Intrusion prevention method, system and medium for trusted data space

Abstract

The application discloses an intrusion protection method and system of a trusted data space and a medium, relates to the technical field of data security protection, and comprises the following steps: performing data feature extraction on sensitive data, and establishing a feature data set of the sensitive data; activating a mixed fragmentation calculation unit, performing fragmentation distribution calculation, and generating a fragmentation distribution result; distributing the fragmentation distribution result to a mixed storage node storage by using a mixed storage architecture; when a calculation task with passed calculation verification is acquired, configuring a multi-party secure calculation node; and performing storage data calling calculation on the mixed storage node, and feeding back the calculation result as an output result. The application solves the technical problems that sensitive data is prone to be leaked, storage and calculation efficiency is low, and the accuracy and reliability of the calculation result are difficult to guarantee in the prior art, achieves the technical effects of realizing safe storage and efficient calculation of sensitive data, and improves the safety, efficiency and reliability of the calculation result of sensitive data processing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security protection, in particular to an intrusion protection method and system of a trusted data space and a medium. BACKGROUND

[0002] In the digital era, data has become the core asset of enterprises and organizations, and the value of data is increasingly prominent with the growth of its scale and diversity. Sensitive data, such as personal identity information, financial data, business secrets, etc., is related to the survival and development of enterprises and the privacy rights and interests of individuals. However, the current data storage and computing environment faces many serious challenges. On the one hand, traditional data storage methods are difficult to effectively protect sensitive data in the face of increasingly complex network attacks, leading to frequent data leakage incidents, causing great losses to enterprises and individuals. On the other hand, with the exponential growth of data volume and the increasing complexity of computing tasks, the existing computing mode is inefficient and cannot meet the real-time requirements, and the integrity and accuracy of data cannot be guaranteed during the computing process. In addition, in the multi-party data computing scenario, the security of different computing nodes is uneven, and there is a lack of effective trust mechanism, further increasing the risk of data processing.

[0003] The prior art has the technical problems of easy leakage of sensitive data, low storage and computing efficiency, and difficulty in guaranteeing the accuracy and credibility of the computing results. SUMMARY

[0004] The present application provides an intrusion protection method and system of a trusted data space and a medium, which is used to solve the technical problems of easy leakage of sensitive data, low storage and computing efficiency, and difficulty in guaranteeing the accuracy and credibility of the computing results in the prior art.

[0005] In view of the above problems, the present application provides an intrusion protection method and system of a trusted data space and a medium.

[0006] In a first aspect of the embodiments of the present application, an intrusion protection method of a trusted data space is provided, which comprises:

[0007] Data feature extraction is performed on sensitive data to establish a feature data set of the sensitive data; a hybrid sharding computing unit is activated, and the hybrid sharding computing unit is used to perform sharding distribution calculation based on the feature data set to generate a sharding distribution result; the sharding distribution result is distributed to a hybrid storage node for storage by using a hybrid storage architecture; when a computing task with passed computing verification is obtained, multi-party secure computing nodes are configured according to the task complexity, task computing time random number, and task trust degree of the computing task; after the storage data of the hybrid storage node is homomorphically encrypted, the storage data of the hybrid storage node is called for calculation by using the multi-party secure computing nodes, and the calculation result is fed back as an output result.

[0008] In a second aspect, the application provides an intrusion protection system for a trusted data space, the system comprising:

[0009] The feature data set establishment module is configured to perform data feature extraction on the sensitive data and establish a feature data set of the sensitive data; the sharding distribution result generation module is configured to activate a hybrid sharding calculation unit, perform sharding distribution calculation based on the feature data set by using the hybrid sharding calculation unit, and generate a sharding distribution result; the sharding distribution result distribution module is configured to distribute the sharding distribution result to a hybrid storage node storage by using a hybrid storage architecture; the multi-party secure calculation node configuration module is configured to, after obtaining a calculation task that passes calculation verification, configure a multi-party secure calculation node according to a task complexity of the calculation task, a task calculation time random number, and a task trust degree; and the output result feedback module is configured to, after homomorphic encryption of storage data of the hybrid storage node, perform storage data calling calculation of the hybrid storage node by using the multi-party secure calculation node, and feed back a calculation result as an output result.

[0010] In a third aspect, the application provides a computer readable storage medium storing a computer program, the computer program being configured to execute the intrusion protection method for a trusted data space provided by the application.

[0011] The one or more technical solutions provided in the application have at least the following technical effects or advantages:

[0012] Data feature extraction is performed on sensitive data, and a feature data set of the sensitive data is established; a hybrid sharding calculation unit is activated, sharding distribution calculation is performed, and a sharding distribution result is generated; the sharding distribution result is distributed to a hybrid storage node storage by using a hybrid storage architecture; after obtaining a calculation task that passes calculation verification, a multi-party secure calculation node is configured according to a task complexity of the calculation task, a task calculation time random number, and a task trust degree; after homomorphic encryption of storage data of the hybrid storage node, storage data calling calculation of the hybrid storage node is performed by using the multi-party secure calculation node, and a calculation result is fed back as an output result. The technical effects of realizing secure storage and efficient calculation of sensitive data, and improving the security, efficiency, and reliability of calculation results of sensitive data processing are achieved. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0014] Figure 1A flowchart of a trusted data space intrusion protection method provided by an embodiment of the present application.

[0015] Figure 2 A structural diagram of a trusted data space intrusion protection system provided by an embodiment of the present application.

[0016] Legend: feature data set establishment module 10, shard distribution result generation module 20, node storage module 30, multi-party secure computing node configuration module 40, output result feedback module 50. DETAILED DESCRIPTION

[0017] The present application provides a trusted data space intrusion protection method, system and medium, which is used to solve the technical problems of sensitive data leakage, low storage and computing efficiency, and difficulty in guaranteeing the accuracy and credibility of the computing result in the prior art.

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0019] Embodiment one, as shown in the present application provides a trusted data space intrusion protection method, which comprises: Figure 1

[0020] Step S100: data feature extraction is performed on sensitive data to establish a feature data set of the sensitive data.

[0021] Specifically, the scope of sensitive data is determined, which includes user privacy information, enterprise business secrets, important business data, etc., and once the data is leaked, it will cause serious security risks. Comprehensive analysis is performed on various types of sensitive data. For text type sensitive data, the frequency of key words is counted through word frequency analysis, and the meaning of the text is understood by using semantic analysis, so as to extract word features and semantic features. For numerical type sensitive data, statistical quantities such as mean, median and standard deviation are calculated to master the concentration trend and dispersion degree of the data and obtain the distribution characteristics. For unstructured sensitive data such as images and audios, features such as color, texture and shape are extracted by using image recognition algorithm, and features such as frequency and amplitude are obtained by using audio feature extraction technology. These features extracted from different types of sensitive data are integrated and stored, and finally a feature data set of the sensitive data is constructed. This data set provides a core basis for subsequent data analysis, processing and intrusion protection strategy formulation, ensuring that sensitive data security is protected while data management and utilization are more efficient. ​

[0022] Step S200: activating a hybrid sharding computing unit, and performing sharding distribution calculation based on the feature data set by using the hybrid sharding computing unit to generate a sharding distribution result.

[0023] Specifically, the hybrid sharding computing unit is started, which includes multiple function layers working cooperatively. First, the complexity calculation layer starts to operate, which comprehensively evaluates the feature data set, analyzes the dimensions of the data, the correlation between the dimensions, the distribution of the data, and the like, and obtains the complexity of the feature data set through the analysis. For example, if the data has multiple dimensions and complex nonlinear relationships between the dimensions, the complexity is high. According to the complexity calculation result, the first sharding constraint is established, which specifies the basic rules such as the approximate number of shards, the upper limit of the data amount of each shard, and the like. Then, the sensitivity calculation layer is activated, which evaluates the data in the feature data set from the perspective of the sensitivity of the data. The sensitivity calculation considers the possible impact after the data leakage, such as the high sensitivity of the data related to personal privacy, and different sensitivity levels of the commercial secret data according to their importance. According to the sensitivity calculation result, the second sharding constraint is established, which is used to ensure that the sharding manner of sensitive data meets the security requirements, such as separate sharding of high-sensitivity data or more stringent encryption measures. Subsequently, the first sharding constraint and the second sharding constraint are synchronized to the distribution calculation layer. After receiving the two constraints, the distribution calculation layer further extracts the timestamp feature, the access frequency feature, and the task period feature from the feature data set, integrates these features to establish the third sharding constraint. This constraint is mainly used to optimize the sharding according to the timeliness and frequency of use of the data, for example, the data frequently accessed in recent period can be separately sharded for fast access. Finally, the distribution calculation layer configures the distribution number space according to the three sharding constraints, and determines a reasonable sharding number range. Within this range, a distribution random number is generated by a random algorithm, and combined with the distribution number space to determine the final sharding distribution result. This result determines how the feature data set is divided into different shards for subsequent storage and processing, to ensure that the data can be efficiently processed and the security can be ensured in the subsequent process.

[0024] Step S300: distributing the sharding distribution result to the hybrid storage node storage by using the hybrid storage architecture.

[0025] Specifically, the mixed storage architecture allocates the shard distribution result to the mixed storage node, and the storage layer of the mixed storage architecture is composed of local storage, distributed cloud storage and edge node temporary storage. First, the duration of each shard in the shard distribution result is analyzed, and the data is classified according to the first duration threshold and the second duration threshold. The data meeting the first duration threshold, which is usually some data that does not change frequently and is important to the integrity of historical data, is recorded as long-term storage data; the data not meeting the second duration threshold, which is frequently accessed and time-sensitive data, is recorded as short-term high-frequency access data; the remaining data not covered by the above thresholds is identified as high-speed access data. Then, the data proportion of long-term storage data, short-term high-frequency access data and high-speed access data is obtained. By analyzing these data proportions, a first variation factor is established, which is used to measure the weight of different types of data in storage capacity allocation. At the same time, the data sensitivity of each data in each type of data is obtained, and a second variation factor is established according to the sensitivity, which adjusts the security level of storage according to the data sensitivity. Then, the first variation factor and the second variation factor are used to process the records of long-term storage data, short-term high-frequency access data and high-speed access data. For long-term storage data, the storage path will be adjusted based on the variation factor, and the more stable and lower cost storage area in the distributed cloud storage will be selected; for short-term high-frequency access data, it will be stored in local storage or edge node temporary storage close to the data source to reduce access delay; high-speed access data will optimize its storage layout in the storage node according to the variation result to improve data reading speed. Finally, according to the record variation result, the shard distribution result is reasonably distributed to the corresponding mixed storage node for storage, realizing the balance of efficiency, security and cost of data storage.

[0026] Step S400: When the computing task that passes the calculation verification is obtained, the multi-party secure computing node is configured according to the task complexity, task calculation time random number and task trust degree of the computing task.

[0027] Specifically, when a computing task that has passed the calculation verification is obtained, the multi-party secure computing node is configured. First, the task complexity of the computing task is accurately evaluated. The measurement of the task complexity involves multiple aspects, such as the amount of data required to be processed by the computing task, the complexity of the algorithm logic involved, the demand for computing resources, etc. If the computing task needs to process massive data and the algorithm contains complex logic with multiple layers of nesting, the complexity is high; on the contrary, if the task only processes a small amount of data and the algorithm is simple, the complexity is low. Then, the task calculation time random number is generated. The random number is generated based on the consideration of the reasonable completion time of the task combined with certain random factors. It is used to provide flexibility for the allocation of computing time for the computing task, avoiding the concentration of all tasks in the same time period for computing, causing resource congestion. Then, the task trust degree is evaluated. This index mainly considers the reliability of the source of the computing task and the compliance of the task itself. For example, tasks from the core business departments of enterprises and after strict approval processes usually have a high trust degree; while tasks with unknown sources or insufficient audits have a low trust degree. The three key factors of task complexity, task calculation time random number and task trust degree are combined to screen and configure from the numerous multi-party secure computing nodes. For tasks with high complexity, high trust degree and urgent time requirements, computing nodes with strong computing ability, high security and fast response speed are preferred; for tasks with low complexity, general trust degree and not so strict time requirements, computing nodes with relatively less resource consumption can be selected. In this way, the reasonable matching of computing tasks and multi-party secure computing nodes is realized, ensuring that the computing tasks can be executed efficiently and securely.

[0028] Step S500: After the storage data of the hybrid storage node is homomorphically encrypted, the hybrid storage node storage data calling calculation is performed by using the multi-party secure computing node, and the calculation result is fed back as the output result.

[0029] Specifically, a homomorphic encryption process is started for the storage data in the hybrid storage node. A homomorphic encryption algorithm such as CKKS (for approximate calculation) or BGV (for integer calculation) is used, and is selected according to the characteristics of the data and the calculation requirements. The sharded data stored in the local storage, distributed cloud storage and edge node temporary storage are encrypted one by one, ensuring that the data remains in the original format and operational attributes in the encrypted state, so that subsequent calculations can be directly performed on the ciphertext. After completing the encryption, the multi-party secure calculation nodes configured according to the task before are called. These nodes work collaboratively based on a secure multi-party computation protocol, each node only holds part of the encrypted data and cannot obtain the data content of other nodes, thereby ensuring data privacy. After receiving the encrypted data, each node performs the corresponding operation according to the requirements of the calculation task, such as addition, multiplication and other operations. During the operation process, the nodes transmit the encrypted intermediate calculation results through a secure channel to avoid information leakage. After all the multi-party secure calculation nodes participating in the calculation complete their respective calculation tasks and aggregate the results, the ciphertext form of the calculation results is transmitted back to the system, and the corresponding decryption key is used to decrypt the ciphertext results to obtain the final plaintext calculation results, which are fed back to the task demander as output results. This process ensures the security of the data during the entire calculation process, effectively prevents sensitive data from being stolen or tampered with during the calculation process, and ensures the security of the trusted data space and the reliability of data processing.

[0030] In one possible implementation manner, step S200 further includes:

[0031] Step S210: activating a complexity calculation layer of the hybrid sharding calculation unit, performing complexity calculation of the feature data set by using the complexity calculation layer, and establishing a first sharding constraint according to the complexity calculation result.

[0032] Step S220: activating a sensitivity calculation layer of the hybrid sharding calculation unit, performing sensitivity calculation of the feature data set by using the sensitivity calculation layer, and establishing a second sharding constraint according to the sensitivity calculation result.

[0033] Step S230: synchronizing the first sharding constraint and the second sharding constraint to a distribution calculation layer to generate a sharding distribution result.

[0034] Specifically, the complexity calculation layer of the hybrid fragmentation calculation unit is activated, and a decision tree algorithm is used to carry out complexity calculation of the feature data set. First, multiple attributes of the feature data set are analyzed, such as the number of dimensions of the data, the correlation between the dimensions, the distribution of the data, etc., which are regarded as input features of the decision tree. Then, a decision tree model is constructed, and in the construction process, indicators such as information gain and Gini index are used to select the optimal partition attribute to recursively divide the feature data set into different subsets. Each internal node represents a test on an attribute, each branch represents a test output, and each leaf node represents a class or value. After multiple divisions, the decision tree gradually grows until it meets the preset stopping conditions, such as the number of samples in the node being less than a certain threshold, the information gain being less than a certain threshold, etc. Through the structure and division results of the decision tree, the source and distribution of the complexity of the feature data set can be clearly seen. For example, if the depth of the decision tree is large and the branches are more, it means that the complexity of the feature data set is high, because more judgments and divisions are needed to effectively organize the data. According to the complexity calculation results, the first fragmentation constraint is established. If the complexity is high, the first fragmentation constraint can be set to divide the data set into a larger number of small fragments to reduce the processing difficulty of each fragment; if the complexity is low, the number of fragments can be appropriately reduced or the data volume of each fragment can be increased to improve the processing efficiency.

[0035] The sensitivity calculation layer of the hybrid fragmentation calculation unit is activated, which uses a fuzzy comprehensive evaluation algorithm to calculate the sensitivity of the feature data set. First, the evaluation factor set of sensitivity is determined, such as the privacy level of the data, the potential economic loss caused by data leakage, the impact on business operation, etc., which can be used as evaluation factors. Then, a reasonable weight is assigned to each evaluation factor, which can be determined by expert evaluation method, that is, experts in the relevant field score according to the importance of each factor, and then statistical analysis is performed to obtain the weight. Then, a comment set is constructed, for example, the sensitivity is divided into low, medium and high levels. For each data item in the feature data set, according to its attributes and related background information, the expert or the preset rule gives the comment membership degree for each evaluation factor to form a fuzzy relation matrix. Through fuzzy matrix operation, the weight vector is multiplied by the fuzzy relation matrix to obtain a comprehensive evaluation vector. According to the principle of maximum membership degree, the evaluation level with the maximum membership degree is found from the comprehensive evaluation vector, which is used as the sensitivity level of the data item. After completing the sensitivity calculation of the entire feature data set, the second fragmentation constraint is established according to the sensitivity calculation results. If the sensitivity of a data item is high, the second fragmentation constraint can specify that it is fragmented separately and encrypted using a high-strength encryption algorithm, and access permission is strictly limited; for data items with medium sensitivity, they can be grouped into a fragment, but certain security protection measures are also needed; data items with low sensitivity can be relatively loosely fragmented, stored and managed.

[0036] The timestamp feature, the access frequency feature, and the task period feature are extracted from the feature data set, and a third sharding constraint is established based on these features. This third sharding constraint provides more practical usage rules for data sharding from the time dimension and usage frequency. The distribution computing layer comprehensively considers the first, second, and third sharding constraints, deeply analyzes the conditions and rules involved in each constraint, and evaluates the possible conflicts and complementary relationships between them. For example, a high-complexity shard requires more computing resources, but a high-sensitivity shard requires more stringent security protection, so a balance needs to be found between the two. Then, the distribution computing layer configures a distribution quantity space according to the results of these comprehensive considerations. This space specifies the approximate range of the number of shards, which is determined in combination with the overall size of the data, the requirements of each constraint, and the resource situation of the system. Then, a distribution random number is generated through a random algorithm. The role of this random number is to further randomize the final number of shards within the distribution quantity space to increase the flexibility and randomness of the shards and avoid regular sharding patterns. Finally, according to the determined number of shards, the distribution computing layer divides the feature data set into different shards according to the requirements of each constraint, clearly defines the data composition of each shard and related security, computing, and other configuration information, thereby generating a shard distribution result. This result will provide clear guidance for subsequent data storage and computing, ensuring that data can be processed efficiently and securely under the premise of meeting various constraint conditions.

[0037] In one possible implementation manner, step S230 further includes:

[0038] Step S231: extracting a timestamp feature, an access frequency feature, and a task period feature from the feature data set, and establishing a third sharding constraint based on the timestamp feature, the access frequency feature, and the task period feature as time features.

[0039] Step S232: after synchronizing the first sharding constraint, the second sharding constraint, and the third sharding constraint to the distribution computing layer, configuring a distribution quantity space according to the calculation result.

[0040] Step S233: configuring a distribution random number, and determining a shard distribution result according to the distribution random number and the distribution quantity space.

[0041] Specifically, a deep analysis is carried out on the feature data set, from which timestamp features, access frequency features and task cycle features with key significance are extracted. For timestamp features, the timestamp recorded by each data in the data set is accurately identified and analyzed to determine the specific time point at which the data is generated or updated, and thus the timeliness of the data is grasped. The extraction of access frequency features is achieved by counting the number of times the data is accessed within a certain time period, which can understand the use heat and activity level of the data. The task cycle feature studies the time law of data participating in the task and judges whether the data is used according to a specific cycle (such as day, week, month, etc.). After integrating the three features into time features, the third shard constraint is established according to these time features. For example, for data with a recent timestamp, high access frequency and in a task critical cycle, the third shard constraint will stipulate that it must be divided into a shard with fast response speed and high storage performance to ensure that the data can be quickly and stably obtained during task execution. For data with periodic changes in access frequency, the constraint will require that the data be shard according to its cycle characteristics, and more resources will be allocated to the corresponding data shard during the peak usage period to ensure the efficiency of data processing. In this way, the third shard constraint can fully consider the time characteristics of the data and provide more actual usage demand-oriented rules for subsequent data sharding and processing.

[0042] The first shard constraint (established based on complexity calculation results), the second shard constraint (established based on sensitivity calculation results) and the third shard constraint are transmitted to the distribution computing layer synchronously. After receiving these constraints, the distribution computing layer will comprehensively analyze them. Considering the complexity constraint, if the data complexity is high, more shards are needed to reduce the processing difficulty; in terms of sensitivity constraint, high sensitivity data needs to be separately shard or special security measures are adopted; and the third shard constraint related to time features requires fast access to data during the peak cycle of data usage. According to these comprehensive calculation results, the distribution computing layer will configure a distribution number space to determine a reasonable shard number range that meets various constraint conditions and considers the resources and performance of the system.

[0043] A distribution random number is configured, which is randomly generated within a certain rule and range, and its purpose is to increase the randomness and flexibility of the shard. Then, combined with the previously configured distribution number space, the final shard number is determined using the distribution random number. For example, the distribution number space stipulates that the shard number is between 10 and 20, and the distribution random number may determine that the final shard number is 15. After determining the shard number, the feature data set is reasonably divided into different shards according to the specific requirements of the three shard constraints, and the data composition and related configurations of each shard are determined, thereby obtaining the final shard distribution result and providing accurate guidance for subsequent data storage and calculation.

[0044] In a possible implementation manner, the step S300 further includes:

[0045] The step S310: performing time length analysis on the sharding distribution result, recording data satisfying a first time length threshold as long-term storage data, recording data not satisfying a second time length threshold as short-term high-frequency access data, and recording data not recorded as high-speed access data.

[0046] The step S320: obtaining a data proportion of the long-term storage data, the short-term high-frequency access data and the high-speed access data, and establishing a first variation factor according to the data proportion.

[0047] The step S330: obtaining a data sensitivity of each data in the long-term storage data, the short-term high-frequency access data and the high-speed access data, and establishing a second variation factor according to the data sensitivity.

[0048] The step S340: performing record variation on the long-term storage data, the short-term high-frequency access data and the high-speed access data according to the first variation factor and the second variation factor, and distributing the sharding distribution result to the hybrid storage node for storage according to a record variation result.

[0049] Specifically, a detailed time length analysis is carried out on the sharding distribution result. Through comprehensive evaluation on each shard, data is classified according to time characteristics. According to a pre-set first time length threshold, data satisfying the threshold is marked as long-term storage data, which is usually stable and persistent, and is crucial for saving and analyzing historical data. Data not satisfying a second time length threshold is recorded as short-term high-frequency access data, which is frequently called in a short time and needs quick access response. Data not recorded by the above rules is classified as high-speed access data, which usually has a very high requirement for access speed.

[0050] The proportions of the three types of data in the overall data set are accurately obtained by traversing all classified data and calculating the proportions of long-term storage data, short-term high-frequency access data, and high-speed access data, respectively. For example, the proportions are determined by calculating the data volume, the number of data records, or the storage space occupied by the data. After obtaining these data proportions, a first variation factor is established based on them. The first variation factor is a numerical value that comprehensively considers the proportional relationship of the three types of data, and it reflects the relative importance and distribution of different types of data in the overall data. If the proportion of long-term storage data is high, it means that there is a large amount of data with historical value in the data set that needs to be saved for a long time, and the first variation factor will reflect the demand for long-term storage resources. If the proportion of short-term high-frequency access data is large, it indicates that the real-time and frequent access requirements of the data are more prominent, and the first variation factor will focus more on optimizing the access efficiency of short-term data. When the proportion of high-speed access data is high, it means that the system has a very high requirement for data access speed, and the first variation factor will guide the subsequent data storage and processing strategy to adjust in the direction of improving access speed. By establishing the first variation factor and according to the proportional relationship of different types of data, the data storage and management strategy is dynamically adjusted to achieve reasonable allocation of resources and efficiency of data processing.

[0051] For the classified long-term storage data, short-term high-frequency access data and high-speed access data, the data sensitivity evaluation work is carried out. Each data item is analyzed, and various factors are considered to determine the data sensitivity. For long-term storage data, it is considered whether the information contained therein relates to enterprise core secrets, long-term strategic planning, etc. If data leakage may have a significant impact on the long-term development of the enterprise, the sensitivity is higher. For short-term high-frequency access data, attention is paid to whether it contains real-time transaction information, personal privacy data, etc. Once such data is leaked, it may lead to user rights being damaged and business risks. For high-speed access data, the key degree in real-time business processes is evaluated, such as real-time data related to business transactions, which usually has a higher sensitivity. After obtaining the data sensitivity of each data, a second variation factor is established according to the sensitivity information. The second variation factor is an index that comprehensively reflects the sensitivity distribution of different types of data in the data set. If there are more high-sensitivity data in the long-term storage data, it means that more stringent security protection measures need to be taken for the long-term storage data, and the second variation factor will reflect higher requirements for long-term storage security. If the proportion of high-sensitivity data in short-term high-frequency access data is large, security control needs to be strengthened during data access and processing, and the second variation factor will guide the optimization of the security mechanism of short-term data access. When the sensitivity of high-speed access data is generally high, the security of data in the high-speed read-write process needs to be ensured, and the second variation factor will promote the security protection level of high-speed access data. By establishing the second variation factor, the security policy of data storage and management can be adjusted according to the sensitivity of the data, so as to protect the security and privacy of the data.

[0052] The records of long-term storage data, short-term high-frequency access data and high-speed access data are mutated based on a first mutation factor and a second mutation factor. The first mutation factor reflects the proportional relationship of different types of data, and the second mutation factor reflects the sensitivity distribution of the data. Comprehensive consideration of the two factors adjusts the records of various types of data. For long-term storage data, if the first mutation factor shows that its proportion is high, and the second mutation factor shows that there are more high-sensitivity data, more long-term storage data will be divided into smaller shards alone, and higher-level encryption algorithms will be used for encryption, and storage areas with higher security and better stability will be selected, such as enterprise-level tape libraries or large data center dedicated storage devices. For short-term high-frequency access data, if the first mutation factor shows that its proportion is large, and the second mutation factor shows that the sensitivity of part of the data is high, these data will be stored in the cache device close to the user end or access interface first, and the access control and audit mechanism will be strengthened to ensure that the data can be quickly accessed and its security can be guaranteed. For high-speed access data, when the first mutation factor shows that its proportion is large, and the second mutation factor shows that the data sensitivity is high, the storage layout is optimized, a distributed storage architecture is used, the data is stored in multiple high-performance storage nodes, and real-time encryption technology is used to prevent data from being stolen during high-speed transmission and processing. After the record mutation is completed, the shard distribution result is re-planned according to the mutation results, and each shard is reasonably distributed to the corresponding storage location in the mixed storage node. The mixed storage node includes local storage, distributed cloud storage and edge node temporary storage, and according to the new characteristics and needs of different types of data, it is accurately allocated to the most suitable storage node, so as to realize the efficiency, security and reliability of data storage.

[0053] In one possible implementation, step S340 further includes:

[0054] Step S341: The storage layer of the mixed storage architecture includes local storage, distributed cloud storage and edge node temporary storage.

[0055] Specifically, in the entire data storage system, the storage layer of the hybrid storage architecture plays a crucial role. The storage layer is composed of local storage, distributed cloud storage, and edge node temporary storage. Initially, before the record mutation operation is performed, the three storage methods correspond to different types of data: local storage is mainly used to store long-term storage data, which is relatively stable, has a low update frequency, and has high requirements for long-term data preservation and integrity; distributed cloud storage is responsible for storing short-term high-frequency access data, which has strong scalability and flexible access capabilities, and can well cope with the frequent read and write requests of this type of data; edge node temporary storage is suitable for high-speed access data, which can quickly respond to the high-speed access requirements of data due to its proximity to data sources and user terminals. After the record mutation operation, the storage characteristics of the data change, and the storage layer needs to adjust the storage strategy accordingly. At this time, the mutation mainly changes the original data record form, and this change involves encryption methods, storage formats, access permissions, and other aspects. In adjusting the storage strategy, the storage layer still relies on local storage, distributed cloud storage, and edge node temporary storage for storage, but will optimize the storage method according to the data characteristics after the mutation. For example, for long-term storage data with higher encryption strength after mutation, local storage will increase higher-level security protection mechanisms; for short-term high-frequency access data with further improved access speed requirements after mutation, distributed cloud storage will optimize its data transmission and reading algorithms; for high-speed access data with more stringent security requirements after mutation, edge node temporary storage will strengthen data encryption and access verification processes, to ensure that all types of data can be properly stored and managed in the storage layer, and to ensure the efficient and secure operation of the entire data storage system.

[0056] In one possible implementation manner, step S500 further includes:

[0057] Step S510: Obtain a demand subject of the computing task, monitor the behavior of the demand subject, and establish a behavior data set.

[0058] Step S520: Backtrack to obtain a computing verification passing result of the computing task, and perform risk identification of the demand subject according to the computing verification passing result and the behavior data set.

[0059] Step S530: Configure an additional verification scheme according to the risk identification result, and perform additional verification management of the demand subject based on the additional verification scheme.

[0060] Specifically, after completing the computing task and outputting the result, a new security monitoring process is entered, first obtaining the demand subject of the computing task, which can be an individual user, an enterprise department, or other systems, etc. Then, comprehensive behavior monitoring is performed on the demand subject, and its behavior data is collected through various ways. For example, the mouse trajectory tracking technology is used to record the mouse movement path, click frequency and position when the demand subject operates the device; the keyboard input is monitored to analyze the typing rhythm, including key interval time, error correction frequency, etc.; at the same time, the information of the demand subject accessing the page is recorded, such as the URL, stay time, jump order, etc. of the page. These monitored data are integrated to generate the original monitoring data set, and then key information such as the frequency of specific operations and the access time distribution of different pages is extracted from the data set to establish the behavior data set.

[0061] Through a specific database query interface, the computing verification passing result of the computing task is retrieved from the database table recording the computing verification result, using the unique identifier of the computing task as the retrieval keyword. These results record in detail the input data of the task, the computing process, the algorithms used, and the final verification conclusion, etc. information. For the behavior data set, clustering algorithms in machine learning, such as DBSCAN algorithm, are used to group the behavior data according to similarity and identify different behavior patterns. Then, using association rule mining algorithms, such as Apriori algorithm, the frequently occurring behavior combinations in the behavior data set are found out to establish a rule library of normal behavior patterns. In the risk identification stage, the task-related information in the computing verification passing result is associated with the analysis result of the behavior data set. For example, check if there is any abnormal behavior related to sensitive operations of the computing task (such as data export, modification of key parameters, etc.) in the behavior pattern. If some operations in the behavior data are found to be unmatched with the rules in the normal behavior pattern rule library, and these abnormal behaviors are related to the security-critical links of the computing task, it is judged that the demand subject is at risk. At the same time, using risk assessment models such as Analytic Hierarchy Process (AHP), the severity of abnormal behavior, the frequency of occurrence, and the importance and sensitivity of the computing task are comprehensively considered to quantitatively evaluate the risk of the demand subject and determine the risk level, providing a basis for subsequent security decisions.

[0062] According to the results of risk identification, the corresponding additional verification scheme is configured for the demand subject. If the risk identification result shows that the demand subject has low risk, for example, there are occasional minor abnormal behaviors, but the overall operation is still within the acceptable range, a relatively simple additional verification scheme will be configured, such as sending a one-time password to the mobile phone associated with the demand subject, and requiring it to input the correct password within the specified time for verification. When the risk level is medium, the system will use more stringent additional verification measures. For example, in addition to sending an SMS verification code, the demand subject will also be required to complete a simple graphical verification task, such as clicking on specific elements on the picture in the specified order, to increase the security and complexity of the verification. For high-risk demand subjects, the system will enable a multi-factor authentication additional verification scheme. This may include biometric technologies such as fingerprint recognition, facial recognition, combined with dynamic password and security question verification, and other ways. For example, first perform facial recognition to confirm the identity of the demand subject, then require the input of the dynamic password obtained from the mobile phone, and finally answer the pre-set security question, only after all verification is passed can the identity be confirmed. After configuring the additional verification scheme, the system will manage the additional verification of the demand subject based on this scheme. In the subsequent operation process of the demand subject, whenever it attempts to access sensitive data or initiate a critical computing task, the additional verification process is automatically triggered, and the verification steps are strictly performed according to the configured verification scheme, and the demand subject's input verification information is verified in real time. If the verification is passed, the demand subject can continue to perform related operations; if the verification fails, the operation permission is restricted, and corresponding measures are taken according to the pre-set rules, such as recording the number of failures, temporarily locking the account, etc., to protect data security and stable operation of the system.

[0063] In one possible implementation, step S510 further includes:

[0064] Step S511: Monitor and record mouse trajectory data, typing rhythm data, and access page data to generate a monitoring data set.

[0065] Step S512: Extract key data from the monitoring data set to establish a behavior data set.

[0066] Specifically, the behavior data of the demand subject is comprehensively collected. Through the monitoring tool deployed on the terminal device, the mouse trajectory data is captured in real time, and the coordinate position and timestamp of each movement and click of the mouse on the screen are accurately recorded, so as to completely present the motion path and operation rhythm of the mouse. At the same time, with the help of the keyboard input monitoring program, the press and release time of each key is recorded in detail, so as to obtain the typing rhythm data, including the key interval time, continuous key speed and other information. In addition, by using the network monitoring module and browser plug-in, the behavior of the demand subject accessing the page is tracked, and the URL of the accessed page, the stay time on each page, and the sequence and frequency of page jumps and other data are recorded. The mouse trajectory data, typing rhythm data and page access data obtained from different dimensions are integrated to form a monitoring data set covering the multi-aspect operation behavior of the demand subject, providing rich raw materials for subsequent in-depth analysis.

[0067] In order to extract key data from the monitoring data set to establish the behavior data set, the principal component analysis (PCA) algorithm is used to reduce the dimension of the data. For the monitoring data set containing mouse trajectory data, typing rhythm data and page access data, these data often have high dimension and certain correlation. The PCA algorithm finds the principal component direction of the data by calculating the covariance matrix of the data set, projects the original high-dimensional data onto these principal components, removes redundant information, and reduces the dimension of the data while retaining the main features of the data. The decision tree algorithm is used to further analyze the reduced data. The decision tree divides the data recursively based on indicators such as information gain or Gini index. In terms of mouse trajectory data, the decision tree can divide the data into different nodes based on the number of clicks in different areas and the moving speed of the mouse, and identify representative mouse operation modes. For typing rhythm data, the decision tree can classify based on key interval time and error correction frequency, and find different typing behavior patterns. In terms of page access data, the decision tree can divide different page access behavior patterns based on page access frequency, stay time and jump order. Finally, according to the results of the decision tree division, the key features of each node are extracted, which constitute the behavior data set. For example, in the mouse trajectory data, the high-frequency click behavior feature in a specific operation area is extracted; in the typing rhythm data, the behavior feature of fast input of common character combinations is extracted; in the page access data, the behavior feature of frequent access to a specific page set is extracted. Through the extraction of these key data, the behavior data set is successfully established, providing effective data support for subsequent risk identification and other operations.

[0068] In one possible implementation manner, step S540 further includes:

[0069] Step S541: Obtain the feedback score of the multi-party secure computing node.

[0070] Step S542: Update the security value of the multi-party secure computing node according to the feedback score at a preset period, and perform selection and calling management of the multi-party secure computing node according to the updated security value.

[0071] Specifically, the feedback score acquisition process for the multi-party secure computing node is started, a stable communication link is established with each participating multi-party secure computing node, and a specific communication protocol, such as a customized interface based on HTTP / HTTPS, is used to send a score request to each node. After receiving the request, each secure computing node will evaluate the performance of each node during the execution of the multi-party secure computing task according to the evaluation standard set internally. For data processing, the node will consider the accuracy of the data, such as the deviation rate of the calculation result from the expected value; at the same time, it will pay attention to the efficiency of data processing, that is, whether the time spent to complete the task is within a reasonable range. In terms of security, the node will evaluate the strength of its data encryption, whether it effectively prevents data leakage, and its ability to respond to various security attacks. In addition, the node will also review the cooperation between nodes, including the stability of data transmission, the timeliness of responding to other node requests, etc. After comprehensive evaluation, each node will generate a feedback score reflecting its overall performance, which will usually be presented in numerical form and packaged in a specific data structure according to the system's required format, such as a JSON format data packet. Subsequently, the node will return the packaged feedback score data packet to the system through the previously established communication link. After receiving these feedback scores, they are sorted and stored for subsequent use in updating the security value of the node and related management operations.

[0072] The preset period node is a pre-set time point or time period. At this specific time, the security value of the multi-party secure computing node is updated according to the obtained feedback score. The security value is an important indicator to measure the security and reliability of the node. According to a set of preset calculation rules, the current security value is adjusted in combination with the feedback score. For example, if the feedback score of a node is high, it means that the node performs well in the execution process of the computing task, and the security value of the node is appropriately increased. On the contrary, if the feedback score is low, the security value of the node will be reduced. After updating the security value, the multi-party secure computing node is selected and called according to the updated security value. When there is a new computing task to be allocated in the subsequent process, the node with a higher security value is preferentially selected to execute the task. This is because the node with a higher security value means that it has better security and reliability in terms of security and reliability, can better protect the security and privacy of data, and ensure the accuracy of the calculation result. At the same time, for the node with a lower security value, the use of the node is limited, or the node is required to be rectified, and the normal calling is restored after the security value is improved. In this way, the multi-party secure computing node can be dynamically managed, and the overall computing security and efficiency can be improved.

[0073] In the second embodiment, based on the same inventive concept as the intrusion protection method of the trusted data space in the foregoing embodiments, as shown in the following table, the present application provides an intrusion protection system for a trusted data space, and the system and method embodiments in the present application are based on the same inventive concept. The system comprises: Figure 2

[0074] The feature data set establishment module 10 is configured to extract data features of sensitive data and establish a feature data set of the sensitive data.

[0075] The sharding and distribution result generation module 20 is configured to activate a hybrid sharding computing unit, perform sharding and distribution calculation based on the feature data set by using the hybrid sharding computing unit, and generate a sharding and distribution result.

[0076] The node storage module 30 is configured to distribute the sharding and distribution result to a hybrid storage node storage by using a hybrid storage architecture.

[0077] The multi-party secure computing node configuration module 40 is configured to configure a multi-party secure computing node according to the task complexity, the task calculation time random number, and the task trust degree of a computing task when the computing task is obtained.

[0078] The output result feedback module 50 is configured to perform homomorphic encryption on the storage data of the hybrid storage node, perform calling calculation on the storage data of the hybrid storage node by using the multi-party secure computing node, and feed back the calculation result as an output result.

[0079] Further, the system is also configured to implement the following functions: ​

[0080] activating a complexity calculation layer of the hybrid sharding calculation unit, performing complexity calculation on the feature data set by using the complexity calculation layer, establishing a first sharding constraint according to the complexity calculation result; activating a sensitivity calculation layer of the hybrid sharding calculation unit, performing sensitivity calculation on the feature data set by using the sensitivity calculation layer, establishing a second sharding constraint according to the sensitivity calculation result; synchronizing the first sharding constraint and the second sharding constraint to a distribution calculation layer to generate a sharding distribution result.

[0081] Further, the system is also used to implement the following functions:

[0082] According to the feature data set, extracting timestamp features, access frequency features, and task period features, taking the timestamp features, the access frequency features, and the task period features as time features, establishing a third sharding constraint; after synchronizing the first sharding constraint, the second sharding constraint, and the third sharding constraint to the distribution calculation layer, configuring a distribution quantity space according to the calculation result; configuring a distribution random number, and determining a sharding distribution result according to the distribution random number and the distribution quantity space.

[0083] Further, the system is also used to implement the following functions:

[0084] Performing duration analysis of each sharding on the sharding distribution result, recording data meeting a first duration threshold as long-term storage data, recording data not meeting a second duration threshold as short-term high-frequency access data, and recording unrecorded data as high-speed access data; obtaining data proportions of the long-term storage data, the short-term high-frequency access data, and the high-speed access data, establishing a first variation factor according to the data proportions; obtaining data sensitivity of each data in the long-term storage data, the short-term high-frequency access data, and the high-speed access data, establishing a second variation factor according to the data sensitivity; performing record variation of the long-term storage data, the short-term high-frequency access data, and the high-speed access data according to the first variation factor and the second variation factor, and distributing the sharding distribution result to the hybrid storage node storage according to the record variation result.

[0085] Further, the system is also used to implement the following functions:

[0086] The storage layer of the hybrid storage architecture includes local storage, distributed cloud storage, and edge node temporary storage.

[0087] Further, the system is also used to implement the following functions:

[0088] Obtain the demand subject of the computing task, monitor the behavior of the demand subject, and establish a behavior dataset; trace back the computing verification passing result of the computing task, and perform risk identification of the demand subject according to the computing verification passing result and the behavior dataset; configure an additional verification scheme according to the risk identification result, and perform additional verification management of the demand subject based on the additional verification scheme.

[0089] Further, the system is also used to implement the following functions:

[0090] Monitor and record mouse track data, typing rhythm data, and access page data to generate a monitoring dataset; extract key data from the monitoring dataset to establish a behavior dataset.

[0091] Further, the system is also used to implement the following functions:

[0092] Obtain feedback scores of the multi-party secure computing nodes; update the security values of the multi-party secure computing nodes according to the feedback scores at a preset period node, and perform selection and calling management of the multi-party secure computing nodes according to the updated security values.

[0093] Embodiment three, based on the same inventive concept as the intrusion protection method of the trusted data space in the foregoing embodiments, this embodiment provides a computer readable storage medium, which can be used to store software programs, computer executable programs and modules, such as the program instructions / modules corresponding to the intrusion protection method of the trusted data space in the embodiments of the present application. The processor executes the software programs, instructions and modules stored in the memory, thereby performing various functional applications and data processing of the computer device, that is, implementing the above-mentioned intrusion protection method of the trusted data space.

[0094] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And the above describes a specific embodiment of the present application. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or can be advantageous.

[0095] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0096] The specification and drawings are, of course, to be regarded in an illustrative rather than a restrictive sense. It is to be understood that any such modifications, variations, combinations or equivalents which fall within the scope of the application are intended to be embraced herein.

Claims

1. An intrusion prevention method for a trusted data space, characterized in that, The method includes: Extract data features from sensitive data and establish a feature dataset for sensitive data; Activate the hybrid sharding computation unit, and use the hybrid sharding computation unit to perform sharding distribution computation based on the feature dataset to generate sharding distribution results, including: Activate the complexity calculation layer of the hybrid sharding calculation unit, use the complexity calculation layer to calculate the complexity of the feature dataset, and establish the first sharding constraint based on the complexity calculation result; Activate the sensitivity calculation layer of the hybrid sharding calculation unit, use the sensitivity calculation layer to perform sensitivity calculation on the feature dataset, and establish a second sharding constraint based on the sensitivity calculation result; The first and second sharding constraints are synchronized to the distribution calculation layer to generate sharding distribution results, including: Based on the feature dataset, timestamp features, access frequency features, and task cycle features are extracted. The timestamp features, access frequency features, and task cycle features are used as time features to establish a third partitioning constraint. After synchronizing the first fragmentation constraint, the second fragmentation constraint, and the third fragmentation constraint to the distribution calculation layer, the distribution quantity space is configured according to the calculation results; Configure a random number for distribution, and determine the fragmentation distribution result based on the random number for distribution and the distribution quantity space; The sharding distribution results are distributed to hybrid storage nodes using a hybrid storage architecture; Once a computation task that has passed the computation verification is obtained, multi-party secure computation nodes are configured based on the task complexity, random number of task computation time, and task trust level. After homomorphically encrypting the stored data of the hybrid storage node, the multi-party secure computing node is used to perform calculations on the stored data of the hybrid storage node, and the calculation results are fed back as output results.

2. The intrusion prevention method for a trusted data space as described in claim 1, characterized in that, The step of distributing the sharding distribution results to hybrid storage nodes using a hybrid storage architecture includes: The fragmented distribution results are analyzed for the duration of each fragment. Data that meets the first duration threshold is recorded as long-term storage data, data that does not meet the second duration threshold is recorded as short-term high-frequency access data, and unrecorded data is recorded as high-speed access data. Obtain the data ratio of long-term stored data, short-term high-frequency access data, and high-speed access data, and establish a first variation factor based on the data ratio; Obtain the data sensitivity of each data point in long-term stored data, short-term high-frequency access data, and high-speed access data, and establish a second variation factor based on the data sensitivity; Based on the first mutation factor and the second mutation factor, the records of long-term stored data, short-term high-frequency access data, and high-speed access data are mutated, and the sharding distribution results are distributed to the hybrid storage nodes for storage based on the mutation results.

3. The intrusion prevention method for a trusted data space as described in claim 2, characterized in that, The storage layer of the hybrid storage architecture includes local storage, distributed cloud storage, and temporary storage at edge nodes.

4. The intrusion prevention method for a trusted data space as described in claim 1, characterized in that, The step of feeding back the calculation result as an output includes: Obtain the entities that require the computing tasks, monitor their behavior, and establish a behavior dataset; The computation verification results of the computation task are retrieved retrospectively, and the risk identification of the demand subject is performed based on the computation verification results and the behavior dataset. Configure additional verification schemes based on the risk identification results, and manage additional verification for the target entity based on the additional verification schemes.

5. The intrusion prevention method for a trusted data space as described in claim 4, characterized in that, The establishment of the behavior dataset includes: Monitor and record mouse trajectory data, typing rhythm data, and page access data to generate a monitoring dataset; Key data are extracted from the monitoring dataset to establish a behavioral dataset.

6. The intrusion prevention method for a trusted data space as described in claim 1, characterized in that, After feeding back the calculation result as the output, it also includes: Obtain feedback scores from multiple secure computation nodes; At a preset periodic node, the security value of the multi-party secure computing node is updated based on the feedback score, and the selection, invocation, and management of the multi-party secure computing node are performed based on the updated security value.

7. An intrusion prevention system for a trusted data space, characterized in that, The system is used to implement the intrusion prevention method for a trusted data space as described in any one of claims 1-6, and the system comprises: The feature dataset creation module is used to extract data features from sensitive data and create a feature dataset for sensitive data. The sharding distribution result generation module is used to activate the hybrid sharding calculation unit, and use the hybrid sharding calculation unit to perform sharding distribution calculation based on the feature dataset to generate sharding distribution results; The sharding distribution result distribution module is used to distribute the sharding distribution result to hybrid storage nodes for storage using a hybrid storage architecture. The multi-party secure computation node configuration module is used to configure multi-party secure computation nodes based on the task complexity, random number of task computation time, and task trust level after obtaining a computation task that has passed computation verification. The output result feedback module is used to homomorphically encrypt the stored data of the hybrid storage node, and then use the multi-party secure computing node to perform calculations on the stored data of the hybrid storage node, and feed the calculation results back as output results.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the intrusion prevention method for a trusted data space as described in any one of claims 1-6.

Images