Data real-time backup security protection system and protection method

Abstract

The invention discloses a data real-time backup security protection system and method, and the method comprises the steps: collecting to-be-backed-up data, converting the to-be-backed-up data into ciphertext data through an AES symmetric encryption algorithm, transmitting the backup ciphertext data from a data collection module to a backup storage module, and transmitting the backup ciphertext data to a backup storage module; carrying out data transmission monitoring by using a DPI (Deep Packet Inspection) technology; the backup ciphertext data is stored in a storage medium, an SHA-256 algorithm is utilized to calculate a hash value in the backup ciphertext data, the backup hash value is compared with an original hash value in the backup ciphertext data, and if the original hash value is inconsistent with the backup hash value, early warning is carried out; and receiving a user access instruction, authenticating the biological information of the user, and if the authentication is passed, allowing the user to access. Data security is guaranteed, and various attacks are resisted from acquisition encryption, transmission backup monitoring to storage hash value comparison.

Description

Technical Field

[0001] The present invention relates to the technical field of fire protection management, and in particular to a data real-time backup safety protection system and a protection method. Background Art

[0002] In the current environment of rapid digital development, data has become the core asset of operations in various industries. Data backup is crucial to cope with risks such as data loss and corruption. However, existing data backup systems face many severe challenges. Traditional backup systems usually lack in-depth verification of the legitimacy of data sources during data collection, which easily leads to malicious data being mixed into the backup stream. During the transmission process, it is difficult to resist advanced persistent threat (APT) attacks by relying solely on conventional encryption and simple network monitoring. Attackers may use complex vulnerabilities to bypass encryption channels to steal or tamper with data. For backup storage, existing solutions mostly focus on the management of a single storage medium, lacking effective guarantees for data consistency and fault tolerance in a multi-storage medium fusion environment. At the same time, the access control mechanism is not flexible enough and cannot dynamically adjust permissions based on data sensitivity and user behavior. In addition, when faced with complex abnormal situations, the recovery strategy is not smart enough and cannot quickly and accurately restore data. These problems seriously threaten data security. Summary of the invention

[0003] The purpose of the present invention is to solve the above problems and to design a data real-time backup security protection system and protection method.

[0004] To achieve the above purpose, the technical solution of the present invention is that, further, in the above-mentioned data real-time backup security protection system, the data real-time backup security protection system includes a data acquisition module, a data transmission monitoring module, a backup storage management module, a data comparison module, and an access control module: The data collection module is used to collect the data to be backed up, and convert the data to be backed up into ciphertext data using the AES symmetric encryption algorithm to obtain backup ciphertext data; A data transmission monitoring module, used to transmit the backup ciphertext data from the data acquisition module to the backup storage module, and use DPI deep packet inspection technology to perform data transmission monitoring; A backup storage management module, used to receive the backup ciphertext data, store the backup ciphertext data in a storage medium, and calculate a hash value in the backup ciphertext data using a SHA-256 algorithm to obtain a backup hash value; A data comparison module, used to compare the backup hash value with the original hash value in the backup ciphertext data, and issue an early warning if the original hash value is inconsistent with the backup hash value; The access control module is used to receive user access instructions, authenticate the user's biometric information, and allow the user to access if the authentication is successful.

[0005] Furthermore, in the above-mentioned data real-time backup security protection system, the data acquisition module includes the following submodules: A generation submodule, used to randomly generate a symmetric encryption key, wherein the symmetric encryption key is generated based on a secure random number generator and the length is based on the AES-128 algorithm mode; The block submodule is used to collect the data to be backed up, perform block processing on the data to be backed up, and divide the data into 1MB data blocks according to the data size and the block threshold set by the system; The encryption submodule is used to encrypt each data block by using the symmetric encryption key through the encryption function of the AES algorithm to obtain an encrypted data block; An adding submodule is used to add an identifier and verification information to the encrypted data block, the identifier is used to identify the order and source of the data block in the subsequent decryption and recovery process, and the verification information is calculated on the encrypted data block through the SHA-256 hash function to obtain the original hash value; The encapsulation submodule is used to encapsulate the encrypted data block, identifier and verification information into a data packet format to obtain backup ciphertext data.

[0006] Furthermore, in the above-mentioned data real-time backup security protection system, the data transmission monitoring module includes the following submodules: A deployment submodule is used to deploy a DPI monitoring point at the starting end of the data transmission channel to capture data packets sent from the data acquisition module in real time; The reading submodule is used for DPI to read the header information of each data packet when the data packet passes through the monitoring point, including the source IP address, destination IP address, port number, protocol type, and determine whether there is an abnormal source address or destination address; The analysis submodule is used to analyze the length, format and specific identification information of the data packet using DPI technology. If the length of the data packet does not meet the preset encrypted data block length range, the system will issue an alarm; The recording submodule is used to analyze the data packets based on predefined rules and models. If the transmission behavior of the data packets is found to be abnormally frequent retransmission and large fluctuations in transmission speed, the abnormal situation will be recorded in time.

[0007] Furthermore, in the above-mentioned data real-time backup security protection system, the backup storage management module includes the following submodules: The reading submodule is used to read the stored backup ciphertext data from the storage medium and open a buffer in the memory for hash calculation; The parameter submodule is used to initialize the hash value of the SHA-256 algorithm using eight 32-bit registers and set the SHA-256 algorithm parameters, including the message length representation method, data padding rules, etc. The padding submodule is used to fill the data message length to a multiple of 512 bits in the SHA-256 algorithm, and the padding content includes a 1 and several 0s; padding is performed on each data block read, and the data block is divided into 16-bit and 32-bit words; The operator module is used to enter the main calculation loop of the SHA-256 algorithm, perform AND, OR, NOT, XOR logic operations on the words in the data block, and update the values ​​of 8 registers; The processing submodule is used to obtain an intermediate hash value after processing a data block, use the intermediate hash value as one of the initial values ​​for calculating the next data block, and continue to process the next data block until all backup ciphertext data are processed. The submodule is used to combine the values ​​of the final 8 registers in a specific order to obtain a backup hash value when all data blocks are processed.

[0008] Furthermore, in the above-mentioned data real-time backup security protection system, the data comparison module includes the following submodules: A comparison submodule, used to compare each bit of the backup hash value and the original hash value in sequence starting from the highest bit of the hash value by using bit operation; A collection submodule is used to collect detailed information related to the hash value comparison, including the identifier of the backup ciphertext data, the backup hash value, the original hash value, and the comparison timestamp; The configuration submodule is used to determine the warning level according to the system configuration and security policy. If the hash values ​​are inconsistent, the warning level is set to high. The early warning submodule is used to send early warning information to staff or systems according to the set early warning level and notification strategy.

[0009] Furthermore, in the above-mentioned data real-time backup security protection system, the access control module includes the following submodules: The receiving submodule is used for the system to receive the user access instruction, conduct detailed analysis on the instruction, and identify the key information in the instruction, including the instruction type, target data identification, and user-related identification information; The collection submodule is used to activate the user biometric information collection module and use biometric recognition technology to obtain the user's biometric information; the biometric information at least includes the user's fingerprint image, facial feature information and iris texture information; The analysis submodule is used to transmit the collected user biometric information to the authentication server, compare the fingerprint pattern direction, the location and number of detail feature points; analyze the multi-dimensional features such as the shape, proportion, position relationship of the facial features and skin texture; compare the texture pattern and pigmentation of the iris; The access submodule is used to generate an access token based on the user's access instruction type and the access permission rules of the target data if the collected biometric information highly matches the stored template, and is used for access based on the access token.

[0010] Furthermore, a data real-time backup security protection method is provided, characterized in that the method comprises the following steps: Collecting data to be backed up, converting the data to be backed up into ciphertext data using an AES symmetric encryption algorithm to obtain backup ciphertext data; The backup ciphertext data is transmitted from the data acquisition module to the backup storage module, and the data transmission is monitored by using the DPI deep packet inspection technology; The backup ciphertext data is stored in a storage medium, and a hash value in the backup ciphertext data is calculated using a SHA-256 algorithm to obtain a backup hash value; Compare the backup hash value with the original hash value in the backup ciphertext data, and issue an early warning if the original hash value is inconsistent with the backup hash value; Receive user access instructions, authenticate the user's biometric information, and allow the user to access if the authentication is successful.

[0011] Furthermore, a data real-time backup security protection method is characterized in that the data to be backed up is collected, and the data to be backed up is converted into ciphertext data using an AES symmetric encryption algorithm to obtain backup ciphertext data, including: Randomly generate a symmetric encryption key, the symmetric encryption key is generated based on a secure random number generator and the length is based on the AES-128 algorithm mode; Collect the data to be backed up, perform block processing on the data to be backed up, and divide the data into 1MB data blocks according to the data size and the block threshold set by the system; Using the symmetric encryption key, encrypt each data block through an encryption function of the AES algorithm to obtain an encrypted data block; Adding an identifier and verification information to the encrypted data block, the identifier is used to identify the order and source of the data block in the subsequent decryption and recovery process, and the verification information is calculated on the encrypted data block through the SHA-256 hash function to obtain the original hash value; The encrypted data block, identifier and verification information are encapsulated into a data packet format to obtain backup ciphertext data.

[0012] Furthermore, a data real-time backup security protection method is implemented, characterized in that the backup ciphertext data is transmitted from the data acquisition module to the backup storage module, and the data transmission is monitored using the DPI deep packet inspection technology, including: Deploy a DPI monitoring point at the start end of the data transmission channel to capture data packets sent from the data acquisition module in real time; When a data packet passes through a monitoring point, DPI reads the header information of each data packet, including the source IP address, destination IP address, port number, and protocol type, and determines whether there is an abnormal source address or destination address; Use DPI technology to analyze the length, format and specific identification information of the data packet. If the length of the data packet does not meet the preset encryption data block length range, the system will issue an alarm; Analyze data packets based on predefined rules and models. If the transmission behavior of data packets is found to be abnormally frequent retransmission and large fluctuations in transmission speed, record the abnormal situation in a timely manner.

[0013] Its beneficial effects are that, by collecting the data to be backed up, the AES symmetric encryption algorithm is used to convert the data to be backed up into ciphertext data to obtain the backup ciphertext data; the backup ciphertext data is transmitted from the data collection module to the backup storage module, and the DPI deep packet inspection technology is used to monitor the data transmission; the backup ciphertext data is stored in the storage medium, and the hash value in the backup ciphertext data is calculated by the SHA-256 algorithm to obtain the backup hash value; the backup hash value is compared with the original hash value in the backup ciphertext data, and if the original hash value is inconsistent with the backup hash value, an early warning is issued; the user access instruction is received, the user's biometric information is authenticated, and the user is allowed to access if the authentication is passed. 1. Ensure data security, from collection encryption, transmission monitoring to storage hash value comparison, resist various attacks, ensure data integrity and prevent tampering and theft. 2. Improve backup reliability, real-time collection and transmission monitoring to ensure timely and accurate backup, and powerful exception handling and recovery capabilities reduce the risk of data loss. 3. Optimize user access management, biometric authentication has high security, and flexible permission control based on authentication results ensures access compliance and security. Fourth, improve the system's compatibility and adaptability, be compatible with multiple data sources and formats, different storage media and network environments, and enhance versatility and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.

[0015] Figure 1This is a schematic diagram of a first embodiment of a real-time data backup security protection system in an embodiment of the present invention; Figure 2 A schematic diagram of a second embodiment of a real-time data backup security protection system according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a first embodiment of a real-time data backup security protection method in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0017] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0018] The present invention will be described in detail below in conjunction with the accompanying drawings. Figure 1 As shown, a data real-time backup security protection system includes a data acquisition module, a data transmission monitoring module, a backup storage management module, a data comparison module, and an access control module: The data collection module is used to collect the data to be backed up, and convert the data to be backed up into ciphertext data using the AES symmetric encryption algorithm to obtain backup ciphertext data; Specifically, the present embodiment also includes: a generation submodule, which is used to randomly generate a symmetric encryption key, the symmetric encryption key is generated based on a secure random number generator, and the length is based on the AES-128 algorithm mode; The block submodule is used to collect the data to be backed up, and to process the data to be backed up in blocks. The data is divided into 1MB blocks according to the data size and the block threshold set by the system; The encryption submodule is used to encrypt each data block by using the encryption function of the AES algorithm using a symmetric encryption key to obtain an encrypted data block; Add a submodule to add identifiers and verification information to the encrypted data block. The identifier is used to identify the order and source of the data block in the subsequent decryption and recovery process. The verification information is calculated on the encrypted data block through the SHA-256 hash function to obtain the original hash value; The encapsulation submodule is used to encapsulate the encrypted data block, identifier and verification information into a data packet format to obtain backup ciphertext data.

[0019] The data transmission monitoring module is used to transmit the backup ciphertext data from the data acquisition module to the backup storage module, and use the DPI deep packet inspection technology to monitor the data transmission; Specifically, the present embodiment also includes: a deployment submodule, which is used to deploy a DPI monitoring point at the starting end of the data transmission channel, and is used to capture data packets sent from the data acquisition module in real time; The reading submodule is used for DPI to read the header information of each data packet when the data packet passes through the monitoring point, including the source IP address, destination IP address, port number, protocol type, and determine whether there is an abnormal source address or destination address; The analysis submodule is used to analyze the length, format and specific identification information of the data packet using DPI technology. If the length of the data packet does not meet the preset encrypted data block length range, the system will issue an alarm; The recording submodule is used to analyze the data packets based on predefined rules and models. If the transmission behavior of the data packets is found to be abnormally frequent retransmission and large fluctuations in transmission speed, the abnormal situation will be recorded in time.

[0020] A backup storage management module is used to receive the backup ciphertext data, store the backup ciphertext data in a storage medium, and calculate the hash value in the backup ciphertext data using the SHA-256 algorithm to obtain a backup hash value; Specifically, the present embodiment further includes: a reading submodule, which is used to read the stored backup ciphertext data from the storage medium and to open a buffer in the memory for hash calculation; The parameter submodule is used to initialize the hash value of the SHA-256 algorithm using eight 32-bit registers and set the SHA-256 algorithm parameters, including the message length representation method, data padding rules, etc. The padding submodule is used to fill the data message length to a multiple of 512 bits in the SHA-256 algorithm, and the padding content includes a 1 and several 0s; padding is performed on each data block read, and the data block is divided into 16-bit and 32-bit words; The operator module is used to enter the main calculation loop of the SHA-256 algorithm, perform AND, OR, NOT, XOR logic operations on the words in the data block, and update the values ​​of 8 registers; The processing submodule is used to obtain an intermediate hash value after processing a data block, use the intermediate hash value as one of the initial values ​​for calculating the next data block, and continue to process the next data block until all backup ciphertext data are processed. The submodule is used to combine the values ​​of the final 8 registers in a specific order to obtain a backup hash value when all data blocks are processed.

[0021] The data comparison module is used to compare the backup hash value with the original hash value in the backup ciphertext data. If the original hash value is inconsistent with the backup hash value, an early warning is issued. Specifically, the present embodiment further includes: a comparison submodule, which is used to compare each bit of the backup hash value and the original hash value in sequence starting from the highest bit of the hash value by using bit operation; A collection submodule is used to collect detailed information related to the hash value comparison, including the identifier of the backup ciphertext data, the backup hash value, the original hash value, and the comparison timestamp; The configuration submodule is used to determine the warning level according to the system configuration and security policy. If the hash values ​​are inconsistent, the warning level is set to high. The early warning submodule is used to send early warning information to staff or systems according to the set early warning level and notification strategy.

[0022] The access control module is used to receive user access instructions, authenticate the user's biometric information, and allow the user to access if the authentication is successful.

[0023] Specifically, the present embodiment also includes: a receiving submodule, which is used for the system to receive a user access instruction, analyze the instruction in detail, and identify key information in the instruction, including the instruction type, target data identifier, and user-related identification information; The collection submodule is used to activate the user biometric information collection module and use biometric recognition technology to obtain the user's biometric information; the biometric information at least includes the user's fingerprint image, facial feature information and iris texture information; The analysis submodule is used to transmit the collected user biometric information to the authentication server, compare the fingerprint pattern direction, the location and number of detail feature points; analyze the multi-dimensional features such as the shape, proportion, position relationship of the facial features and skin texture; compare the texture pattern and pigmentation of the iris; The access submodule is used to generate an access token based on the user's access instruction type and the access permission rules of the target data if the collected biometric information highly matches the stored template, and is used for access based on the access token.

[0024] Its beneficial effects are that by collecting the data to be backed up, the data to be backed up is converted into ciphertext data using the AES symmetric encryption algorithm to obtain the backup ciphertext data; the backup ciphertext data is transmitted from the data collection module to the backup storage module, and the data transmission is monitored using the DPI deep packet inspection technology; the backup ciphertext data is stored in the storage medium, and the hash value in the backup ciphertext data is calculated using the SHA-256 algorithm to obtain the backup hash value; the backup hash value is compared with the original hash value in the backup ciphertext data, and if the original hash value is inconsistent with the backup hash value, an early warning is issued; the user access instruction is received, the user's biometric information is authenticated, and if the authentication is passed, the user is allowed to access. 1. Ensure data security, from collection encryption, transmission monitoring to storage hash value comparison, resist various attacks, ensure data integrity and prevent tampering and theft. 2. Improve backup reliability, real-time collection and transmission monitoring to ensure timely and accurate backup, and powerful exception handling and recovery capabilities reduce the risk of data loss. 3. Optimize user access management, biometric authentication is highly secure, and flexible permission control based on authentication results ensures access compliance and security. Fourth, improve the system's compatibility and adaptability, be compatible with multiple data sources and formats, different storage media and network environments, and enhance versatility and practicality.

[0025] See also Figure 2 In a data real-time backup security protection system, the backup storage management module includes the following submodules: The reading submodule is used to read the stored backup ciphertext data from the storage medium and open a buffer in the memory for hash calculation; The parameter submodule is used to initialize the hash value of the SHA-256 algorithm using eight 32-bit registers and set the SHA-256 algorithm parameters, including the message length representation method, data padding rules, etc. The padding submodule is used to fill the data message length to a multiple of 512 bits in the SHA-256 algorithm, and the padding content includes a 1 and several 0s; padding is performed on each data block read, and the data block is divided into 16-bit and 32-bit words; The operator module is used to enter the main calculation loop of the SHA-256 algorithm, perform AND, OR, NOT, XOR logic operations on the words in the data block, and update the values ​​of 8 registers; The processing submodule is used to obtain an intermediate hash value after processing a data block, use the intermediate hash value as one of the initial values ​​for calculating the next data block, and continue to process the next data block until all backup ciphertext data are processed. The submodule is used to combine the values ​​of the final 8 registers in a specific order to obtain a backup hash value when all data blocks are processed.

[0026] See also Figure 3 In a data real-time backup security protection method, the data real-time backup security protection method includes the following steps: Step 101: Collect the data to be backed up, and convert the data to be backed up into ciphertext data using the AES symmetric encryption algorithm to obtain backup ciphertext data; Step 102: The backup ciphertext data is transmitted from the data acquisition module to the backup storage module, and the data transmission is monitored using the DPI deep packet inspection technology; Step 103: Store the backup ciphertext data in a storage medium, and use the SHA-256 algorithm to calculate the hash value in the backup ciphertext data to obtain a backup hash value; Step 104: Compare the backup hash value with the original hash value in the backup ciphertext data. If the original hash value is inconsistent with the backup hash value, issue a warning. Step 105: Receive a user access instruction, authenticate the user's biometric information, and allow the user to access if the authentication passes.

[0027] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A data real-time backup security protection system, characterized in that: The data real-time backup security protection system includes a data acquisition module, a data transmission monitoring module, a backup storage management module, a data comparison module, and an access control module: The data collection module is used to collect the data to be backed up, and convert the data to be backed up into ciphertext data using the AES symmetric encryption algorithm to obtain backup ciphertext data; A data transmission monitoring module, used to transmit the backup ciphertext data from the data acquisition module to the backup storage module, and use DPI deep packet inspection technology to perform data transmission monitoring; A backup storage management module, used to receive the backup ciphertext data, store the backup ciphertext data in a storage medium, and calculate a hash value in the backup ciphertext data using a SHA-256 algorithm to obtain a backup hash value; A data comparison module, used to compare the backup hash value with the original hash value in the backup ciphertext data, and issue an early warning if the original hash value is inconsistent with the backup hash value; The access control module is used to receive user access instructions, authenticate the user's biometric information, and allow the user to access if the authentication is successful.

2. A data real-time backup security protection system as claimed in claim 1, characterized in that: The data acquisition module includes the following submodules: A generation submodule, used to randomly generate a symmetric encryption key, wherein the symmetric encryption key is generated based on a secure random number generator and the length is based on the AES-128 algorithm mode; The block submodule is used to collect the data to be backed up, perform block processing on the data to be backed up, and divide the data into 1MB data blocks according to the data size and the block threshold set by the system; The encryption submodule is used to encrypt each data block by using the symmetric encryption key through the encryption function of the AES algorithm to obtain an encrypted data block; An adding submodule is used to add an identifier and verification information to the encrypted data block, the identifier is used to identify the order and source of the data block in the subsequent decryption and recovery process, and the verification information is calculated on the encrypted data block through the SHA-256 hash function to obtain the original hash value; The encapsulation submodule is used to encapsulate the encrypted data block, identifier and verification information into a data packet format to obtain backup ciphertext data.

3. A data real-time backup security protection system as claimed in claim 1, characterized in that: The data transmission monitoring module includes the following submodules: A deployment submodule is used to deploy a DPI monitoring point at the starting end of the data transmission channel to capture data packets sent from the data acquisition module in real time; The reading submodule is used for DPI to read the header information of each data packet when the data packet passes through the monitoring point, including the source IP address, destination IP address, port number, protocol type, and determine whether there is an abnormal source address or destination address; The analysis submodule is used to analyze the length, format and specific identification information of the data packet using DPI technology. If the length of the data packet does not meet the preset encrypted data block length range, the system will issue an alarm; The recording submodule is used to analyze the data packets based on predefined rules and models. If the transmission behavior of the data packets is found to be abnormally frequent retransmission and large fluctuations in transmission speed, the abnormal situation will be recorded in time.

4. A data real-time backup security protection system as claimed in claim 1, characterized in that: The backup storage management module includes the following submodules: The reading submodule is used to read the stored backup ciphertext data from the storage medium and open a buffer in the memory for hash calculation; The parameter submodule is used to initialize the hash value of the SHA-256 algorithm using eight 32-bit registers and set the SHA-256 algorithm parameters, including the message length representation method, data padding rules, etc. The padding submodule is used to fill the data message length to a multiple of 512 bits in the SHA-256 algorithm, and the padding content includes a 1 and several 0s; padding is performed on each data block read, and the data block is divided into 16-bit and 32-bit words; The operator module is used to enter the main calculation loop of the SHA-256 algorithm, perform AND, OR, NOT, XOR logic operations on the words in the data block, and update the values ​​of 8 registers; A processing submodule is used to obtain an intermediate hash value after processing a data block, use the intermediate hash value as one of the initial values ​​for calculating the next data block, and continue to process the next data block until all backup ciphertext data are processed; The submodule is used to combine the values ​​of the final 8 registers in a specific order to obtain a backup hash value when all data blocks are processed.

5. A data real-time backup security protection system as claimed in claim 1, characterized in that: The data comparison module includes the following submodules: A comparison submodule, used to compare each bit of the backup hash value and the original hash value in sequence starting from the highest bit of the hash value by using bit operation; A collection submodule is used to collect detailed information related to the hash value comparison, including the identifier of the backup ciphertext data, the backup hash value, the original hash value, and the comparison timestamp; The configuration submodule is used to determine the warning level according to the system configuration and security policy. If the hash values ​​are inconsistent, the warning level is set to high. The early warning submodule is used to send early warning information to staff or systems according to the set early warning level and notification strategy.

6. A data real-time backup security protection system as claimed in claim 1, characterized in that: The access control module includes the following submodules: The receiving submodule is used for the system to receive the user access instruction, conduct detailed analysis on the instruction, and identify the key information in the instruction, including the instruction type, target data identification, and user-related identification information; The collection submodule is used to activate the user biometric information collection module and use biometric recognition technology to obtain the user's biometric information; the biometric information at least includes the user's fingerprint image, facial feature information and iris texture information; The analysis submodule is used to transmit the collected user biometric information to the authentication server, compare the fingerprint pattern direction, the location and number of detail feature points, and analyze the multi-dimensional features such as the shape, proportion, position relationship of the facial features and skin texture; Compare the texture pattern and pigmentation of the iris; The access submodule is used to generate an access token based on the user's access instruction type and the access permission rules of the target data if the collected biometric information highly matches the stored template, and is used for access based on the access token.

7. A data real-time backup security protection method, characterized in that: The data real-time backup security protection method comprises the following steps: Collecting data to be backed up, converting the data to be backed up into ciphertext data using an AES symmetric encryption algorithm to obtain backup ciphertext data; The backup ciphertext data is transmitted from the data acquisition module to the backup storage module, and the data transmission is monitored by using the DPI deep packet inspection technology; The backup ciphertext data is stored in a storage medium, and a hash value in the backup ciphertext data is calculated using a SHA-256 algorithm to obtain a backup hash value; Compare the backup hash value with the original hash value in the backup ciphertext data, and issue an early warning if the original hash value is inconsistent with the backup hash value; Receive user access instructions, authenticate the user's biometric information, and allow the user to access if the authentication is successful.

8. A data real-time backup security protection method as claimed in claim 7, characterized in that: The collecting of the data to be backed up, converting the data to be backed up into ciphertext data using the AES symmetric encryption algorithm, and obtaining the backup ciphertext data, comprises: Randomly generate a symmetric encryption key, the symmetric encryption key is generated based on a secure random number generator and the length is based on the AES-128 algorithm mode; Collect the data to be backed up, perform block processing on the data to be backed up, and divide the data into 1MB data blocks according to the data size and the block threshold set by the system; Using the symmetric encryption key, encrypt each data block through an encryption function of the AES algorithm to obtain an encrypted data block; Adding an identifier and verification information to the encrypted data block, the identifier is used to identify the order and source of the data block in the subsequent decryption and recovery process, and the verification information is calculated on the encrypted data block through the SHA-256 hash function to obtain the original hash value; The encrypted data block, identifier and verification information are encapsulated into a data packet format to obtain backup ciphertext data.

9. A data real-time backup security protection method as claimed in claim 7, characterized in that: The step of transmitting the backup ciphertext data from the data acquisition module to the backup storage module and using the DPI deep packet inspection technology to perform data transmission monitoring includes: Deploy a DPI monitoring point at the start end of the data transmission channel to capture data packets sent from the data acquisition module in real time; When a data packet passes through a monitoring point, DPI reads the header information of each data packet, including the source IP address, destination IP address, port number, and protocol type, and determines whether there is an abnormal source address or destination address; Use DPI technology to analyze the length, format and specific identification information of the data packet. If the length of the data packet does not meet the preset encryption data block length range, the system will issue an alarm; Analyze data packets based on predefined rules and models. If the transmission behavior of data packets is found to be abnormally frequent retransmission and large fluctuations in transmission speed, record the abnormal situation in a timely manner.

Images