Enterprise data security protection system and method

Abstract

The invention relates to the field of data security, in particular to an enterprise data security protection system and method. The enterprise data security protection system comprises a plurality of terminals, a demand processing server, an operation processing server cluster and a distributed server cluster, the operation processing server cluster consists of a plurality of operation processing servers; the distributed server cluster is composed of a plurality of storage operation servers. The method has the beneficial effect that the security is high in the data processing process. In the data processing process, one-way data transmission is carried out, and the security risk caused by data leakage of a single node is avoided. And the data processing speed is high.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to an enterprise data security protection system and method. Background Art

[0002] During the operation of an enterprise, data security is a very important concern. Especially for enterprises in the field of data processing, the operation of an enterprise involves the processing of a large amount of data. The process of data storage and use faces the risk of internal and external leakage.

[0003] Therefore, it is necessary to study a set of enterprise data security protection systems and methods to deal with internal and external risks. Summary of the invention

[0004] The purpose of the present invention is to provide an enterprise data security protection system and method to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions: An enterprise data security protection system includes: multiple terminals, demand processing servers, a computing processing server cluster and a distributed server cluster; the computing processing server cluster is composed of multiple computing processing servers; the distributed server cluster is composed of multiple storage computing servers; The terminal sends the data processing request to the demand processing server; the demand processing server performs demand splitting processing on the data processing request and splits the data processing request into several task processing requests; The demand processing server randomly sends the disassembled task processing requests to different computing processing servers in the computing processing server cluster, determines the processing method for the data results of all the task processing requests, and transmits the processing method to the terminal that initiated the data processing request; The computing processing server that receives the task processing request communicates data with the distributed server cluster, determines the storage address of the data required for the calculation, and then parses the task processing request based on the storage address of the data required for the calculation to generate specific computing processing instructions; The computing processing server sends the computing processing instruction to the distributed server cluster, and the distributed server cluster designates a storage computing server to send the computing processing instruction to it; the storage computing server executes the computing processing instruction, wherein the computing processing instruction includes the storage address of the data required for the computing, and the storage computing server retrieves the data from the storage address of the data required for the computing as cache data, and performs computing processing on the data; After the storage computing server executes the computing instruction, it slices the data result of the computing processing to obtain a number of data slices, and then randomly sends different data slices to different computing processing servers other than the computing processing instruction source in the computing processing server cluster, and instructs the computing processing servers that have received the data slices to transmit the data slices to the designated terminal; The operation processing server executes the data transmission task and transmits the data slices to the terminal; after the terminal receives all the data slices, it first splices the data of the data slices of the same operation processing result to obtain the data results of a corresponding task processing request, and then processes the data results of all task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

[0006] As a further solution of the present invention: encrypted communication is adopted between the terminal and the demand processing server, between the demand processing server and the operation processing server, between the operation processing server and the storage operation server, and between the operation processing server and the terminal, and the encryption methods between each other are different.

[0007] As a further solution of the present invention: the storage operation server executes the operation processing instruction including instructing other storage operation servers to perform internal operation and then feed back the operation result; The storage operation server performs calculation operations based on the operation processing instructions and the operation results received from other storage operation servers.

[0008] An enterprise data security protection method is applied to an enterprise data security protection system, which includes: multiple terminals, demand processing servers, a computing processing server cluster and a distributed server cluster; the computing processing server cluster is composed of multiple computing processing servers; the distributed server cluster is composed of multiple storage computing servers; A method for protecting enterprise data security comprises the following steps: Step 1: The terminal sends a data processing request to a demand processing server; Step 2: The demand processing server performs demand splitting processing on the data processing request, and splits the data processing request into several task processing requests; Step 3: The demand processing server randomly sends the decomposed task processing requests to different computing processing servers in the computing processing server cluster, determines the processing method for the data results of all the task processing requests, and transmits the processing method to the terminal that initiated the data processing request; Step 4, the computing processing server that receives the task processing request communicates with the distributed server cluster, determines the storage address of the data required for the calculation, and then parses the task processing request based on the storage address of the data required for the calculation to generate a specific computing processing instruction; Step 5, the computing processing server sends the computing processing instruction to the distributed server cluster, and the distributed server cluster designates a storage computing server to send the computing processing instruction to it; Step 6: The storage operation server executes the operation processing instruction, wherein the operation processing instruction includes the storage address of the data required for the operation, and the storage operation server retrieves the data from the storage address of the data required for the operation as cache data, and performs operation processing on the data; Step 7: After the storage computing server executes the computing instruction, it slices the data result of the computing processing to obtain a number of data slices, and then randomly sends different data slices to different computing processing servers other than the computing processing instruction source in the computing processing server cluster, and instructs the computing processing servers that have received the data slices to transmit the data slices to the designated terminal; Step 8: The computing processing server executes the data transmission task to transmit the data slices to the terminal; Step 9. After the terminal receives all the data slices, it first splices the data slices of the same calculation processing result to obtain the data results of a corresponding task processing request, and then processes the data results of all task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

[0009] As a further solution of the present invention: encrypted communication is adopted between the terminal and the demand processing server, between the demand processing server and the operation processing server, between the operation processing server and the storage operation server, and between the operation processing server and the terminal, and the encryption methods between each other are different.

[0010] As a further solution of the present invention: the storage operation server executes the operation processing instruction including instructing other storage operation servers to perform internal operation and then feed back the operation result; The storage operation server performs calculation operations based on the operation processing instructions and the operation results received from other storage operation servers.

[0011] As a further solution of the present invention: a storage computing server pre-stores a plurality of slicing methods; a slice header of a data slice is accompanied by a slice identification code of the data slice; the slice identification code includes a plurality of splicing method identification codes and a plurality of slice codes; the splicing method identification code is used to indicate the splicing method required for the data slice; the terminal determines the required splicing method through the splicing method identification code, and performs splicing of the slices based on the preset splicing method.

[0012] As a further solution of the present invention: a slice header of the data slice is provided with a slice identification code of the data slice; The data slice identification code includes: the slice code of the slice, the slice code of the previous splicing, the slice code of the following splicing and the code position identification code; The coding position identification code is used to identify the positions of the slice code of the slice, the slice code of the previous splicing, and the slice code of the following splicing in the slice identification code.

[0013] As a further solution of the present invention: the slice code of the slice, the slice code spliced ​​above and the slice code spliced ​​below are connected in sequence as a whole, and the slice identification code is used to indicate the position of the whole composed of the slice code of the slice, the slice code spliced ​​above and the slice code spliced ​​below in the slice identification code.

[0014] As a further solution of the present invention: the slice identification code includes a position code of a slice code of the slice, a position code of a slice code spliced ​​above, and a position code of a slice code spliced ​​below; The position code of the slice code of the slice, the position code of the slice code spliced ​​above, and the position code of the slice code spliced ​​below are respectively located at non-adjacent preset positions of the slice identification code.

[0015] Compared with the prior art, the present invention has the beneficial effect of high security in the data processing process.

[0016] During the data processing process, one-way data transmission is carried out to avoid security risks caused by data leakage at a single node.

[0017] The demand processing server splits the demand so that the subsequent processor cannot know the complete data processing task. Although the demand processing server knows the task, it does not have the data, which avoids risks. In addition, after the task is split, the computing pressure of a single server is reduced, and the data processing speed is improved.

[0018] After the storage computing server performs calculations, it outputs data slices instead of complete data, reducing the risk of data leakage during the output process.

[0019] The terminal only performs the final data integration, and most of the core calculations are performed by the computing processing server and the storage computing server, which reduces the data calculation pressure on the terminal and improves the data processing speed.

[0020] Data slices are decrypted and spliced ​​using the slice identification codes they carry.

[0021] Other features and advantages of the present invention will be disclosed in detail in the following specific embodiments and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a structural block diagram of an enterprise data security protection system of the present invention; Figure 2 It is a flow chart of an enterprise data security protection method of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] See also Figure 1 and Figure 2 , An enterprise data security protection system includes: multiple terminals, demand processing servers, a computing processing server cluster and a distributed server cluster. The computing processing server cluster is composed of multiple computing processing servers. The distributed server cluster is composed of multiple storage computing servers.

[0025] The terminal sends the data processing request to the demand processing server, which performs demand splitting processing on the data processing request and splits the data processing request into several task processing requests.

[0026] The demand processing server randomly sends several disassembled task processing requests to different computing processing servers in the computing processing server cluster, determines the processing method for the data results of all the final task processing requests, and transmits the processing method to the terminal that initiates the data processing request.

[0027] The computing processing server that receives the task processing request communicates data with the distributed server cluster, determines the storage address of the data required for the calculation, and then parses the task processing request based on the storage address of the data required for the calculation to generate specific computing processing instructions.

[0028] The operation processing server sends the operation processing instruction to the distributed server cluster, and the distributed server cluster designates a storage operation server to send the operation processing instruction to it. The storage operation server executes the operation processing instruction, wherein the operation processing instruction includes the storage address of the data required for the operation. The storage operation server retrieves the data from the storage address of the data required for the operation as cache data and performs operation processing on the data.

[0029] After the storage computing server executes the computing instruction, it slices the data result of the computing processing to obtain several data slices, and then randomly sends different data slices to other different computing processing servers in the computing processing server cluster except the source of the computing processing instruction, and instructs the computing processing servers that receive the data slices to transmit the data slices to the designated terminal.

[0030] The computing processing server executes the data transmission task to transmit the data slices to the terminal. After receiving all the data slices, the terminal first splices the data of the data slices of the same computing processing result to obtain the data result of a corresponding task processing request, and then processes the data results of all task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

[0031] As a specific implementation method: encrypted communication is used between the terminal and the demand processing server, between the demand processing server and the operation processing server, between the operation processing server and the storage operation server, and between the operation processing server and the terminal, and the encryption methods between each other are different.

[0032] As a further solution of the present invention: the storage operation server executes the operation processing instruction including instructing other storage operation servers to perform internal operation and then feed back the operation result; The storage operation server performs calculation operations based on the operation processing instructions and the operation results received from other storage operation servers.

[0033] An enterprise data security protection method is applied to an enterprise data security protection system. An enterprise data security protection system includes: multiple terminals, demand processing servers, a computing processing server cluster and a distributed server cluster; the computing processing server cluster is composed of multiple computing processing servers; the distributed server cluster is composed of multiple storage computing servers.

[0034] A method for protecting enterprise data security comprises the following steps: Step 1: The terminal sends a data processing request to a demand processing server; Step 2: The demand processing server performs demand splitting processing on the data processing request, and splits the data processing request into several task processing requests; Step 3: The demand processing server randomly sends the decomposed task processing requests to different computing processing servers in the computing processing server cluster, determines the processing method for the data results of all the task processing requests, and transmits the processing method to the terminal that initiated the data processing request; Step 4, the computing processing server that receives the task processing request communicates with the distributed server cluster, determines the storage address of the data required for the calculation, and then parses the task processing request based on the storage address of the data required for the calculation to generate a specific computing processing instruction; Step 5, the computing processing server sends the computing processing instruction to the distributed server cluster, and the distributed server cluster designates a storage computing server to send the computing processing instruction to it; Step 6: The storage operation server executes the operation processing instruction, wherein the operation processing instruction includes the storage address of the data required for the operation, and the storage operation server retrieves the data from the storage address of the data required for the operation as cache data, and performs operation processing on the data; Step 7: After the storage computing server executes the computing instruction, it slices the data result of the computing processing to obtain a number of data slices, and then randomly sends different data slices to different computing processing servers other than the computing processing instruction source in the computing processing server cluster, and instructs the computing processing servers that have received the data slices to transmit the data slices to the designated terminal; Step 8: The computing processing server executes the data transmission task to transmit the data slices to the terminal; Step 9. After the terminal receives all the data slices, it first splices the data slices of the same calculation processing result to obtain the data results of a corresponding task processing request, and then processes the data results of all task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

[0035] As a preferred implementation, the storage and operation server pre-stores a variety of slicing methods; the slice header of the data slice is accompanied by a slice identification code of the data slice; the slice identification code contains a number of splicing method identification codes and a number of slice codes; the splicing method identification code is used to indicate the splicing method required for the data slice; the terminal determines the required splicing method through the splicing method identification code, and performs slice splicing based on the preset splicing method. For example, the slice identification code a87d63m, the first and second bits are used as the splicing method identification code, that is, the splicing method corresponding to a8 is used for splicing processing, and the fifth and sixth bits are used as the slice code, indicating that the slice code is 63. By using the pre-stored splicing method, more complex splicing methods can be performed with high data security. For example, two data slices are spliced ​​by splicing multiple data streams at intervals.

[0036] As another preferred implementation, a slice identification code of the data slice is included in the header of the data slice; the data slice identification code includes: a slice code of the slice, a slice code spliced ​​above, a slice code spliced ​​below and a coding position identification code; the coding position identification code is used to identify the positions of the slice code of the slice, the slice code spliced ​​above and the slice code spliced ​​below in the slice identification code.

[0037] Specifically, the slice code of the slice, the slice code of the previous splicing, and the slice code of the following splicing are sequentially connected as a whole, and the slice identification code is used to indicate the position of the whole composed of the slice code of the slice, the slice code of the previous splicing, and the slice code of the following splicing in the slice identification code. For example, the slice identification code 1423ad5f68, for example, the 4th bit 4 indicates that the position of the whole composed of the slice code of the slice, the slice code of the previous splicing, and the slice code of the following splicing in the slice identification code starts from the 4th bit, that is, the 4th bit 3a indicates the slice code of the slice, and the following d5 indicates the slice code of the previous splicing, and f6 indicates the slice code of the following splicing. Splicing is performed in the order of d5, 3a, and f6.

[0038] As an optional implementation, the slice identification code includes a position code of a slice code of the slice, a position code of a slice code spliced ​​above, and a position code of a slice code spliced ​​below; The position code of the slice code of the slice, the position code of the slice code spliced ​​above, and the position code of the slice code spliced ​​below are respectively located at non-adjacent preset positions of the slice identification code. For example, the slice identification code 1423ad5f68 can use the second bit 4 to represent the position code of the slice code of the slice, and the corresponding slice code is 3a; the seventh bit 5 represents the position code of the slice code spliced ​​above the slice, and the corresponding slice code is ad; the tenth bit 8 represents the position code of the slice code spliced ​​below the slice, and the corresponding spoof code is f6.

[0039] Sequential splicing based on slice coding may not require a pre-stored splicing method. In addition, it should be understood that although this specification is described according to the implementation methods, not every implementation method contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should take the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

Claims

1. An enterprise data security protection system, characterized in that: include: Multiple terminals, demand processing servers, computing processing server clusters and distributed server clusters; The computing and processing server cluster is composed of a plurality of computing and processing servers; the distributed server cluster is composed of a plurality of storage computing servers; The terminal sends the data processing request to the demand processing server; The demand processing server performs demand splitting processing on the data processing request, and splits the data processing request into a plurality of task processing requests; the demand processing server randomly sends the split several task processing requests to different computing processing servers in the computing processing server cluster, and determines a processing method for the final data results of all the task processing requests, and transmits the processing method to the terminal that initiates the data processing request; The computing processing server that receives the task processing request communicates data with the distributed server cluster, determines the storage address of the data required for computing, and then parses the task processing request based on the storage address of the data required for computing to generate a specific computing processing instruction; The operation processing server sends the operation processing instruction to the distributed server cluster, and the distributed server cluster designates one of the storage operation servers to send the operation processing instruction to it; the storage operation server executes the operation processing instruction, wherein the operation processing instruction includes a storage address of data required for the operation, and the storage operation server retrieves data from the storage address of the data required for the operation as cache data, and performs operation processing on the data; After executing the operation processing instruction, the storage operation server performs data result slicing processing on the data result of the operation processing to obtain a plurality of data slices, and then randomly sends different data slices to other different operation processing servers in the operation processing server cluster except the source of the operation processing instruction, and instructs the operation processing servers that receive the data slices to transmit the data slices to the designated terminal; The operation processing server executes the data output task and transmits the data slices to the terminal; after the terminal receives all the data slices, it first splices the data of the data slices of the same operation processing result to obtain the data result of a corresponding task processing request, and then processes the data results of all the task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

2. An enterprise data security protection system according to claim 1, characterized in that: Encrypted communication is used between the terminal and the demand processing server, between the demand processing server and the operation processing server, between the operation processing server and the storage operation server, and between the operation processing server and the terminal, and the encryption methods are different from each other.

3. The enterprise data security protection system according to claim 1, characterized in that: The storage operation server executes the operation processing instruction including instructing other storage operation servers to perform internal operation and then feed back the operation result; The storage operation server performs calculation based on the operation processing instruction and the received operation results of other storage operation servers.

4. A method for protecting enterprise data security, characterized in that: Applied to an enterprise data security protection system, the enterprise data security protection system comprises: multiple terminals, demand processing servers, a computing processing server cluster and a distributed server cluster; the computing processing server cluster is composed of multiple computing processing servers; the distributed server cluster is composed of multiple storage computing servers; The enterprise data security protection method comprises the following steps: Step 1, the terminal sends a data processing request to the demand processing server; Step 2, the demand processing server performs demand splitting processing on the data processing request, and splits the data processing request into a plurality of task processing requests; Step 3, the demand processing server randomly sends the disassembled several task processing requests to different computing processing servers in the computing processing server cluster, and determines the processing method of the data results of all the task processing requests, and transmits the processing method to the terminal that initiates the data processing request; Step 4, the computing processing server that receives the task processing request communicates data with the distributed server cluster, determines the storage address of the data required for the computing, and then parses the task processing request based on the storage address of the data required for the computing, and generates a specific computing processing instruction; Step 5, the operation processing server sends the operation processing instruction to the distributed server cluster, and the distributed server cluster designates one of the storage operation servers to send the operation processing instruction to it; Step 6, the storage operation server executes the operation processing instruction, wherein the operation processing instruction includes a storage address of data required for the operation, and the storage operation server retrieves data from the storage address of the data required for the operation as cache data to perform operation processing on the data; Step 7: After executing the operation processing instruction, the storage operation server performs data result slicing processing on the data result of the operation processing to obtain a plurality of data slices, and then randomly sends different data slices to other different operation processing servers in the operation processing server cluster except the source of the operation processing instruction, and instructs the operation processing servers that receive the data slices to transmit the data slices to the designated terminal; Step 8, the computing processing server executes a data output task to transmit the data slice to the terminal; Step 9: After the terminal receives all the data slices, it first splices the data slices of the same calculation processing result to obtain the data result of a corresponding task processing request, and then processes all the data results of the task processing requests based on the processing method obtained from the demand processing server to obtain the final data conclusion of the data processing request.

5. The enterprise data security protection method according to claim 4, characterized in that: Encrypted communication is used between the terminal and the demand processing server, between the demand processing server and the operation processing server, between the operation processing server and the storage operation server, and between the operation processing server and the terminal, and the encryption methods are different from each other.

6. The enterprise data security protection method according to claim 4, characterized in that: The storage operation server executes the operation processing instruction including instructing other storage operation servers to perform internal operation and then feed back the operation result; The storage operation server performs calculation based on the operation processing instruction and the received operation results of other storage operation servers.

7. The enterprise data security protection method according to claim 4, characterized in that: The storage computing server pre-stores a plurality of slicing methods; the slice header of the data slice is accompanied by a slice identification code of the data slice; the slice identification code includes a plurality of bits of splicing method identification codes and a plurality of bits of slice codes; the splicing method identification code is used to indicate the splicing method required for the data slice; the terminal determines the required splicing method through the splicing method identification code, and performs splicing of slices based on the preset splicing method.

8. The enterprise data security protection method according to claim 4, characterized in that: The slice header of the data slice is accompanied by a slice identification code of the data slice; the data slice identification code includes: a slice code of the slice, a slice code spliced ​​above, a slice code spliced ​​below and a coding position identification code; the coding position identification code is used to identify the positions of the slice code of the slice, the slice code spliced ​​above and the slice code spliced ​​below in the slice identification code.

9. The enterprise data security protection method according to claim 8, characterized in that: The slice code of the slice, the slice code of the previous spliced ​​text and the slice code of the following spliced ​​text are connected in sequence as a whole, and the slice identification code is used to indicate the position of the whole composed of the slice code of the slice, the slice code of the previous spliced ​​text and the slice code of the following spliced ​​text in the slice identification code.

10. The enterprise data security protection method according to claim 8, characterized in that: The slice identification code includes the position code of the slice code of the slice, the position code of the slice code spliced ​​above, and the position code of the slice code spliced ​​below; The position code of the slice code of the slice, the position code of the slice code spliced ​​above, and the position code of the slice code spliced ​​below are respectively located at non-adjacent preset positions of the slice identification code.

Images