Cloud computing operation and maintenance safety management and auditing system

Abstract

The invention belongs to the technical field of network data security, and discloses a cloud computing operation and maintenance security management and auditing system. Comprising the steps of collecting cloud computing operation and maintenance data; preprocessing the cloud computing operation and maintenance data to obtain preprocessed operation and maintenance data; encrypting the preprocessed operation and maintenance data to obtain final encrypted operation and maintenance data block matrixes, and collecting all the final encrypted operation and maintenance data block matrixes to obtain encrypted operation and maintenance data; acquiring an original auditing code of the final encrypted operation and maintenance data block matrix, interacting the encrypted operation and maintenance data, and auditing the interacted encrypted operation and maintenance data according to the original auditing code; the security of the cloud computing operation and maintenance data is further improved, whether the encrypted operation and maintenance data after interaction is tampered or not is found in time, the tampered position is obtained, and the security of the encrypted operation and maintenance data after interaction is further improved.

Description

Technical Field

[0001] The present invention relates to the field of network data security technology, and more specifically, to a cloud computing operation and maintenance security management and auditing system. Background Art

[0002] The patent application with the publication number CN118860800A discloses an operation and maintenance management system based on cloud computing services, which belongs to the field of operation and maintenance management technology. It includes a resource management module connected by wireless communication, a monitoring and alarm module, a fault diagnosis module, a performance optimization module and a security management module; the resource management module is configured to uniformly manage cloud computing resources, and the monitoring and alarm module is configured to monitor the performance indicators of cloud computing resources in real time and issue alarms in time when abnormalities occur. The present invention can effectively integrate data scattered in different cloud services and applications by establishing a unified resource management module. The resource management module realizes the full life cycle management of resources through the unified management of computing, storage and network resources, improves resource utilization and reduces operating costs. The performance indicators of cloud computing resources are monitored in real time through the monitoring and alarm module, and customized monitoring thresholds and alarm rules are supported to ensure the stability and reliability of the system.

[0003] However, in the process of collecting cloud computing operation and maintenance data, the data volume is large, and abnormal operation and maintenance data is prone to appear, which will affect subsequent data interactions. Traditional data encryption is easy to be cracked, thereby reducing the security of cloud computing operation and maintenance data. In the process of encrypted operation and maintenance data interaction, the encrypted operation and maintenance data may be tampered with. If the tampered encrypted operation and maintenance data cannot be discovered in time, the security of the encrypted operation and maintenance data after the interaction will be greatly reduced.

[0004] In view of this, the present invention proposes a cloud computing operation and maintenance security management and audit system to solve the above problems. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a cloud computing operation and maintenance security management and audit system, comprising:

[0006] Data collection module, used to collect cloud computing operation and maintenance data;

[0007] A data preprocessing module is used to preprocess cloud computing operation and maintenance data to obtain preprocessed operation and maintenance data;

[0008] A data encryption module is used to encrypt the pre-processed operation and maintenance data to obtain the final encrypted operation and maintenance data block matrix, and to collect all the final encrypted operation and maintenance data block matrices to obtain the encrypted operation and maintenance data;

[0009] The interactive audit module is used to obtain the original audit code of the final encrypted operation and maintenance data block matrix, and to interact with the encrypted operation and maintenance data, and to audit the encrypted operation and maintenance data after interaction according to the original audit code;

[0010] The modules are connected to each other via wired and / or wireless means.

[0011] Furthermore, the cloud computing operation and maintenance data includes basic resource data, service operation data, user operation behavior data and security alarm data;

[0012] The data categories included in the basic resource data are server information data, virtualization resource data, storage data and network data; the data categories included in the service operation data are application service indicator data and log data; the data categories included in the user operation behavior data are user login data, operation record data and permission change data; the data categories included in the security alarm data are intrusion detection data, real-time alarm data and historical event data.

[0013] Furthermore, the method of preprocessing the cloud computing operation and maintenance data to obtain the preprocessed operation and maintenance data includes:

[0014] Determine whether there is abnormal operation and maintenance data in the cloud computing operation and maintenance data. If there is abnormal operation and maintenance data, remove the abnormal operation and maintenance data in the cloud computing operation and maintenance data, and use the interpolation method to fill the abnormal operation and maintenance data in the removed cloud computing operation and maintenance data to obtain pre-processed operation and maintenance data. If there is no abnormal operation and maintenance data, record the cloud computing operation and maintenance data as pre-processed operation and maintenance data.

[0015] The process of determining whether there is abnormal operation and maintenance data in cloud computing operation and maintenance data includes:

[0016] Step A1: Randomly select a data category to build an isolation tree, randomly select a data in this data category as a cutting point, and divide all the data in p data categories into two parts according to the cutting point, that is, the data less than or equal to the cutting point is taken as one part, and the data greater than the cutting point is taken as the other part, and the left subtree and the right subtree are constructed respectively. Repeat recursively for the nodes of each subtree until the number of data in the node is less than or equal to 1, and stop. p is the number of data categories;

[0017] Step A2: Repeat step A1 to construct p-1 isolation trees, obtain the sum of the scores of the path lengths of each data in all isolation trees, and obtain the alienation coefficient of each data according to the sum of the scores of the path lengths: SY

[0018]

[0019] Among them, i is the index of all data in p data categories, SY(i) is the alienation coefficient of the i-th data, PF(i) is the total score of the path length of the i-th data in all isolation trees, n is the number of all data in p data categories, and L(n) is the theoretical expected value of the path length.

[0020] Step A3: Preset an alienation coefficient threshold SY. When the alienation coefficient of the data is greater than or equal to the alienation coefficient threshold SY, it is determined as abnormal operation and maintenance data; otherwise, it is determined as normal operation and maintenance data.

[0021] Furthermore, the method for obtaining the total score of the path length of each data in all isolation trees includes:

[0022] Set a path length threshold range (Lf0, Lf1) and path length scores f1, f2, and f3. f1, f2, and f3 are all positive numbers, and f1 < f2 < f3. Obtain the path length score f r (i) of each data in all isolation trees according to the path length threshold range and the path length scores, and accumulate the path length scores of each data in all isolation trees to obtain the total score PF(i) of the path length of each data in all isolation trees;

[0023] Among them, f r (i) is the path length score of the i-th data in the r-th isolation tree, Lf r (i) is the path length of the i-th data in the r-th isolation tree. The path length is the number of splits required from the cutting point to the node with only one data. Lf0 is the minimum value in the path length threshold range, and Lf1 is the maximum value in the path length threshold range. r is the index of the isolation tree.

[0024] Furthermore, the method for presetting the alienation coefficient threshold includes:

[0025] Obtain m historical cloud computing operation and maintenance data, and obtain the historical alienation coefficients corresponding to the historical normal operation and maintenance data and historical abnormal operation and maintenance data in the m historical cloud computing operation and maintenance data. Extract the maximum value LS max of the historical alienation coefficients corresponding to the historical normal operation and maintenance data min and the minimum value LV max of the historical alienation coefficients corresponding to the historical abnormal operation and maintenance data. min Obtain the alienation coefficient threshold SY according to the maximum value LS

[0026] Among them,

[0027] Furthermore, the method of encrypting the pre-processed operation and maintenance data to obtain the final encrypted operation and maintenance data block matrix includes:

[0028] Convert the characters in the preprocessed operation and maintenance data into corresponding ASCII code representations, convert the ASCII code of each character into corresponding binary representations, obtain a binary operation and maintenance data stream, and segment the binary operation and maintenance data stream to obtain a binary operation and maintenance data block with a length of TL2;

[0029] Generate TL2 random values ​​through the random value generation formula. The random value generation formula is:

[0030] Where R is a random value generated by the random value generation formula, t is a randomly changing value, and t>0; rand(0,1) means randomly generating a floating value between 0 and 1, and TL2 is the length of the binary operation and maintenance data block;

[0031] Set a random value threshold. When the random value is greater than or equal to the random value threshold, replace the random value with 1. When the random value is less than the random value threshold, replace the random value with 0. Collect all replaced random values ​​to obtain the initial key, and convert the initial key into an initial key matrix.

[0032] Obtain the start time of splitting the binary operation and maintenance data stream, and cyclically shift the initial key matrix according to the start time of splitting the binary operation and maintenance data stream to obtain the final key matrix;

[0033] Convert the binary operation and maintenance data block into a binary operation and maintenance data block matrix, perform XOR operations on the first to last rows of the final key matrix and the first to last rows of the binary operation and maintenance data block matrix respectively, delete the binary in the binary operation and maintenance data block matrix, and fill the result of the XOR operation into the deleted binary operation and maintenance data block matrix to obtain the initial encrypted operation and maintenance data block matrix;

[0034] According to the start time of segmenting the binary operation and maintenance data stream, the binary in the final key matrix is ​​XORed with the binary in the initial encrypted operation and maintenance data block matrix to obtain the final encrypted operation and maintenance data block matrix.

[0035] Furthermore, the method of segmenting the binary operation and maintenance data stream to obtain binary operation and maintenance data blocks of length TL2 includes:

[0036] Obtain the length of the binary operation and maintenance data stream, divide the length of the binary operation and maintenance data stream by the length of the binary operation and maintenance data block to obtain a division result, and determine whether to fill the binary operation and maintenance data stream according to the division result. If the division result is an integer, the binary operation and maintenance data stream is not filled, and the binary operation and maintenance data stream is recorded as a filled operation and maintenance data stream. Otherwise, the binary operation and maintenance data stream is filled, and the filled binary operation and maintenance data stream is recorded as a filled operation and maintenance data stream;

[0037] Methods for filling the binary operation and maintenance data stream include:

[0038] Obtain the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block, and obtain the padding length TD according to the remainder and the length of the binary operation and maintenance data block;

[0039] Wherein, TD=TL2-TY; TY is the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block;

[0040] Add TD binary 0s to the end of the binary operation and maintenance data stream;

[0041] The padding operation and maintenance data stream is split once every TL2 bits to obtain a binary operation and maintenance data block with a length of TL2.

[0042] Furthermore, the method of converting the initial key into an initial key matrix includes:

[0043] Construct an H×Q empty matrix, TL2=H×Q; and H>9, map the first Q bits of the initial key to the first row of the empty matrix, map the (Q+1)th to 2Qth bits of the initial key to the second row of the empty matrix, map the (2Q+1)th to 3Qth bits of the initial key to the third row of the empty matrix, ..., repeat this cycle, map the (TL 2-Q+1)th to TL2th bits of the initial key to the Hth row of the empty matrix, and obtain the initial key matrix.

[0044] Furthermore, the method for obtaining the original audit code of the final encrypted operation and maintenance data block matrix includes:

[0045] Perform an XOR operation on the first row and the second row of the final encrypted operation and maintenance data block matrix to obtain the first XOR operation result, perform an XOR operation on the first XOR operation result and the third row of the final encrypted operation and maintenance data block matrix to obtain the second XOR operation result, perform an XOR operation on the second XOR operation result and the fourth row of the final encrypted operation and maintenance data block matrix to obtain the third XOR operation result, and so on, perform an XOR operation on the H-2th XOR operation result and the Hth row of the final encrypted operation and maintenance data block matrix to obtain the original audit code of the final encrypted operation and maintenance data block matrix.

[0046] Furthermore, the method for auditing the encrypted operation and maintenance data after interaction according to the original audit code includes:

[0047] Obtain the original audit code of the final encrypted operation and maintenance data block matrix after interaction, and record it as the interactive audit code, and compare the interactive audit code with the original audit code. If the comparison result is the same, the final encrypted operation and maintenance data block matrix has not been tampered with, otherwise, the final encrypted operation and maintenance data block matrix has been tampered with;

[0048] If the final encrypted operation and maintenance data block matrix after all interactions has not been tampered with, the encrypted operation and maintenance data after the interaction is safe. If the final encrypted operation and maintenance data block matrix after the interaction has been tampered with, the encrypted operation and maintenance data after the interaction is not safe, and relevant personnel will be dispatched to handle it.

[0049] The technical effects and advantages of a cloud computing operation and maintenance security management and audit system of the present invention are as follows:

[0050] The cloud computing operation and maintenance data is preprocessed to determine whether there is abnormal operation and maintenance data in the cloud computing operation and maintenance data. If there is abnormal operation and maintenance data, the abnormal operation and maintenance data is eliminated and filled with normal operation and maintenance data, thereby ensuring that there is no abnormal operation and maintenance data in the collected cloud computing operation and maintenance data. The preprocessed operation and maintenance data is encrypted to obtain the final encrypted operation and maintenance data block matrix. The preprocessed operation and maintenance data is encrypted in sections to make the final encrypted operation and maintenance data block matrix difficult to be cracked, further improving the security of the preprocessed operation and maintenance data. The encrypted operation and maintenance data after the interaction is audited according to the original audit code to determine whether the encrypted operation and maintenance data after the interaction has been tampered with. If tampered with, which final encrypted operation and maintenance data block matrix has been tampered with is obtained, and the tampered location is determined, further improving the security of the encrypted operation and maintenance data after the interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a cloud computing operation and maintenance security management and auditing system of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Example 1

[0054] See also Figure 1 As shown, a cloud computing operation and maintenance security management and auditing system described in this embodiment includes:

[0055] Data collection module, used to collect cloud computing operation and maintenance data;

[0056] A data preprocessing module is used to preprocess cloud computing operation and maintenance data to obtain preprocessed operation and maintenance data;

[0057] A data encryption module is used to encrypt the pre-processed operation and maintenance data to obtain the final encrypted operation and maintenance data block matrix, and to collect all the final encrypted operation and maintenance data block matrices to obtain the encrypted operation and maintenance data;

[0058] The interactive audit module is used to obtain the original audit code of the final encrypted operation and maintenance data block matrix, and to interact with the encrypted operation and maintenance data, and to audit the encrypted operation and maintenance data after interaction according to the original audit code;

[0059] The modules are connected to each other via wired and / or wireless means.

[0060] The process of collecting cloud computing operation and maintenance data includes:

[0061] The cloud computing operation and maintenance data includes basic resource data, service operation data, user operation behavior data and security alarm data;

[0062] The basic resource data includes the following data categories: server information data, virtualization resource data, storage data, and network data. The server information data includes the usage of resources such as CPU, memory, and disk. The virtualization resource data includes virtual machine status, image information, snapshots, etc. The storage data includes the capacity and performance indicators of object storage and block storage. The network data includes load balancing, subnets, routing tables, IP address allocation, etc.

[0063] The service operation data includes application service indicator data and log data. The application service indicator data includes database (number of queries, slow queries, number of connections, etc.) and Web server (response time, number of concurrent connections, etc.).

[0064] The user operation behavior data includes the following data categories: user login data, operation record data, and permission change data. The user login data includes login time, login IP address, login authentication method, etc. The operation record data includes the user's creation, deletion, modification, etc. of cloud resources. The permission change data includes the allocation and revocation of roles or permissions, etc.;

[0065] The data categories of the security alarm data include intrusion detection data, real-time alarm data and historical event data. The intrusion detection data includes suspicious logins, abnormal traffic, etc. The real-time alarm data includes cloud computing platform failures, abnormal operations, etc. The historical event data includes resource migration, task failure, fault recovery, etc.;

[0066] The data collection module is composed of a basic resource data collection terminal, a service operation data collection terminal, a user operation behavior data collection terminal and a security alarm data collection terminal;

[0067] The basic resource data collection terminal is used to collect basic resource data, the service operation data collection terminal is used to collect service operation data, the user operation behavior data collection terminal is used to collect user operation behavior data, and the security alarm data collection terminal is used to collect security alarm data;

[0068] The basic resource data collection terminal, service operation data collection terminal, user operation behavior data collection terminal and security alarm data collection terminal are configured to generate corresponding configuration channels. The cloud computing platform is linked through the generated configuration channels. The basic resource data collection terminal, service operation data collection terminal, user operation behavior data collection terminal and security alarm data collection terminal respectively obtain the basic resource data, service operation data, user operation behavior data and security alarm data in the cloud computing platform through the corresponding configuration channels.

[0069] The method of preprocessing cloud computing operation and maintenance data to obtain the preprocessed operation and maintenance data includes:

[0070] Determine whether there is abnormal operation and maintenance data in the cloud computing operation and maintenance data. If there is abnormal operation and maintenance data, remove the abnormal operation and maintenance data in the cloud computing operation and maintenance data, and fill in the abnormal operation and maintenance data in the removed cloud computing operation and maintenance data to obtain pre-processed operation and maintenance data. If there is no abnormal operation and maintenance data, record the cloud computing operation and maintenance data as pre-processed operation and maintenance data.

[0071] It should be explained that the abnormal operation and maintenance data in the removed cloud computing operation and maintenance data can be filled by filling the removed abnormal operation and maintenance data with normal operation and maintenance data through the context of the abnormal operation and maintenance data, or by interpolation method;

[0072] The process of determining whether there is abnormal operation and maintenance data in cloud computing operation and maintenance data includes:

[0073] Step A1: Randomly select a data category to build an isolation tree, randomly select a data in this data category as a cutting point, and divide all the data in p data categories into two parts according to the cutting point, that is, the data less than or equal to the cutting point is taken as one part, and the data greater than the cutting point is taken as the other part, and the left subtree and the right subtree are constructed respectively. Repeat recursively for the nodes of each subtree until the number of data in the node is less than or equal to 1, and stop. p is the number of data categories;

[0074] Step A2: Repeat step A1 to construct p-1 isolation trees and calculate the alienation coefficient of each data. i is the index of all data in p data categories, SY(i) is the alienation coefficient of the i-th data, PF(i) is the sum of the scores of the path length of the i-th data in all isolation trees, n is the number of all data in p data categories, and L(n) is the theoretical expected value of the path length;

[0075] in, r is the index of the isolation tree, f r (i) is the score of the path length of the i-th data in the r-th isolation tree. The path length is the number of splits required from the cutting point to the node with only one data. Lf r (i) is the path length of the i-th data in the r-th isolation tree, Lf0 and Lf1 are path length thresholds and Lf1>Lf0, f1, f2 and f3 are all positive numbers and f1 <f2<f3,

[0076] It is important to explain that the data categories selected are different each time the isolation tree is constructed;

[0077] Step A3: Preset a distance coefficient threshold SY. When the distance coefficient of the data is greater than or equal to the distance coefficient threshold SY, it is determined to be abnormal operation and maintenance data. Otherwise, it is determined to be normal operation and maintenance data.

[0078] The process of presetting the alienation coefficient threshold includes:

[0079] Obtain m historical cloud computing operation and maintenance data, and obtain the historical alienation coefficients corresponding to the historical normal operation and maintenance data and the historical abnormal operation and maintenance data in the m historical cloud computing operation and maintenance data, and extract the maximum value LS of the historical alienation coefficients corresponding to the historical normal operation and maintenance data max The minimum value LV of the historical alienation coefficient corresponding to the historical abnormal operation and maintenance data min , according to the maximum value LS max and minimum LV min Obtaining alienation coefficient threshold SY;

[0080] in,

[0081] The method of encrypting the pre-processed operation and maintenance data to obtain the final encrypted operation and maintenance data block matrix includes:

[0082] Convert the characters in the preprocessed operation and maintenance data into corresponding ASCII code representations, convert the ASCII code of each character into corresponding binary representations, obtain a binary operation and maintenance data stream, and segment the binary operation and maintenance data stream to obtain a binary operation and maintenance data block with a length of TL2;

[0083] The method of segmenting the binary operation and maintenance data stream to obtain binary operation and maintenance data blocks of length TL2 includes:

[0084] Get the length of the binary operation and maintenance data stream, and obtain the filling judgment formula based on the length of the binary operation and maintenance data stream and the length of the binary operation and maintenance data block: TC is the output result of the filling judgment formula, TL1 is the length of the binary operation and maintenance data stream, and TL2 is the length of the binary operation and maintenance data block. The filling judgment formula is used to judge whether to fill the binary operation and maintenance data stream. If the output result TC of the filling judgment formula is an integer, the binary operation and maintenance data stream is not filled, and the binary operation and maintenance data stream is recorded as the filled operation and maintenance data stream. If the output result TC of the filling judgment formula is not an integer, the binary operation and maintenance data stream is filled, and the filled binary operation and maintenance data stream is recorded as the filled operation and maintenance data stream;

[0085] The process of filling the binary operation and maintenance data stream includes:

[0086] Obtain the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block, and obtain the padding length TD according to the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block and the length of the binary operation and maintenance data block;

[0087] Wherein, TD=TL2-TY; TY is the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block;

[0088] Add TD binary 0s to the end of the binary operation and maintenance data stream;

[0089] The padding operation and maintenance data stream is split once every TL2 bits to obtain TK binary operation and maintenance data blocks with a length of TL2;

[0090] in, LT is the length of the padding operation and maintenance data stream;

[0091] Generate TL2 random values ​​through the random value generation formula. The random value generation formula is:

[0092] Among them, R is the random value generated by the random value generation formula, t is the randomly changing value and t>0; rand(0,1) means randomly generating a floating value between 0 and 1;

[0093] It needs to be explained that This term introduces more complex mixed elements based on square roots and quadratic powers, producing fluctuations of different frequencies and amplitudes, making the generated values ​​​​periodic, and as t increases, the frequency and amplitude of the changes will change nonlinearly. This term uses a combination of exponentiation and division to produce very rapid changes, making the random value generation formula very complex. The term ln(t+1) uses a logarithmic function for smoothing, making the increment gradually decrease. This term combines a sine wave with t squared, adding randomness and complexity;

[0094] Set a random value threshold. When the random value is greater than or equal to the random value threshold, replace the random value with 1. When the random value is less than the random value threshold, replace the random value with 0. Collect all replaced random values ​​to obtain the initial key.

[0095] Construct an empty matrix of H×Q, TL2=H×Q; and H>9, map the first Q bits of the initial key to the first row of the empty matrix, map the (Q+1)th to 2Qth bits of the initial key to the second row of the empty matrix, map the (2Q+1)th to 3Qth bits of the initial key to the third row of the empty matrix, ..., repeat this process, map the (TL 2-Q+1)th to TL2th bits of the initial key to the Hth row of the empty matrix, and obtain the initial key matrix;

[0096] Obtain the start time of splitting the binary operation and maintenance data stream, and cyclically shift the initial key matrix according to the start time of splitting the binary operation and maintenance data stream to obtain the final key matrix;

[0097] For example, the start time of splitting the binary operation and maintenance data stream is 14:27:13 on December 15, 2024, and the corresponding number is 20241215142713. If 0 is replaced by 1, the corresponding number is 21241215142713.

[0098] The first two digits of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 2 and 1, then the second row of the final key matrix is ​​cyclically shifted left by one digit, and the first row is cyclically shifted right by two digits. The third and fourth digits of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 2 and 4 respectively, then the second row of the final key matrix is ​​cyclically shifted left by four digits, and the fourth row is cyclically shifted right by two digits, ..., repeatedly. The second to last digit and the last to last digit of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 1 and 3, then the first row of the final key matrix is ​​cyclically shifted left by three digits, and the third row is cyclically shifted right by one digit to obtain the final key matrix;

[0099] Converting the binary operation and maintenance data block into a binary operation and maintenance data block matrix based on a process of converting an initial key into an initial key matrix;

[0100] Perform an XOR operation on the first to last rows of the final key matrix and the first to last rows of the binary operation and maintenance data block matrix respectively, delete the binary in the binary operation and maintenance data block matrix, and fill the result of the XOR operation into the deleted binary operation and maintenance data block matrix to obtain the initial encrypted operation and maintenance data block matrix;

[0101] According to the start time of splitting the binary operation and maintenance data stream, perform an XOR operation on the binary in the final key matrix and the binary in the initial encrypted operation and maintenance data block matrix to obtain the final encrypted operation and maintenance data block matrix;

[0102] For example, the start time of splitting the binary operation and maintenance data stream is 14:27:13 on December 15, 2024, and the corresponding number is 20241215142713. If 0 is replaced by 1, the corresponding number is 21241215142713.

[0103] If the first two digits of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 2 and 1, then the second row of the final key matrix and the first row of the initial encrypted operation and maintenance data block matrix are XORed, and the first row of the initial encrypted operation and maintenance data block matrix is ​​replaced with the result of the XOR operation. If the third and fourth digits of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 2 and 4 respectively, then the second row of the final key matrix and the fourth row of the initial encrypted operation and maintenance data block matrix are XORed, and the fourth row of the initial encrypted operation and maintenance data block matrix is ​​replaced with the result of the XOR operation, ..., the cycle is repeated. If the second to last digit and the first to last digit of the number corresponding to the start time of splitting the binary operation and maintenance data stream are 1 and 3, then the first row of the final key matrix and the third row of the initial encrypted operation and maintenance data block matrix are XORed, and the third row of the initial encrypted operation and maintenance data block matrix is ​​replaced with the result of the XOR operation to obtain the final encrypted operation and maintenance data block matrix.

[0104] The process of obtaining the original audit code of the final encrypted operation and maintenance data block matrix includes:

[0105] Perform an XOR operation on the first row and the second row of the final encrypted operation and maintenance data block matrix to obtain the first XOR operation result, perform an XOR operation on the first XOR operation result and the third row of the final encrypted operation and maintenance data block matrix to obtain the second XOR operation result, perform an XOR operation on the second XOR operation result and the fourth row of the final encrypted operation and maintenance data block matrix to obtain the third XOR operation result, and so on, perform an XOR operation on the H-2th XOR operation result and the Hth row of the final encrypted operation and maintenance data block matrix to obtain the original audit code of the final encrypted operation and maintenance data block matrix.

[0106] The process of auditing the encrypted operation and maintenance data after interaction according to the original audit code includes:

[0107] Obtain the original audit code of the final encrypted operation and maintenance data block matrix after interaction, and record it as the interactive audit code, compare the interactive audit code with the original audit code, if the comparison result is the same, then the final encrypted operation and maintenance data block matrix has not been tampered with, if the comparison result is different, then the final encrypted operation and maintenance data block matrix has been tampered with;

[0108] If the final encrypted operation and maintenance data block matrix after all interactions has not been tampered with, the encrypted operation and maintenance data after the interaction is safe. If the final encrypted operation and maintenance data block matrix after the interaction has been tampered with, the encrypted operation and maintenance data after the interaction is not safe, and relevant personnel will be dispatched to handle it.

[0109] In this embodiment, the cloud computing operation and maintenance data is preprocessed to determine whether there is abnormal operation and maintenance data in the cloud computing operation and maintenance data. If there is abnormal operation and maintenance data, the abnormal operation and maintenance data is eliminated and filled with normal operation and maintenance data, thereby ensuring that there is no abnormal operation and maintenance data in the collected cloud computing operation and maintenance data. The preprocessed operation and maintenance data is encrypted to obtain a final encrypted operation and maintenance data block matrix. The preprocessed operation and maintenance data is encrypted in sections to make the final encrypted operation and maintenance data block matrix difficult to be cracked, thereby further improving the security of the preprocessed operation and maintenance data. The encrypted operation and maintenance data after the interaction is audited according to the original audit code to determine whether the encrypted operation and maintenance data after the interaction has been tampered with. If tampered with, it is obtained which final encrypted operation and maintenance data block matrix has been tampered with and the tampered location is determined, thereby further improving the security of the encrypted operation and maintenance data after the interaction.

[0110] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0111] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only one, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0112] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0113] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A cloud computing operation and maintenance security management and audit system, characterized in that: The cloud computing operation and maintenance security management and audit system comprises: Data collection module, used to collect cloud computing operation and maintenance data; A data preprocessing module is used to preprocess cloud computing operation and maintenance data to obtain preprocessed operation and maintenance data; A data encryption module is used to encrypt the pre-processed operation and maintenance data to obtain a final encrypted operation and maintenance data block matrix, and to collect all the final encrypted operation and maintenance data block matrices to obtain encrypted operation and maintenance data; The interactive audit module is used to obtain the original audit code of the final encrypted operation and maintenance data block matrix, and to interact with the encrypted operation and maintenance data, and to audit the encrypted operation and maintenance data after interaction according to the original audit code; The modules are connected to each other via wired and / or wireless means.

2. A cloud computing operation and maintenance security management and audit system according to claim 1, characterized in that: The cloud computing operation and maintenance data includes basic resource data, service operation data, user operation behavior data and security alarm data; The data categories included in the basic resource data are server information data, virtualization resource data, storage data and network data; the data categories included in the service operation data are application service indicator data and log data; the data categories included in the user operation behavior data are user login data, operation record data and permission change data; the data categories included in the security alarm data are intrusion detection data, real-time alarm data and historical event data.

3. A cloud computing operation and maintenance security management and audit system according to claim 2, characterized in that: The method of preprocessing the cloud computing operation and maintenance data to obtain the preprocessed operation and maintenance data includes: Determine whether there is abnormal operation and maintenance data in the cloud computing operation and maintenance data. If there is abnormal operation and maintenance data, remove the abnormal operation and maintenance data, and use the interpolation method to fill the removed abnormal operation and maintenance data to obtain pre-processed operation and maintenance data. If there is no abnormal operation and maintenance data, record the cloud computing operation and maintenance data as pre-processed operation and maintenance data. The process of determining whether there is abnormal operation and maintenance data in cloud computing operation and maintenance data includes: Step A1: Randomly select a data category to build an isolation tree, randomly select a data in this data category as a cutting point, and divide all the data in p data categories into two parts according to the cutting point, that is, the data less than or equal to the cutting point is taken as one part, and the data greater than the cutting point is taken as the other part, and the left subtree and the right subtree are constructed respectively. Repeat recursively for the nodes of each subtree until the number of data in the node is less than or equal to 1, and stop. p is the number of data categories; Step A2: Repeat step A1 to construct p-1 isolation trees, obtain the sum of the scores of the path lengths of each data in all isolation trees, and obtain the alienation coefficient of each data according to the sum of the scores of the path lengths: SY Where i is the index of all data in p data categories, SY(i) is the alienation coefficient of the i-th data, PF(i) is the sum of the scores of the path lengths of the i-th data in all isolation trees, n is the number of all data in p data categories, and L(n) is the theoretical expected value of the path length. Step A3: preset a distance coefficient threshold SY. When the distance coefficient of the data is greater than or equal to the distance coefficient threshold SY, it is determined to be abnormal operation and maintenance data. Otherwise, it is determined to be normal operation and maintenance data.

4. A cloud computing operation and maintenance security management and audit system according to claim 3, characterized in that: The method for obtaining the sum of the scores of the path lengths of each data in all isolation trees includes: Set a path length threshold range (Lf0, Lf1), as well as path length scores f1, f2, and f3. f1, f2, and f3 are all positive numbers, and f1 < f2 < f3. Obtain the score f of the path length of each data in all isolation trees according to the path length threshold range and the path length scores r (i), accumulate the scores of the path lengths of each data in all isolation trees to obtain the total score PF(i) of the path lengths of each data in all isolation trees; in, f r (i) is the score of the path length of the i-th data in the r-th isolation tree, Lf r (i) is the path length of the i-th data in the r-th isolation tree. The path length is the number of splits required from the cutting point to the node with only one data. Lf0 is the minimum value in the path length threshold range, and Lf1 is the maximum value in the path length threshold range. r is the index of the isolation tree.

5. A cloud computing operation and maintenance security management and auditing system according to claim 4, characterized in that: The method for presetting the alienation coefficient threshold comprises: Obtain m historical cloud computing operation and maintenance data, and obtain the historical alienation coefficients corresponding to the historical normal operation and maintenance data and the historical abnormal operation and maintenance data in the m historical cloud computing operation and maintenance data, and extract the maximum value LS of the historical alienation coefficients corresponding to the historical normal operation and maintenance data max The minimum value LV of the historical alienation coefficient corresponding to the historical abnormal operation and maintenance data min , according to the maximum value LS max and minimum LV min Obtaining alienation coefficient threshold SY; in, 6. A cloud computing operation and maintenance security management and audit system according to claim 5, characterized in that: The method of encrypting the pre-processed operation and maintenance data to obtain the final encrypted operation and maintenance data block matrix includes: Convert the characters in the preprocessed operation and maintenance data into corresponding ASCII code representations, convert the ASCII code of each character into corresponding binary representations, obtain a binary operation and maintenance data stream, and segment the binary operation and maintenance data stream to obtain binary operation and maintenance data blocks with a length of TL2; Generate TL2 random values ​​through the random value generation formula. The random value generation formula is: Where R is a random value generated by the random value generation formula, t is a randomly changing value, and t>0; rand(0,1) means randomly generating a floating value between 0 and 1, and TL2 is the length of the binary operation and maintenance data block; Set a random value threshold. When the random value is greater than or equal to the random value threshold, replace the random value with 1. When the random value is less than the random value threshold, replace the random value with 0. Collect all replaced random values ​​to obtain the initial key, and convert the initial key into an initial key matrix. Obtain the start time of splitting the binary operation and maintenance data stream, and cyclically shift the initial key matrix according to the start time of splitting the binary operation and maintenance data stream to obtain the final key matrix; Convert the binary operation and maintenance data block into a binary operation and maintenance data block matrix, perform XOR operations on the first to last rows of the final key matrix and the first to last rows of the binary operation and maintenance data block matrix respectively, delete the binary in the binary operation and maintenance data block matrix, and fill the result of the XOR operation into the deleted binary operation and maintenance data block matrix to obtain the initial encrypted operation and maintenance data block matrix; According to the start time of segmenting the binary operation and maintenance data stream, the binary in the final key matrix is ​​XORed with the binary in the initial encrypted operation and maintenance data block matrix to obtain the final encrypted operation and maintenance data block matrix.

7. A cloud computing operation and maintenance security management and audit system according to claim 6, characterized in that: The method of dividing the binary operation and maintenance data stream to obtain a binary operation and maintenance data block with a length of TL2 includes: Obtain the length of the binary operation and maintenance data stream, divide the length of the binary operation and maintenance data stream by the length of the binary operation and maintenance data block to obtain a division result, and determine whether to fill the binary operation and maintenance data stream according to the division result. If the division result is an integer, the binary operation and maintenance data stream is not filled, and the binary operation and maintenance data stream is recorded as a filled operation and maintenance data stream. Otherwise, the binary operation and maintenance data stream is filled, and the filled binary operation and maintenance data stream is recorded as a filled operation and maintenance data stream; Methods for filling the binary operation and maintenance data stream include: Obtain the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block, and obtain the padding length TD according to the remainder and the length of the binary operation and maintenance data block; Wherein, TD=TL2-TY; TY is the remainder of the length of the binary operation and maintenance data stream divided by the length of the binary operation and maintenance data block; Add TD binary 0s to the end of the binary operation and maintenance data stream; The padding operation and maintenance data stream is split once every TL2 bits to obtain a binary operation and maintenance data block with a length of TL2.

8. A cloud computing operation and maintenance security management and audit system according to claim 7, characterized in that: The method for converting the initial key into the initial key matrix comprises: Construct an H×Q empty matrix, TL2=H×Q; and H>9, map the first Q bits of the initial key to the first row of the empty matrix, map the (Q+1)th to 2Qth bits of the initial key to the second row of the empty matrix, map the (2Q+1)th to 3Qth bits of the initial key to the third row of the empty matrix, ..., repeat this cycle, map the (TL 2-Q+1)th to TL2th bits of the initial key to the Hth row of the empty matrix, and obtain the initial key matrix.

9. A cloud computing operation and maintenance security management and audit system according to claim 8, characterized in that: The method for obtaining the original audit code of the final encrypted operation and maintenance data block matrix includes: Perform an XOR operation on the first row and the second row of the final encrypted operation and maintenance data block matrix to obtain the first XOR operation result, perform an XOR operation on the first XOR operation result and the third row of the final encrypted operation and maintenance data block matrix to obtain the second XOR operation result, perform an XOR operation on the second XOR operation result and the fourth row of the final encrypted operation and maintenance data block matrix to obtain the third XOR operation result, and so on, perform an XOR operation on the H-2th XOR operation result and the Hth row of the final encrypted operation and maintenance data block matrix to obtain the original audit code of the final encrypted operation and maintenance data block matrix.

10. A cloud computing operation and maintenance security management and audit system according to claim 9, characterized in that: The method for auditing the encrypted operation and maintenance data after interaction according to the original audit code includes: Obtain the original audit code of the final encrypted operation and maintenance data block matrix after interaction, and record it as the interactive audit code, and compare the interactive audit code with the original audit code. If the comparison result is the same, the final encrypted operation and maintenance data block matrix has not been tampered with, otherwise, the final encrypted operation and maintenance data block matrix has been tampered with; If the final encrypted operation and maintenance data block matrix after all interactions has not been tampered with, the encrypted operation and maintenance data after the interaction is safe. If the final encrypted operation and maintenance data block matrix after the interaction has been tampered with, the encrypted operation and maintenance data after the interaction is not safe, and relevant personnel will be dispatched to handle it.

Images