Data storage security management method and system

Abstract

The invention discloses a data storage security management method and system, and relates to the technical field of data storage security, and the method comprises the steps: selecting a cloud data center, constructing a centralized trust management system, carrying out the distributed storage of trust credentials of a user, and carrying out the regular updating; and based on the acquired data items of the network nodes, main components are extracted according to PCA, and importance weights corresponding to the network nodes are determined through an FCM algorithm. According to the method, trust credentials of users are managed and trust evaluation tasks are executed through the decentralized trust management system, the system avoids risks caused by single-point faults, the PCA, the FCM and fuzzy weight vector calculation are combined, the finally obtained weight is based on data features, the flexibility of fuzzy analysis is also integrated, and the trust evaluation efficiency is improved. The overall performance of the importance of network nodes in global comparison is reflected, the roles of the nodes are further defined, and the role of each node and task allocation directly depend on the overall target and importance evaluation standard of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage security, and in particular to a data storage security management method and system. Background Art

[0002] Data security storage is an important security project at present. With the popularization of the Internet and smart terminal devices, the demand for data storage security management is also gradually increasing. Traditional data storage methods mainly rely on local hard disks or centralized servers for management. In addition to data encryption storage, data security verification and other links are gradually becoming important steps in security management.

[0003] Existing technologies usually have a high level of control when dealing with data storage security in a distributed environment, but are prone to high risks of single point failures. When dealing with a dynamic environment with multiple nodes, multiple users, and multiple permissions, they often lack sufficient flexibility and are unable to achieve dynamic management of encrypted data. In particular, traditional encryption methods require the entire data set to be re-encrypted when data ciphertext permissions are changed, which not only increases the cost of computing and encryption, but may also lead to data consistency issues, making it difficult to provide real-time data security protection and reducing the efficiency of data storage security management. Summary of the invention

[0004] In view of the problems existing in the above-mentioned existing data storage security management methods and systems, the present invention is proposed.

[0005] Therefore, the problem to be solved by the present invention is that when dealing with a dynamic environment with multiple nodes, multiple users and multiple permissions, there is often a lack of sufficient flexibility and the dynamic management of encrypted data cannot be achieved. In particular, traditional encryption methods require the entire data set to be re-encrypted when the data ciphertext permissions are changed, which not only increases the cost of computing and encryption, but may also lead to data consistency problems, making it difficult to provide real-time data security protection and reducing the efficiency of data storage security management.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a data storage security management method, comprising:

[0007] Select a cloud data center and build a centralized trust management system to store user trust credentials in a distributed manner and update them regularly;

[0008] Based on the collected data items of network nodes, the main components are extracted according to PCA and the importance weights of network nodes are determined by FCM algorithm. The fuzzy judgment matrix is ​​constructed to calculate the fuzzy weight vector, and the defuzzification is performed by the centroid method to calculate the final weight of the network nodes.

[0009] Allocate the number of trust credentials that each network node needs to manage and define the node role;

[0010] Divide the encrypted data, select a strong hash function to perform hash operation to generate a data block hash value, use the attribute-based encryption algorithm to generate the initial ciphertext, perform hash operation again to generate the initial ciphertext hash value, generate a short fingerprint, and re-encrypt the initial ciphertext based on the proxy re-encryption method;

[0011] Use short fingerprints to verify data transmission and integrity, and generate log data for off-site file storage.

[0012] As a preferred solution of the data storage security management method of the present invention, wherein: the cloud data center is selected and a centralized trust management system is constructed to distribute and store the user's trust credentials and update them regularly, including:

[0013] Select independent network nodes based on cloud data centers, manage user trust credentials and perform trust assessment tasks through the decentralized trust management system DTMS;

[0014] The PBFT consensus algorithm is used to identify and confirm the data consistency and security between different nodes, and the node data is securely transmitted through the encrypted communication protocol TLS;

[0015] The user's trust credentials are stored in a distributed manner, and the credential data is encrypted and stored using a hash encryption algorithm;

[0016] Network nodes regularly update and back up the trust credential data they manage.

[0017] As a preferred solution of the data storage security management method of the present invention, wherein: the collected data items based on network nodes extract the main components according to PCA and determine the importance weights corresponding to the network nodes through the FCM algorithm, construct a fuzzy judgment matrix to calculate the fuzzy weight vector, perform defuzzification processing through the centroid method, and calculate the final weight of the network node, including,

[0018] Construct a hierarchical model of importance weights for network nodes, where the top level is the overall goal of the system and the secondary level is the importance evaluation criteria for network nodes;

[0019] Based on the collected data items of network nodes, data collection and standardization are carried out;

[0020] Calculate the covariance matrix for each data of the importance assessment standard data;

[0021] Perform eigenvalue decomposition on the covariance matrix to obtain the eigenvalue and eigenvector corresponding to the i-th data item;

[0022] Calculate the proportion of the sum of the first k eigenvalues ​​to the sum of all eigenvalues ​​as the contribution rate, and take the eigenvalues ​​and eigenvectors of the first k data items with the 80th percentile contribution rate as the main components of the selection;

[0023] According to the main components extracted by PCA, the network nodes are clustered by fuzzy C-means using the FCM algorithm, where the number of cluster centers is determined by the number of main components, and the distance between each network node and the characteristic vector of the cluster center is calculated based on the cluster center to calculate the membership. The objective function is defined by the FCM algorithm, and the cluster center and membership are iteratively updated to minimize the objective function, which is expressed as:

[0024]

[0025] Among them, M represents the total number of samples, C represents the number of cluster centers, represents the membership of sample i to cluster center h, m represents the fuzzy index, x i represents the feature vector of sample i, c h represents the feature vector of the cluster center h, c k represents the eigenvector of cluster center k, J m represents the objective function value;

[0026] Update the cluster center by weighted averaging the membership of each network node in the cluster;

[0027] The importance weight corresponding to the network node is obtained by multiplying the membership degree of each network node calculated according to the minimization objective function with the eigenvalue extracted from the main component;

[0028] Based on the weights corresponding to the network nodes as the basis of importance, a fuzzy judgment matrix is ​​constructed matrix including the minimum value of the comparison of the importance of network node i and network node j, the median value of the comparison of the importance of network node i and network node j, and the maximum value of the comparison of the importance of network node i and network node j;

[0029] The constructed fuzzy judgment matrix Calculate the fuzzy weight vector to obtain the fuzzy weight vector of each network node;

[0030] The fuzzy weight vector is defuzzified by the centroid method to calculate the final weight of the network node i.

[0031] As a preferred solution of the data storage security management method of the present invention, wherein: the allocation of the number of trust credentials required to be managed by each network node and the definition of the node role include:

[0032] Normalize based on the final calculated weights and allocate the number of trust credentials that each network node needs to manage proportionally;

[0033] At the same time, the node roles are defined based on the hierarchical model. i f The highest value of is defined as the core node, and W i f The lowest value of is defined as a common node, and the W corresponding to the core node and the common node is i f Values ​​are defined as significant nodes.

[0034] As a preferred solution of the data storage security management method of the present invention, wherein: the encrypted data is divided, a strong hash function is selected to perform hash operation to generate a data block hash value, an attribute-based encryption algorithm is used to generate an initial ciphertext, a hash operation is performed again to generate an initial ciphertext hash value, and a short fingerprint is generated, and the initial ciphertext is re-encrypted based on a proxy re-encryption method, including:

[0035] Based on the node role definition, determine the attribute set required for the node role definition, including user role, department, and access level;

[0036] The encrypted data is divided into m data blocks before encryption and a strong hash function is selected for hash operation to generate a hash value H2(m i );

[0037] For each data block, the key generation algorithm in the attribute-based encryption algorithm is used to generate a public key PK and multiple private keys SK. Based on the access policy defined by the node role, the public key PK is used to encrypt the data and generate the initial ciphertext CT. i ;

[0038] The strong hash function is used to perform hash operation again, and a fixed-length hash value H3 (CT i ), combined with H2(m i ) Use XOR operation on two hash values ​​to generate a short fingerprint FP i , expressed as:

[0039]

[0040] Based on the proxy re-encryption method, the proxy re-encryption key rk is generated according to the node role definition and sent to the proxy server. The proxy server uses the re-encryption key rk and the initial ciphertext to re-encrypt and generate the re-ciphertext.

[0041] As a preferred solution of the data storage security management method of the present invention, wherein: the use of short fingerprints for data transmission verification and integrity verification includes:

[0042] Generate short fingerprint FP i The data blocks are then stored and the corresponding short fingerprints FP' are calculated for each data block. i , and FP' i With FP i Compare, if FP' i With FP i If they are equal, the transmission verification is considered to have passed;

[0043] At the same time, when the receiver requests access to data, it decrypts the re-encrypted ciphertext according to the attribute set and permissions of the requesting user and the corresponding private key rk, and calculates the short fingerprint FP of the decrypted data block at the same time. i , and FP" i With FP i Compare, if FP i With FP i If they are equal, the integrity verification is considered to have passed.

[0044] As a preferred solution of the data storage security management method of the present invention, wherein: the generation of log data for off-site file storage includes:

[0045] Generate corresponding log data according to the data encryption, decryption, verification and transmission operations, and record and store them as log files. The data recorded in the log files for the operations include the operation type, operation timestamp, operation initiator, operation result, verification hash value and node information data;

[0046] After the log is generated, the TLS / SSL protocol is used to encrypt the log transmission and asynchronously copy it to the off-site storage server to realize off-site log file storage.

[0047] Another object of the present invention is to provide a system for data storage security management method, which comprises:

[0048] Trust management module: selects cloud data centers and builds a centralized trust management system to manage user trust credentials and role definitions of network nodes;

[0049] Network node weight evaluation module, which evaluates the importance of network nodes and assigns node tasks;

[0050] The data encryption processing module encrypts and hashes the data to generate a data block hash value and a short fingerprint;

[0051] The data verification module is responsible for the secure transmission and integrity verification of data to ensure the security of data during transmission;

[0052] The log storage module generates operation logs and stores them securely to ensure the traceability of system operations and the security of logs.

[0053] A computer device comprises: a memory and a processor; the memory stores a computer program, and the processor implements the steps of the above-mentioned data storage security management method when executing the computer program.

[0054] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned data storage security management method.

[0055] The beneficial effects of the present invention are as follows: by managing the user's trust credentials and executing trust assessment tasks through a decentralized trust management system, the system avoids the risks brought by single point failures. By combining PCA, FCM and fuzzy weight vector calculations, the final weights are not only based on data features, but also integrate the flexibility of fuzzy analysis, reflecting the overall performance of the importance of network nodes in global comparison, and further defining node roles, so that the role and task allocation of each node directly depend on the overall system goals and importance assessment standards, achieving the overall goal of each node in meeting security, reliability and efficiency. By re-encrypting attribute-based encrypted data through PRE technology, the system can adjust access rights without re-encrypting the data. At the same time, the short fingerprint calculated by the hash function will reflect the slight changes in the original data and ciphertext, thereby ensuring uniqueness and improving data security, thereby improving the efficiency of data storage security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 The figure is a flowchart of a data storage security management method.

[0058] Figure 2 This is a structural diagram of the data storage security management system. DETAILED DESCRIPTION

[0059] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0060] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0061] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0062] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a data storage security management method, the data storage security management method comprising:

[0063] S1, select a cloud data center and build a centralized trust management system to distribute and store user trust credentials and update them regularly;

[0064] Preferably, a cloud data center is selected and a centralized trust management system is built to store user trust credentials in a distributed manner and update them regularly, including:

[0065] Select independent network nodes based on cloud data centers, manage user trust credentials and perform trust assessment tasks through the decentralized trust management system DTMS;

[0066] The PBFT consensus algorithm is used to identify and confirm the data consistency and security between different nodes, and the node data is securely transmitted through the encrypted communication protocol TLS;

[0067] The user's trust credentials are stored in a distributed manner, and the credential data is encrypted and stored using a hash encryption algorithm;

[0068] Network nodes regularly update and back up the trust credential data they manage.

[0069] By managing users' trust credentials and performing trust assessment tasks through a decentralized trust management system (DTMS), the system avoids the risks brought by single point failures and ensures the high availability and reliability of the system. By encrypting and storing users' trust credentials through a hash encryption algorithm, the system ensures the privacy of users' sensitive information. By selecting independent network nodes and distributing storage of users' trust credentials, the system improves its fault resistance. Through the application of the PBFT consensus algorithm, it ensures the common confirmation of data consistency by each node and prevents the generation of inconsistent data. By decentralizing the management of trust credentials, the system can more effectively utilize network resources to cope with the growing needs of users and data volume.

[0070] S2, based on the collected data items of network nodes, extract the main components according to PCA and determine the importance weights of network nodes through FCM algorithm, construct fuzzy judgment matrix to calculate fuzzy weight vector, perform defuzzification through centroid method, and calculate the final weights of network nodes;

[0071] Preferably, based on the collected data items of the network nodes, the main components are extracted according to PCA and the importance weights corresponding to the network nodes are determined by the FCM algorithm, a fuzzy judgment matrix is ​​constructed to calculate the fuzzy weight vector, and the defuzzification is performed by the centroid method to calculate the final weight of the network nodes, including:

[0072] Construct a hierarchical model of importance weights for network nodes, where the top level is the overall system goal (such as security, reliability, efficiency, etc.), and the secondary level is the importance evaluation criteria of network nodes (such as computing power, data processing capacity, network latency, historical performance, etc.);

[0073] Based on the collected data items of network nodes, data collection and standardization are carried out;

[0074] The covariance matrix is ​​calculated for each data of the importance assessment standard data, expressed as:

[0075]

[0076] Among them, ∑ ij represents the covariance matrix of data items i and j, represents the index value of the i-th data item of the k-th sample, represents the index value of the jth data item of the kth sample, N represents the total number of samples, μ i Represents the mean value of the index of the i-th data item, μ j Represents the mean value of the j-th data item indicator;

[0077] Perform eigenvalue decomposition on the covariance matrix to obtain the eigenvalue and eigenvector corresponding to the i-th data item;

[0078] Calculate the proportion of the sum of the first k eigenvalues ​​to the sum of all eigenvalues ​​as the contribution rate, and take the eigenvalues ​​and eigenvectors of the first k data items with the 80th percentile contribution rate as the main components of the selection;

[0079] According to the main components extracted by PCA, the network nodes are clustered by fuzzy C-means using the FCM algorithm, where the number of cluster centers is determined by the number of main components, and the distance between each network node and the characteristic vector of the cluster center is calculated based on the cluster center to calculate the membership. The objective function is defined by the FCM algorithm, and the cluster center and membership are iteratively updated to minimize the objective function, which is expressed as:

[0080]

[0081] Among them, M represents the total number of samples, C represents the number of cluster centers, represents the membership of sample i to cluster center h, m represents the fuzzy index (usually set to 2), x i represents the feature vector of sample i, c h represents the feature vector of the cluster center h, c k represents the eigenvector of cluster center k, J m represents the objective function value, ||x i -c h || represents the Euclidean distance between the feature vector of sample i and the feature vector of cluster center h;

[0082] The cluster center is updated by weighted averaging the membership of each network node in the cluster, which is expressed as:

[0083]

[0084] According to the membership of each network node calculated by minimizing the objective function and the feature value extracted from the main component, the importance weight corresponding to the network node is obtained, which is expressed as:

[0085]

[0086] Among them, W i represents the importance weight of the i-th network node, λ h The characteristic value of the h-th cluster center;

[0087] Based on the weights corresponding to the network nodes as the basis of importance, a fuzzy judgment matrix is ​​constructed matrix including the minimum value of the comparison of the importance of network node i and network node j, the median value of the comparison of the importance of network node i and network node j, and the maximum value of the comparison of the importance of network node i and network node j;

[0088] The constructed fuzzy judgment matrix The fuzzy weight vector is calculated to obtain the fuzzy weight vector of each network node, which is expressed as:

[0089]

[0090] in represents the fuzzy weight vector, l i 、m i and u i They represent the minimum, median and maximum values ​​of the fuzzy judgment matrix respectively, and n represents the total number of network nodes;

[0091] The fuzzy weight vector is defuzzified by the centroid method, and the final weight of the network node i is calculated, which is expressed as:

[0092]

[0093] Among them, W i f Represents the final weight of network node i.

[0094] By combining PCA, FCM and fuzzy weight vector calculation, the final weight is not only based on data features, but also integrates the flexibility of fuzzy analysis. The method combining PCA and FCM is based on a data-driven approach. The importance of each network node is automatically determined by extracting the main components and clustering analysis, ensuring that the importance evaluation of each network node is based on scientific calculation. Compared with the traditional judgment of network node weights, the PCA and FCM methods automate weight calculation in a data-driven way, integrate statistical analysis and machine learning technology, and make the network node weight calculation more scientific and automated. At the same time, by combining with fuzzy weight vector calculation, the final weight is not only based on data features, but also integrates the flexibility of fuzzy analysis. The network nodes are automatically determined by extracting the main components and clustering analysis, ensuring that the importance evaluation of each network node is based on scientific calculation. Compared with the traditional judgment of network node weights, the PCA and FCM methods automate weight calculation in a data-driven way, integrate statistical analysis and machine learning technology, and make the network node weight calculation more scientific and automated. The importance comparison between them is decomposed into three possible cases including minimum, median and maximum. This triplet representation can capture the different possibilities of network node importance comparison and avoid the information loss caused by simple binary comparison. At the same time, based on the three possibilities, the overall performance of the importance of network nodes in global comparison is reflected through aggregate calculation. Finally, the median is given a larger weight through the centroid method, making the weight calculation more balanced, which not only considers extreme cases but also fully reflects the judgment of normal situations. The introduction of the centroid method ensures the rationality of the defuzzification process, so that the final network node weight can be effectively applied to the actual trust management system.

[0095] The hierarchical model enables the originally complex decision-making problems to be analyzed layer by layer, ensuring that the importance of each network node can be evaluated based on clear standards. By combining PCA, FCM and fuzzy weight vector calculation methods, the technical means of statistics, machine learning and fuzzy mathematics are integrated together, which can automatically extract key features from the data and improve the accuracy of weight calculation by superposition of multiple algorithms. Especially when facing complex network systems, the importance of key network nodes can be more accurately identified. Among them, the automatic preliminary weight calculation combined with PCA and FCM has realized the automatic evaluation of the importance of network nodes. The further introduction of fuzzy weight vector calculation and defuzzification processing makes the whole process more accurate and meticulous, preventing the influence of subjective judgment. At the same time, fuzzy weight vector calculation allows the system to dynamically adjust weights according to changes in different situations. This dynamic adjustment is not based on fixed rules, but adapts to changes in the network environment in real time in a data-driven way. This is impossible with traditional methods. It has achieved the effect of improving calculation flexibility and ensuring calculation accuracy, especially in highly dynamic networks, effectively maintaining the stability and security of the system.

[0096] S3, allocates the number of trust credentials that each network node needs to manage and defines the node role;

[0097] Preferably, each network node is assigned the number of trust credentials it needs to manage and defines the node role, including:

[0098] The calculated final weight is normalized and the number of trust credentials that each network node needs to manage is proportionally allocated, expressed as:

[0099] V i =V t ·W i f ;

[0100] Where V i represents the number of trust credentials assigned to network node i, V t Represents the total number of all trust credentials in the system;

[0101] At the same time, the node roles are defined based on the hierarchical model. i f The highest value of is defined as the core node, and W i f The lowest value of is defined as a common node, and the W corresponding to the core node and the common node is i f Values ​​are defined as significant nodes.

[0102] By directly associating the role definition and task allocation of the node with the hierarchical model mentioned above, the role and task allocation of each node are directly dependent on the overall system goals and importance assessment criteria. This ensures that each node can assume appropriate responsibilities based on its respective strengths (such as computing power, data processing capabilities, etc.) while meeting the overall goals of security, reliability, and efficiency. This ensures that the task allocation of the node matches the overall system goals and the actual capabilities of the node, thereby maximizing the realization of the overall goal of the system.

[0103] S4, divide the encrypted data, select a strong hash function to perform hash operation to generate a data block hash value, use the attribute-based encryption algorithm to generate an initial ciphertext, perform hash operation again to generate an initial ciphertext hash value, generate a short fingerprint, and re-encrypt the initial ciphertext based on a proxy re-encryption method;

[0104] Preferably, the encrypted data is divided, a strong hash function is selected to perform hash operation to generate a data block hash value, an attribute-based encryption algorithm is used to generate an initial ciphertext, a hash operation is performed again to generate an initial ciphertext hash value, and a short fingerprint is generated, and the initial ciphertext is re-encrypted based on a proxy re-encryption method, including:

[0105] Based on the node role definition, determine the attribute set that the node role definition needs to use, including user roles, such as administrator, data scientist, departments, such as R&D department, finance department, and access levels, such as confidential and highly confidential;

[0106] The encrypted data is divided into m data blocks before encryption and a strong hash function is selected for hash operation to generate a hash value H2(m i ), expressed as:

[0107] H2(m i )=Hash(m i );

[0108] Among them, H2(m i ) represents the hash value of the i-th data block, m i represents the i-th data block, and Hash represents the hash function used to generate the hash value;

[0109] For each data block, the key generation algorithm in the attribute-based encryption algorithm is used to generate a public key PK and multiple private keys SK. Based on the access policy defined by the node role, the public key PK is used to encrypt the data and generate the initial ciphertext CT. i ;

[0110] The strong hash function is used to perform hash operation again, and a fixed-length hash value H3 (CT i ), combined with H2(m i) Use XOR operation on two hash values ​​to generate a short fingerprint FP i , expressed as:

[0111]

[0112] Based on the proxy re-encryption method, the proxy re-encryption key rk is generated according to the node role definition and sent to the proxy server. The proxy server uses the re-encryption key rk and the initial ciphertext to re-encrypt and generate the re-ciphertext.

[0113] By combining attribute-based encryption (ABE) with proxy re-encryption (PRE) technology for data encryption and access control, the problem of flexibility and security being difficult to balance in traditional encryption methods is solved. By re-encrypting the data of attribute-based encryption (ABE) with PRE technology, the system can adjust access permissions without re-encrypting the data. A multi-level encryption strategy is introduced in the encryption process. Combining ABE and PRE, users at different levels are allowed to access different parts of the same data set under different permissions, achieving precise permission control, significantly improving the operability and response speed of the system, reducing the system's computing burden and operation and maintenance complexity, and ensuring the security and controllability of data in a distributed environment. The short fingerprint calculated by the hash function will reflect the slight changes in the original data and ciphertext, thereby ensuring uniqueness and improving data security. At the same time, the use of short fingerprints provides a basis for verification before and after data use, and can achieve fast verification. The short fingerprint generation process is integrated into each link of data encryption, enabling the system to perform fast integrity checks before and after encryption, during transmission, and during decryption. A dual confidentiality mechanism is implemented through data encryption and hash calculation verification, further improving data security.

[0114] S5, uses short fingerprints to verify data transmission and integrity, and generates log data for off-site file storage;

[0115] Preferably, using a short fingerprint for data transmission verification and integrity verification includes,

[0116] Generate short fingerprint FP i The data blocks are then stored and the corresponding short fingerprints FP' are calculated for each data block. i , and FP' i With FP i Compare, if FP' i With FP i If they are equal, the transmission verification is considered to have passed;

[0117] At the same time, when the receiver requests access to data, it decrypts the re-encrypted ciphertext according to the attribute set and permissions of the requesting user and the corresponding private key rk, and calculates the short fingerprint FP of the decrypted data block at the same time. i , and FP" i With FP i Compare, if FP i With FP i If they are equal, the integrity verification is considered to have passed.

[0118] Through integrity verification after decryption and verification during transmission, the system can ensure the integrity of data at all stages of the data life cycle (encryption, storage, transmission and decryption). Through the generation and verification mechanism of short fingerprints, the integrity of the data is guaranteed, which can effectively prevent the data from being affected by man-in-the-middle attacks, data tampering or other malicious behaviors on the transmission path or in storage, thereby improving the overall anti-attack capability of the system and enhancing the security of data in the entire system. Through the verification mechanism after decryption, the system can quickly detect data corruption or loss problems that may occur during transmission or storage, and take timely measures to prevent the further use of the damaged data. By combining attribute-based encryption (ABE) and proxy re-encryption (PRE) technology, the system can dynamically adjust data access rights without sacrificing data security, thereby achieving the effect of security verification and retaining the data security of data transmission and usage environment.

[0119] Further, log data is generated for off-site file storage, including,

[0120] Generate corresponding log data according to the data encryption, decryption, verification and transmission operations, and record and store them as log files. The data recorded in the log files for the operations include the operation type, operation timestamp, operation initiator, operation result, verification hash value and node information data;

[0121] After the log is generated, the TLS / SSL protocol is used to encrypt the log transmission and asynchronously copy it to the off-site storage server to realize off-site log file storage.

[0122] By recording detailed logs of each data encryption, decryption, verification and transmission operation, the system can provide a complete traceability path for each operation. By using TLS / SSL protocol to encrypt log transmission, the system ensures the security of logs during transmission and prevents log data from being intercepted, tampered with or leaked during network transmission. By asynchronously copying log files to off-site storage servers, the security of log data is improved, preventing data loss that makes it impossible to trace and analyze data, allowing auditors to access and analyze operation logs in a secure environment, thereby improving audit efficiency and accuracy.

[0123] Example 2, reference Figure 2 , which is the second embodiment of the present invention, and which is different from the previous embodiment, provides a system for a data storage security management method, including:

[0124] Trust management module: selects cloud data centers and builds a centralized trust management system to manage user trust credentials and role definitions of network nodes;

[0125] Network node weight evaluation module, which evaluates the importance of network nodes and assigns node tasks;

[0126] The data encryption processing module encrypts and hashes the data to generate a data block hash value and a short fingerprint;

[0127] The data verification module is responsible for the secure transmission and integrity verification of data to ensure the security of data during transmission;

[0128] The log storage module generates operation logs and stores them securely to ensure the traceability of system operations and the security of logs.

[0129] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0130] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0131] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0132] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0133] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data storage security management method, characterized in that: include, Select a cloud data center and build a centralized trust management system to distribute and regularly update user trust credentials; Based on the collected data items of network nodes, the main components are extracted according to PCA and the importance weights of network nodes are determined by FCM algorithm. The fuzzy judgment matrix is ​​constructed to calculate the fuzzy weight vector, and the defuzzification is performed by the centroid method to calculate the final weight of the network nodes. Allocate the number of trust credentials that each network node needs to manage and define the node role; Divide the encrypted data, select a strong hash function to perform hash operation to generate a data block hash value, use the attribute-based encryption algorithm to generate the initial ciphertext, perform hash operation again to generate the initial ciphertext hash value, generate a short fingerprint, and re-encrypt the initial ciphertext based on the proxy re-encryption method; Use short fingerprints to verify data transmission and integrity, and generate log data for off-site file storage.

2. The data storage security management method according to claim 1, characterized in that: The cloud data center is selected and a centralized trust management system is constructed to store the user's trust credentials in a distributed manner and update them regularly, including: Select independent network nodes based on cloud data centers, manage user trust credentials and perform trust assessment tasks through the decentralized trust management system DTMS; The PBFT consensus algorithm is used to identify and confirm the data consistency and security between different nodes, and the node data is securely transmitted through the encrypted communication protocol TLS; The user's trust credentials are stored in a distributed manner, and the credential data is encrypted and stored using a hash encryption algorithm; Network nodes regularly update and back up the trust credential data they manage.

3. The data storage security management method according to claim 2, characterized in that: The collected data items based on the network nodes extract the main components according to PCA and determine the importance weights corresponding to the network nodes through the FCM algorithm, construct a fuzzy judgment matrix to calculate the fuzzy weight vector, perform defuzzification processing through the centroid method, and calculate the final weights of the network nodes. include, Construct a hierarchical model of importance weights for network nodes, where the top level is the overall goal of the system and the secondary level is the importance evaluation criteria for network nodes; Based on the collected data items of network nodes, data collection and standardization are carried out; Calculate the covariance matrix for each data of the importance assessment standard data; Perform eigenvalue decomposition on the covariance matrix to obtain the eigenvalue and eigenvector corresponding to the i-th data item; Calculate the proportion of the sum of the first k eigenvalues ​​to the sum of all eigenvalues ​​as the contribution rate, and take the eigenvalues ​​and eigenvectors of the first k data items with the 80th percentile contribution rate as the main components of the selection; According to the main components extracted by PCA, the network nodes are clustered by fuzzy C-means using the FCM algorithm, where the number of cluster centers is determined by the number of main components, and the distance between each network node and the characteristic vector of the cluster center is calculated based on the cluster center to calculate the membership. The objective function is defined by the FCM algorithm, and the cluster center and membership are iteratively updated to minimize the objective function, which is expressed as: Among them, M represents the total number of samples, C represents the number of cluster centers, represents the membership degree of sample i to cluster center h, m represents the fuzzy index, xi represents the eigenvector of sample i, ch represents the eigenvector of cluster center h, ck represents the eigenvector of cluster center k, and Jm represents the objective function value; Update the cluster center by weighted averaging the membership of each network node in the cluster; The importance weight corresponding to the network node is obtained by multiplying the membership degree of each network node calculated according to the minimization objective function with the eigenvalue extracted from the main component; Based on the weights corresponding to the network nodes as the basis of importance, a fuzzy judgment matrix is ​​constructed matrix including the minimum value of the comparison of the importance of network node i and network node j, the median value of the comparison of the importance of network node i and network node j, and the maximum value of the comparison of the importance of network node i and network node j; The constructed fuzzy judgment matrix Calculate the fuzzy weight vector to obtain the fuzzy weight vector of each network node; The fuzzy weight vector is defuzzified by the centroid method to calculate the final weight of the network node i.

4. The data storage security management method according to claim 3, characterized in that: The allocation of the number of trust credentials required to be managed by each network node and the definition of node roles include: Normalize based on the final calculated weights and allocate the number of trust credentials that each network node needs to manage proportionally; At the same time, the node roles are defined based on the hierarchical model. The highest value of Wif is defined as the core node, the lowest value of Wif is defined as the ordinary node, and the Wif value between the core node and the ordinary node is defined as the important node.

5. The data storage security management method according to claim 4, characterized in that: The encrypted data is divided, a strong hash function is selected to perform hash operation to generate a data block hash value, an attribute-based encryption algorithm is used to generate an initial ciphertext, a hash operation is performed again to generate an initial ciphertext hash value, and a short fingerprint is generated, and the initial ciphertext is re-encrypted based on a proxy re-encryption method, including: Based on the node role definition, determine the attribute set required for the node role definition, including user role, department, and access level; The encrypted data is divided into m data blocks before encryption and a strong hash function is selected for hash operation to generate a hash value H2(m i ); For each data block, the key generation algorithm in the attribute-based encryption algorithm is used to generate a public key PK and multiple private keys SK. Based on the access policy defined by the node role, the public key PK is used to encrypt the data and generate the initial ciphertext CTi. The strong hash function is used to perform hash operation again, and a fixed-length hash value H3 (CT i ), combined with H2(m i ) Use XOR operation on two hash values ​​to generate a short fingerprint FP i , expressed as: Based on the proxy re-encryption method, the proxy re-encryption key rk is generated according to the node role definition and sent to the proxy server. The proxy server uses the re-encryption key rk and the initial ciphertext to re-encrypt and generate the re-ciphertext.

6. The data storage security management method according to claim 5, characterized in that: The use of short fingerprints for data transmission verification and integrity verification includes: After generating the short fingerprint FPi, the data block is stored, the corresponding short fingerprint FP'i is calculated for each data block, and FP'i is compared with FPi. If FP'i is equal to FPi, it is judged that the transmission verification is passed; At the same time, when the recipient requests access to data, it decrypts the re-encrypted ciphertext after the proxy is re-encrypted according to the attribute set and permissions of the requesting user and the corresponding private key rk. At the same time, it calculates the short fingerprint FP"i of the decrypted data block and compares FP"i with FPi. If FP"i is equal to FPi, it is judged that the integrity verification has passed.

7. The data storage security management method according to claim 6, characterized in that: The generating log data for off-site file storage includes: Generate corresponding log data according to the data encryption, decryption, verification and transmission operations, and record and store them as log files. The data recorded in the log files for the operations include the operation type, operation timestamp, operation initiator, operation result, verification hash value and node information data; After the log is generated, the TLS / SSL protocol is used to encrypt the log transmission and asynchronously copy it to the off-site storage server to realize off-site log file storage.

8. A system based on the data storage security management method according to any one of claims 1 to 7, characterized in that: include, Trust management module: selects cloud data centers and builds a centralized trust management system to manage user trust credentials and role definitions of network nodes; Network node weight evaluation module, which evaluates the importance of network nodes and assigns node tasks; The data encryption processing module encrypts and hashes the data to generate a data block hash value and a short fingerprint; The data verification module is responsible for the secure transmission and integrity verification of data to ensure the security of data during transmission; The log storage module generates operation logs and stores them securely to ensure the traceability of system operations and the security of logs.

9. A computer device comprising: A memory and a processor; the memory stores a computer program, wherein the processor implements the steps of the data storage security management method described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the data storage security management method described in any one of claims 1 to 7 are implemented.

Images