardware-level protection measures, such as using tamper-proof storage devices and hardware encryption modules, to prevent physical attacks (such as data theft, hard drive cloning, storage device disassembly, etc.) from threatening data security.

[0037] Specifically, the data storage process is as follows: the user needs to upload a sensitive file to the storage system. First, user A uses the AES encryption algorithm to encrypt the file content, and then uses the RSA encryption algorithm to encrypt the generated AES key. Next, user A divides the encrypted file data into several data fragments and stores these fragments in multiple decentralized storage nodes. During the storage process, each storage node only has partial encryption information of the file and cannot obtain complete data. Finally, the storage location of each storage fragment is recorded to ensure data integrity.

[0038] The data access process is as follows: when a user needs to access a stored file, the system verifies his access rights through intelligent access. If the user is authorized, the encryption key of the file segment will be decrypted and sent to user B. User B reassembles the file fragments and decrypts them using the provided key to obtain the original data.

[0039] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data storage method, characterized in that: Includes steps: S10, Data Identification and Verification The data identification and verification include data classification and data verification; S20, data encryption storage The data encryption storage includes data encryption and data storage; S30, real-time behavior monitoring and anti-tampering mechanism The real-time behavior monitoring and anti-tampering mechanism includes storage area access behavior analysis and anomaly detection and anti-tampering mechanism design; S40, intelligent access control and rights management The intelligent access control and authority management include fine-grained access control and data security assessment; S50, multiple backup and redundant storage The multiple backup and redundant storage include a combination of local backup and remote backup, regular backup and redundant disk array; S60, hardware protection against physical attacks The hardware protection against physical attacks includes security protection and self-destruction mechanisms.

2. A data storage method according to claim 1, characterized in that: The data verification uses an identity authentication mechanism, including but not limited to fingerprint recognition, iris scanning, password or two-factor authentication for sensitive data, to confirm the authorized user of the stored data.

3. A data storage method according to claim 1, characterized in that: The data encryption uses a symmetric encryption algorithm or an asymmetric encryption algorithm to encrypt data.

4. A data storage method according to claim 1, characterized in that: The data storage adopts decentralized storage as well as data segmentation and heterogeneous storage.

5. A data storage method according to claim 4, characterized in that: The decentralized storage mentioned above is to store data in a distributed manner using a decentralized storage network instead of storing it in a single server or data center. Each storage node can only store part of the encrypted fragments of the data, ensuring that even if a node is attacked or leaked, the attacker cannot obtain the complete sensitive data. The integrity and high availability of the data are ensured through a redundant mechanism. The data segmentation and heterogeneous storage mentioned above is to segment the stored data and distribute it among multiple heterogeneous storage platforms to further enhance the security and anti-attack capability of data storage. Each data segment uses a different storage platform to increase the difficulty of data loss or leakage.

6. A data storage method according to claim 1, characterized in that: The storage area access behavior analysis and anomaly detection is to record detailed logs of all read and write operations, file creation, modification, deletion and other behaviors, including the visitor's identity, timestamp, operation type, operation content, etc. The records can be saved in a structured log format or a standardized log format for subsequent analysis.

7. A data storage method according to claim 1, characterized in that: The anti-tampering mechanism is designed to generate hash values ​​for key data in storage, regularly check the integrity of the data, and use public key infrastructure to digitally sign important files or data blocks to ensure that the data has not been tampered with during storage or transmission.

8. A data storage method according to claim 1, characterized in that: The fine-grained access control usually allows dynamic adjustment of access rights in different environments or times. In the ABAC model, access decisions not only depend on the user's identity and role, but also involve the user's attributes, resource attributes and environmental conditions. Fine-grained access control not only controls whether a user can access a resource, but also controls the user's specific operations on the resource. Fine-grained access control relies on defined access control policies, which can be refined based on multiple factors such as role, user attributes, resource attributes, operation type, time, etc. Users have the right to view and edit project data within a specified time period, but can only view but not edit during other time periods.

9. A data storage method according to claim 1, characterized in that: The self-destruction mechanism is a security protection function of the storage device. When the storage device detects illegal access, physical intrusion or security attack, it will take automated measures to completely destroy or encrypt the stored data to prevent data leakage. The self-destruction mechanism usually includes data deletion, encryption self-destruction and physical destruction. The mechanism monitors signs of external attacks or unauthorized access behaviors and triggers self-destruction or self-clearing operations, thereby ensuring that the stored data cannot be stolen.

Images