Data security backup method and system based on multilayer encryption

Abstract

The invention discloses a data security backup method and system based on multi-layer encryption, and particularly relates to the technical field of industrial internet encryption and storage. Data needing to be backed up is classified, and a unique identifier is generated for the data; performing primary encryption on the data by selecting a symmetric encryption algorithm to generate a primary ciphertext; performing identity authentication and management on the asymmetric encryption key; storing the encrypted data to a plurality of distributed storage nodes with scattered geographic positions, segmenting the data into data blocks by adopting an erasure code technology, and carrying out redundant coding storage; setting a regular check mechanism, recalculating the hash value of the stored data, and comparing the hash value with the original hash value; on the security level, the multilayer encryption technology is combined with symmetric, asymmetric and quantum encryption, an algorithm is selected according to the data sensitivity degree, a firm security defense line is created for data, various attacks are effectively resisted, and the data leakage risk is reduced.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet encryption and storage technology, and more specifically, to a data security backup method and system based on multi-layer encryption. Background Art

[0002] As digitalization accelerates, data becomes a key asset, making data security and backup crucial. However, traditional data security and backup methods present significant challenges. For one thing, encryption methods are limited, often relying on simple symmetric or asymmetric encryption. This makes data vulnerable to leakage or tampering in the face of sophisticated cyberattacks. For example, if a small business uses simple symmetric encryption, data security is compromised once the key is leaked.

[0003] On the other hand, there is a lack of effective data integrity detection mechanism, and data damage during the backup process is difficult to detect and repair. For example, when a database backup encounters a disk failure, the traditional system cannot guarantee the integrity of the restored data. At the same time, data recovery efficiency is low, there is no effective index, data locating is slow during recovery, and incremental recovery is not supported. Therefore, a data security backup method and system based on multi-layer encryption is proposed to solve the above problems. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a data security backup method and system based on multi-layer encryption, selects AES algorithms of different strengths based on data sensitivity, and dynamically authenticates asymmetric keys in combination with a digital certificate mechanism, thereby establishing a secure closed loop from data attribute identification to encryption algorithm allocation, ensuring that highly sensitive data has dynamic and controllable strong encryption protection capabilities, reducing the systemic risks caused by key leakage, and solving the technical problems raised by the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a data security backup method based on multi-layer encryption, comprising the following steps:

[0006] S1. Classify the data to be backed up and generate a unique identifier for the data;

[0007] S2. Use a symmetric encryption algorithm to initially encrypt the data and generate a preliminary ciphertext; perform identity authentication and management on the asymmetric encryption key;

[0008] S3: Store the encrypted data in multiple geographically dispersed distributed storage nodes, use erasure coding technology to split the data into data blocks and perform redundant encoding storage;

[0009] S4. When backing up data, use a hash function to generate a hash value for each encrypted data and store it; set up a periodic inspection mechanism to recalculate the hash value of the stored data and compare it with the original hash value;

[0010] S5. Provides a visual interface for users to customize backup strategies, including setting backup cycles, backup time points, and backup data ranges;

[0011] S6. After receiving the user's data recovery request, the encrypted data is obtained from the distributed storage node according to the data identifier and recovery time point in the request.

[0012] In a preferred embodiment, in step S1, data is classified based on its sensitivity, business system, data format and frequency of use; data sensitivity is divided into high, medium and low levels according to the importance of the information contained in the data and the degree of privacy involved; the business systems include finance, personnel and sales systems; the data formats include relational database files, document files, image files and video files; the frequency of use is determined by counting the number of times the data has been accessed in the past 30 days, with 100 times being set as the threshold. Data above the threshold is considered high-frequency use data, and data below the threshold is considered low-frequency use data.

[0013] In a preferred embodiment, in step S2, a symmetric encryption algorithm is selected based on the data type and sensitivity;

[0014] For highly sensitive database files, the AES-256 algorithm is used to group data into 128-bit groups and encrypt them using a 256-bit key. The encryption process includes byte replacement, row shifting, column obfuscation, and round key plus multiple rounds of operations.

[0015] For moderately sensitive documents, the AES-128 algorithm is used, grouped into 128-bit blocks and encrypted with a 128-bit key.

[0016] For low-sensitivity image files, the AES-192 algorithm is used, with 128-bit blocks and a 192-bit key for encryption;

[0017] A digital certificate authentication mechanism is introduced to authenticate the identity of the asymmetric encryption key holder; after receiving the request from the key applicant through the digital certificate authentication mechanism, the business license, personal ID card identity information, corporate organizational structure and business scope organization information submitted by the applicant are reviewed; after the review is passed, the applicant's public key, identity information and validity period are signed with its own private key through the digital certificate authentication mechanism to generate a digital certificate; during the encrypted communication process, the sender obtains the receiver's digital certificate, and uses the public key introduced in the digital certificate authentication mechanism to verify the legitimacy of the certificate signature to confirm the receiver's identity. The digital certificate is updated regularly every six months, and the review materials need to be resubmitted when updating.

[0018] In a preferred embodiment, in step S3, the SHA-512 hash function is used, and the unique identifier and backup start time of the data are used as input parameters. When calculating the hash value, the unique identifier and timestamp are first converted into a byte array according to a specific encoding format, and then the byte array is padded according to the SHA-512 algorithm rules so that its length meets the 512-bit integer multiple required by the algorithm. The padded byte array is then divided into groups of fixed size, and a compression function operation is performed on each group in turn. The operation involves multiple rounds of complex bit operations and logical operations, and finally a 256-bit hash value is obtained, which is stored together with the encrypted data.

[0019] In a preferred embodiment, in step S4, the periodic check mechanism is set to have a check period of 2:00 a.m. every day. During the check, the system reads the encrypted data and the corresponding hash value from the storage device and recalculates the hash value of the encrypted data. If the hash values are inconsistent, the system initiates a data repair procedure.

[0020] Obtain redundant data blocks from corresponding distributed storage nodes according to pre-recorded redundant data block storage location information;

[0021] The erasure code recovery algorithm is used to recover damaged data blocks. The algorithm attempts to reconstruct the damaged data blocks by performing calculations on redundant data blocks and some undamaged data blocks. If the recovery fails, the system obtains the data from the storage nodes where other backup copies are located according to the preset backup copy search strategy. After obtaining the data, the hash value is recalculated and compared with the original hash value.

[0022] If there is still inconsistency, the data integrity exception event will be recorded; the record content includes data identification, backup time, exception occurrence time, storage node information involved, original hash value, inconsistent hash values calculated multiple times, and preliminary speculation on the cause of the data exception based on the system operation status and related logs.

[0023] In a preferred embodiment, in step S6, after receiving the user's data recovery request, identity authentication is performed; the authentication method adopts multi-factor authentication, which includes the user entering a password, a dynamic verification code sent by the system to the bound mobile phone, and fingerprint recognition;

[0024] After the user enters the password, the password is hashed and compared with the hash value stored in the database; the dynamic verification code entered by the user is obtained and matched with the verification code sent by the system; if the device has fingerprint recognition function, the user's fingerprint is collected and compared with the pre-stored fingerprint template;

[0025] When all three verification methods are passed, the user's identity is confirmed to be legitimate; encrypted data is obtained from the distributed storage node based on the data identifier and recovery time point; the storage node information where the data is located is searched in the storage record of the blockchain based on the data identifier. The storage record of the blockchain contains the mapping relationship between the data identifier and the storage node. By performing a hash calculation on the data identifier, the corresponding storage record is located, and a data request is sent to the corresponding distributed storage node based on the node address information in the storage record;

[0026] If the data stored in the node has been processed with erasure coding, the node determines the data blocks and redundant data blocks that need to be provided based on the recovery time point, and sends these data blocks back to the system. After receiving the data, the system checks the integrity of the data. If the data is complete, the next step of decryption operation is performed. If the data is missing or damaged, it is repaired based on the redundant data and erasure code recovery algorithm.

[0027] A data security backup system based on multi-layer encryption, comprising: a data classification identification module, a multi-layer encryption module, a distributed storage module, an integrity verification module, a backup strategy management module and a data recovery module;

[0028] The data classification and identification module is used to classify the data to be backed up and generate a unique identifier for the data;

[0029] The multi-layer encryption module is used to select a symmetric encryption algorithm to perform initial encryption on data and generate preliminary ciphertext; it also performs identity authentication and management on asymmetric encryption keys;

[0030] The distributed storage module is used to store encrypted data in multiple geographically dispersed distributed storage nodes, using erasure coding technology to divide the data into data blocks and perform redundant encoding storage;

[0031] The integrity check module is used to generate and store a hash value for each encrypted data using a hash function when backing up data; a periodic check mechanism is set up to recalculate the hash value of the stored data and compare it with the original hash value;

[0032] The backup strategy management module is used to provide a visual interface for users to customize backup strategies, and can set the backup cycle, backup time point, and backup data range;

[0033] The data recovery module is used to obtain encrypted data from the distributed storage node according to the data identifier and recovery time point in the request after receiving the user's data recovery request.

[0034] The technical effects and advantages of the present invention are as follows:

[0035] 1. We select AES algorithms of varying strengths based on data sensitivity and dynamically authenticate asymmetric keys using digital certificates. This establishes a secure closed loop from data attribute identification to encryption algorithm allocation, ensuring highly sensitive data possesses dynamic, controllable, and strong encryption protection capabilities, mitigating systemic risks from key leaks.

[0036] 2. By using erasure codes to redundantly encode data blocks and distribute them across geographically distributed nodes, redundant blocks can be used to reconstruct data when hash inconsistencies are detected, mitigating the impact of disk failures on data integrity and building a multi-source redundant fault-tolerant system.

[0037] 3. Hash values are recalculated and compared through a periodic verification mechanism. Once an anomaly is detected, a repair program is triggered and the anomaly is recorded in detail, effectively improving the ability to perceive and respond to potential threats such as hidden data tampering and media aging.

[0038] 4. The data recovery process embeds a multi-factor authentication mechanism and combines it with blockchain storage mapping to enhance identity security and data path transparency during the recovery process;

[0039] 5. Provide users with a visual customization interface to set the backup cycle, time point and data range, and intelligently recommend strategies based on server load and user habits to achieve precise and low-intrusion backup management. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of the steps of the present invention.

[0041] Figure 2 It is a system module diagram of the present invention.

[0042] Figure 3 This is a flow chart of data access and multi-layer encryption of the present invention.

[0043] Figure 4 This is a flow chart of the distributed storage and redundant backup of the present invention.

[0044] Figure 5 This is a flow chart of data integrity verification and fault repair according to the present invention.

[0045] Figure 6 This is a flow chart of data recovery request and identity authentication according to the present invention. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] An example implementation will now be described more fully with reference to the accompanying drawings. S1. Classify the data to be backed up and generate a unique identifier for the data; S2. Select a symmetric encryption algorithm to initially encrypt the data to generate a preliminary ciphertext; authenticate and manage the asymmetric encryption key; S3. Store the encrypted data in multiple geographically dispersed distributed storage nodes, use erasure coding technology to divide the data into data blocks and perform redundant encoding storage; S4. When backing up data, use a hash function to generate and store a hash value for each encrypted data; set a regular inspection mechanism to recalculate the hash value of the stored data and compare it with the original hash value; S5. Provide a visual interface for users to customize backup strategies, and set the backup cycle, backup time point, and backup data range; S6. After receiving a user's data recovery request, obtain the encrypted data from the distributed storage node based on the data identifier and recovery time point in the request;

[0048] In step S1, data is classified based on its sensitivity, business system, data format, and frequency of use. Data sensitivity is divided into three levels: high, medium, and low, based on the importance of the information contained in the data and the degree of privacy involved. Business systems include finance, personnel, and sales systems. Data formats include relational database files, document files, image files, and video files. Frequency of use is determined by counting the number of times data has been accessed in the past 30 days, with a threshold of 100 times. Data above this threshold is considered high-frequency use, while data below this threshold is considered low-frequency use.

[0049] The calculation of data usage frequency is as follows: let the number of data accesses in the past 30 days be N, and the data access records are stored in a time series set R = {r1, r2, ..., r n}, where r i Represents the i-th access record, including access time t i and data identifier d i ; The current time is T, then: Where I is an indicator function. When the condition in the brackets is met, I = 1, otherwise I = 0. d is the identifier of the data whose access frequency is currently being calculated. If N > 100, the data is frequently used data; if N ≤ 100, the data is infrequently used data.

[0050] In addition, the data is uniquely generated as follows: Let the data classification information be C and the creation timestamp be T c , the 16-bit random number is R 16 , the unique identification ID is generated by the following formula: ID = SHA-256 (C | | T c ∣∣R 16 );

[0051] Where ∣∣ represents the string concatenation operation, and SHA-256 is the corresponding hash function;

[0052] In step S2, a symmetric encryption algorithm is selected based on the data type and sensitivity;

[0053] For highly sensitive database files, the AES-256 algorithm is used to group data into 128-bit groups and encrypt them using a 256-bit key. The encryption process includes byte replacement, row shifting, column obfuscation, and round key plus multiple rounds of operations.

[0054] For moderately sensitive documents, the AES-128 algorithm is used, also grouped into 128-bit blocks and encrypted with a 128-bit key.

[0055] For low-sensitivity image files, the AES-192 algorithm is used, with 128-bit blocks and a 192-bit key for encryption;

[0056] A digital certificate authentication mechanism is introduced to authenticate the asymmetric encryption key holder. After receiving the key applicant's request through the digital certificate authentication mechanism, the business license, personal ID card identity information, corporate organizational structure and business scope information submitted by the applicant are reviewed. After the review is passed, the applicant's public key, identity information and validity period are signed with its own private key through the digital certificate authentication mechanism to generate a digital certificate. During the encrypted communication process, the sender obtains the receiver's digital certificate and uses the public key introduced in the digital certificate authentication mechanism to verify the legitimacy of the certificate signature to confirm the receiver's identity. The digital certificate is updated regularly every six months, and the review materials need to be resubmitted when updating. Taking AES-256 as an example, the input data block M is a 128-bit (16-byte) vector M = (m0, m1, ..., m 15 ), the key K is a 256-bit (32-byte) vector K = (k0, k1, ..., k 31 );

[0057] Byte replacement is shown as follows: Let S be an S-box, which is a 16x16 lookup table. For each byte m in M i , the replaced byte m′ i =S[m i ];

[0058] The row shifts are: row 0: m′0, m′1, m′2, m′3 remain unchanged;

[0059] Line 1: m′4, m′5, m′6, m′7 are circularly shifted left by 1 byte;

[0060] Row 2: m′8, m′9, m′ 10 ,m′ 11 Circularly shift left by 2 bytes;

[0061] Row 3: m′ 12 ,m′ 13 ,m′ 14 ,m′ 15 Circularly shift left by 3 bytes;

[0062] Then column confusion: Let M' be the matrix after row shift, M" be the matrix after column confusion, each column M" j It is obtained by the following matrix multiplication:

[0063]

[0064] The multiplication and addition are performed over the finite field GF(2 8 )

[0065] Then the round key is added: Let the subkey of round r be K r ,but Represents a bitwise exclusive OR operation;

[0066] Digital certificate signing and verification:

[0067] Assume that the private key of the digital certificate authentication mechanism (CA) is SK CA , the public key is PK CA , the applicant's public key is PK, identity information is ID, and validity period is T;

[0068] Signature generation: Signature = E(SK CA ,H(PK|||ID||T));

[0069] Where E is the encryption function using the private key, and H is the hash function (such as SHA-256); signature verification:

[0070] Where D is the function that uses the public key for decryption; if the equality holds, the signature verification is successful;

[0071] In step S3, the SHA-512 hash function is used, with the data's unique identifier and backup start time as input parameters. When calculating the hash value, the unique identifier and timestamp are first converted into a byte array according to a specific encoding format. Then, according to the SHA-512 algorithm rules, the byte array is padded to make its length an integer multiple of 512 bits that meets the algorithm's requirements. Next, the padded byte array is divided into fixed-size groups, and a compression function operation is performed on each group in turn. This operation involves multiple rounds of complex bit operations and logical operations, ultimately obtaining a 256-bit hash value, which is stored together with the encrypted data.

[0072] Hash calculation means setting the unique identifier of the data as ID and the backup start time as T b , concatenate them into a string S = ID | | T b , converted to byte array B;

[0073] The padding operation means that the length of B is L bytes, and the length of the byte array B' after padding must satisfy (L+1+k)mod1024=896, where k is the number of bytes added with 0; first add a 1-bit "1" after B, then add k 0s, and finally add a 64-bit binary number representing the length of the original byte array L;

[0074] The SHA-512 hash calculation is to fill the byte array B ′ Divide into fixed-size groups G1, G2, ..., G n , each group of 1024 bits (128 bytes) undergoes operations including AND, OR, NOT, XOR, and specific constants and shift operations, and finally obtains a 256-bit hash value H;

[0075] In step S4, the periodic check mechanism is set to check at 2:00 a.m. every day. During the check, the system reads the encrypted data and the corresponding hash value from the storage device and recalculates the hash value of the encrypted data. If the hash values are inconsistent, the system starts the data repair program.

[0076] First, the system obtains redundant data blocks from the corresponding distributed storage nodes based on the pre-recorded redundant data block storage location information;

[0077] The system uses an erasure code recovery algorithm to recover damaged data blocks. This algorithm attempts to reconstruct the damaged data blocks by performing specific mathematical operations on redundant data blocks and some undamaged data blocks. If recovery fails, the system retrieves the data from the storage nodes where other backup copies are located according to the preset backup copy search strategy. After retrieving the data, the hash value is recalculated and compared with the original hash value.

[0078] If there is still inconsistency, the system will record this data integrity anomaly event; the record content includes data identification, backup time, anomaly occurrence time, involved storage node information, original hash value, inconsistent hash values calculated multiple times, and the preliminary inference of the cause of the data anomaly based on the system operation status and related logs;

[0079] Erasure coding technology uses redundant data blocks to generate:

[0080]

[0081] Using (3, 2) erasure code technology, let the original data blocks be D1, D2, D3, and the redundant data blocks be R1, R2; where, Represents a bitwise XOR operation, where a, b, and c are finite fields GF(2 8 ) over a specific coefficient, multiplication and addition are performed over this finite field;

[0082] Data recovery: If some data blocks and redundant data blocks are known, the lost data blocks can be recovered by solving a system of linear equations. For example, if D1 is lost and D2, D3, R1, and R2 are known, D1 can be inferred based on the above formula: Then combine the R2 formula to verify and correct (calculate on a finite field);

[0083] In step S5, the visualization interface adopts graphical interactive design and is constructed using HTML, CSS, and JavaScript technologies;

[0084] When setting the backup cycle, a drop-down menu is provided, which includes daily, weekly, and monthly backups. If you choose daily backup, you can further set the specific interval days; if you choose weekly backup, you can select the specific backup date of each week; if you choose monthly backup, you can specify the backup day of each month.

[0085] When setting a backup time point, the system makes intelligent recommendations based on server load and user history. The system collects hourly server load data from the past week, calculates the load average, and selects the time period with the lowest load average as the recommended time point. It also analyzes the user's data usage over the past month. If the user rarely uses data during a certain time period, that time period will be recommended first. Users can also manually enter a custom backup time point.

[0086] When setting the backup data range, multiple selection methods are provided. For folder backup, users can select local or network shared folders through the file selection dialog box. For database table backup, the system displays all table structures in the database after connecting to the database, and users can select the tables to be backed up. For specific file type backup, users can enter the file type extension to filter the backup. The system also provides data filtering functions, users can filter by setting the range of data creation time, modification time, and file size attributes.

[0087] Assume that the hourly load data of the server in the past week is L = {l1,l2,…,l 168}, where l i Indicates the load value in hour i; load average value for:

[0088] Select the load value closest to The minimum time period is taken as the recommended time point; suppose the user’s data usage time record in the past month is U = {u1,u2,…,u m}, where u i Indicates the time of the i-th usage of the data; counts the usage frequency of each time period, and recommends the time period with the lowest usage frequency first;

[0089] In step S6, after receiving the user's data recovery request, the system first performs identity verification; the verification method adopts multi-factor authentication, including the user entering a password, a dynamic verification code sent by the system to the bound mobile phone, and fingerprint recognition;

[0090] After the user enters the password, the system hashes the password and compares it with the hash value stored in the database; obtains the dynamic verification code entered by the user and matches it with the verification code sent by the system; if the device has fingerprint recognition function, collects the user's fingerprint and compares it with the pre-stored fingerprint template;

[0091] Only when all three verification methods are passed can the user's identity be confirmed as legitimate. The system obtains encrypted data from distributed storage nodes based on the data identifier and recovery time point. First, the system searches for the storage node information where the data is located in the storage record of the blockchain based on the data identifier. The storage record of the blockchain contains the mapping relationship between the data identifier and the storage node. By performing a hash calculation on the data identifier, the corresponding storage record is quickly located. Based on the node address information in the storage record, a data request is sent to the corresponding distributed storage node.

[0092] If the data stored on the node is erasure coded, the node determines the data blocks and redundant data blocks that need to be provided based on the recovery time point, and sends these blocks back to the system. After receiving the data, the system checks the integrity of the data. If the data is complete, it proceeds to the next step of decryption. If the data is missing or damaged, it is repaired based on the redundant data and erasure code recovery algorithm.

[0093] Suppose the password entered by the user is P and the password hash value stored in the database is H P , the dynamic verification code sent by the system to the bound mobile phone is Csys, the dynamic verification code entered by the user is Cuser, the user fingerprint template collected by the device is Fsys, and the user's current fingerprint is Fuser;

[0094] Password Verification: Where H is the hash function;

[0095] Verification code verification:

[0096] Fingerprint verification (if supported by the device): Verify F =Match(F user ,F sys );

[0097] Among them, Match is the fingerprint matching function, which returns true when the match is successful, otherwise returns false; only when Verify P 、Verify C and Verify F (If supported) When both are true, the user authentication is successful;

[0098] The data classification and identification module is used to classify the data to be backed up based on the data sensitivity, business system, data format and usage frequency. The sensitivity is divided into three levels: high, medium and low according to the importance of the information contained in the data and the degree of privacy involved. The business systems include finance, personnel and sales systems. The data formats include relational database files, document files, image files and video files. By counting the number of accesses to the data in the past 30 days, 100 times is used as the threshold to distinguish between high-frequency and low-frequency data, and a unique identifier is generated for the classified data. The information, creation timestamp, and 16-bit random number are concatenated in a specific order and a unique identifier is calculated using the SHA-256 hash algorithm. The sensitivity scoring formula is as follows: Let the importance score of the information contained in the data be I (0≤I≤100), the privacy involvement score be P, and the total sensitivity score be S=w1I+w2P, where w1 and w2 are weight coefficients, and w1+w2=1. Usually, w1=w2=0.5 is set according to actual conditions. When S≥80, the data is highly sensitive; when 40≤S<80, it is moderately sensitive; and when S<40, it is lowly sensitive.

[0099] The multi-layer encryption module selects a symmetric encryption algorithm to perform initial encryption on the data based on the data type and sensitivity. For highly sensitive database files, the AES-256 algorithm is used, grouped by 128 bits, and a 256-bit key is used to perform multiple rounds of encryption operations including byte replacement, row shift, column confusion, and round key addition. For moderately sensitive document files, the AES-128 algorithm is used, also grouped by 128 bits, and encrypted with a 128-bit key. For low-sensitivity image files, the AES-192 algorithm is used, grouped by 128 bits, and encrypted with a 192-bit key. A digital certificate authentication mechanism is introduced to authenticate non-encrypted files. The encryption key holder is authenticated. The agency reviews the business license, personal ID card information, corporate organizational structure, and business scope information submitted by the applicant. After the review is passed, the applicant's public key, identity information, and validity period are signed with its own private key to generate a digital certificate. During encrypted communication, the sender uses the public key of the certification agency to verify the legitimacy of the signature of the recipient's digital certificate to confirm the identity. The digital certificate is updated regularly every six months, and the review materials need to be resubmitted when updating. The AES algorithm round key generation formula: Taking AES-256 as an example, assuming that the initial key is K = (k0, k1, ..., k 31 ), round key W i The generation of (i=0,1,…,13) depends on the key expansion algorithm; first, the initial key K is copied to W0-W7, and the subsequent round keys are generated by the following formula:

[0100] Among them, the T function includes byte replacement and circular left shift operations, specifically: i-1 The four bytes are circularly shifted left by one position, and then each byte is byte-replaced (through the S-box), and finally XORed with Rcon[i / 4] (round constant); Rcon[i] is a specific byte sequence with different values in different rounds;

[0101] The distributed storage module uses blockchain technology to manage data storage. Each storage node acts as a full blockchain node to store complete blockchain data. The encrypted data is divided into data blocks of 1MB in size. The (3, 2) erasure code technology is used to generate two redundant data blocks for every three data blocks. The first redundant data block is obtained by performing an XOR operation on the three data blocks, and the second redundant data block is obtained by performing a specific linear combination operation on two of the data blocks. The data blocks and redundant data blocks are stored in nodes with different geographical locations. The blockchain hash chain structure is used to encrypt and verify data storage records. New storage records are first hashed and then added to the new block to ensure data integrity and traceability. The blockchain hash chain structure verification formula is: Let the hash value of the nth block in the blockchain be Hash n, the hash value of the previous block is Hash n-1 , the data content of this block is Data n , then Hash n =H(Hash n-1 ∣∣Data n )H is a hash function (such as SHA-256); when verifying data storage records, starting from the genesis block of the blockchain, the hash value of each block is calculated according to this formula and compared with the stored hash value. If all are consistent, the data storage record is complete and has not been tampered with;

[0102] Integrity verification module: Using the SHA-512 hash function, the unique identifier and backup start time of the data are used as input parameters to calculate the hash value. The unique identifier and timestamp are first converted into a byte array according to a specific encoding format, padded to an integer multiple of 512 bits, and then divided into fixed-size groups. A compression function involving multiple rounds of complex bit operations and logical operations is performed on each group in turn to obtain a 256-bit hash value and store it with the encrypted data. A regular check mechanism is set up at 2:00 a.m. every day. During the check, the encrypted data and corresponding hash value are read from the storage device, the encrypted data hash value is recalculated and compared. If there is any inconsistency, the data repair program is initiated. Redundant data is first obtained from the node storing the redundant data block. The damaged data block is attempted to be restored using the erasure code recovery algorithm. If this fails, data is obtained from other backup replica nodes and the hash value is calculated again for comparison. If there is still inconsistency, a data integrity anomaly event is recorded, including the data identifier, backup time, anomaly occurrence time, information about the storage nodes involved, the original hash value, inconsistent hash values calculated multiple times, and a preliminary inferred cause of the anomaly.

[0103] The backup strategy management module provides a visual interface built with HTML, CSS and JavaScript technologies using graphical interactive design. When setting the backup cycle, it provides drop-down menu options for daily, weekly and monthly backups. For daily backups, you can set a specific interval of days, for weekly backups, you can select a specific backup date each week, and for monthly backups, you can specify a backup day each month. When setting the backup time point, the system calculates the average value based on the hourly load data of the server in the past week, selects the time period with the lowest average value as the recommended time point, and analyzes the user's data usage time in the past month, giving priority to the time period when the user rarely uses the data. Users can also manually enter a custom backup time point. When setting the backup data range, multiple selection methods are provided. For folder backups, you can select a local or network shared folder through the file selection dialog box. For database table backups, you can connect to the database and display the table structure for the user to select. For backups of specific file types, you can enter the file type extension to filter. It also provides the function of filtering according to the data creation time, modification time, and file size attribute range. Users can set three levels of priority for backup tasks: high, medium and low. Server load average calculation: Set the hourly load data of the server in the past week as Load i (i=1,2,…,168), then the average server load

[0104] User data usage frequency calculation: Assume that the user's data usage time in the past month is recorded as UsageTime j (j=1,2,…,n), count the number of times data is used in each time period (such as hourly, daily, etc., determined according to actual needs); assuming that the number of times data is used every day is counted, let the number of times used on the kth day be UsageCount k ,but Where I is the indicator function, when UsageTime j If it is within the kth day, I = 1, otherwise I = 0; the day with the least number of times used is recommended as the backup time point;

[0105] After receiving the user's data recovery request, the data recovery module uses a multi-factor authentication method to authenticate the user, including hashing the password entered by the user and comparing it with the hash value in the database, obtaining the dynamic verification code entered by the user and matching it with the verification code sent by the system, and collecting the user's fingerprint and comparing it with the pre-stored fingerprint template if the device supports it. The user's identity is confirmed to be legitimate only after all three verification methods are passed. The encrypted data is obtained from the distributed storage node based on the data identifier and the recovery time point. The storage node information where the data is located is first located in the blockchain storage record through hash calculation based on the data identifier, and a data request is sent to the corresponding node. If the data stored in the node has been processed by erasure coding, the node determines and sends the required data block and redundant data block based on the recovery time point. After receiving the data, the system checks the integrity. If it is complete, it proceeds to the next decryption operation. If it is missing or damaged, it is repaired according to the redundant data and erasure code recovery algorithm;

[0106] Multi-factor authentication hash calculation: Assume that the password entered by the user is Password, and the password hash value stored in the database is StoredHash. Use the hash function HashFunction (such as SHA-256) to calculate CalculatedHash = HashFunction(Password);

[0107] If CalculatedHash = StoredHas·, password verification succeeds;

[0108] Blockchain data location hash calculation: Let the data identifier be DataID, and the hash calculation function of the record stored in the blockchain be BlockchainHashFunction. Take the data identifier DataID as input and calculate Hash Value = BlockchainHash Function (DataID). Use HashValue to find the storage node information of the corresponding data in the index structure of the blockchain.

[0109] Data integrity check hash calculation: Let the data block obtained from the distributed storage node be ReceivedBlock, calculate its hash value as ReceivedHash = SHA-512 (ReceivedBlock), and compare it with the original hash value stored Make a comparison;

[0110] If ReceivedHash = OriginalHash, the data is complete and the next step of decryption is performed;

[0111] If ReceivedHash≠OriginalHash, repair it based on redundant data and erasure code recovery algorithm;

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data security backup method based on multi-layer encryption, characterized in that: The following steps are involved: S1. Classify the data to be backed up and generate a unique identifier for the data; S2. Use a symmetric encryption algorithm to perform initial encryption on the data and generate preliminary ciphertext; perform identity authentication and management on the asymmetric encryption key; S3: Store the encrypted data in multiple geographically dispersed distributed storage nodes, use erasure coding technology to split the data into data blocks and perform redundant encoding storage; S4. When backing up data, use a hash function to generate a hash value for each encrypted data and store it; set up a periodic inspection mechanism to recalculate the hash value of the stored data and compare it with the original hash value; S5. Provide a visual interface for users to customize backup strategies, set backup cycles, backup time points, and backup data ranges; S6. After receiving the user's data recovery request, the encrypted data is obtained from the distributed storage node according to the data identifier and recovery time point in the request.

2. The data security backup method based on multi-layer encryption according to claim 1, characterized in that: In step S1, data is classified based on its sensitivity, business system, data format and frequency of use. Data sensitivity is divided into three levels: high, medium and low according to the importance of the information contained in the data and the degree of privacy involved. Business systems include finance, personnel and sales systems. Data formats include relational database files, document files, image files and video files. Frequency of use is determined by counting the number of times data has been accessed in the past 30 days, with 100 times being set as the threshold. Data above this threshold is considered high-frequency data, and data below this threshold is considered low-frequency data.

3. The data security backup method based on multi-layer encryption according to claim 2, characterized in that: In step S2, a symmetric encryption algorithm is selected based on the data type and sensitivity; For highly sensitive database files, the AES-256 algorithm is used to group data into 128-bit groups and encrypt them using a 256-bit key. The encryption process includes byte replacement, row shifting, column obfuscation, and round key plus multiple rounds of operations. For moderately sensitive documents, the AES-128 algorithm is used, grouped into 128-bit blocks and encrypted with a 128-bit key. For low-sensitivity image files, the AES-192 algorithm is used, with 128-bit blocks and a 192-bit key for encryption; A digital certificate authentication mechanism is introduced to authenticate the identity of the asymmetric encryption key holder; after receiving the request from the key applicant through the digital certificate authentication mechanism, the business license, personal ID card identity information, corporate organizational structure and business scope organization information submitted by the applicant are reviewed; after the review is passed, the applicant's public key, identity information and validity period are signed with its own private key through the digital certificate authentication mechanism to generate a digital certificate; during the encrypted communication process, the sender obtains the receiver's digital certificate, and uses the public key introduced in the digital certificate authentication mechanism to verify the legitimacy of the certificate signature to confirm the receiver's identity. The digital certificate is updated regularly every six months, and the review materials need to be resubmitted when updating.

4. The data security backup method based on multi-layer encryption according to claim 3, characterized in that: In step S3, the SHA-512 hash function is used, and the unique identifier and backup start time of the data are used as input parameters. When calculating the hash value, the unique identifier and timestamp are first converted into a byte array according to a specific encoding format. Then, according to the SHA-512 algorithm rules, the byte array is padded so that its length meets the 512-bit integer multiple required by the algorithm. Then, the padded byte array is divided into groups of fixed size, and the compression function operation is performed on each group in turn. This operation involves multiple rounds of complex bit operations and logical operations, and finally a 256-bit hash value is obtained, which is stored together with the encrypted data.

5. The data security backup method based on multi-layer encryption according to claim 4, characterized in that: In step S4, the periodic inspection mechanism is set to have an inspection period of 2:00 a.m. every day. During the inspection, the system reads the encrypted data and the corresponding hash value from the storage device and recalculates the hash value of the encrypted data. If the hash values are inconsistent, the system starts the data repair program; Obtain redundant data blocks from corresponding distributed storage nodes according to pre-recorded redundant data block storage location information; The erasure code recovery algorithm is used to recover damaged data blocks. The algorithm attempts to reconstruct the damaged data blocks by performing calculations on redundant data blocks and some undamaged data blocks. If the recovery fails, the system obtains the data from the storage nodes where other backup copies are located according to the preset backup copy search strategy. After obtaining the data, the hash value is recalculated and compared with the original hash value. If there is still inconsistency, record this data integrity abnormality event; The record content includes data identification, backup time, exception occurrence time, storage node information involved, original hash value, inconsistent hash values calculated multiple times, and preliminary speculation on the cause of the data exception based on the system operation status and related logs.

6. The data security backup method based on multi-layer encryption according to claim 5, characterized in that: In step S6, after receiving the user's data recovery request, identity verification is performed; Verification uses multi-factor authentication, which includes the user entering a password, a dynamic verification code sent by the system to the bound mobile phone, and fingerprint recognition; After the user enters the password, the password is hashed and compared with the hash value stored in the database; the dynamic verification code entered by the user is obtained and matched with the verification code sent by the system; if the device has fingerprint recognition function, the user's fingerprint is collected and compared with the pre-stored fingerprint template; When all three verification methods are passed, the user's identity is confirmed to be legitimate; encrypted data is obtained from the distributed storage node based on the data identifier and recovery time point; the storage node information where the data is located is searched in the storage record of the blockchain based on the data identifier. The storage record of the blockchain contains the mapping relationship between the data identifier and the storage node. By performing a hash calculation on the data identifier, the corresponding storage record is located, and a data request is sent to the corresponding distributed storage node based on the node address information in the storage record; If the data stored in the node has been processed with erasure coding, the node determines the data blocks and redundant data blocks that need to be provided based on the recovery time point, and sends these data blocks back to the system. After receiving the data, the system checks the integrity of the data. If the data is complete, the next step of decryption operation is performed. If the data is missing or damaged, it is repaired based on the redundant data and erasure code recovery algorithm.

7. A data security backup system based on multi-layer encryption, characterized in that: include: Data classification and identification module, multi-layer encryption module, distributed storage module, integrity verification module, backup strategy management module and data recovery module; The data classification and identification module is used to classify the data to be backed up and generate a unique identifier for the data; The multi-layer encryption module is used to select a symmetric encryption algorithm to perform initial encryption on data and generate preliminary ciphertext; it also performs identity authentication and management on asymmetric encryption keys; The distributed storage module is used to store encrypted data in multiple geographically dispersed distributed storage nodes, using erasure coding technology to divide the data into data blocks and perform redundant encoding storage; The integrity check module is used to generate and store a hash value for each encrypted data using a hash function when backing up data; Set up a regular checking mechanism to recalculate the hash value of the stored data and compare it with the original hash value; The backup strategy management module is used to provide a visual interface for users to customize backup strategies, and can set the backup cycle, backup time point, and backup data range; The data recovery module is used to obtain encrypted data from the distributed storage node according to the data identifier and recovery time point in the request after receiving the user's data recovery request.

Images