Data security storage protection device and system

Abstract

The invention discloses a data security storage protection device and system. The data security storage protection device comprises a fragmentation storage module, a sensing distribution module, a security migration module and a terminal defense module, the invention relates to the technical field of data security storage protection. According to the data security storage protection device and system, after sensitivity analysis is carried out on data, fragmentation processing is carried out on medium-risk data and high-risk data, the data processing amount is reduced, main fragments, redundant fragments and bait fragments are stored separately through real-time security scoring on storage nodes, and the data security storage protection device and system are realized through setting of the bait fragments and confusion of attackers. The data storage security is improved, fragment data migration is carried out in cooperation with real-time security scores, the risk that high-level sensitive data are stored in low-level storage nodes is avoided, and dynamic defense adjustment of the fragment data is achieved through calculation of fragment entropy values, so that the high processing efficiency of data storage is guaranteed, and the data storage efficiency is improved. The anti-cracking capability of data storage can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security storage protection, and in particular to a data security storage protection device and system. Background Art

[0002] In the digital age, data has become a critical asset for business operations, and its security is directly related to the survival and development of enterprises. However, with the continuous escalation of cyberattack methods, traditional data storage solutions are no longer able to meet high-security requirements.

[0003] Traditional data storage solutions have the following drawbacks: 1) Traditional encrypted storage methods increase the difficulty of cracking through sharding, but lack dynamic adaptability and suffer from the drawback of being unable to balance high processing efficiency and cracking resistance. 2) Existing storage systems mostly use a node allocation mechanism based on initial security ratings, ignoring dynamic changes in node security status, such as sudden vulnerabilities or network attacks, which can easily lead to the risk of highly sensitive data being stored in low-security nodes. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides a data security storage protection device and system, which solves the problem that traditional encrypted storage methods cannot take into account both high processing efficiency and anti-cracking capabilities, and there is a risk of storing highly sensitive data in low-security nodes.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a data security storage and protection device, including a shard storage module, a perception allocation module, a security migration module and a terminal defense module; The shard storage module is used to perform sharding on medium- and high-risk data after classifying the data according to their sensitivity, and store the fragmented data corresponding to the medium- and high-risk data in the storage node; The perception allocation module is used to calculate the real-time security score of the storage node. After the security level is divided, the fragment allocation strategy is optimized through reinforcement learning to store the fragment data corresponding to medium and high-risk data in the storage nodes of the corresponding security level respectively; The security migration module is used to migrate the fragmented data of the corresponding sensitivity level to a storage node of the corresponding security level when the security level of the current storage node does not belong to the sensitivity level of the fragmented data stored therein; The terminal defense module is used to dynamically adjust the defense strategy according to the fragment entropy value.

[0006] The present invention is further configured as follows: the sensitivity grading method is: after weighted summation according to content sensitivity and context sensitivity, grading is performed based on a preset threshold.

[0007] The present invention is further configured as follows: the method of sharding medium-risk and high-risk data includes: Shard the medium-risk data according to the A+N sharding mode, where A is the number of primary shards, which is 1 and is used to store data metadata, and N is the number of redundant shards. The medium-risk data is fragmented according to the A+N+M fragmentation pattern, where M is the number of bait fragments.

[0008] The present invention is further configured as follows: the formula for determining the number of redundant fragments and the number of bait fragments is: Where, is the real-time threat index, For the The weight of each safety indicator, For the Standardized scores for safety indicators, is the total number of safety indicators, 、 and are all constants.

[0009] The present invention is further configured as follows: the real-time security scoring method for the storage node is: after weighted summation based on the equipment protection level score, the network risk index score and the historical security record score, the high security node, the medium security node and the low security node are determined according to the preset threshold; Among them, high-security nodes are used to store primary fragments, medium-security nodes are used to store redundant fragments, and low-security nodes are used to store decoy fragments.

[0010] The present invention is further configured such that the reward function for optimizing the fragment allocation strategy through reinforcement learning is: Where, is the reward value, The average security score of the allocated fragments is obtained by weighting the fragment size, fragment location, and access rights as the fragment security score, and then averaging the security scores of all allocated fragments. is the target storage node load balancing degree, Normalized value for data access latency, are weight coefficients, and .

[0011] The present invention is further configured as follows: when migrating the fragmented data of the corresponding sensitivity level to the storage node of the corresponding security level, the original data is physically erased, and random false content is inserted based on the real log template to generate a log that conforms to the normal migration mode.

[0012] The present invention is further configured as follows: the calculation formula of the fragment entropy value is: Where, is the fragment entropy value, is the number of fragment types, For the The proportion of this type of fragments in the total fragments.

[0013] The present invention is further configured as follows: the method for dynamically adjusting the defense strategy according to the fragment entropy value includes: Preset thresholds for safe state, alert state, and dangerous state, and make judgments on safe state, alert state, and dangerous state based on fragment entropy values; When in a safe state, the main fragment is randomly stored in a high-security node; When the alert state is determined, the main fragment is split into a set number of sub-main fragments, which are stored in different high-security nodes. When it is judged to be in a dangerous state, the main fragment is split into a set number of sub-main fragments, and the sub-main fragments, redundant fragments and bait fragments are stored in different high-security nodes according to categories.

[0014] The present invention also discloses a data security storage protection system, which includes the above-mentioned data security storage protection device.

[0015] The present invention provides a data security storage protection device and system. It has the following beneficial effects: The present invention performs sensitivity analysis on the data and then fragments the medium- and high-risk data to reduce the data processing volume. By performing real-time security scoring on the storage nodes, the present invention realizes the separate storage of primary fragments, redundant fragments and decoy fragments. The setting of decoy fragments confuses attackers and improves the security of data storage. The present invention migrates the fragmented data in conjunction with the real-time security scoring to avoid the risk of high-level sensitive data being stored in low-level storage nodes. The present invention also realizes dynamic defense adjustment of the fragmented data by calculating the fragment entropy value. In this way, the high processing efficiency of data storage is guaranteed while the anti-cracking ability of data storage can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a system architecture block diagram of the present invention. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0018] See also Figure 1 , the embodiment of the present invention provides the following technical solutions: Example 1 A data security storage and protection device includes a shard storage module, a perception allocation module, and a security migration module. The shard storage module is used to classify the sensitivity of the data, then perform sharding on medium- and high-risk data, and store the fragmented data corresponding to the medium- and high-risk data in a storage node. Specifically, the sensitivity grading formula is as follows: after performing a weighted summation based on content sensitivity and context sensitivity, grading is performed based on a preset threshold.

[0019] like: Where, is a sensitive value, To score the sensitivity of the content on a 100-point scale, we use NLP / CV models to analyze sensitive entities in the data. 50-point context sensitivity score, combined with data usage scenarios and access rights, are all weight coefficients.

[0020] For low-risk data, conventional encryption storage methods are sufficient.

[0021] To further explain, the methods for sharding medium and high-risk data include: Shard the medium-risk data according to the A+N sharding mode, where A is the number of primary shards, which is 1 and is used to store data metadata, and N is the number of redundant shards. The medium-risk data is fragmented according to the A+N+M fragmentation pattern, where M is the number of bait fragments.

[0022] The core metadata of the primary shard storage data is the key to data integrity and is only stored in high-security nodes to ensure a high level of security. Redundant shards are used to provide data redundancy, ensuring that data can be recovered even if some nodes fail. They are mainly stored in medium-security nodes. Although the security level of these nodes is slightly lower than that of high-security nodes, they can still meet the security storage requirements of redundant data. Bait fragments are false fragments that simulate real data. They are used to confuse attackers and increase the difficulty of data cracking. They are mainly stored in low-security nodes. These nodes may have certain security risks, but the bait fragments themselves do not contain real data, so even if they are attacked, they will not lead to data leakage.

[0023] As a detailed explanation, the proposed formula for the number of redundant fragments and the number of decoy fragments is: Where, is the real-time threat index, For the The weight of each safety indicator, For the Standardized scores for safety indicators, The total number of security indicators, further explained, includes but is not limited to the frequency of intrusion detection alerts, the number of malware detections, the proportion of abnormal traffic, the number of system vulnerabilities, and the frequency of user permission changes. 、 and These are all constants. By simulating different threat scenarios, such as DDoS attacks and data leaks, we test the defense effectiveness and system performance under different constant combinations and ultimately select the optimal solution: 、 and They are 20, 0.1 and 10 respectively.

[0024] As a preferred solution, in order to judge the real-time security of storage nodes, the perception allocation module is used to calculate the real-time security score of storage nodes. The calculation method is: after weighted summation based on the equipment protection level score, network risk index score and historical security record score, high security nodes, medium security nodes and low security nodes are determined according to the preset threshold.

[0025] like: Where, is the security score of the storage node, Score the equipment protection level on a 100-point scale. Score the cyber risk index on a 50-point scale. Score historical safety records on a 30-point scale. are all weight coefficients.

[0026] The network risk index scoring formula is: The historical safety record scoring formula is: After the security level is divided, high-security nodes are used to store main fragments, medium-security nodes are used to store redundant fragments, and low-security nodes are used to store decoy fragments. The fragment allocation strategy is optimized through reinforcement learning, and the fragment data corresponding to medium and high-risk data are stored in storage nodes of corresponding security levels respectively.

[0027] As a detailed description, for optimizing the fragment allocation strategy through reinforcement learning, a deep Q-network algorithm is used to construct a Markov decision process decision model. Its state space includes: storage node security score, storage load, network latency, and real-time threat index; its action space includes fragment allocation action, redundancy adjustment action, and storage strategy action. The fragment allocation action is used to select the target node number for each fragment, the redundancy adjustment action is used to dynamically adjust the number of redundant fragments, and the storage strategy action is used to select the encryption algorithm and key type. The encryption algorithm includes but is not limited to AES-256-GCM and AES-128-CBC, and the key type includes but is not limited to quantum key. Furthermore, in order to balance security, efficiency, and cost, the reward function is: Where, is the reward value, is the average safety score of the fragments after allocation, using a percentage score. is the load balance of the target storage node, that is, load standard deviation / average load, Normalized value for data access latency, are weight coefficients, and , which selects the weight coefficient according to the importance, such as: In the IoT scenario, The values ​​are 0.5, 0.3 and 0.2 respectively; In the financial context, The values ​​are 0.6, 0.2 and 0.1 respectively.

[0028] As a preferred solution, in order to avoid the risk of high-level sensitive data being stored in low-level storage nodes, the security migration module is used to migrate the fragmented data of the corresponding sensitivity level to the storage node of the corresponding security level when the security level of the current storage node does not belong to the sensitivity level of the fragmented data stored therein. At the same time, the original data is physically erased, and random false content is inserted based on the real log template to generate a log that conforms to the normal migration mode. In this way, the data migration process is made traceless. Even if an attacker obtains the storage medium or log, the real operation path cannot be restored.

[0029] Example 2 This embodiment is an improvement of the previous embodiment. A data security storage protection device further includes a terminal defense module. The terminal defense module is used to dynamically adjust the defense strategy according to the fragment entropy value. The calculation formula of the fragment entropy value is: Where, is the fragment entropy value, is the number of fragment types, For the The proportion of this type of fragments in the total fragments.

[0030] The dynamic adjustment of defense strategies includes: presetting thresholds for safe state, alert state, and dangerous state, and judging safe state, alert state, and dangerous state based on fragment entropy values, such as: exist When the fragment distribution is highly disordered, it is judged to be in a safe state and the main fragment is randomly stored in a high-security node; exist When the shards are in a state of alert, there may be a risk of shard aggregation. The main shard will be split into a set number of sub-main shards, which will be stored in different high-security nodes. exist When the fragment distribution has a high predictable risk, it is judged to be in a dangerous state, and the main fragment is split into a set number of sub-main fragments. The sub-main fragments, redundant fragments and decoy fragments are stored in different high-security nodes according to their categories.

[0031] The advantage of Example 2 over Example 1 is that the data storage scheme can be dynamically adjusted according to the fragmentation threshold to further improve the security of data storage.

[0032] Simulation experiment A distributed storage simulation environment was built, containing 20 storage nodes, to simulate network environments with different security levels, and to simulate threat scenarios such as data theft, tampering, and man-in-the-middle attacks. Using the traditional fixed sharding mode, combined with TLS / SSL encrypted transmission and AES-256 encrypted storage as a comparison, data cracking resistance, storage node load balancing, data access latency, migration trace elimination effect, and defense strategy dynamic adjustment ability were tested as indicators. Among them, the data cracking resistance test was conducted by using automated cracking tools to attack the stored data and record the time required for the cracking and the success rate. The storage node load balancing test was conducted by monitoring the CPU, memory, and disk I / O usage of the storage node and calculating the ratio of the load standard deviation to the average load. The data access latency test was conducted by using the network performance testing tool iperf to measure the time from requesting data to actually obtaining the data. The migration trace elimination effect was tested by using data recovery tools to attempt to restore data from the original storage location after data migration and recording the recovery success rate. The defense strategy dynamic adjustment ability was tested by simulating different threat scenarios and recording the time and accuracy of the system adjusting the defense strategy. The test results are as follows: As can be seen from the above table, compared with traditional sharding technology, this invention effectively improves data anti-cracking capabilities and reduces node load differences. By optimizing storage node selection, it reduces the length of data access paths. Combined with physical erasure and false log generation, it effectively eliminates migration traces. Through real-time threat perception, it quickly and accurately adjusts defense strategies, providing reliable support for data security storage in scenarios with high security requirements.

[0033] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data security storage protection device, characterized in that: It includes shard storage module, perception allocation module, security migration module and terminal defense module; The shard storage module is used to perform sharding on medium- and high-risk data after classifying the data according to their sensitivity, and store the fragmented data corresponding to the medium- and high-risk data in the storage node; The perception allocation module is used to calculate the real-time security score of the storage node. After the security level is divided, the fragment allocation strategy is optimized through reinforcement learning to store the fragment data corresponding to medium and high-risk data in the storage nodes of the corresponding security level respectively; The security migration module is used to migrate the fragmented data of the corresponding sensitivity level to a storage node of the corresponding security level when the security level of the current storage node does not belong to the sensitivity level of the fragmented data stored therein; The terminal defense module is used to dynamically adjust the defense strategy according to the fragment entropy value.

2. The data security storage protection device according to claim 1, characterized in that: The sensitivity grading method is: after performing weighted summation based on content sensitivity and context sensitivity, grading is performed based on a preset threshold.

3. The data security storage protection device according to claim 1, characterized in that: The method of sharding medium- and high-risk data includes: Shard the medium-risk data according to the A+N sharding mode, where A is the number of primary shards, which is 1 and is used to store data metadata, and N is the number of redundant shards. The medium-risk data is fragmented according to the A+N+M fragmentation pattern, where M is the number of bait fragments.

4. The data security storage protection device according to claim 3, characterized in that: The proposed formula for the number of redundant fragments and the number of bait fragments is: Where, is the real-time threat index, Rate the sensitivity of the content, Score context sensitivity, For the The weight of each safety indicator, For the Standardized scores for safety indicators, is the total number of safety indicators, 、 and are all constants.

5. The data security storage protection device according to claim 1, characterized in that: The real-time security scoring method for the storage nodes is as follows: after weighted summation of the equipment protection level score, network risk index score and historical security record score, high security nodes, medium security nodes and low security nodes are determined according to the preset threshold; Among them, high-security nodes are used to store primary fragments, medium-security nodes are used to store redundant fragments, and low-security nodes are used to store decoy fragments.

6. The data security storage protection device according to claim 1, characterized in that: The reward function for optimizing the fragment allocation strategy through reinforcement learning is: Where, is the reward value, The average security score of the allocated fragments is obtained by weighting the fragment size, fragment location, and access rights as the fragment security score, and then averaging the security scores of all allocated fragments. is the target storage node load balancing degree, Normalized value for data access latency, are weight coefficients, and .

7. The data security storage protection device according to claim 1, characterized in that: When migrating the fragmented data of the corresponding sensitivity level to the storage node of the corresponding security level, the original data is physically erased, and random false content is inserted based on the real log template to generate a log that conforms to the normal migration mode.

8. The data security storage and protection system according to claim 5, characterized in that: The calculation formula of the fragment entropy value is: Where, is the fragment entropy value, is the number of fragment types, For the The proportion of this type of fragments in the total fragments.

9. The data security storage and protection system according to claim 8, characterized in that: The dynamic adjustment method of the defense strategy based on the fragment entropy value includes: Preset thresholds for safe state, alert state, and dangerous state, and make judgments on safe state, alert state, and dangerous state based on fragment entropy values; When it is judged to be in a safe state, the main fragment is randomly stored in a high-security node; When the alert state is reached, the main fragment is split into a set number of sub-main fragments, which are stored in different high-security nodes. When it is judged to be in a dangerous state, the main fragment is split into a set number of sub-main fragments, and the sub-main fragments, redundant fragments and bait fragments are stored in different high-security nodes according to categories.

10. A data security storage and protection system, characterized in that: The device comprises the data security storage protection device as described in any one of claims 1 to 9.

Images