Calculation method and system for information security

Abstract

The invention relates to the technical field of information security, in particular to a computing method and system for information security. The method comprises the following steps of: partitioning and fragmenting input data, and distributing the data to a plurality of storage nodes through randomization, distributed storage and Hash mapping to ensure the safety of data storage and the distribution flexibility; establishing an index table for all the fragments; regularly triggering a data confusion mechanism, and adjusting the storage position of data fragments through a pseudo-random function; the integrity of the data is detected by generating a check code and an erasure code, it is ensured that the data is not tampered or damaged in the transmission or storage process, and the data is recovered through a redundant copy when the data is lost; the identity verification and the data integrity when the user accesses the data are ensured through authority authentication; and monitoring storage nodes and data access behaviors in real time, detecting potential threats and taking dynamic adjustment measures. According to the invention, through a multi-level security policy, the security and fault-tolerant capability of data processing are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a computing method and system for information security. Background Art

[0002] As information security issues become increasingly serious, traditional protection mechanisms can no longer meet the security requirements of modern data storage and transmission. Especially in distributed storage and cloud computing environments, data storage, transmission, processing and access are facing many security risks, such as data leakage, tampering, loss and other risks. Therefore, how to ensure the integrity, confidentiality and availability of data in distributed systems has become an important research direction in the field of information security.

[0003] A Chinese invention patent application with publication number CN116318628A discloses an information security method that ensures information security and has low computational complexity. A client connects to a server to establish communication. The communication between the client and the server first enters a handshake phase. During the handshake phase, the client and the server use three message headers to verify the legitimacy of the identity and generate a symmetric key. After the handshake phase is passed, the communication between the client and the server enters a regular communication phase and begins to exchange information. During the regular communication phase, the check bits of the message header are used to perform CRC and DES calculations to determine the legitimacy of the identity and the reliability of the data. This invention application solves the limitation of low computing power, and both parties in network communication can achieve identity reliability, information that cannot be tampered with, and information security attributes that cannot be forged.

[0004] However, with the continuous upgrading of network attack technology, the importance of data protection has become more and more prominent, especially in areas involving sensitive information and personal privacy. Data security issues have become a difficult problem that needs to be solved urgently. Most existing technologies focus on single-aspect protection such as data encryption and authentication. However, there is still a large research gap on how to comprehensively ensure data security in a complex distributed environment. Summary of the invention

[0005] The purpose of the present invention is to propose a calculation method and system for information security in view of the problems existing in the background technology.

[0006] The technical solution of the present invention is a calculation method for information security, comprising the following specific implementation steps: S1. Split the input data into multiple logically independent small data fragments according to preset rules, and output the fragmented data sets; S2. Combine the fragmented data set and create a distribution index table for all fragments, including fragment number, storage node, and data checksum value. S3. Trigger the obfuscation mechanism regularly to dynamically adjust the storage location of existing data fragments, migrate data fragments to other storage nodes, and redistribute the storage order of fragments randomly; S4, dynamically reorganize the index according to the logical rules through the obfuscated fragment set to generate new fragments, and dynamically adjust the storage strategy according to the distributed node load status, give priority to the node with the lowest load to store the new fragment, and update the index table record at the same time, reorganize the original fragment set, reorganization rules, storage node information and check value of the fragment; S5. Based on distributed storage, data fragments are segmented, checksums are generated, distributed checksum tables are constructed, and linear coding is used to generate data blocks and checksums. The number of redundant blocks is dynamically adjusted in combination with node failure prediction, and additional redundant blocks are pre-generated at high-risk nodes. Then, through periodic check tasks and dynamic trigger mechanisms, machine learning is used to predict node risks and optimize check scheduling. S6. The user initiates a data access request and verifies the authority. After the authority verification is passed, the data shard is located and the distributed node address is queried. After reading the data shard, the data integrity is verified by hash value comparison. If it fails, the error correction mechanism is called. After the verification is successful, the data shard is encrypted using the AES algorithm to generate ciphertext, and then returned to the user through a secure transmission protocol; S7. Monitor the behavior of storage nodes and data access in real time. If abnormal behavior is found, it will be immediately marked as a potential threat. When a potential threat is detected, the dynamic adjustment mechanism will be automatically triggered, and the alarm function will be automatically triggered to notify the administrator to check for security vulnerabilities.

[0007] Preferably, the generation process of the fragmented data set is as follows: S21. Set the original data D to a size of |D|, and divide the data into n logical data blocks according to a preset storage strategy: ; In the formula, S i Indicates the size of the i-th logical data block; n indicates the number of logical blocks; S22, after completing data segmentation, enter the fragmentation stage, the logical data block S i will be further subdivided into smaller random fragments, with each logical data block S i Further decomposed into k fragments F i,j , and disrupt the fragment order by random offset, as follows: S2201, Fragmentation rules: ; In the formula, F i,j represents the jth fragment of the i-th logical data block; k represents the number of fragments of each logical data block; S2202, random offset: introduce pseudo-random function PRNG (seed) to generate the offset δ of each fragment j : δ j =PENG(seed) mod |S i |; In the formula, seed represents a dynamically generated random seed; Among them, δ j Determine the starting position of the fragment and break the regularity of linear segmentation. The end position of the offset is determined by δ j+1 or |S i | OK; S2203, after the fragmentation is completed, these randomized fragments are allocated to different storage nodes; S23, fragmented data F i,j Map to different storage nodes N according to the distribution strategy p : Node distribution mapping rule: Using the hash function H(F i,j ) Calculate the fragmentation distribution: N p =H(F i,j ) mod m; In the formula, H(F i,j ) represents the hash value calculated based on the fragment content; m represents the total number of storage nodes; N p represents the target storage node number; H represents the hash function; Consistent hashing: Using consistent hashing, each node N p The number of virtual nodes v p Dynamically adjust according to its performance weight: ; Where W p represents the node weight; VR represents the total number of virtual nodes; W q represents the weight of the qth storage node; S24, output the fragmented data set F = {F i,j}.

[0008] Preferably, the migration process of migrating data fragments to other storage nodes is as follows: S31, generating a confusion sequence M for each group of fragments based on a pseudo-random function PRNG (seed') i,j : M i,j =shuffle(F i,j , PRNG(seed')); In the formula, shuffle() represents a function that randomly arranges a set of fragments to disrupt the order; PRNG(seed') is a pseudo-random function, and the seed seed' is dynamically updated and adjusted according to the storage node status; S32, cross-confusion of fragments of different logical data blocks to build a random mapping relationship: ; In the formula, Indicates the fragments after confusion; represents a logical combination based on specific rules, i.e., an XOR operation; k and l represent another randomly selected data block and its fragment number; F i,j represents the jth fragment in the i-th data block; F k,l Represents the lth fragment in the kth data block.

[0009] Preferably, the verification process through the periodic verification task and the dynamic trigger mechanism is as follows: S41, for each obfuscated and reorganized data segment G l,s , generate the corresponding check code C l,s : C l,s =H(G l,s ); S42, build a distributed check table to record each data segment G l,s Information including: data segment identifier R, corresponding check code C l,s , storage node location N p , current timestamp T; Wherein, the data segment identifier R=H(G l,s ||T);|| represents the splicing operation; S43, the distributed check table is stored in multiple nodes in a distributed manner: Replicate (C l,s ,R'); Among them, R' represents the number of redundant copies, which is dynamically adjusted according to the importance of the data to ensure the high availability of the checksum table; Replicate() is a function used to generate redundant copies of data; S44, for the reorganized data segment G l,s , k data blocks and r check blocks are generated by generating matrix G to form (k+r) error correction code: Encode(G l,s )={D1,D2,…,D k ,P1,P2,…,P r}; The encoding process is as follows: ; Among them, Di represents a data block, i=1,2,…,k; P j represents the check block, which is generated by linear coding, j=1,2,…,r; k represents the number of data blocks; r represents the number of check blocks, r≥m', m' represents the number of fault-tolerant nodes; S45, data integrity check: read data block D from the storage node i Sum check block P j , verify that the following linear constraints are satisfied: ; Data recovery: When some data blocks are lost, the original data is reconstructed using the remaining k+r-m' blocks: G l,s =Decode(D i ,P j ); Among them, Decode() represents the decoding formula, which is as follows: ; In the formula, Indicates the fragment involved in decoding, that is, the currently available data fragment; Based on this, the number of check blocks r is adjusted in real time according to the importance of the data and the node status, the balance between storage and fault tolerance is optimized, and additional redundant blocks P are pre-generated in combination with node failure prediction. r+1 ,P r+2 Storage on high-risk nodes; S46, regularly schedule the verification task, by reading the verification table C l,s Compare data segment G l,s For completeness: ; When abnormal node load, increased access latency or other risk signals are detected, the data verification task is dynamically triggered; if data damage or loss is found, the fault-tolerant recovery process is immediately started to rebuild the complete data fragment G l,s .

[0010] Preferably, the generator matrix G is an r×k matrix used to map k original data blocks into k data blocks and r check blocks, and each element of the matrix is ​​a finite field GF(2 n' ), n' represents the bit width of the data block; ; In the formula, a 11 、a 12 , … and a rk represents the coefficients of the generator matrix; k represents the number of data blocks and r represents the number of check blocks.

[0011] Preferably, the access process for a user to initiate a data access request is as follows: S61. When a user initiates a data access request, an access credential K is generated and the user's authority is verified: ; Where P u Indicates the result of user permission verification, 1 means passed and 0 means rejected; U indicates the user identity identifier; K indicates the access credential; R indicates the target resource identifier, which corresponds to the data shard index; S62: After the permission check is passed, locate the data shard requested by the user, query the distributed check table according to the resource identifier R, and obtain the distributed node address N of the shard. p ; S63. After the shard reading is completed, the integrity of the shard data is verified to ensure that the data has not been tampered with or lost; S64. Target data D i Use the AES encryption algorithm to encrypt and obtain the ciphertext CT i , and then the ciphertext CT i The data is returned to the user via the network transmission protocol.

[0012] Preferably, the integrity verification process for the shard data is as follows: S71. Calculate the read data fragment D i The hash value H(D i ); S72, extract the check code C of the distributed check table l,s ; S73, if H(D i )=C l,s , the verification passes, otherwise the error correction mechanism is called to regenerate the number of shards.

[0013] Preferably, the generation process of the access credential K is as follows: S81. When a user logs in, the user's identity is automatically verified. If the authentication is successful, a temporary session key K is assigned to the user. session , to ensure the legitimacy of this visit; S82: Based on the user's session key K session The final access credential K is generated by the resource characteristics currently being accessed. The formula is: K=f key (K session ,C text ); Among them, C text Represents access context information.

[0014] Preferably, the update process of updating the index table record is as follows: S91. The obfuscated fragment set is reindexed according to the new logical rules: ; In the formula, G l,s Represents the dynamically reorganized data fragment; merge() represents the fragment combination operation, which is used to generate a new fragment; R(i,j) represents the mapping relationship set of dynamic reorganization rules; S92. Use the state of the distributed nodes, that is, the node load L, as a dynamic adjustment factor: Re(i,j)=argmin p (L p ), p∈Nodes; Based on this, the node with the lowest load is selected to store the new fragment first; S93, update the index table, each recombinant fragment G l,s Corresponding to an index record, including: the original fragment set , reorganization rule Re(i,j), storage node information N p , check value H(G l,s ).

[0015] The technical solution of the present invention is a computing system for information security, which is used to execute the above-mentioned computing method for information security, including: Data distribution module, responsible for data segmentation, fragmentation and dynamic distribution; Index management module, used to maintain the distribution index of fragments and storage nodes; Fault tolerance and verification module, used to provide data verification and redundancy recovery functions; Permission control module, used to control the permissions and content of user access to data; Security monitoring module, used to monitor and respond to potential security threats in real time.

[0016] Compared with the prior art, the above technical solution of the present invention has the following beneficial technical effects: The present invention designs a computing method and system for information security. Through the comprehensive application of distributed storage, fragmentation, encryption, fault tolerance, and permission control technologies, the security, reliability, and management efficiency of data are comprehensively improved, providing an innovative solution for the field of information security: (1) Improved data security: By dividing and fragmenting the input data, and using random storage and pseudo-random offset to disrupt the order of the fragments, the risk of data leakage and tampering is effectively avoided. Data fragmentation processing can increase the difficulty for attackers to obtain complete data, thereby improving data security. (2) Efficient data distribution and storage management: Distributed storage nodes and consistent hashing algorithms are used to map and distribute fragments, effectively avoiding large-scale data migration problems caused by node changes. The performance and resource utilization of storage nodes are optimized through dynamic adjustment of virtual node weights. (3) Flexible data management and verification mechanism: The combination of index management and fragmented data enables efficient data index management and verification, ensuring data integrity and traceability. The dynamically updated index table and data fragment migration mechanism ensure effective data management and storage when the storage node status changes. (4) Enhanced fault tolerance and data recovery capabilities: Through the strategies of erasure coding and redundant copies, the system has strong fault tolerance. Even if some nodes fail, data can still be recovered through redundant copies, which improves data reliability and availability. The regularly triggered verification tasks can detect data corruption in time and start the recovery process to ensure data integrity. (5) Intelligent security monitoring and anomaly detection: By real-time monitoring of storage nodes and data access behaviors, potential security threats can be identified and countermeasures can be taken in a timely manner. This mechanism not only enhances the ability to protect against security vulnerabilities, but also improves the ability to quickly respond to abnormal access behaviors. (6) Efficient data access control: Through dynamic permission verification and encryption mechanisms, ensure that users' access to data is legal and secure. Multi-factor authentication and dynamically generated access credentials ensure the authenticity of access. Combined with encryption algorithms, ensure privacy protection during data transmission. (7) Flexible and scalable storage architecture: The distributed storage and virtual node mapping mechanism enables the system to dynamically expand or reduce storage nodes according to load conditions, improving the scalability and adaptability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a system architecture diagram of a computing system for information security proposed by the present invention. DETAILED DESCRIPTION

[0018] Embodiment 1, as Figure 1 As shown, a computing system for information security proposed by the present invention includes: a data distribution module, an index management module, a fault tolerance and verification module, a permission control module and a security monitoring module.

[0019] The data distribution module is responsible for data segmentation, fragmentation and dynamic distribution; The index management module is used to maintain the distribution index of fragments and storage nodes; The fault tolerance and verification module is used to provide data verification and redundancy recovery functions; The permission control module is used to control the permissions and content of user access to data; The security monitoring module is used to monitor and respond to potential security threats in real time.

[0020] Embodiment 2, a computing method for information security proposed by the present invention is applied to a computing system for information security proposed in Embodiment 1, and its specific implementation steps are as follows: S1. The data distribution module divides the input data according to preset rules and divides it into multiple logically independent small data fragments. The specific implementation process is as follows: S11. Set the original data D to a size of |D|, and divide the data into n logical data blocks according to a preset storage strategy: ; In the formula, S i Indicates the size of the i-th logical data block; n indicates the number of logical blocks; It should be noted that the preset storage strategy is: based on the conventional logical block, combined with the data content analysis algorithm, further optimized for data types (including but not limited to text, images or time series): Text data: divided into blocks according to semantic structures (including but not limited to paragraphs); Image data: segmentation based on feature regions, including but not limited to edges and color blocks; Time series data: divided by time windows or event frequencies; S12, after completing data segmentation, enter the fragmentation stage, the logical data block S i It will be further subdivided into smaller random fragments to improve security and distribution flexibility. i Further decomposed into k fragments F i,j , and disrupt the fragment order by random offset. The specific implementation process is as follows: S1201, Fragmentation rules: ; In the formula, F i,j represents the jth fragment of the i-th logical data block; k represents the number of fragments of each logical data block; S1202, random offset: introduce pseudo-random function PRNG (seed) to generate the offset δ of each fragment j : δ j =PENG(seed) mod |S i |; In the formula, seed represents a dynamically generated random seed; Among them, δ jDetermine the starting position of the fragment and break the regularity of linear segmentation. The end position of the offset is determined by δ j+1 or |S i | OK; S1203, after the fragmentation is completed, these randomized fragments are allocated to different storage nodes; S13, fragmented data F i,j Map to different storage nodes N according to the distribution strategy p The specific implementation process is as follows: S1301, node distribution mapping rule: using hash function H(F i,j ) Calculate the fragmentation distribution: N p =H(F i,j ) mod m; In the formula, H(F i,j ) represents the hash value calculated based on the fragment content; m represents the total number of storage nodes; N p represents the target storage node number; H represents the hash function; S1302, consistent hashing: Consistent hashing is used to avoid large-scale data migration caused by node changes. Each node N p The number of virtual nodes v p Dynamically adjust according to its performance weight: ; Where W p represents the node weight; VR represents the total number of virtual nodes; W q represents the weight of the qth storage node; S14, output the fragmented data set F = {F i,j}.

[0021] S2, the index management module combines the fragmented data set F = {F i,j}, create index table I for all fragments j,j , to achieve efficient data management and verification mechanism: S21. Design index content: Each index record includes: fragment number (i, j), storage node N p 、Data check value H(F i,j ); Index table formula: I i,j ={(i,j),N p , H(F i,j )}; S22, Dynamic index update: When the storage node status changes (including but not limited to failure or expansion), the index table is dynamically updated and the affected fragments are migrated synchronously.

[0022] S3, the data distribution module triggers the obfuscation mechanism regularly, dynamically adjusts the storage location of existing data fragments, migrates data fragments to other storage nodes, and re-randomly distributes the storage order of fragments. The specific implementation process is as follows: S31, the data distribution module generates a confusion sequence M for each group of fragments based on the pseudo-random function PRNG (seed') i,j : M i,j =shuffle(F i,j , PRNG(seed')); Wherein, shuffle() represents a function that randomly arranges a set of fragments to disrupt the order; PRNG(seed') is a pseudo-random function, and the seed seed' is dynamically updated and adjusted according to the storage node status (including but not limited to load or network delay); S32, cross-confusion of fragments of different logical data blocks to build a random mapping relationship: ; In the formula, Indicates the fragments after confusion; represents a logical combination based on a specific rule, and this embodiment adopts an XOR operation; k and l represent another randomly selected data block and its fragment number; F i,j represents the jth fragment in the i-th data block; F k,l Represents the lth fragment in the kth data block.

[0023] S4. During obfuscation, the index management module automatically updates the fragment distribution index table and discards the old distribution information. The specific implementation steps are as follows: S41. The obfuscated fragment set is re-indexed according to the new logical rules: ; In the formula, G l,s Represents the dynamically reorganized data fragment; merge() represents the fragment combination operation, which is used to generate a new fragment; R(i,j) represents the mapping relationship set of dynamic reorganization rules; S42. Use the state of the distributed node (node ​​load L) as a dynamic adjustment factor: Re(i,j)=argmin p (L p ), p∈Nodes; Based on this, the node with the lowest load is selected to store the new fragment first; S43, update the index table, each recombinant fragment G l,s Corresponding to an index record, including: the original fragment set , reorganization rule Re(i,j), storage node information N p , check value H(G l,s ).

[0024] S5, the fault tolerance and verification module takes the check code, check table, erasure code and dynamic trigger mechanism as the core, dynamically adjusts parameters and strategies, detects whether the data has been tampered or damaged through the verification mechanism, and uses the fault tolerance strategy to ensure data recoverability. The specific implementation process is as follows: S51, for each obfuscated and reorganized data segment G l,s , generate the corresponding check code C l,s : C l,s =H(G l,s ); This checksum provides a unique integrity identifier for each data fragment, and any form of tampering or damage can be quickly detected during data transmission or storage; S52, build a distributed check table, record each data segment G l,s Information including: data segment identifier R, corresponding check code C l,s , storage node location N p , current timestamp T; Wherein, the data segment identifier R=H(G l,s ||T);|| represents the splicing operation; S53, the distributed check table is stored in multiple nodes in a distributed manner: Replicate (C l,s ,R'); Among them, R' represents the number of redundant copies, which is dynamically adjusted according to the importance of the data to ensure the high availability of the checksum table; Replicate() is a function used to generate redundant copies of data (i.e., replicate data fragments); It should be noted that the function of Replicate() is: according to the system's fault tolerance strategy, the data segment G l,s Generate redundant copies of the data and distribute them to different storage nodes, ensuring that even if some nodes fail, data can still be restored through redundant copies, improving system reliability and fault tolerance; It should be noted that redundant copies refer to the duplication of original data and storage of multiple copies of the same data on multiple nodes in a distributed storage system or data management system in order to improve data reliability, availability and fault tolerance. S54, for the reorganized data segment G l,s , generate k data blocks {D1,D2,…,D k} and r check blocks {P1,P2,…,Pr}, forming a (k+r) error correction code: Encode(G l,s )={D1,D2,…,D k ,P1,P2,…,P r}; The encoding process is as follows: ; Among them, D i represents a data block, i=1,2,…,k; P j represents the check block, which is generated by linear coding, j=1,2,…,r; k represents the number of data blocks; r represents the number of check blocks, r≥m', m' represents the number of fault-tolerant nodes; The generator matrix G is an r×k matrix used to map k original data blocks into k data blocks and r check blocks. Each element (coefficient) of the matrix is ​​a finite field GF(2 n' ), n' represents the bit width of the data block; ; In the formula, a 11 、a 12 , … and a rk The coefficients of the generator matrix are shown; S55, data integrity check: read data block D from the storage node i Sum check block P j , verify that the following linear constraints are satisfied: ; Data recovery: When some data blocks are lost, the original data is reconstructed using the remaining k+r-m' blocks: G l,s =Decode(D i ,P j ); Among them, Decode() represents the decoding formula, which is as follows: ; In the formula, Indicates the fragment involved in decoding, that is, the currently available data fragment; Based on this, the number of check blocks r is adjusted in real time according to the importance of the data and the node status, the balance between storage and fault tolerance is optimized, and additional redundant blocks P are pre-generated in combination with node failure prediction. r+1 ,P r+2 Storing on high-risk nodes improves the system's fault recovery efficiency; S56, regularly schedule the verification task, by reading the verification table C l,s Compare data segment G l,s For completeness: ; When abnormal node load, increased access latency or other risk signals are detected, the data verification task is dynamically triggered; if data damage or loss is found, the fault-tolerant recovery process is immediately started to rebuild the complete data fragment G l,s ; Based on this, machine learning is used to predict the risk of node failure, verify the data of high-risk nodes in advance, improve response speed, and use multiple nodes for parallel verification to improve the execution efficiency of verification tasks.

[0025] S6. The permission control module realizes efficient user access to data based on the output results of distributed verification and fault tolerance, while ensuring the integrity and authenticity of the data. The specific implementation process is as follows: S61. When a user initiates a data access request, the user's authority is first verified: ; Where P u Indicates the result of user permission verification, 1 means passed and 0 means rejected; U indicates the user identity identifier; K indicates the access credential; R indicates the target resource identifier, which corresponds to the data shard index; It should be noted that the access credential K: when a user logs in, the user's identity is automatically verified (including but not limited to username and password or multi-factor authentication). If the authentication is successful, a temporary session key K will be assigned to the user. session , to ensure the legitimacy of this access, and then use the user's session key K session The final access credential K is generated by the resource characteristics currently being accessed. The formula is: K=f key (K session ,C text ), C text Indicates access context information (including but not limited to user role, permission scope, access time); S62: After the permission check is passed, locate the data shard requested by the user, query the distributed check table according to the resource identifier R, and obtain the distributed node address N of the shard. p ; S63. After the shard reading is completed, the integrity of the shard data is verified to ensure that the data has not been tampered with or lost. The verification process is as follows: S6301. Calculate the read data fragment D i The hash value H(D i ); S6302, extract the check code C of the distributed check table l,s ; S6303, if H(D i )=C l,s, the verification is passed and S64 is executed; otherwise, the error correction mechanism is called to regenerate the number of shards; S64. Target data D i Use AES (Advanced Encryption Standard) encryption algorithm to encrypt and obtain the ciphertext CT i , and then the ciphertext CT i The data is returned to the user via a network transmission protocol (including but not limited to HTTPS).

[0026] S7. The security monitoring module monitors the storage nodes and data access behaviors in real time, including access frequency, request source and data migration. If abnormal behaviors are found (including but not limited to high-frequency access to a single node or multiple failed authentications), they are immediately marked as potential threats. When potential threats are detected, the dynamic adjustment mechanism is automatically triggered, including but not limited to reallocating data fragments, changing the storage order of fragments or locking sensitive data access permissions. In addition, the alarm function is automatically triggered to notify the administrator to check for possible security vulnerabilities.

[0027] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto, and various changes can be made within the knowledge scope of technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A computing method for information security, characterized in that: The specific implementation steps include the following: S1. Split the input data into multiple logically independent small data fragments according to preset rules, and output the fragmented data sets; S2. Combine the fragmented data set and create a distribution index table for all fragments, including fragment number, storage node, and data checksum value; S3. Trigger the obfuscation mechanism regularly to dynamically adjust the storage location of existing data fragments, migrate data fragments to other storage nodes, and redistribute the storage order of fragments randomly; S4, dynamically reorganize the index according to the logical rules through the obfuscated fragment set to generate new fragments, and dynamically adjust the storage strategy according to the distributed node load status, give priority to the node with the lowest load to store the new fragment, and update the index table record at the same time, reorganize the original fragment set, reorganization rules, storage node information and check value of the fragment; S5. Based on distributed storage, data fragments are segmented, checksums are generated, distributed checksum tables are constructed, and linear coding is used to generate data blocks and checksums. The number of redundant blocks is dynamically adjusted in combination with node failure prediction, and additional redundant blocks are pre-generated at high-risk nodes. Then, through periodic check tasks and dynamic trigger mechanisms, machine learning is used to predict node risks and optimize check scheduling. S6. The user initiates a data access request and verifies the authority. After the authority verification is passed, the data shard is located and the distributed node address is queried. After reading the data shard, the data integrity is verified by hash value comparison. If it fails, the error correction mechanism is called. After the verification is successful, the data shard is encrypted using the AES algorithm to generate ciphertext, and then returned to the user through a secure transmission protocol; S7. Monitor the behavior of storage nodes and data access in real time. If abnormal behavior is found, it will be immediately marked as a potential threat. When a potential threat is detected, the dynamic adjustment mechanism will be automatically triggered, and the alarm function will be automatically triggered to notify the administrator to check for security vulnerabilities.

2. A calculation method for information security according to claim 1, characterized in that: The generation process of the fragmented dataset is as follows: S21. Set the original data D to a size of |D|, and divide the data into n logical data blocks according to a preset storage strategy: ； In the formula, S i Indicates the size of the i-th logical data block; n indicates the number of logical blocks; S22, after completing data segmentation, enter the fragmentation stage, the logical data block S i will be further subdivided into smaller random fragments, with each logical data block S i Further decomposed into k fragments F i,j , and disrupt the fragment order by random offset, as follows: S2201, Fragmentation rules: ； In the formula, F i,j represents the jth fragment of the i-th logical data block; k represents the number of fragments of each logical data block; S2202, random offset: introduce pseudo-random function PRNG (seed) to generate the offset δ of each fragment j : δ j =MONEY(seed) mod |S i |; In the formula, seed represents a dynamically generated random seed; Among them, δ j Determine the starting position of the fragment and break the regularity of linear segmentation. The end position of the offset is determined by δ j+1 or |S i | OK; S2203, after the fragmentation is completed, these randomized fragments are allocated to different storage nodes; S23, fragmented data F i,j Map to different storage nodes N according to the distribution strategy p : Node distribution mapping rule: Using the hash function H(F i,j ) Calculate the fragmentation distribution: N p =H(F i,j ) mod m; In the formula, H(F i,j ) represents the hash value calculated based on the fragment content; m represents the total number of storage nodes; N p represents the target storage node number; H represents the hash function; Consistent hashing: Using consistent hashing, each node N p The number of virtual nodes v p Dynamically adjust according to its performance weight: ； Where W p represents the node weight; VR represents the total number of virtual nodes; W q represents the weight of the qth storage node; S24, output the fragmented data set F = {F i,j }.

3. A calculation method for information security according to claim 1, characterized in that: The migration process of migrating data fragments to other storage nodes is as follows: S31, generating a confusion sequence M for each group of fragments based on a pseudo-random function PRNG (seed') i,j : M i,j =shuffle(F i,j ,PRNG(seed')); In the formula, shuffle() represents a function that randomly arranges a set of fragments to disrupt the order; PRNG(seed') is a pseudo-random function, and the seed seed' is dynamically updated and adjusted according to the storage node status; S32, cross-confusion of fragments of different logical data blocks to build a random mapping relationship: ； In the formula, Indicates the fragments after confusion; represents a logical combination based on a specific rule, i.e., an XOR operation; k and l represent another randomly selected data block and its fragment number; F i,j represents the jth fragment in the i-th data block; F k,l Represents the lth fragment in the kth data block.

4. A calculation method for information security according to claim 1, characterized in that: The verification process through periodic verification tasks and dynamic triggering mechanism is as follows: S41, for each obfuscated and reorganized data segment G l,s , generate the corresponding check code C l,s : C l,s =H(G l,s ); S42, build a distributed check table to record each data segment G l,s Information including: data segment identifier R, corresponding check code C l,s , storage node location N p , current timestamp T; Wherein, the data segment identifier R=H(G l,s ||T);|| represents the splicing operation; S43, the distributed check table is stored in multiple nodes in a distributed manner: Replicate (C l,s ,R'); Among them, R' represents the number of redundant copies, which is dynamically adjusted according to the importance of the data to ensure the high availability of the checksum table; Replicate() is a function used to generate redundant copies of data; S44, for the reorganized data segment G l,s , k data blocks and r check blocks are generated by generating matrix G to form (k+r) error correction code: Encode(G l,s )={D1,D2,…,D k ,P1,P2,…,P r }; The encoding process is as follows: ； Among them, D i represents a data block, i=1,2,…,k; P j represents the check block, which is generated by linear coding, j=1,2,…,r; k represents the number of data blocks; r represents the number of check blocks, r≥m', m' represents the number of fault-tolerant nodes; S45, data integrity check: read data block D from the storage node i Sum check block P j , verify that the following linear constraints are satisfied: ； Data recovery: When some data blocks are lost, the original data is reconstructed using the remaining k+r-m' blocks: G l,s =Decode(D i ,P j ); Among them, Decode() represents the decoding formula, which is as follows: ； In the formula, Indicates the fragment involved in decoding, that is, the currently available data fragment; Based on this, the number of check blocks r is adjusted in real time according to the importance of the data and the node status, the balance between storage and fault tolerance is optimized, and additional redundant blocks P are pre-generated in combination with node failure prediction. r+1 ,P r+2 Storage on high-risk nodes; S46, regularly schedule the verification task, by reading the verification table C l,s Compare data segment G l,s For completeness: ； When abnormal node load, increased access latency or other risk signals are detected, the data verification task is dynamically triggered; if data damage or loss is found, the fault-tolerant recovery process is immediately started to rebuild the complete data fragment G l,s .

5. A calculation method for information security according to claim 4, characterized in that: The generator matrix G is an r×k matrix used to map k original data blocks into k data blocks and r check blocks. Each element of the matrix is ​​a finite field GF(2 n' ), n' represents the bit width of the data block; ； In the formula, a 11 、a 12 , … and a rk represents the coefficients of the generator matrix; k represents the number of data blocks and r represents the number of check blocks.

6. A computing method for information security according to claim 1, characterized in that: The access process for a user to initiate a data access request is as follows: S61. When a user initiates a data access request, an access credential K is generated and the user's authority is verified: ； Where P u Indicates the result of user permission verification, 1 means passed and 0 means rejected; U indicates the user identity identifier; K indicates the access credential; R indicates the target resource identifier, which corresponds to the data shard index; S62: After the permission check is passed, locate the data shard requested by the user, query the distributed check table according to the resource identifier R, and obtain the distributed node address N of the shard. p ; S63. After the shard reading is completed, the integrity of the shard data is verified to ensure that the data has not been tampered with or lost; S64. Target data D i Use the AES encryption algorithm to encrypt and obtain the ciphertext CT i , and then the ciphertext CT i The data is returned to the user via the network transmission protocol.

7. A calculation method for information security according to claim 6, characterized in that: The verification process for integrity verification of shard data is as follows: S71. Calculate the read data fragment D i The hash value H(D i ); S72, extract the check code C of the distributed check table l,s ; S73, if H(D i )=C l,s , the verification passes, otherwise the error correction mechanism is called to regenerate the number of shards.

8. A computing method for information security according to claim 1, characterized in that: The generation process of access credential K is as follows: S81. When a user logs in, the user's identity is automatically verified. If the authentication is successful, a temporary session key K is assigned to the user. session , to ensure the legitimacy of this visit; S82: Based on the user's session key K session The final access credential K is generated by the resource characteristics currently being accessed. The formula is: K=f key (K session ,C text ); Among them, C text Represents access context information.

9. A computing method for information security according to claim 1, characterized in that: The update process for updating index table records is as follows: S91. The obfuscated fragment set is reindexed according to the new logical rules: ； In the formula, G l,s Represents the dynamically reorganized data fragment; merge() represents the fragment combination operation, which is used to generate a new fragment; R(i,j) represents the mapping relationship set of dynamic reorganization rules; S92. Use the state of the distributed nodes, that is, the node load L, as a dynamic adjustment factor: Re(i,j)=argmin p (L p ),p∈Nodes; Based on this, the node with the lowest load is selected to store the new fragment first; S93, update the index table, each recombinant fragment G l,s Corresponding to an index record, including: the original fragment set , reorganization rule Re(i,j), storage node information N p , check value H(G l,s ).

10. A computing system for information security, used to execute a computing method for information security according to any one of claims 1 to 9, characterized in that: include: Data distribution module, responsible for data segmentation, fragmentation and dynamic distribution; Index management module, used to maintain the distribution index of fragments and storage nodes; Fault tolerance and verification module, used to provide data verification and redundancy recovery functions; Permission control module, used to control the permissions and content of user access to data; Security monitoring module, used to monitor and respond to potential security threats in real time.

Images