A data security processing method and system based on distributed storage

Abstract

This invention relates to a data security processing method and system based on distributed storage, belonging to the field of computer information processing technology. The method includes: employing a dynamic sharding strategy to divide data into a configurable number of encrypted shards, and combining timestamps to generate physically isolated dynamic verification blocks to achieve tamper-proofing; dynamically calculating dynamic threshold values ​​based on data sensitivity indices and node load, and selecting nodes for collaborative decryption through reliability scoring; dividing database tables into independent groups for storage according to primary and foreign key relationships, with foreign key fields encrypted using cross-key encryption, and requiring multi-key threshold conditions for cross-group access; and constructing an intelligent threat perception engine to analyze access logs and threat intelligence in real time, dynamically triggering key rotation, shard replacement, and joint defense response mechanisms. This invention achieves full lifecycle protection for data, effectively solving the risks of key leakage and cross-table association attacks.

Description

Technical Field

[0001] This invention relates to the field of computer information processing technology, and in particular to a data security processing method and system based on distributed storage. Background Technology

[0002] With the rapid development of information technologies such as cloud computing, the Internet of Things, and artificial intelligence, and the digital transformation of traditional industries, the global data volume is growing exponentially. Traditional relational databases, limited by centralized architecture and fixed storage capacity, can no longer meet the demands of high-concurrency, high-throughput massive data storage. Against this backdrop, big data storage technology based on distributed architecture has emerged, achieving data sharding and storage through horizontal scaling of node clusters, significantly improving system scalability and disaster recovery capabilities. However, existing distributed storage solutions have serious shortcomings in terms of security.

[0003] Chinese invention patent with publication number CN115422570B provides a data processing method and system for distributed storage, which receives a decryption request for the encryption key of target ciphertext data sent by a client of distributed storage.

[0004] The first encryption zone key of the target ciphertext data encryption key is obtained from the relational key library; the target ciphertext data encryption key is decrypted according to the first encryption zone key to obtain the decrypted data encryption key, and the decrypted data encryption key is fed back to the client, so that the client's encryption and decryption module calls the target encryption algorithm through the encryption engine to encrypt the data file according to the data encryption key, to obtain the encrypted data file, and the encrypted data file is stored in the data node to improve security.

[0005] However, its over-reliance on fixed encryption zone keys and data encryption key layering mechanisms lacks dynamic response capabilities. Attackers can steal shards over a long period or exploit node vulnerabilities to crack keys, leading to the spread of single point of failure risks. Summary of the Invention

[0006] This invention addresses the problems existing in current distributed storage solutions, such as static key management, poor security isolation of shards, high risk of cross-table associations, and delayed threat response. Through dynamic sharding strategies, multi-dimensional verification mechanisms, cross-group key binding, and intelligent threat awareness, it achieves full lifecycle security protection and real-time attack blocking.

[0007] This application provides a data security processing method and system based on distributed storage, the method comprising:

[0008] S1. Based on the original data, the data is divided into fragments using a dynamic fragmentation strategy. Each fragment generates an independent data encryption key, and a dynamic verification block is generated based on the timestamp and fragment content.

[0009] S2. Based on multi-dimensional indicators, obtain the data sensitivity index and node load index, and generate dynamic threshold values;

[0010] The multi-dimensional indicators include the privacy level, compliance requirements, and data value of the raw data, as well as the server's CPU utilization, memory utilization, and network latency; a node refers to an independent storage unit in a distributed system.

[0011] S3. Divide the database tables into independent groups according to the primary and foreign key relationships. Each independent group is stored in a physically isolated node cluster. Foreign key fields between groups are encrypted using cross-key encryption technology.

[0012] Among them, nodes include, but are not limited to, regional data center nodes of cloud service providers, physical server clusters of local enterprise data centers, etc.

[0013] S4. The intelligent danger perception engine is trained by using group access logs, external threat intelligence, and real-time traffic characteristics as data sources. The intelligent danger perception engine identifies the attacked nodes in the group and sets the data-related nodes to automatic defense. Based on the intelligent danger perception engine and the group joint defense strategy, a joint defense response is carried out.

[0014] Furthermore, the number of shards and redundancy coefficients are dynamically configured based on the data sensitivity level; the dynamic verification block adopts HMAC-SM3 hash chain technology, the master key MEK is generated by the hardware security module, and the shard keys are dynamically derived; the dynamic verification block storage retains 30 days of historical versions, and forced operations are based on the latest version of the dynamic verification block for verification.

[0015] Furthermore, based on this architecture, the master key (MEK) is generated by the hardware security module (HSM), and the fragment key (DEK) is generated through... Dynamic derivation ensures that a single fragment key leak does not affect other fragments. Combining edge pre-decryption and parallel verification reduces decryption latency by 40% and increases throughput by 120%.

[0016] Furthermore, supported by a dynamic key system, a dynamic threshold formula is constructed based on the Data Sensitivity Index (DSI) and the Node Load Index (NLI): ,

[0017] Where t is the dynamic threshold value, and Nodes is the total number of nodes in the storage shard;

[0018] DSI stands for Data Sensitivity Index. , , All of these are pre-set weighting coefficients, and , , The sum is 1, P is the privacy level, C is the compliance level, and D is the network protocol; NLI is the node load index, U and M are the CPU utilization and memory utilization, respectively, both ranging from [0, 100], N is the real-time network latency in milliseconds, and R is the baseline latency; node reliability score. , Let O represent the reliability score of the i-th node, O be the online rate, Time be the total duration, and Num be the number of historical failures.

[0019] For example, when the node load index increases by 20%, the dynamic threshold value automatically increases by 1-2 levels. During this process, nodes are sorted in descending order based on their reliability scores, and nodes with high RScores are prioritized for threshold decryption. Combined with threshold signature verification of shard consistency, the success rate of tampering injection is reduced from 20% to 0.1%.

[0020] Furthermore, to prevent foreign key association attacks, the database tables are divided into independent marshallingbases based on primary and foreign key relationships. Each marshallingbase is stored in a physically isolated node cluster, and the foreign key fields use... Cross-encryption requires that decryption simultaneously meet the threshold conditions for multiple grouped keys.

[0021] Furthermore, by defining the grouping safety weight formula: 'a' represents the current group weight, 'b' represents the associated group weight, and the sum of 'a' and 'b' equals 1. Set the privacy level for the current group i, from low to high, from 1 to 5. Let j be the sum of the associated group safety weights; if there is no association, the value is 0. The dynamic threshold is adjusted based on the group safety weights, using the following formula: , TN represents the node load index of the current i-th node, and TN represents the total number of nodes, preventing the risk of cross-table joins due to the leakage of foreign key plaintext.

[0022] Furthermore, based on the above protection, by analyzing marshalling access logs, external threat intelligence, and traffic characteristics, attacks such as brute-force attacks and node hijacking can be identified in real time, with a threat identification accuracy rate of 99.9%. Automated joint defense response enables dynamic key rotation: in leakage scenarios, cross-marshalling key updates are automatically triggered (e.g., ...). Re-encryption with foreign keys ensures consistency of ciphertext migration transactions and enhances the protection level of associated marshalling.

[0023] A data security processing system based on distributed storage includes:

[0024] The multi-dimensional verification storage module is used to acquire data fragments and generate dynamic verification blocks;

[0025] The intelligent hazard perception engine module is trained based on group access logs, external threat intelligence, and real-time traffic characteristics as data sources. When a corresponding threat type is detected, the engine automatically raises the dynamic threshold value of the relevant nodes.

[0026] The group defense control module is used for node clusters. When a group is attacked, the other groups will conduct dynamic joint defense. When the group defense control module detects an attack, it generates corresponding threat intelligence and synchronizes it to the other nodes in the group through an encrypted channel, automatically updating their firewall rules.

[0027] The geofencing module dynamically builds geofencing strategies based on the geographic compliance requirements of the data.

[0028] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0029] By combining dynamic sharding strategies with physical isolation verification mechanisms, the problem of single-point failure caused by fixed sharding keys in existing technologies is solved; by dynamic threshold adjustment and cross-group cross-key encryption, the shortcomings of traditional schemes in blocking foreign key association attacks are overcome; and the real-time joint defense response based on the intelligent threat perception engine improves the attack blocking rate. Attached Figure Description

[0030] Figure 1 This is a flowchart of a data security processing method based on distributed storage in an embodiment of the present invention;

[0031] Figure 2 This is an example diagram of the e-commerce database of the present invention;

[0032] Figure 3 This is a key allocation rule diagram for the present invention;

[0033] Figure 4 This is a data security processing system architecture diagram based on distributed storage in an embodiment of the present invention;

[0034] Figure 5 This is a flowchart of a data security processing system based on distributed storage, as described in an embodiment of the present invention. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0037] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0038] Example 1: This application discloses a distributed storage data processing method, the method comprising:

[0039] Based on the security requirements of different business scenarios, the system classifies data sensitivity levels into: Top Secret (n=10 shards, r=2 redundancy); Sensitive (n=6 shards, r=3 redundancy); and Normal (n=3 shards, r=1 redundancy). When a storage node failure is detected, r is automatically increased, and the system replicates the shards to a new node to ensure availability.

[0040] The original data is split into n fragments based on its data sensitivity level, where n ranges from 2 to 10. An independent data encryption key (DEK) is generated for each fragment, and the fragments are encrypted using either the Chinese national cryptographic standard SM4 or AES. The encrypted fragments are then distributed and stored across different nodes, resulting in a set of encrypted fragments. ,in This represents the i-th fragment, and n is the total number of fragments.

[0041] After completing the encrypted sharded distributed storage, for each shard... The dynamic check block of HMAC-SM3 based on timestamp is calculated using the following formula:

[0042] ,

[0043] in, The obtained dynamic verification hash value, where i represents the i-th fragment, HMAC-SM3 is a hash message authentication code based on the Chinese national cryptographic SM3 hash algorithm, used to generate a hash value with a key. This represents the i-th original data content, || represents the data concatenation operator, which concatenates adjacent content in order, and Timestamp is the precise timestamp when the fragment is generated.

[0044] After obtaining the dynamic check hash value, a dynamic check block is generated and stored in an independent secure storage pool. The calculation formula is as follows: ,in, For the i-th segment, the dynamic verification block, Let be the dynamic check hash value of the i-th fragment, and Version be the version number of the dynamic check block, thus obtaining the set of dynamic check blocks. ,in This represents the i-th dynamic check block, and n is the total number of dynamic check blocks.

[0045] To meet data auditing and rollback protection requirements, a new dynamic checksum block is generated with each shard update, while older versions are retained for 30 days. During auditing, historical data status can be traced using the version number. It is mandatory that every operation must be based on the latest version of the dynamic checksum block; older versions are only used for auditing and cannot be used for data recovery. Version control and rollback prevention are achieved through multi-version dynamic checksum block storage.

[0046] The key system employs a hierarchical protection design. The master key (MEK) is generated by the key management service and stored in the hardware security module; the fragmented DEKs are derived hierarchically. ;

[0047] in, Let be the key for the i-th slice. To store the unique identifier of the node for the i-th shard, ensure that the key is bound to the node, and that the DEK of each shard is independent, so that the leakage of the key of a single shard does not affect other shards.

[0048] When a client requests access to data, it retrieves a shard from the storage node. Retrieve the latest dynamic check block from the security pool Recalculate hash , For dynamic verification blocks The timestamp at the time of generation, if If the shard is found to have been tampered with, an alarm will be triggered and the node will be isolated.

[0049] In an adversarial attack environment, when an attacker tampers with the content of a fragment, a dynamic verification block is generated based on the timestamp and fragment content. After tampering, the hash value does not match, triggering a real-time alarm. The tampering detection rate is 99.9%, and the response latency is <50ms. When the DEK of a fragment is leaked, the attacker attempts to decrypt other fragments. Because the fragment keys are independently derived, the leaked DEK only affects a single fragment. Therefore, combined with the dynamic verification block, even if a single fragment is decrypted, the tampering will still be detected, reducing the scope of impact by 80%.

[0050] A dynamic sharding strategy is formed by dynamically adjusting the number of shards based on data sensitivity levels, key level derivation, dynamic check block generation, and version number tracing mechanism.

[0051] For example, an attacker may obtain a subkey for a fragment but still be unable to decrypt the complete data. Dynamic verification blocks can verify the integrity of fragments. If a fragment has been tampered with, the recovery process will automatically detect and reject it.

[0052] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages:

[0053] Dynamic verification blocks completely neutralize data tampering and rollback attacks. The sharding key isolation mechanism reduces the impact of key leakage by 80%, and dynamic sharding and redundancy strategies reduce storage costs by 35% and improve resource utilization by 40%. In contrast, existing technologies rely on fixed encryption zone keys and data encryption key layering mechanisms, lacking dynamic response capabilities. Attackers can steal shards over a long period or exploit node vulnerabilities to crack keys, leading to the spread of single-point failure risks.

[0054] Example 2: In the above examples, data security is further improved by using fragmented encrypted storage and dynamic verification blocks. However, although the risk of single point of leakage is reduced by fragmented key isolation, it cannot prevent attackers from launching coordinated attacks by forging nodes or tampering with the transmitted content. In order to address this problem, this example further improves upon the above examples.

[0055] Privacy level, compliance requirements, and data value are used as the Data Sensitivity Index (DSI). Privacy levels are divided into 1 to 5. Compliance requirements are divided into 3 levels based on the General Data Protection Regulation (GDPR), Cybersecurity Level Protection 2.0, and no requirements, with values ​​of GDPR = 3, Cybersecurity Level Protection 2.0 = 2, and no requirements = 1. Data value is a quantified economic value, such as 100 yuan per MB for medical images. The formula is:

[0056]

[0057] Wherein, DSI is the data sensitivity index. , , All of these are pre-set weighting coefficients, and , , The sum is 1, P is the privacy level, C is the compliance level, and D is the network protocol;

[0058] The server's CPU utilization, memory utilization, and network latency are used as the Node Load Index (NLI).

[0059] The formula is:

[0060] Where NLI is the node load index, U and M are the CPU utilization and memory utilization, respectively, with values ​​ranging from [0,100]. N is the real-time network latency in milliseconds (ms), and R is the baseline latency, which uses different data depending on the scenario, such as 10ms for local use and 100ms for cross-border use.

[0061] A dynamic threshold value is generated based on the data sensitivity index and the node load index.

[0062] The formula for calculating the dynamic threshold is:

[0063] Where t is the dynamic threshold value and Nodes is the total number of nodes in the storage shard.

[0064] To assess the stability and reliability of different nodes, a node reliability score (RScore) is added, calculated using the following formula:

[0065] in, Let represent the reliability score of the i-th node, O be the online rate, Time be the total duration, and Num be the number of historical failures. Based on the reliability scores in descending order, the first t nodes are selected for decryption, and the rest are used as redundant backups.

[0066] By inputting the encrypted fragment set A dynamic threshold value t is used to select t fragments for decryption collaboration based on reliability scores and priorities. Each node uses an independent key to decrypt the fragments and generate intermediate results. Nodes based on Generate local signature Aggregate t items Generate a complete signature The function verifies whether the hash matches the original data hash; if the verification passes, the decryption is successful.

[0067] When an attacker forges multiple fake nodes to participate in collaborative decryption, the reliability score is dynamically downgraded. Because the fake nodes lack historical data or have high threat scores, their reliability scores approach zero, making them unselectable. Therefore, fake shards cannot generate valid shards. This causes aggregation to fail, thus effectively resisting attacks; when an attacker tampers with the content or result, verification is performed according to the threshold signature scheme, and any fragment tampering will result in... If a node fails verification three times in a row, it is marked as high-risk and isolated, reducing the success rate of data tampering injection from 20% to 0.1%.

[0068] In some embodiments, a geofencing strategy is dynamically constructed based on the geographical compliance requirements of the data to restrict the storage and processing nodes of shards to be located within a specified geographical area. When a cross-border shard processing request or a node location is detected outside the geofencing range, a shard replacement mechanism is automatically triggered to migrate the original shard to a compliant node cluster and isolate the non-compliant node. At the same time, the binding relationship between the dynamic verification block and the cross-key is updated to ensure data integrity and regional compliance. For example, EU data is only processed by European nodes, and the dynamic threshold value is adjusted according to regional compliance requirements. The audit log records the entire process of threshold adjustment, shard selection, and decryption verification and retains it for 180 days.

[0069] For example, a stock exchange processes 50,000 trading orders per second, requiring real-time decryption and risk control analysis, and must resist attacks and tampering; the privacy level is 5, the compliance requirement is 2, and the data value is 1KB × 500 yuan / KB = 500 yuan. Substituting these values ​​into the Data Sensitivity Index (DSI) formula yields: The Node Load Index (NLI) is: Thus, dynamic threshold values ​​are obtained: By dynamically lowering the threshold value from 5 to 3 and combining it with GPU parallel computing, millisecond-level decryption is achieved. Verification using the threshold signature scheme ensures that even if an attacker controls one node, they cannot tamper with the transaction data.

[0070] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages:

[0071] By employing dynamic threshold adjustment, fragmentation priority scheduling, and threshold signature verification, the system addresses the security issues arising from attackers launching coordinated attacks by forging nodes or tampering with transmitted content. The dynamic threshold value is adjusted in real time based on the data sensitivity index and the node load index, achieving an optimal balance between security and efficiency.

[0072] Example 3: In the above examples, dynamic threshold sharding and collaborative decryption solve the security problem of attackers launching collaborative attacks by forging nodes or tampering with transmitted content. However, it only encrypts sharded data in a single table and does not solve the risk of cross-table foreign key associations. To address this issue, this example further improves upon the above examples.

[0073] The database tables are divided into multiple groups based on business logic, with each group containing a primary table and secondary tables directly related by foreign keys. Data in each group is stored independently in a physically isolated node cluster. Figure 2 As shown, G1 is stored in node cluster A, and G2 is stored in cluster B; foreign key fields between marshalling groups are stored encrypted.

[0074] Based on the grouping of primary and foreign keys, the grouped keys are fragmented and bound according to the key allocation rules, such as... Figure 3 Foreign keys between groups are encrypted using cross-key encryption. The UserID field in G2 is encrypted as follows: K is the encrypted foreign key. This represents the composite key generated by operating on the key K1 of group G1 and the key K2 of group G2. Decryption requires both K1 and K2 to recover the foreign key plaintext.

[0075] When querying a user's order and payment record data, the client requests to decrypt the UserID of G1 to provide administrator and auditor shards, thereby recovering K1 and decrypting the UserID plaintext:

[0076] Where SM4_Decrypt is the decryption function of the SM4 algorithm, K1 is the key for marshalling G1, and KNC_K1(UserID) represents the ciphertext obtained by encrypting the primary key field UserID of the user table G1 using key K1. This is the decrypted plaintext. User data is obtained; a one-time password token is generated based on the client, valid for 30 seconds, and K2 is generated in conjunction with the administrator's sharding. The foreign key G2 is then further decrypted. To ensure G1's With G2 Match. If a match is found, the order data is retrieved; the auditor activates the K3 shard, verifies the access authorization records of G1 and G2, and dynamically generates a global key: Decrypting the OrderID association in G3: The system obtains payment record data; threshold signatures are used throughout the access process to verify the consistency of cross-group decryption results and prevent man-in-the-middle tampering.

[0077] The grouping safety weight is set based on data sensitivity, and the formula is as follows:

[0078]

[0079] Where 'a' is the current group weight, 'b' is the associated group weight, and the sum of 'a' and 'b' equals 1. Set the privacy level of the current group i from 1 to 5, from low to high. This is the sum of the associated group security weights; if there is no association, this value is 0.

[0080] Adding groups to the dynamic threshold formula yields a new dynamic threshold formula:

[0081]

[0082] Where NLI is the node load index of the current i-th node, and TN is the total number of nodes.

[0083] For example, after stealing order table information, an attacker might want to obtain user information, but due to the use of the foreign key UserID... Encryption is used, and without the G1 key K1, identity cannot be linked. Even if internal personnel obtain the payment record table and attempt to access other data without authorization, the administrator and client still need to generate a one-time password token to create a global key, thus blocking unauthorized access. This provides a technological breakthrough for data association security protection, moving from single-point protection to global collaborative defense.

[0084] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages:

[0085] Dynamic threshold control for primary and foreign key marshalling prevents the leakage of cross-table data relationships through plaintext foreign keys; accessing cross-marshalling data requires meeting multiple marshalling threshold conditions, increasing the cost of cracking for attackers; local storage of data within a marshalling group reduces the overhead of cross-node queries.

[0086] Example 4: In the above examples, dynamic threshold control of primary and foreign key grouping prevents the leakage of cross-table data relationships through plaintext foreign keys; accessing cross-group data requires meeting the threshold conditions of multiple groups, increasing the cost of cracking by attackers; local storage of data within a group reduces the overhead of cross-node queries; however, crisis management often involves passive post-event tracing. To address this issue, this example further improves upon the above examples.

[0087] When the system detects a corresponding threat type, it automatically raises the relevant group dynamic threshold based on the engine, blocks access permissions for suspicious IPs, and triggers key rotation. The intelligent threat perception engine is trained using group access logs, external threat intelligence, and real-time traffic characteristics as input data sources.

[0088] Based on the engine and grouping joint defense strategy, when receiving brute-force attack information, if the G1 node is subjected to a brute-force attack, the dynamic threshold value of the associated group is temporarily increased and the foreign key encryption algorithm is upgraded. The dynamic threshold value is increased, and the foreign key encryption is dynamically updated to SM4-256. When the G2 node is hijacked, the high-risk G2 node is isolated, the associated shards in G1 and G3 are cleaned up simultaneously, the blockchain smart contract is used to trigger cross-group shard deletion, and new shards are generated and stored on the secure node. When the G3 key is leaked, K3 is automatically rotated and all associated foreign keys are updated, and new shards are regenerated. The foreign keys are re-encrypted by traversing the G2 table. Because the foreign keys are dynamically re-encrypted, the key is also rotated to generate new keys. .

[0089] Based on the new key, the ciphertext is migrated, and the integrity of the encryption switch is ensured through database transactions to avoid data inconsistency. The new ciphertext formula is: Text is the new ciphertext, and FK is the corresponding foreign key plaintext.

[0090] Threat intelligence will be shared across groups. When G1 detects a brute-force attack, it will generate corresponding threat intelligence; the report will be synchronized to G2 and G3 via an encrypted channel, automatically updating their firewall rules. Assuming the probability of a single group independently intercepting an attack is P=90%, the overall interception probability increases after joint defense to: This greatly enhances security.

[0091] For example, in the data protection of a cross-border e-commerce platform, user data is placed on an EU node (GSW=5), order data on an Asian node (GSW=4), and payment data on a North American node (GSW=5). When an attacker hijacks two nodes (G2) and attempts to crack the order foreign key association with user identity, the system first identifies the abnormal access pattern of the G2 node, assesses the threat level as 4, and adjusts the G2 dynamic threshold from 4 to 5, requiring 5 shards to decrypt 0. The G1 foreign key encryption algorithm is upgraded from SM4-128 to SM4-256 to block association inference. G3 automatically rotates the K3 key and updates the payment record ciphertext from G2 to G3. Based on the above joint defense response, the attacker cannot obtain enough shards within 1 hour, and the attack fails. The system automatically generates new shards to replace the hijacked nodes, and the business recovery time is less than 5 minutes.

[0092] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages:

[0093] Threat identification has shifted from "post-incident tracing" to "real-time blocking," reducing the attack success rate from 0.1% to 0.001%. When a single group is attacked, associated groups automatically upgrade their protection level. Key rotation and ciphertext migration are fully automated, reducing recovery time from hours to minutes.

[0094] Example 5: Figure 4As shown, this application also provides a data security processing system based on distributed storage, including:

[0095] The multi-dimensional verification storage module is used to acquire data fragments and generate dynamic verification blocks, including:

[0096] The dynamic verification hash value generation unit generates a dynamic verification hash value based on the national cryptographic standard SM3 and the current timestamp. The master key (MEK) is generated by the HSM hardware security module, and the fragmentation key (DEKi) is generated through... Dynamic derivation ensures a strong binding between the key and the node and time;

[0097] The dynamic verification block management unit supports 30-day historical version tracing based on the version number. The dynamic verification block is composed of a combination of version number, timestamp, and hash value. Historical versions can be retrieved by timestamp and the version number can confirm the version.

[0098] The intelligent hazard perception engine module is trained based on group access logs, external threat intelligence, and real-time traffic characteristics as data sources. When a corresponding threat type is detected, the engine automatically raises the dynamic threshold values ​​of relevant nodes, including:

[0099] The automatic detection unit automatically raises the dynamic threshold value of the relevant grouping based on the engine when the system detects the corresponding threat type, blocks the access rights of suspicious IPs, and triggers key rotation.

[0100] The group-based joint defense control module is used for physically isolated node clusters. When one group is attacked, the other groups will dynamically coordinate defense. When the group-based joint defense control module detects an attack, it generates corresponding threat intelligence and synchronizes it to the other nodes in the group through an encrypted channel, automatically updating their firewall rules, including:

[0101] Data isolation storage units are used to independently store grouped data in physically isolated node clusters;

[0102] The cross-key management unit is used to bind the group keys in segments based on the grouping of primary and foreign keys, and to encrypt the foreign keys between groups using cross-key encryption.

[0103] An adaptive threshold adjustment unit is used to respond to changes in threat level in real time;

[0104] The Transaction Consistency Guarantee Unit is used to ensure data integrity during key rotation or ciphertext migration.

[0105] The geofencing module dynamically builds geofencing strategies based on data geographic compliance requirements, including:

[0106] Geofencing units restrict the storage and processing nodes of a shard to a specified geographical area.

[0107] When a cross-border sharding processing request or a node location is detected outside the geofence, the sharding replacement mechanism is automatically triggered to migrate the original shard to the compliant node cluster and isolate the non-compliant node. At the same time, the binding relationship between the dynamic verification block and the cross-key is updated to ensure data integrity and regional compliance.

[0108] like Figure 5 As shown in the diagram, the system workflow is executed in the following order:

[0109] Dynamic sharding strategy: The original data file is sharded into n shards according to a dynamic sharding strategy.

[0110] Dynamic check block: Based on fragmentation, dynamic check blocks are calculated and stored in an independent secure storage pool.

[0111] Key system hierarchical protection design: The master key is generated by the key management service and stored in the hardware security module; the fragmented DEK is derived hierarchically.

[0112] Data Sensitivity Index: Composed of privacy level, compliance requirements, and data value.

[0113] Node load index: composed of privacy level, compliance level, and network protocol.

[0114] Dynamic threshold: A dynamic threshold is generated based on the data sensitivity index and the node load index.

[0115] Reliability score: The stability and reliability of different nodes, used to rank the nodes.

[0116] Primary and foreign keys are used for grouping: Database tables are divided into multiple groups according to business logic. Each group contains a primary table and secondary tables that are directly related by foreign keys. The data in each group is stored independently in a physically isolated node cluster.

[0117] Grouping safety weight: Composed of data sensitivity and grouping settings.

[0118] Intelligent danger perception engine: an engine trained by taking grouped access logs, external threat intelligence, and real-time traffic characteristics as input data sources.

[0119] Cross-group threat intelligence sharing: When one node in a group is attacked, the associated corresponding nodes will automatically defend themselves.

[0120] Geofencing strategy dynamically restricts cross-border framing: a strategy of adjusting dynamic threshold values ​​for different environments.

[0121] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0122] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0123] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0124] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0125] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0126] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0127] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A data security processing method based on distributed storage, characterized in that, include: S1. The original data is divided into fragments based on a dynamic fragmentation strategy. Each fragment generates an independent data encryption key and a dynamic verification block is generated based on the timestamp and fragment content. S2. Based on multi-dimensional indicators, obtain the data sensitivity index and node load index, and generate dynamic threshold values; The multi-dimensional indicators include the privacy level, compliance requirements, and data value of the raw data, as well as the server's CPU utilization, memory utilization, and network latency; a node refers to an independent storage unit in a distributed system. S3. Divide the database tables into independent groups according to the primary and foreign key relationships. Each independent group is stored in a physically isolated node cluster. Foreign key fields between groups are encrypted using cross-key encryption technology. The step of dividing the database table into independent groups based on primary and foreign key relationships includes: primary and foreign key fields are encrypted using cross-key encryption, and the encryption formula is as follows: Where K is the encrypted foreign key, It is a composite key generated based on operations on key K1 and key K2; the grouping security weight calculation uses... 'a' represents the current group weight, 'b' represents the associated group weight, and the sum of 'a' and 'b' equals 1. Set the privacy level for the current group i, from low to high, from 1 to 5. Let j be the sum of the safety weights of the associated groups; if there is no association, the value is 0. The dynamic threshold is adjusted based on the group safety weights, using the following formula: , TN is the node load index of the current i-th node, and TN is the total number of nodes; S4. The intelligent danger perception engine is trained by using group access logs, external threat intelligence, and real-time traffic characteristics as data sources. The intelligent danger perception engine identifies the attacked nodes in the group and sets the data-related nodes to automatic defense. Based on the intelligent danger perception engine and the group joint defense strategy, a joint defense response is carried out.

2. The data security processing method based on distributed storage according to claim 1, characterized in that, The dynamic sharding strategy includes: dynamically configuring the number of shards and redundancy coefficients based on data sensitivity levels; the dynamic verification block adopts HMAC-SM3 hash chain technology, the master key MEK is generated by the hardware security module, and the sharding key is dynamically derived; the dynamic verification block storage retains 30 days of historical versions, and forced operations are based on the latest version of the dynamic verification block for verification.

3. The data security processing method based on distributed storage according to claim 1, characterized in that, The formula for calculating the dynamic threshold value is as follows: ， Where t is the dynamic threshold value, and Nodes is the total number of nodes in the storage shard; ， DSI stands for Data Sensitivity Index. , , All of these are pre-set weighting coefficients, and , , The sum is 1, where P is the privacy level, C is the compliance level, and D is the network protocol; ， NLI is the node load index, U and M are the CPU utilization and memory utilization respectively, both ranging from [0,100], N is the real-time network latency in ms, and R is the baseline latency. Node reliability score ， Let O represent the reliability score of the i-th node, O be the online rate, Time be the total duration, and Num be the number of historical failures.

4. The data security processing method based on distributed storage according to claim 1, characterized in that, The joint defense response includes: The dynamic key rotation mechanism automatically triggers cross-group key updates and foreign key re-encryption in the event of a leak, ensuring the consistency of ciphertext migration transactions and improving the protection level of associated groups.

5. A data security processing system based on distributed storage, implementing the data security processing method based on distributed storage as described in any one of claims 1-4, characterized in that, include: The multi-dimensional verification storage module is used to acquire data fragments and generate dynamic verification blocks; The intelligent hazard perception engine module is trained based on group access logs, external threat intelligence, and real-time traffic characteristics as data sources. When a corresponding threat type is detected, the intelligent hazard perception engine automatically raises the dynamic threshold value of the relevant nodes. The group defense control module is used to manage physically isolated node clusters. When a group is attacked, the other groups will conduct dynamic joint defense. When the group defense control module detects an attack, it generates corresponding threat intelligence and synchronizes it to the other nodes in the group through an encrypted channel, automatically updating the node firewall rules. The geofencing module dynamically builds geofencing strategies based on the geographic compliance requirements of the data.

6. The data security processing system based on distributed storage according to claim 5, characterized in that, The multidimensional verification storage module includes: The dynamic verification hash value generation unit generates a dynamic verification hash value based on the national cryptographic standard SM3 and the current timestamp. The dynamic verification block management unit supports 30-day historical version tracing based on the version number.

7. The data security processing system based on distributed storage according to claim 5, characterized in that, The intelligent hazard perception engine module includes: The automatic detection unit automatically raises the dynamic threshold value of the relevant grouping based on the engine when the system detects the corresponding threat type, blocks the access rights of suspicious IPs, and triggers key rotation.

8. The data security processing system based on distributed storage according to claim 5, characterized in that, The grouped joint defense control module includes: Data isolation storage units are used to independently store grouped data in physically isolated node clusters; The cross-key management unit is used to bind the group keys in segments based on the grouping of primary and foreign keys, and to encrypt the foreign keys between groups using cross-key encryption. An adaptive threshold adjustment unit is used to respond to changes in threat level in real time; The Transaction Consistency Guarantee Unit is used to ensure data integrity during key rotation or ciphertext migration.

9. A data security processing system based on distributed storage according to claim 5, characterized in that, Also includes: Geofencing units restrict the storage and processing nodes of a shard to a specified geographical area. When a cross-border sharding processing request or a node location is detected outside the geofence, the sharding replacement mechanism is automatically triggered to migrate the original shard to the compliant node cluster and isolate the non-compliant node. At the same time, the binding relationship between the dynamic verification block and the cross-key is updated to ensure data integrity and regional compliance.

Images