Data storage method for database security audit data

Abstract

The invention relates to the technical field of data security and storage, and discloses a data storage method for database security audit data, comprising the following steps: preprocessing security audit data in a database; the security audit data is encrypted by adopting a homomorphic encryption technology, and the homomorphic encryption technology supports execution of arithmetic operation of addition and multiplication on the encrypted data and can execute query operation on the encrypted data; carrying out compression optimization storage on the encrypted data; and managing the user permission according to the access control strategy. According to the method, a homomorphic encryption technology is adopted, direct calculation and analysis are supported in a data encryption state, potential safety hazards in a decryption process are solved, data privacy protection and processing safety are improved, and ciphertext query efficiency is improved; real-time monitoring is realized in combination with dynamic authority management; low-density parity check coding is adopted, encrypted data storage and fault-tolerant recovery are optimized, and the problems of storage resource waste and insufficient flexibility are solved.

Description

Technical Field

[0001] The present invention relates to the field of data security and storage technology, and in particular to a data storage method for database security audit data. Background Art

[0002] With the rapid development of information technology and the increasing demand for data processing, databases have become the core tool for storing and managing massive amounts of data. However, traditional databases have many technical limitations when processing security-related data, especially the difficulty in balancing data privacy protection and computing efficiency. In the existing technology, database security audit mainly relies on the following two processing methods: one is through direct analysis of plain text data, and the other is to encrypt and then decrypt the data. Both methods have exposed obvious shortcomings in practical applications; First, it is difficult to achieve both data privacy protection and computing efficiency: although plaintext storage and operation have the convenience of direct processing, the data exists in plaintext and is extremely vulnerable to internal or external attacks. The security risks of plaintext operation are not only reflected in the risk of data leakage, but also in the lack of protection mechanism for user privacy, which cannot meet the requirements of emerging privacy protection regulations (such as GDPR, etc.), and the processing method of encryption and decryption brings efficiency bottlenecks; Secondly, most traditional homomorphic encryption technologies support limited arithmetic operations (such as simple addition or multiplication), but in actual scenarios, database query and analysis usually require more complex computing support. For example, complex aggregation operations (such as summation, average calculation) and conditional screening cannot be completed directly on ciphertext. The computational efficiency of some homomorphic encryption schemes is low. When multi-dimensional queries or complex analyses are performed on large-scale data, the operation delay increases significantly, making it difficult to meet real-time processing requirements. The computing power and efficiency of homomorphic encryption technology have not yet met actual needs and cannot support complex queries and multi-dimensional analysis. Furthermore, the high cost of data storage and the lack of an effective fault-tolerant recovery mechanism restrict the application of large-scale data. In existing encrypted data storage solutions, it is difficult to balance data integrity and fault tolerance. Once data is lost or damaged, the existing technology lacks an efficient recovery mechanism, making it difficult to ensure data integrity. There is also a lack of flexible storage adjustment mechanisms, such as dynamic adjustment of block size and encoding parameters, to meet the storage needs of different scenarios. Finally, in the existing technology, when users perform abnormal operations, the security mechanism is often not triggered in real time. Due to the lag in audit log recording, it is difficult for the system to prevent malicious operations in the first place, resulting in an increased risk of data leakage or damage. The access control is not flexible enough and cannot dynamically respond to changes in user permissions and abnormal behaviors; Therefore, a data storage method for database security audit data is proposed to solve the above problems. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention provides a data storage method for database security audit data, which solves the problems of difficult balance between data privacy protection and processing efficiency, limited computing functions of homomorphic encryption, low storage efficiency of encrypted data, lack of effective fault-tolerant recovery mechanism, and insufficient ability to handle abnormal behavior.

[0004] To achieve the above objectives, the present invention is implemented through the following technical solutions: a data storage method for database security audit data, comprising the following steps: Preprocess the security audit data in the database; The security audit data is encrypted using homomorphic encryption technology, which supports arithmetic operations of addition and multiplication on the encrypted data and can perform query operations on the encrypted data; Compress the encrypted data for optimized storage; Manage user rights according to access control policies, use role-based access control mechanisms combined with dynamic access control mechanisms to limit and manage user access to data, and ensure that data is only open to authorized users during storage and query; In the query operation, calculation and analysis of encrypted data are supported, and the query results are returned to the authorized user through the decryption process.

[0005] Preferably, the step of preprocessing the security audit data in the database specifically includes the following steps: Extract security audit data from the database; Format the extracted data; Fill in missing data using mean or median fill strategies; Remove redundant data; Sort the data according to timestamp; Standardize the formatted data.

[0006] Preferably, the encryption process adopts the Paillier encryption algorithm, and the formula of the Paillier encryption algorithm is: ; in, is the encrypted ciphertext; x is the plaintext data to be encrypted; g is the encryption base, which is one of the public key parameters of the system; r is a random number; n is the key parameter of the encryption algorithm; For the extended modulus.

[0007] Preferably, the step of compressing and optimizing the encrypted data for storage comprises the following steps: Divide the encrypted security audit data into multiple data blocks according to fixed size or data type; Generate a low-density parity check matrix for each data block, wherein the matrix is ​​a sparse matrix; Construct a parity check matrix so that each data block meets the check condition when stored; The data blocks meeting the verification condition are stored together with the corresponding verification matrix; Dynamically adjust the data segmentation size, the sparsity of the parity check matrix, and the compression ratio; When data recovery is required, the stored encrypted data is decoded and verified through the check matrix.

[0008] Preferably, the sparse matrix satisfies the following verification conditions: ; Wherein, H is a low-density parity check matrix; x is encrypted data, and 0 is a zero vector, which is used as a target vector of a check equation in low-density parity check coding.

[0009] Preferably, the step of managing user rights according to the access control policy includes the following sub-steps: Define user roles and their corresponding access rights, and grant different data access rights to each user; Role-based access control mechanism, which limits the scope of user access to stored data according to the predefined permissions of the user role; Monitor user behavior characteristics and dynamically adjust user permission levels; Perform dynamic permission adjustments in real time according to access control policies; When abnormal behavior or unauthorized operations occur, the access control security mechanism is triggered to automatically suspend or restrict the user's access rights and record audit logs.

[0010] Preferably, the query operation further includes the following sub-steps: Parse and format the query conditions submitted by the user to generate query expressions that meet the requirements of encrypted query operations; Preprocess the formatted query conditions and narrow the query scope through the index mechanism; Perform grouping operations on qualified data in an encrypted state and calculate addition, multiplication and aggregation results; Generates the grouped intermediate query results and further optimizes the calculation according to the user's query conditions in the encrypted state; The final query ciphertext result is decrypted and its integrity verified before being returned to the authorized user.

[0011] Preferably, the calculation and analysis of the encrypted data comprises the following steps: Receive user query requests, determine query conditions and generate corresponding query operations; Perform query operations on encrypted data, and directly calculate in the ciphertext state through homomorphic encryption technology, supporting addition, multiplication and aggregation calculations; Perform secondary calculations on query results and perform multi-dimensional analysis. All operations are completed in an encrypted state. Send the ciphertext calculation result to the decryption module, and use the predefined key to decrypt the query result; Return the decrypted result data to the authorized user.

[0012] Preferably, the data integrity and security in the storage process are achieved by: A unique integrity check code is added to each encrypted data block, and the check code is used to verify that the data has not been tampered with when the data is stored or queried; Generate security event logs for key operations in the storage and query process, recording user identity, operation time, data range, and operation results; Use multi-factor authentication for sensitive operations, requiring users to provide dynamic verification codes to confirm their operation permissions; Set data access thresholds. When the user query frequency or data volume exceeds the predefined security threshold, the security policy is triggered to suspend operations and send an alarm. The data encryption key is regularly replaced through the dynamic encryption key update mechanism to ensure the security of long-term stored data.

[0013] The present invention also provides a system for storing and querying database security audit data, comprising: The data preprocessing module is used to perform preliminary processing on the security audit data in the database to make the data meet the subsequent storage and computing requirements; The encryption module is used to perform homomorphic encryption on pre-processed data to ensure the privacy of data during storage and calculation; Data compression and storage module, used to compress and optimize the storage of encrypted data; Access control module, used to manage data access permissions to ensure that only authorized users can access sensitive data; The query and encrypted state calculation module is used to execute the user's query operation in the encrypted state and return the decryption result to the authorized user; Security monitoring module, used to ensure the security of data storage and query.

[0014] The present invention provides a data storage method for database security audit data. It has the following beneficial effects: 1. The present invention achieves the technical effect of directly performing calculations and analyses in a data encrypted state by adopting a homomorphic encryption technical solution. Compared with the technical solution in the prior art that relies on data processing after decryption, it solves the potential security risk that data may be stolen or leaked during the decryption process, which not only improves the data privacy protection capability, but also significantly improves the security of data processing.

[0015] 2. The present invention supports complex calculation operations such as addition, multiplication, and aggregate statistics on encrypted data, achieving the technical effect of quickly completing query and analysis in the encrypted state. Compared with the technical solutions in the prior art that cannot directly support encrypted multidimensional analysis, the problem of low query efficiency and high calculation complexity caused by limited ciphertext operations is solved, and the practicality of homomorphic encryption technology is enhanced.

[0016] 3. The present invention effectively realizes the refined management of query permissions by combining role-based access control with dynamic permission management mechanism, and achieves the technical effect that only authorized users can obtain query results. Compared with the technical solution in the prior art that only relies on static access control strategy, it solves the shortcomings that user permissions cannot be dynamically adjusted and abnormal behaviors cannot be monitored in real time, and improves the security and flexibility of data access.

[0017] 4. The present invention adopts a low-density parity check coding scheme in the compressed storage of encrypted data, achieving the technical effect of efficient storage and fault-tolerant recovery of encrypted data. Compared with the technical solution in the prior art that directly stores encrypted data and wastes storage space, it solves the problem of excessive storage resource occupation and insufficient flexibility of data during storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the method flow of the present invention; Figure 2 It is a system framework diagram of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings of the present invention specification to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Please refer to the attached Figure 1 The embodiment of the present invention provides a data storage method for database security audit data, comprising the following steps: S1. Preprocess the security audit data in the database; S2. Encrypt the security audit data using homomorphic encryption technology, where the homomorphic encryption technology supports arithmetic operations of addition and multiplication on the encrypted data and can perform query operations on the encrypted data; S3, compressing and optimizing the storage of the encrypted data; S4. Manage user rights according to access control policies, use role-based access control mechanisms combined with dynamic access control mechanisms to limit and manage user access to data, and ensure that data is only open to authorized users during storage and query; S5. In the query operation, calculation and analysis of encrypted data are supported, and the query results are returned to the authorized user through the decryption process.

[0021] Specifically, in the implementation process of the present invention, the database security audit data mainly comes from user operation logs, database system behavior records, abnormal behavior detection data and system performance monitoring data. These data may exist in unstructured, semi-structured or structured forms, and usually have the following characteristics: diverse field formats, inconsistent timestamps, many missing values, and a high proportion of redundant data and noise data.

[0022] Step S1 ensures the quality and standardization of data through multi-stage processing, including data extraction, formatting, missing value filling, redundant data removal, timestamp sorting and data standardization. In this embodiment, data extraction is the process of collecting security audit data from multiple data sources and aggregating them into the central processing module. The data source includes but is not limited to the audit log file of the database, the distributed log system, the application access log and the operating system monitoring record.

[0023] Specifically, the extraction process is usually implemented by calling a data interface. For example, for audit logs within a database, data that meets the conditions can be extracted through query statements and stored as an intermediate table; for distributed log systems, log data can be pushed to the central system in real time through APIs or message queue technology.

[0024] As an option, in real-time data processing scenarios, you can combine distributed collection technology to extract only the latest audit data generated through time windows. For example, set a time range parameter (such as the past 24 hours) to extract only data generated within this time range. This can reduce unnecessary storage and computing burdens.

[0025] It should be noted that the quality of data extraction directly affects the subsequent processing process. In some embodiments, in order to avoid data loss or abnormality due to incomplete or erroneous extraction operations, basic integrity checks can also be performed on the extracted data, such as checking the integrity of the fields and checking whether the timestamp format is legal.

[0026] In this embodiment, the missing value filling strategy selects an appropriate filling method according to the field type and context information.

[0027] For numeric fields, such as the execution time or number of executions of user operations, it is preferred to use mean filling or median filling methods. The specific formula is as follows: ; in, is the value of the i-th non-missing sample, and n is the number of non-missing samples; Represents all non-missing value samples The sum of .

[0028] The removal of redundant data is to reduce the storage and computing burden while ensuring the uniqueness of the data.

[0029] Specifically, data can be deduplicated by constructing a unique identifier. For example, for user operation records, a unique key value can be generated using the combination of [user+time+operation type]. If a duplicate key value is found, it is considered a redundant record.

[0030] In a possible implementation, redundancy can also be detected by calculating a hash value of a record. For example, a hash function is applied to each record, and if the hash value is repeated, it indicates that the record is repeated.

[0031] It should be noted that the redundancy definition in some scenarios needs to be adjusted according to the context. For example, although batch operation records have the same operation type, if the time is different, they may still need to be retained for analyzing batch behavior characteristics.

[0032] In this embodiment, the standardization process is intended to narrow the value range and reduce the imbalance of value distribution. For numeric fields, the following standardization formula is used: ; Where x is the original value, and are the minimum and maximum values ​​of the field, respectively. is the standardized value.

[0033] In some embodiments, for fields with long-tail distribution, a logarithmic transformation may be used to further compress the value range: ; Where x is the original value, is the value after logarithmic transformation; is the natural logarithm function.

[0034] For step S2, the present invention uses homomorphic encryption technology to encrypt the security audit data to achieve full-process encryption protection of the data during storage and calculation. Unlike traditional data encryption technology, homomorphic encryption technology allows arithmetic and logical operations to be performed directly in the ciphertext state, thereby supporting the query and calculation functions of encrypted data without exposing the original data. This technology is particularly suitable for security audit scenarios, which can effectively avoid the risk of data leakage while ensuring the flexibility of calculation and analysis.

[0035] It should be noted that the present invention selects the Paillier encryption algorithm as the core encryption method when adopting homomorphic encryption technology. The Paillier encryption algorithm is a public key encryption algorithm with additive homomorphism and scalar multiplication homomorphism, which can meet the operation requirements of database security audit data in the ciphertext state.

[0036] In this embodiment, the Paillier encryption algorithm is used to encrypt the security audit data. Specifically, the Paillier encryption algorithm is based on the additive homomorphism of large integers, and its encryption formula is as follows: ; in, is the encrypted ciphertext; x is the plaintext data to be encrypted; g is the encryption base, which is one of the public key parameters of the system; r is a random number; n is the key parameter of the encryption algorithm; For the extended modulus.

[0037] It should be noted that the additive homomorphism of the Paillier encryption algorithm is specifically reflected in the following two aspects: if two ciphertexts and Multiplying together, we can get the ciphertext of the addition result corresponding to the encrypted data, that is, ; in, and are two plaintext data to be encrypted; and They are and The encrypted ciphertext, It is an extended modulus, which is used to limit the range of encryption operation results.

[0038] If the ciphertext By operating with a constant power k, we can get the ciphertext of the scalar multiplication result corresponding to the encrypted data, that is, ; Where k is a scalar (constant); x is the plaintext data to be encrypted; is the encryption result of plaintext x.

[0039] As an option, the present invention enhances the randomness of the ciphertext by randomly generating r, thereby preventing an attacker from inferring the encrypted data by observing the ciphertext results of the same plaintext multiple times.

[0040] In some embodiments, the present invention also optimizes the key management scheme. Specifically: The server is responsible for generating a Paillier public-private key pair, where the public key is used for encryption operations and the private key is used for decryption operations; When each user performs a data query, the system dynamically assigns a temporary public key for the query session to achieve key isolation based on the query operation; The storage of private keys is protected by a hardware security module (HSM) to ensure that the keys cannot be illegally accessed.

[0041] It should be noted that the generation and distribution of keys follow strict encryption protocols, such as the Diffie-Hellman key exchange protocol, to ensure the security of the keys during transmission.

[0042] In a possible implementation of the present invention, the Paillier encryption algorithm is further applied in layers for data of different sensitivity levels: Highly sensitive data (such as user behavior logs) is encrypted using the Paillier algorithm with a longer key length (e.g., 2048 bits or higher) to provide higher security; Ordinary sensitive data (such as statistical indicators) use standard length keys (for example, 1024 bits) to improve encryption efficiency while ensuring security.

[0043] Exemplarily, for frequently accessed data (such as log records of the most recent day), the present invention supports using optimized encryption parameters for such data, such as reducing the complexity of random number generation to reduce the overhead of encryption calculations.

[0044] In some embodiments, the present invention also optimizes the computational performance of the Paillier encryption algorithm. For example: By pre-calculating the encryption base 、 , decomposing complex exponential operations into simple multiplication operations, thereby increasing encryption speed; Use multi-threading technology to parallelize the encryption process of batch data to meet the needs of high-throughput audit data encryption; Modulo space optimization technology is used to reduce the computational complexity of encryption and decryption through fast modular operation algorithms (such as Montgomery modular multiplication).

[0045] In some extended applications, the present invention also supports performing more complex operations in the ciphertext state through the Paillier encryption technology, such as: Aggregate calculation: perform sum operation on multiple records and return encrypted statistical results; Multi-dimensional analysis: Combined with the analysis function mentioned in step S5, weighted calculation of data in multiple dimensions is achieved.

[0046] Through the comprehensive application of the above-mentioned homomorphic encryption technology, the present invention can complete complex security audit data processing tasks without decrypting the data, while ensuring the privacy and security of the data.

[0047] Step S3 is an important part of the invention to realize the optimized storage of encrypted data. Its main goal is to improve the storage efficiency of data and realize the reliability verification of data while ensuring the security of data encryption. Based on the encrypted security audit data, the data is divided into blocks, verified and compressed for storage through the compression optimization technology of low-density parity check coding (LDPC), thereby effectively reducing the storage space occupied by encrypted data and providing technical support for subsequent data decoding and recovery.

[0048] In the specific implementation, the present invention fully considers the particularity of encrypted data and the protection requirements for encrypted data during compression and verification. As an important implementation method, the present invention combines the characteristics of LDPC coding and improves the efficiency and reliability of data storage through distributed processing and dynamic parameter adjustment.

[0049] In this embodiment, the compressed optimized storage of encrypted data includes multiple sub-steps, the core of which is to use low-density parity check coding to perform block processing and check compression on the data. Specifically, the storage process of encrypted data can be divided into the following stages: The encrypted security audit data is divided into multiple independent data blocks according to fixed size or field type. As an option, the size of the data block can be set to a fixed number of bytes (such as 512 bytes, 1024 bytes, etc.) to facilitate subsequent distributed storage.

[0050] It should be noted that, in some cases, the size of the data block can also be dynamically adjusted according to the specific characteristics of the encrypted data. For example: When the encrypted data contains large-scale log records, the data can be divided into blocks according to time intervals; For smaller data records, field-aligned block division can be used to avoid data redundancy.

[0051] Each data unit after block division carries a unique identifier to mark its logical position in the encrypted data set, which plays an important role in subsequent decoding and verification.

[0052] Construction of the parity check matrix. In this embodiment, a low-density parity check matrix (LDPC) is generated for each data block. The parity check matrix is ​​used to perform check encoding on the data block to ensure the integrity and reliability of the stored data. Specifically, the parity check matrix is ​​a sparse matrix, and its construction process meets the following conditions: ; Wherein, H represents a low-density parity check matrix, whose sparsity can be dynamically adjusted according to storage requirements, x is the encrypted data block, and 0 is a zero vector, which is used as the target vector of the check equation in the low-density parity check coding.

[0053] In the present invention, by constructing a parity check matrix H, a check condition is set for each data block x to ensure that it meets a specific storage integrity requirement. As an implementation method, the check condition may include the following: Each data block can satisfy the condition of target vector 0 under the action of parity check matrix; When part of the data block is lost, the lost data can be recovered by decoding through the check equation.

[0054] It should be noted that in actual operation, the setting of the verification condition can be combined with the error correction capability of the LDPC code. For example: For important audit data, stricter verification conditions can be set to improve fault tolerance; For data that takes up more storage but is relatively less important, the strength of the verification conditions can be reduced to save storage space.

[0055] After the parity check encoding is completed, the encrypted data block and the check matrix are compressed and stored together. Specifically, the compressed storage can be performed in the following ways: Store the data blocks in logical order and attach a check matrix as metadata; The check matrix and data blocks are further compressed using compression algorithms (such as Zstandard, LZ77, etc.).

[0056] It is understandable that special attention should be paid to the decompressibility of data and the reproducibility of verification during the compression and storage process. For example, in some embodiments, the verification matrix can be compressed and stored separately to facilitate fast retrieval and use.

[0057] In order to improve the flexibility of data storage, the present invention introduces a dynamic parameter adjustment mechanism in the compression storage stage. Specifically, the dynamically adjusted parameters include: Data block size: dynamically adjust the granularity of data blocks based on data characteristics and storage resources; Matrix sparsity: dynamically set the sparsity of the parity check matrix according to the check strength requirements; Compression ratio: Dynamically adjust the parameters of the compression algorithm according to the data type and storage efficiency requirements during compressed storage.

[0058] For example, when the system detects that storage resources are insufficient, the size of the data block or the sparsity of the matrix can be appropriately increased to reduce data redundancy and improve storage efficiency.

[0059] When the stored data needs to be restored, the present invention decodes and verifies the stored encrypted data through the parity check matrix. Specifically, data recovery includes the following steps: By parity check equation Verify stored data and locate lost or damaged data blocks; Recover the contents of lost data blocks based on LDPC decoding algorithm; Verify whether the restored data blocks meet the integrity requirements.

[0060] It should be noted that the decoding efficiency in the data recovery process is affected by the sparsity of the parity check matrix. In order to improve the decoding efficiency, an optimized LDPC decoding algorithm (such as the belief propagation algorithm) can be combined to achieve fast decoding.

[0061] For step S4, step S4 forms a security permission management system with both static and dynamic characteristics by combining the role-based access control mechanism (RBAC) and the dynamic access control strategy. Its core goal is to control and adjust the user's access to encrypted data in real time according to the user's role, behavior and system status, so as to ensure that the encrypted data is only accessed by authorized users during storage and query. As a technical means, the implementation of access control strategy can effectively prevent risks such as data abuse and leakage, while meeting high security and flexibility requirements.

[0062] It should be noted that the RBAC mechanism provides clear user role definition and static permission configuration for permission control, while the dynamic access control strategy further realizes real-time adjustment of permissions through analysis of user behavior and context. The technical implementation of the present invention inherits the above-mentioned classic access control method and further enhances the security and auditability of the system through mechanisms such as audit log recording and abnormal behavior detection.

[0063] In this embodiment, step S4 specifically includes the following implementation contents: First, user role definition and static permission allocation. In the implementation scheme of the present invention, user roles are predefined through the RBAC mechanism, and the scope of permissions of each role is clarified. As an option, user roles can be divided into administrators, auditors, and ordinary users. The permissions corresponding to different roles include but are not limited to the following: Administrators have read and write permissions for all data, including but not limited to querying and modifying data, adjusting system parameters, etc.; Auditors have read-only permissions and can only access audit-related data records; Ordinary users can only access audit data related to their own operations.

[0064] Specifically, in the permission allocation process, the binding relationship between roles and permissions is realized through a mapping matrix: ; Among them, P represents the permission allocation matrix, R represents the role matrix, and A represents the permission definition matrix. Through matrix operations, the user's permission set can be quickly generated.

[0065] Secondly, dynamic permission adjustment and abnormal behavior detection In order to cope with real-time changes in user behavior and system environment, the present invention introduces a dynamic access control strategy to adjust user permissions based on the following principles: User behavior feature monitoring: The system uses log analysis tools to record user operation behaviors, including query frequency, access patterns, etc.

[0066] Contextual information collection: Combined with environmental information such as access time and access location, the adaptability of user permissions is evaluated in real time.

[0067] Permission adjustment rules: For example, when the user's operation frequency exceeds the normal threshold, the system can automatically reduce their permission level to prevent malicious operations.

[0068] In a possible implementation, the dynamic permission adjustment rules can be implemented using a decision tree model. Exemplarily, the model rules are as follows: If the user's query frequency exceeds the set threshold, permission downgrade is triggered; If an abnormal change in a user's IP address is detected, their access rights will be suspended; If there are multiple attempts to access unauthorized data, the exception is logged and a security alarm is triggered.

[0069] It should be noted that all dynamic adjustments will be recorded in the audit log and reviewed by the system administrator.

[0070] Further security mechanisms and audit functions, in some embodiments, the present invention combines an abnormal behavior detection mechanism to trigger the access control security mechanism when an abnormal user operation behavior is detected. For example: Automatically suspend the user's current session and record the user's access request and the corresponding encrypted data block identifier; Send security alerts to administrators and lock related user accounts; Generate a complete audit report in the system background, including timestamp, abnormal behavior type and operation record.

[0071] To ensure the integrity of encrypted data, the present invention verifies the correctness of user operation data through a hash algorithm. For example, when a user submits a query request, the system calculates the hash value of the query request: ; Among them, Q represents the user query condition; is its corresponding hash value; A hash function is used to generate a unique identifier for a query condition, such as the commonly used SHA-256 or MD5 hash algorithm. Any tampering operation will cause the hash value to not match, thus triggering the security mechanism.

[0072] Extended implementation of access control,As a possible extension, the present invention can be combined with attribute-based access control (ABAC) mechanism to further enhance the flexibility of the system.,Specifically, the user's permissions are not only determined by their role, but can also be adjusted in real time according to the dynamic attributes of the operation scenario (such as time, location, and device type).

[0073] In an exemplary implementation, the ABAC policy may be defined by a logical expression: ; in, For user permissions, is a set of user roles, and C is a set of dynamic contexts (such as time, location, and device type).

[0074] For example, a permission rule could be defined as: Only allow users to access data during working hours (e.g. 8:00-18:00); Prevent users from accessing the system from unauthorized devices.

[0075] It should be noted that the above-mentioned extended implementation is not limited to the current technical solution, but is a possible extension of the present invention, and the specific implementation can be flexibly adjusted according to the application scenario.

[0076] The present invention provides an efficient encrypted computing and analysis method in the process of storing and managing encrypted data, which can complete query and calculation while the data is always in an encrypted state, ensuring data privacy and security. Compared with the prior art, the present invention can not only support basic encrypted computing operations, but also realize complex aggregation analysis and multidimensional query, ensuring the practicality of encrypted data. In the specific implementation, the present invention is combined with homomorphic encryption technology, utilizing its addition and multiplication homomorphic characteristics, to effectively support various types of data analysis.

[0077] Step S5 of the present invention ensures the integrity and security of the query operation through the technical process of parsing the user request, executing the encrypted operation and decrypting the result. The technical implementation is described in detail below in conjunction with the embodiments.

[0078] In this embodiment, the calculation and analysis of encrypted data mainly includes the following key links: First, when a user issues a query request, the system generates the corresponding query operation by parsing the query conditions. For example, a user can submit a request to "count the frequency of operations within a specific time period", and the system will parse it into timestamp range filtering and aggregation statistics operations.

[0079] It should be noted that all query operations are performed based on encrypted data. Specifically, the homomorphic encryption technology used supports arithmetic operations directly on ciphertext data, including addition, multiplication, and weighted calculations. In one possible implementation, the Paillier homomorphic encryption algorithm is selected, and its core formula is: ; ; in, Represents ciphertext, and are two plaintext data to be encrypted, x represents the plaintext data, n is the modulus, and k is the scalar value.

[0080] From the above formula, it can be understood that the system can directly complete addition, multiplication and linear combination calculations in an encrypted state, thereby meeting various query requirements.

[0081] When performing query operations, the present invention also supports more complex aggregate analysis. For example, when a user needs to perform group statistics on a certain field, the system will generate a logical expression for the encrypted group operation. As an option, the group statistics operation first divides the data into several time intervals based on the timestamp field, and performs homomorphic addition on the encrypted data in each interval to obtain the statistical results of each time period.

[0082] It should be noted that in addition to simple addition and multiplication operations, the present invention also supports multi-dimensional cross-analysis in an encrypted state. Specifically, in some embodiments, the encrypted data can be filtered and aggregated by decomposing the query conditions into multiple sub-conditions. For example, a user can query "the operation frequency of a specific user role within a certain period of time", and the system will generate the following query steps: First, filter the data based on the timestamp field; Then perform classification aggregation operations based on the user role field; Finally, the screening results of the two conditions are superimposed to complete multi-dimensional statistics.

[0083] All the above query operations are performed in an encrypted state to ensure that the analysis task can be completed without decrypting the data.

[0084] The present invention also includes a decryption process for the query result. In an exemplary implementation, the calculation result is passed to the decryption module in a ciphertext state. The decryption module decrypts the query result into plaintext data using a predefined private key, and the formula is as follows: ; in, is the plaintext decryption result, indicating the decrypted data; c is the encryption result; d is the private key parameter; n is the modulus; It is the extended modulus. It should be noted that only authorized users have the private key, thus ensuring the security of the decryption process.

[0085] After decryption is complete, the system returns the plaintext query results to the authorized user. As a possible optimization method, the query results can be further filtered or formatted before being returned to ensure data integrity and readability. For example, the system can sort the results according to the field order specified by the user and attach statistical summary information.

[0086] In some extended embodiments, the technical solution of the present invention also supports more complex analysis scenarios. For example, when multi-level statistics need to be performed, the preliminary query results can be used as input, secondary encryption can be performed, and further encrypted state calculations can be performed. For example, a user can query "the average number of operations of different roles in different time periods". At this time, the system will: First, perform preliminary encryption state group statistics based on the time and role fields; Then perform homomorphic division on each set of data and calculate the average; Finally, the ciphertext average is decrypted and returned to the user.

[0087] It can be understood that, through the flexible combination of query conditions and computing logic, the present invention can support diverse data analysis needs while taking into account data privacy and computing efficiency.

[0088] Refer to the attached Figure 2 The present invention also provides a system for storing and querying database security audit data, comprising: The data preprocessing module is used to perform preliminary processing on the security audit data in the database to make the data meet the subsequent storage and computing requirements; The encryption module is used to perform homomorphic encryption on pre-processed data to ensure the privacy of data during storage and calculation; Data compression and storage module, used to compress and optimize the storage of encrypted data; Access control module, used to manage data access permissions to ensure that only authorized users can access sensitive data; The query and encrypted state calculation module is used to execute the user's query operation in the encrypted state and return the decryption result to the authorized user; Security monitoring module, used to ensure the security of data storage and query.

[0089] The role of the data preprocessing module is to ensure that the original security audit data has been cleaned and optimized before entering the encryption process, thereby improving the efficiency and accuracy of subsequent storage and calculation, eliminating data redundancy and inconsistency problems, and providing basic support for data encryption and query.

[0090] The role of the encryption module is to provide core data encryption functions to ensure that data will not be leaked or tampered with during storage and transmission. Homomorphic encryption technology is used to implement ciphertext calculations and support subsequent queries and analysis.

[0091] The function of the data compression and storage module is to compress and store data and reduce storage space while ensuring data integrity. The parity check matrix mechanism is used to improve data reliability and ensure rapid recovery in the event of data loss.

[0092] The role of the access control module is to ensure that sensitive data is only accessible to authorized users through access rights management mechanisms. Dynamically adjust user permissions, respond to access behaviors in real time, and enhance the security and flexibility of the system.

[0093] The query and encrypted computing module supports data query and computing directly in an encrypted state to avoid exposure of plain text. It meets users' complex query needs through efficient computing and parsing mechanisms.

[0094] The function of the security monitoring module is to provide an additional security protection mechanism to monitor and record system operations in real time, thereby improving data integrity and operation traceability.

[0095] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data storage method for database security audit data, characterized in that: The following steps are involved: Preprocess the security audit data in the database; The security audit data is encrypted using homomorphic encryption technology, which supports arithmetic operations of addition and multiplication on the encrypted data and can perform query operations on the encrypted data; Compress the encrypted data for optimized storage; Manage user rights according to access control policies, use role-based access control mechanisms combined with dynamic access control mechanisms to limit and manage user access to data, and ensure that data is only open to authorized users during storage and query; In the query operation, calculation and analysis of encrypted data are supported, and the query results are returned to the authorized user through the decryption process.

2. The data storage method for database security audit data according to claim 1, characterized in that: The step of preprocessing the security audit data in the database specifically includes the following steps: Extract security audit data from the database; Format the extracted data; Fill in missing data using mean or median fill strategies; Remove redundant data; Sort the data according to timestamp; Standardize the formatted data.

3. The data storage method for database security audit data according to claim 1, characterized in that: The encryption process adopts the Paillier encryption algorithm, and the formula of the Paillier encryption algorithm is: ； in, is the encrypted ciphertext; x is the plaintext data to be encrypted; g is the encryption base, which is one of the public key parameters of the system; r is a random number; n is the key parameter of the encryption algorithm; For the extended modulus.

4. The data storage method for database security audit data according to claim 1, characterized in that: The step of compressing and optimizing the encrypted data for storage comprises the following steps: Divide the encrypted security audit data into multiple data blocks according to fixed size or data type; Generate a low-density parity check matrix for each data block, wherein the matrix is ​​a sparse matrix; Construct a parity check matrix so that each data block meets the check condition when stored; The data blocks meeting the verification condition are stored together with the corresponding verification matrix; Dynamically adjust the data segmentation size, the sparsity of the parity check matrix, and the compression ratio; When data recovery is required, the stored encrypted data is decoded and verified through the check matrix.

5. The data storage method for database security audit data according to claim 4 is characterized in that: The sparse matrix satisfies the following verification conditions: ； Wherein, H is a low-density parity check matrix; x is encrypted data, and 0 is a zero vector, which is used as a target vector of a check equation in low-density parity check coding.

6. The data storage method for database security audit data according to claim 1, characterized in that: The step of managing user rights according to the access control policy includes the following sub-steps: Define user roles and their corresponding access rights, and grant different data access rights to each user; Role-based access control mechanism, which limits the scope of user access to stored data according to the predefined permissions of the user role; Monitor user behavior characteristics and dynamically adjust user permission levels; Perform dynamic permission adjustments in real time according to access control policies; When abnormal behavior or unauthorized operations occur, the access control security mechanism is triggered to automatically suspend or restrict the user's access rights and record audit logs.

7. The data storage method for database security audit data according to claim 1, characterized in that: The query operation further includes the following sub-steps: Parse and format the query conditions submitted by the user to generate query expressions that meet the requirements of encrypted query operations; Preprocess the formatted query conditions and narrow the query scope through the index mechanism; Perform grouping operations on qualified data in an encrypted state and calculate addition, multiplication and aggregation results; Generates the grouped intermediate query results and further optimizes the calculation according to the user's query conditions in the encrypted state; The final query ciphertext result is decrypted and its integrity verified before being returned to the authorized user.

8. The data storage method for database security audit data according to claim 1, characterized in that: The calculation and analysis of the encrypted data includes the following steps: Receive user query requests, determine query conditions and generate corresponding query operations; Perform query operations on encrypted data, and directly calculate in the ciphertext state through homomorphic encryption technology, supporting addition, multiplication and aggregation calculations; Perform secondary calculations on query results and perform multi-dimensional analysis. All operations are completed in an encrypted state. Send the ciphertext calculation result to the decryption module, and use the predefined key to decrypt the query result; Return the decrypted result data to the authorized user.

9. The data storage method for database security audit data according to claim 1, characterized in that: The data integrity and security in the storage process are achieved in the following ways: A unique integrity check code is added to each encrypted data block, and the check code is used to verify that the data has not been tampered with when the data is stored or queried; Generate security event logs for key operations in the storage and query process, recording user identity, operation time, data range, and operation results; Use multi-factor authentication for sensitive operations, requiring users to provide dynamic verification codes to confirm their operation permissions; Set data access thresholds. When the user query frequency or data volume exceeds the predefined security threshold, the security policy is triggered to suspend operations and send an alarm. The data encryption key is regularly replaced through the dynamic encryption key update mechanism to ensure the security of long-term stored data.

10. A system for storing and querying database security audit data, applied to the data storage method for database security audit data according to any one of claims 1 to 9, characterized in that: include: The data preprocessing module is used to perform preliminary processing on the security audit data in the database to make the data meet the subsequent storage and computing requirements; The encryption module is used to perform homomorphic encryption on pre-processed data to ensure the privacy of data during storage and calculation; Data compression and storage module, used to compress and optimize the storage of encrypted data; Access control module, used to manage data access permissions to ensure that only authorized users can access sensitive data; The query and encrypted state calculation module is used to execute the user's query operation in the encrypted state and return the decryption result to the authorized user; Security monitoring module, used to ensure the security of data storage and query.

Images