Sensitive data storage method and device, equipment and storage medium

Abstract

The invention discloses a sensitive data storage method and device, equipment and a storage medium, and relates to the technical field of data security, the sensitive data storage method comprises the following steps: obtaining sensitive data, and identifying feature information corresponding to the sensitive data; determining a target data compression algorithm based on the data type corresponding to the sensitive data, compressing the sensitive data by using the target data compression algorithm to obtain corresponding compressed data, and generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information; and generating a file copy corresponding to the first data capsule, and respectively storing the first data capsule and the file copy to different nodes in the target distributed system. The file copy is constructed, and the file copy and the data capsule are stored in the distributed system, so that the problem of large-scale data loss is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a sensitive data storage method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology, the ever-changing network environment, and increasingly sophisticated and covert cyberattacks, data security and privacy protection have become a global concern. Relevant regulations require companies to protect personal data from unauthorized access or disclosure.

[0003] Currently, the protection of sensitive data on the market mostly relies on centralized database management models. Access control for sensitive data usually adopts ACL (Access Control Lists) and RBAC (Role-Based Access Control), which controls the scope of data access by assigning different roles or permissions to users. Since centralized data storage systems are susceptible to single points of failure, this approach has the risk of causing large-scale data leakage or loss. Summary of the Invention

[0004] In view of this, the present invention aims to provide a sensitive data storage method, apparatus, device, and storage medium that can avoid the problem of large-scale data loss by creating file copies and storing the file copies and data capsules in a distributed system. The specific solution is as follows:

[0005] In a first aspect, the present application provides a sensitive data storage method, comprising:

[0006] Parsing the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and identifying characteristic information corresponding to the sensitive data using regular expressions, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data;

[0007] determining a target data compression algorithm based on the data type, compressing the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information;

[0008] Generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in a target distributed system respectively.

[0009] Optionally, generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information includes:

[0010] intercepting the compressed data into a first data segment and a second data segment based on the sensitive type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms;

[0011] The encrypted data fragments are spliced into target data, and the first data capsule corresponding to the sensitive data is generated based on the target data and the feature information.

[0012] Optionally, determining a target data compression algorithm based on the data type, and compressing the sensitive data using the target data compression algorithm includes:

[0013] If the data type corresponding to the sensitive data is text data, the DEFLATE compression algorithm is used to replace repeated data blocks in the sensitive data with pointers, and Huffman encoding is performed on non-repeated data blocks in the sensitive data to compress the sensitive data;

[0014] If the data type corresponding to the sensitive data is non-text data, the sensitive data is compressed using the BROTLI algorithm.

[0015] Optionally, the extracting the compressed data into a first data segment and a second data segment based on the sensitive type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms includes:

[0016] Determining a cut-off position corresponding to the compressed data based on the sensitivity type corresponding to the sensitive data and a preset mapping table, and cutting the compressed data into the first data segment and the second data segment according to the cut-off position; wherein the preset mapping table is used to store data cut-off positions corresponding to sensitive data of different sensitivity types;

[0017] Obtain a first key corresponding to the ChaCha20 encryption algorithm and a second key corresponding to the CTR mode of the Advanced Encryption Standard algorithm from a preset key management system, encrypt the first data fragment using the first key, and encrypt the second data fragment using the second key.

[0018] Optionally, before storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes:

[0019] generating a first public key and a first private key corresponding to the first data capsule according to an elliptic curve cryptography algorithm, and storing the first public key and the first private key in the preset key management system;

[0020] generating a digital signature corresponding to the first data capsule based on the first private key, performing a hash operation on the first public key to obtain a first public key tag corresponding to the first public key, wherein the first public key tag is a string used to index the first public key in a key management system, and the digital signature is used to perform data consistency verification on the first data capsule;

[0021] The target data compression algorithm, a first key tag, a second key tag, the digital signature, and the first public key tag are encapsulated into the first data capsule, wherein the first key tag is a key tag corresponding to the first key, the second key tag is a key tag corresponding to the second key, and the first key tag and the second key tag are respectively strings used to index the first key and the second key from the preset key management system.

[0022] Optionally, after storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes:

[0023] Obtaining a data access request from a target user, obtaining the first data capsule from the target distributed system based on the data access request, and allocating a second public key and a second private key to the target user using the preset key management system;

[0024] encrypting the target data compression algorithm, the first key tag, and the second key tag in the first data capsule using the second public key to obtain a corresponding second data capsule;

[0025] The second data capsule is sent to the target user so that the target user obtains the public key tag in the second data capsule, obtains the first public key from the preset key management system based on the public key tag, and verifies the digital signature using the first public key. If the verification result indicates that the second data capsule has not been tampered with, the first key tag, the second key tag, and the target data compression algorithm are obtained using the second private key. The first key and the second key are obtained from the preset key management platform based on the first key tag and the second key tag, and the second data capsule is decrypted and decompressed using the first key, the second key, and the target data compression algorithm to obtain the sensitive data.

[0026] Optionally, after storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes:

[0027] Store the access records corresponding to the data capsule in the target blockchain;

[0028] determining whether the authorization time of the second public key and the second private key corresponding to the target user has expired; if the authorization time of the second public key and the second private key has expired, obtaining a new first key and a new second key from the preset key management system, decrypting the first data capsule using the first key and the second key, and encrypting the decrypted first data capsule using the new first key and the new second key.

[0029] In a second aspect, the present application provides a sensitive data storage device, comprising:

[0030] a characteristic information identification module, configured to parse the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and identify characteristic information corresponding to the sensitive data using regular expressions, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data;

[0031] a data compression module, configured to determine a target data compression algorithm based on the data type, compress the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generate a first data capsule corresponding to the sensitive data based on the compressed data and the feature information;

[0032] The data storage module is configured to generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in the target distributed system respectively.

[0033] In a third aspect, the present application provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the aforementioned sensitive data storage method.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which implements the aforementioned sensitive data storage method when executed by a processor.

[0037] In this application, the target data transmission protocol is first used to parse the traffic data to obtain sensitive data in the traffic data, and the characteristic information corresponding to the sensitive data is identified using a regular expression, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length and data generation time corresponding to the sensitive data. Then, a target data compression algorithm is determined based on the data type, and the sensitive data is compressed using the target data compression algorithm to obtain corresponding compressed data. A first data capsule corresponding to the sensitive data is generated based on the compressed data and the characteristic information. Finally, a file copy corresponding to the first data capsule is generated, and the first data capsule and the file copy are respectively stored in different nodes of the target distributed system. It can be seen that the present application reduces the occupation of data storage resources by compressing sensitive data and constructing data capsules based on the compressed sensitive data, thereby avoiding the waste of storage resources; by storing the constructed data capsules in the distributed system, the problem of large-scale data loss due to single point failure is avoided; by constructing data copies corresponding to the data capsules and storing the data copies and data capsules in different nodes of the distributed system, even if some storage nodes fail, the system can still automatically switch to the available copies to ensure the continuous availability of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0039] Figure 1 A flow chart of a sensitive data storage method disclosed in this application;

[0040] Figure 2 A schematic diagram of a data capsule storage process disclosed in this application;

[0041] Figure 3 This is a schematic diagram of a data capsule structure disclosed in this application;

[0042] Figure 4 A data capsule packaging flow chart disclosed in this application;

[0043] Figure 5 A flowchart of using a data capsule disclosed in this application;

[0044] Figure 6 This is a schematic diagram of a data capsule structure disclosed in this application;

[0045] Figure 7 This is a data capsule destruction flow chart disclosed in this application;

[0046] Figure 8 This is a schematic structural diagram of a sensitive data storage device disclosed in this application;

[0047] Figure 9 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0049] Currently, sensitive data storage methods pose the risk of large-scale data leakage or loss. To this end, this application provides a sensitive data storage method that avoids the problem of large-scale data loss by building file copies and storing the file copies and data capsules in a distributed system.

[0050] See also Figure 1 As shown, an embodiment of the present invention discloses a sensitive data storage method, including:

[0051] Step S11: parse the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and use regular expressions to identify feature information corresponding to the sensitive data, wherein the feature information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data.

[0052] In this embodiment, sensitive data needs to be encapsulated and stored, and the specific process is as follows: Figure 2 As shown, it includes: parsing traffic data based on target data transmission protocols, such as Ethernet protocol, TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) protocol and other protocols; using regular expressions to identify feature information corresponding to sensitive data; compressing sensitive data according to the data type of sensitive data; generating data capsules based on compressed data, and storing the data capsules in a distributed system.

[0053] In this embodiment, data is first parsed from traffic according to different protocols, and characteristic information corresponding to sensitive data is identified using regular expressions or algorithms. This characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data. It should be noted that the sensitive types of sensitive data in this embodiment include not only sensitive identity data, such as ID card data, but also other types of sensitive data.

[0054] Step S12: determining a target data compression algorithm based on the data type, compressing the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information.

[0055] In this embodiment, it is necessary to determine a corresponding target data compression algorithm based on the data type of the sensitive data. Accordingly, the process of determining the target data compression algorithm based on the data type and compressing the sensitive data using the target data compression algorithm may specifically include: if the data type corresponding to the sensitive data is text data, using the DEFLATE compression algorithm (a data compression algorithm) to replace repeated data blocks in the sensitive data with pointers, and performing Huffman encoding on non-repeated data blocks in the sensitive data to compress the sensitive data; if the data type corresponding to the sensitive data is non-text data, using the BROTLI algorithm (a data compression algorithm) to compress the sensitive data; specifically, the DEFLATE compression algorithm is used for the collected text sensitive data. DEFLATE combines LZ77 (a dictionary-based compression method) and Huffman coding (variable-length coding) technologies. LZ77 uses a sliding window to search the input data, finds repeated data blocks and replaces them with pointers, and Huffman coding is used to optimally encode the remaining symbols to reduce redundancy.

[0056] The BROTLI algorithm is used to compress non-text sensitive data. The compressed sensitive data (i.e. compressed data) is expressed as:

[0057] ;

[0058] In this embodiment, the process of generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information may specifically include: truncating the compressed data into a first data segment and a second data segment based on the sensitivity type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms; concatenating the encrypted data segments into target data, and generating a first data capsule corresponding to the sensitive data based on the target data and the feature information. The process of truncating the compressed data into the first data segment and the second data segment based on the sensitivity type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms may specifically include: determining a truncating position corresponding to the compressed data based on the sensitivity type corresponding to the sensitive data and a preset mapping table, and truncating the compressed data into the first data segment and the second data segment based on the truncating position; the preset mapping table is used to store data truncating positions corresponding to sensitive data of different sensitivity types; obtaining a first key corresponding to the ChaCha20 encryption algorithm (a data encryption algorithm) and a second key corresponding to the CTR mode of the Advanced Encryption Standard algorithm from a preset key management system, encrypting the first data segment using the first key, and encrypting the second data segment using the second key.

[0059] Specifically, the compressed data is encrypted in two parts. The interception position corresponding to the sensitive type of data is selected from the sensitive type interception bit mapping table (i.e., the preset mapping table). For example, for sensitive data of the ID card number type, the first 8 bits of the compressed data corresponding to the sensitive data are intercepted (i.e., the first data fragment). The key (i.e., the first key) of the ChaCha20 stream encryption algorithm is obtained from the KMS (Key Management Service) system. The encrypted data will have the same length as before encryption, expressed as:

[0060] ;

[0061] The remaining data after interception (i.e., the second data fragment) is encrypted by querying the sensitive type key dictionary data using the key corresponding to the CTR mode of the AES (Advanced Encryption Standard) algorithm (i.e., the second key). The encrypted data is expressed as:

[0062] ;

[0063] The two encrypted data parts are combined to form new data (i.e., target data). Based on the target data and the characteristic information, a first data capsule corresponding to the sensitive data is generated. Specifically, the identified characteristic information, such as sensitivity level, sensitivity type, and business type, is encapsulated into the data capsule's business metadata, and the data's unique identifier, data length, data type, and generation time within the characteristic information are encapsulated into the data capsule's technical metadata. By compressing, encrypting, and encapsulating sensitive data to form data capsules, the content of the sensitive data is effectively isolated, protecting its integrity and preventing unauthorized copying, tampering, and distribution. By compressing and then encrypting the data, the data volume is significantly reduced, thereby reducing storage space requirements and conserving data traffic and bandwidth. The standardized encapsulation format of data capsules enables secure data transfer between different systems and platforms, ensuring data compatibility across different technology stacks and preventing data loss or alteration over time or due to system upgrades.

[0064] Step S13: Generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in the target distributed system respectively.

[0065] In this embodiment, before storing the first data capsule and the file copy in different nodes of the target distributed system respectively, the method further includes: generating a first public key and a first private key corresponding to the first data capsule according to an elliptic curve cryptography algorithm, and storing the first public key and the first private key in a preset key management system; generating a digital signature corresponding to the first data capsule based on the first private key, performing a hash operation on the first public key to obtain a first public key tag corresponding to the first public key, wherein the first public key tag is a string used to index the first public key in the key management system, and the digital signature is used to perform data consistency verification on the first data capsule; encapsulating the target data compression algorithm, the first key tag, the second key tag, the digital signature, and the first public key tag into the first data capsule, wherein the first key tag is a key tag corresponding to the first key, the second key tag is a key tag corresponding to the second key, and the first key tag and the second key tag are strings used to index the first key and the second key from the preset key management system, respectively; specifically, using the ECC algorithm (Elliptic curve cryptography). Elliptic curve cryptography (elliptic curve cryptography) generates a pair of public keys (i.e., the first public key) and private keys (i.e., the first private key) for each data capsule (the first data capsule). The keys are stored in the KMS (key management system). The private key is used to generate a digital signature. A hash operation is performed on the first public key to obtain the first public key tag corresponding to the first public key. The digital signature and the first public key tag are then encapsulated in the first data capsule for integrity verification. It should be noted that the first public key tag is a string used to index the first public key in the key management system, and the digital signature is used to perform data consistency verification on the first data capsule, that is, to verify whether the data in the data capsule has been tampered with.

[0066] In this embodiment, the structure of the data capsule stored in the target distributed system is as follows: Figure 3 As shown, it includes business metadata: sensitive type, sensitivity level and business type; technical metadata: data length, data type, data generation time and data unique identifier; data body: sensitive data that is compressed and then encrypted; encryption information: key tags corresponding to the first key, the second key and the first public key respectively; the target data compression algorithm and digital signature corresponding to the sensitive data.

[0067] After encapsulating the digital signature and the first public key mark into the first data capsule, the first data capsule and the corresponding file copy need to be stored in the FASTDFS system (ie, the target distributed system), and a unique storage identifier of the data capsule needs to be generated.

[0068] In this embodiment, after storing the first data capsule and the file copy in different nodes of the target distributed system, the method further includes: obtaining a data access request from a target user, obtaining the first data capsule from the target distributed system based on the data access request, and allocating a second public key and a second private key to the target user using a preset key management system; encrypting the target data compression algorithm, the first key tag, and the second key tag in the first data capsule using the second public key to obtain a corresponding second data capsule; sending the second data capsule to the target user so that the target user obtains the public key tag in the second data capsule; obtaining the first public key from the preset key management system based on the public key tag; and verifying the digital signature using the first public key. If the verification result indicates that the second data capsule has not been tampered with, obtaining the first key tag, the second key tag, and the target data compression algorithm using the second private key; obtaining the first key and the second key from the preset key management platform based on the first key tag and the second key tag; and decrypting the second data capsule using the first key, the second key, and the target data compression algorithm to obtain sensitive data.

[0069] Specifically, such as Figure 4 As shown in FIG, a data user (i.e., target user) applies for access to a data capsule. After the data capsule application processing platform approves the application, the KMS system grants the applicant a public-private key pair (i.e., a second public key and a second private key). The applicant's second public key is used to encrypt the target data compression algorithm and the first and second key tags. The encrypted key tags are encapsulated into a data capsule and transmitted to the applicant via the SSL (Secure Sockets Layer) protocol. Afterwards, as shown in FIG, Figure 5 As shown, the applicant obtains the public key token from the data capsule, and then uses the public key token to obtain the complete public key (i.e., the first public key) from the KMS system. The first public key is used to verify the signature of the data capsule to ensure that the original file has not been tampered with. The applicant then uses their own private key (i.e., the second private key) to decrypt the encrypted first and second key tokens to obtain the first and second key tokens. Then, through the application processing platform, the first and second key tokens are used to obtain the complete key (i.e., the first public key and the first private key) from the KMS system, decrypt the data in blocks, and decompress it to obtain the plaintext data (i.e., sensitive data).

[0070] It should be noted that the structure of the data capsule during transmission is as follows Figure 6 As shown, in addition to the original metadata, data body and digital signature of the data capsule during the storage process, it also includes a unique identifier of the data capsule storage location and three encrypted key tags obtained by encrypting the first key tag, the first public key tag and the second key tag respectively.

[0071] In this embodiment, after storing the first data capsule and the file copy in different nodes of the target distributed system, the method further includes: storing the access record corresponding to the data capsule in the target blockchain; determining whether the authorization time of the second public key and the second private key corresponding to the target user has expired; if the authorization time of the second public key and the second private key has expired, obtaining a new first key and a new second key from the preset key management system, decrypting the first data capsule using the first key and the second key, and encrypting the decrypted first data capsule using the new first key and the new second key to generate a new first data capsule, and storing the new data capsule. It is understood that when the authorization time of the second public key and the second private key corresponding to the target user has expired, the target user needs to apply to the data capsule management platform for a new data capsule for use.

[0072] Specifically, the access record of the data capsule is put on the blockchain, and the capsule application processing platform regularly detects whether the authorization time of the applicant's key (i.e., the second public key and the second private key) has expired. If it has expired, it triggers KMS to distribute new encryption keys (i.e., the new first key and the new second key), decrypt the data capsule, and encrypt the data capsule with the new key. The publisher encapsulates the new data capsule and stores it on FASTDFS, and destroys the old data capsule. The above process of destroying the data capsule is as follows: Figure 7 As shown, when the applicant's key expires, the KMS system will issue a new first key corresponding to the ChaCha20 encryption algorithm and a new second key corresponding to the Advanced Encryption Standard algorithm in CTR mode. The first and second keys are used to decrypt the data in the data capsule, and the decrypted data is encrypted using the new first and second keys. By blocking the access records corresponding to the data capsule, the data capsule access records are tamper-proof and traceable. The encapsulation, storage, and access control of the data capsule cover the lifecycle management of sensitive data, including the security management of the entire process of data creation, storage, access, modification, and destruction, thus achieving control and processing of sensitive data throughout its entire lifecycle.

[0073] It can be seen that the present application reduces the occupation of data storage resources by compressing sensitive data and constructing data capsules based on the compressed sensitive data, thereby avoiding waste of storage resources; by storing the constructed data capsules in a distributed system, the problem of large-scale data loss due to single point failure is avoided; by constructing data copies corresponding to the data capsules and storing the data copies and data capsules in different nodes in the distributed system respectively, even if some storage nodes fail, the system can still automatically switch to the available copies to ensure the continuous availability of data.

[0074] See also Figure 8As shown, an embodiment of the present invention discloses a sensitive data storage device, comprising:

[0075] a characteristic information identification module 11, configured to parse the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and identify characteristic information corresponding to the sensitive data using regular expressions, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data;

[0076] a data compression module 12, configured to determine a target data compression algorithm based on the data type, compress the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generate a first data capsule corresponding to the sensitive data based on the compressed data and the feature information;

[0077] The data storage module 13 is configured to generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in the target distributed system respectively.

[0078] It can be seen that the present application reduces the occupation of data storage resources by compressing sensitive data and constructing data capsules based on the compressed sensitive data, thereby avoiding waste of storage resources; by storing the constructed data capsules in a distributed system, the problem of large-scale data loss due to single point failure is avoided; by constructing data copies corresponding to the data capsules and storing the data copies and data capsules in different nodes in the distributed system respectively, even if some storage nodes fail, the system can still automatically switch to the available copies to ensure the continuous availability of data.

[0079] In some specific embodiments, the data compression module 12 may specifically include:

[0080] a data segment encryption submodule, configured to intercept the compressed data into a first data segment and a second data segment based on the sensitivity type corresponding to the sensitive data, and encrypt the first data segment and the second data segment using different encryption algorithms;

[0081] The data capsule generating unit is configured to concatenate the encrypted data segments into target data, and generate the first data capsule corresponding to the sensitive data based on the target data and the feature information.

[0082] In some specific embodiments, the data compression module 12 may specifically include:

[0083] a first data compression unit, configured to, if the data type corresponding to the sensitive data is text data, replace repeated data blocks in the sensitive data with pointers using a DEFLATE compression algorithm, and perform Huffman encoding on non-repeated data blocks in the sensitive data to compress the sensitive data;

[0084] The second data compression unit is configured to compress the sensitive data using a BROTLI algorithm if the data type corresponding to the sensitive data is non-text data.

[0085] In some specific embodiments, the data segment encryption submodule may specifically include:

[0086] a data interception unit, configured to determine an interception position corresponding to the compressed data based on the sensitivity type corresponding to the sensitive data and a preset mapping table, and intercept the compressed data into the first data segment and the second data segment according to the interception position; wherein the preset mapping table is used to store data interception positions corresponding to sensitive data of different sensitivity types;

[0087] A data encryption unit is used to obtain a first key corresponding to the ChaCha20 encryption algorithm and a second key corresponding to the CTR mode of the Advanced Encryption Standard algorithm from a preset key management system, encrypt the first data fragment using the first key, and encrypt the second data fragment using the second key.

[0088] In some specific embodiments, the data storage module 13 further includes:

[0089] a key storage unit, configured to generate a first public key and a first private key corresponding to the first data capsule according to an elliptic curve cryptography algorithm, and store the first public key and the first private key in the preset key management system;

[0090] a digital signature generation unit, configured to generate a digital signature corresponding to the first data capsule based on the first private key, perform a hash operation on the first public key to obtain a first public key tag corresponding to the first public key, wherein the first public key tag is a string used to index the first public key in a key management system, and the digital signature is used to perform data consistency verification on the first data capsule;

[0091] a data encapsulation unit, configured to encapsulate the target data compression algorithm, a first key tag, a second key tag, the digital signature, and the first public key tag into the first data capsule, wherein the first key tag is a key tag corresponding to the first key, the second key tag is a key tag corresponding to the second key, and the first key tag and the second key tag are respectively strings used to index the first key and the second key from the preset key management system.

[0092] In some specific embodiments, the data storage module 13 further includes:

[0093] a key distribution unit, configured to obtain a data access request from a target user, obtain the first data capsule from the target distributed system based on the data access request, and distribute a second public key and a second private key to the target user using the preset key management system;

[0094] a data capsule obtaining unit, configured to encrypt the target data compression algorithm, the first key tag, and the second key tag in the first data capsule using the second public key to obtain a corresponding second data capsule;

[0095] a data capsule sending unit, configured to send the second data capsule to the target user so that the target user obtains the public key tag in the second data capsule, obtain the first public key from the preset key management system based on the public key tag, and verify the digital signature using the first public key; if the verification result indicates that the second data capsule has not been tampered with, obtain the first key tag, the second key tag, and the target data compression algorithm using the second private key; obtain the first key and the second key from the preset key management platform based on the first key tag and the second key tag; and decrypt and decompress the second data capsule using the first key, the second key, and the target data compression algorithm to obtain the sensitive data.

[0096] In some specific embodiments, the data storage module 13 further includes:

[0097] An access record storage unit, used to store the access record corresponding to the data capsule in the target blockchain;

[0098] a data capsule encryption unit, configured to determine whether the authorization time of the second public key and the second private key corresponding to the target user has expired; if the authorization time of the second public key and the second private key has expired, obtain a new first key and a new second key from the preset key management system; decrypt the first data capsule using the first key and the second key; and encrypt the decrypted first data capsule using the new first key and the new second key.

[0099] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 9 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0100] Figure 9 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the sensitive data storage method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0101] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0102] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0103] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of implementing the sensitive data storage method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0104] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned sensitive data storage method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0105] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0106] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0107] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0108] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0109] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A sensitive data storage method, characterized in that: include: Parsing the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and identifying characteristic information corresponding to the sensitive data using regular expressions, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data; determining a target data compression algorithm based on the data type, compressing the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generating a first data capsule corresponding to the sensitive data based on the compressed data and the feature information; Generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in a target distributed system respectively.

2. The sensitive data storage method according to claim 1, characterized in that: The generating a first data capsule corresponding to the sensitive data based on the compressed data and the characteristic information includes: intercepting the compressed data into a first data segment and a second data segment based on the sensitive type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms; The encrypted data fragments are spliced into target data, and the first data capsule corresponding to the sensitive data is generated based on the target data and the feature information.

3. The sensitive data storage method according to any one of claims 1 or 2, characterized in that: Determining a target data compression algorithm based on the data type, and compressing the sensitive data using the target data compression algorithm, includes: If the data type corresponding to the sensitive data is text data, the DEFLATE compression algorithm is used to replace repeated data blocks in the sensitive data with pointers, and Huffman encoding is performed on non-repeated data blocks in the sensitive data to compress the sensitive data; If the data type corresponding to the sensitive data is non-text data, the sensitive data is compressed using the BROTLI algorithm.

4. The sensitive data storage method according to claim 2, characterized in that: The method of extracting the compressed data into a first data segment and a second data segment based on the sensitive type corresponding to the sensitive data, and encrypting the first data segment and the second data segment using different encryption algorithms includes: Determining a cut-off position corresponding to the compressed data based on the sensitivity type corresponding to the sensitive data and a preset mapping table, and cutting the compressed data into the first data segment and the second data segment according to the cut-off position; wherein the preset mapping table is used to store data cut-off positions corresponding to sensitive data of different sensitivity types; Obtain a first key corresponding to the ChaCha20 encryption algorithm and a second key corresponding to the CTR mode of the Advanced Encryption Standard algorithm from a preset key management system, encrypt the first data fragment using the first key, and encrypt the second data fragment using the second key.

5. The sensitive data storage method according to claim 4, characterized in that: Before storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes: generating a first public key and a first private key corresponding to the first data capsule according to an elliptic curve cryptography algorithm, and storing the first public key and the first private key in the preset key management system; generating a digital signature corresponding to the first data capsule based on the first private key, performing a hash operation on the first public key to obtain a first public key tag corresponding to the first public key, wherein the first public key tag is a string used to index the first public key in a key management system, and the digital signature is used to perform data consistency verification on the first data capsule; The target data compression algorithm, a first key tag, a second key tag, the digital signature, and the first public key tag are encapsulated into the first data capsule, wherein the first key tag is a key tag corresponding to the first key, the second key tag is a key tag corresponding to the second key, and the first key tag and the second key tag are respectively strings used to index the first key and the second key from the preset key management system.

6. The sensitive data storage method according to claim 5, characterized in that: After storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes: Obtaining a data access request from a target user, obtaining the first data capsule from the target distributed system based on the data access request, and allocating a second public key and a second private key to the target user using the preset key management system; encrypting the target data compression algorithm, the first key tag, and the second key tag in the first data capsule using the second public key to obtain a corresponding second data capsule; The second data capsule is sent to the target user so that the target user obtains the public key tag in the second data capsule, obtains the first public key from the preset key management system based on the public key tag, and verifies the digital signature using the first public key. If the verification result indicates that the second data capsule has not been tampered with, the first key tag, the second key tag, and the target data compression algorithm are obtained using the second private key. The first key and the second key are obtained from the preset key management platform based on the first key tag and the second key tag, and the second data capsule is decrypted and decompressed using the first key, the second key, and the target data compression algorithm to obtain the sensitive data.

7. The sensitive data storage method according to claim 6, characterized in that: After storing the first data capsule and the file replica in different nodes in the target distributed system respectively, the method further includes: Store the access records corresponding to the data capsule in the target blockchain; determining whether the authorization time of the second public key and the second private key corresponding to the target user has expired; if the authorization time of the second public key and the second private key has expired, obtaining a new first key and a new second key from the preset key management system, decrypting the first data capsule using the first key and the second key, and encrypting the decrypted first data capsule using the new first key and the new second key.

8. A sensitive data storage device, characterized in that: include: a characteristic information identification module, configured to parse the traffic data using the target data transmission protocol to obtain sensitive data in the traffic data, and identify characteristic information corresponding to the sensitive data using regular expressions, wherein the characteristic information includes the data type, sensitivity level, sensitivity type, data length, and data generation time corresponding to the sensitive data; a data compression module, configured to determine a target data compression algorithm based on the data type, compress the sensitive data using the target data compression algorithm to obtain corresponding compressed data, and generate a first data capsule corresponding to the sensitive data based on the compressed data and the feature information; The data storage module is configured to generate a file copy corresponding to the first data capsule, and store the first data capsule and the file copy in different nodes in the target distributed system respectively.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the sensitive data storage method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, which, when executed by a processor, implements the sensitive data storage method according to any one of claims 1 to 7.

Images