Data security management method and system based on cloud computing

Abstract

The invention is suitable for the technical field of cloud computing, and provides a data security management method and system based on cloud computing, and the method comprises the following steps: constructing a hardware-level isolation layer, and creating an encrypted memory sandbox in a physical server based on a ComfyUI driver; performing encryption protection during operation and persistent encryption during shutdown unloading; updating a GPU model library, a user demand library and a resource state library in real time, and automatically performing GPU model adaptation according to a user task; hardware state monitoring and software probe monitoring are carried out; user behavior analysis is carried out, and resource demands in future set time are predicted; according to the monitoring result and the resource demand in the future set time, whether automatic shutdown is carried out or not is determined, and after shutdown, GPU resources are immediately released to the public pool. According to the method, the hardware-level isolation layer and the encryption memory sandbox are constructed, and the persistent encryption measures are taken, so that the security of the data in the cloud computing environment is effectively protected, and a more reliable data storage and processing environment is provided for a user.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, specifically to a data security management method and system based on cloud computing. Background Technology

[0002] With the widespread application of cloud computing technology, centralized storage and processing of data in the cloud has become the norm. In cloud computing environments, data security and efficient resource management face numerous challenges. On the one hand, data security is a key factor in the development of cloud computing. Data in the cloud involves sensitive information from numerous users, such as personal privacy and trade secrets; leakage would have serious consequences. Traditional security measures are inadequate in dealing with increasingly complex network attacks and data theft methods, especially in terms of memory-level data protection and encryption during persistent data storage. On the other hand, resource demands in cloud computing environments are dynamic and uncertain. Different user tasks have vastly different demands for computing resources, especially GPU resources, which change continuously as the task is executed. Existing cloud computing systems lack flexibility and intelligence in resource allocation and management, making it difficult to accurately adapt to real-time resource status and user needs, resulting in low resource utilization and failing to fully leverage the advantages of cloud computing in efficiently processing large-scale data and complex computing tasks. Simultaneously, monitoring of hardware status and analysis of user behavior are relatively lagging, unable to predict changes in resource demand in advance, and unable to make timely resource adjustment decisions. Therefore, a cloud-based data security management method and system are needed to address these problems. Summary of the Invention

[0003] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a data security management method and system based on cloud computing to solve the problems existing in the above-mentioned background technology.

[0004] This invention is implemented as follows: a data security management method based on cloud computing, the method comprising the following steps: A hardware-level isolation layer is constructed, and an encrypted memory sandbox is created on the physical server based on the ComfyUI driver; runtime encryption protection and persistent encryption are performed when the data is transferred during shutdown. The system updates the GPU model library, user requirement library, and resource status library in real time, automatically adapts the GPU model according to the user task, and automatically builds a cross-server computing cluster when a single GPU cannot meet the requirements. Perform hardware status monitoring and software probe monitoring; conduct user behavior analysis to predict resource requirements within a set timeframe in the future; Based on monitoring results and resource requirements within a set future timeframe, determine whether to automatically shut down the system. After shutdown, immediately release GPU resources to the public pool while retaining container metadata.

[0005] As a further aspect of the present invention: the steps of performing runtime encryption protection and persistent encryption during shutdown and data transfer specifically include: During read and write operations, a random AES key is generated and stored using white-box encryption technology to monitor abnormal process behavior in real time; when an attack is detected, the data in the quarantine area is automatically erased and a forensic snapshot is generated. When the system is shut down and the data is transferred, the file is split into 128KB data fragments, each encrypted with a different key. The hash value of each data fragment is written into a distributed ledger, and copies of the encrypted data are stored on nodes in several different cities.

[0006] As a further aspect of the present invention: the step of automatically adapting the GPU model according to the user task specifically includes: Identify available GPU models and filter out GPU nodes that have had hardware alarms in the last 2 hours; The matching degree between user tasks and GPUs is calculated based on the model's computing power and memory availability. Control load balancing to distribute continuous user tasks across different physical machines and avoid hotspots.

[0007] As a further aspect of the present invention: the steps of performing hardware status monitoring and software probe monitoring; performing user behavior analysis; and predicting resource requirements within a set future time period specifically include: Perform hardware monitoring to monitor GPU core temperature, record instantaneous power consumption, and track fan speed; perform software probes to record GPU utilization and memory usage information for each CUDA process. Analyze user operation logs, record all console commands and API calls, and detect abnormal data access behavior through clustering algorithms; Collect resource usage curves within a recently set time period and predict resource demand within a future set time period based on the Prophet time series algorithm.

[0008] As a further aspect of the present invention: the method further includes implementing a fast recovery mechanism, the specific steps of which are as follows: After identity authentication and authorization are performed, the pre-set smart contract is automatically executed to read encrypted data fragments in parallel from several geographically distributed nodes. Perform fragment-level integrity verification and dynamic key reconstruction; Read container configuration, restore snapshots of incomplete tasks, pre-allocate GPU resources of a specified model, and load CUDA context cache; High-frequency access data blocks are identified and preloaded into GPU memory using RDMA technology.

[0009] Another object of the present invention is to provide a cloud computing-based data security management system, the system comprising: The hardware isolation layer building module is used to build a hardware-level isolation layer, creating an encrypted memory sandbox on the physical server based on the ComfyUI driver; it performs runtime encryption protection and persistent encryption during shutdown and data transfer. The GPU model adaptation module is used to update the GPU model library, user requirement library, and resource status library in real time. It automatically adapts the GPU model according to the user task and automatically builds a cross-server computing cluster when a single GPU cannot meet the requirements. The resource demand forecasting module is used for hardware status monitoring and software probe monitoring; it also performs user behavior analysis to predict resource demand within a set future time period. The shutdown data management module is used to determine whether to automatically shut down based on monitoring results and resource requirements within a set future time. After shutdown, GPU resources are immediately released to the public pool, while container metadata is retained.

[0010] As a further aspect of the present invention: the hardware isolation layer construction module includes: The read / write interaction encryption unit is used to generate random AES keys during read / write operations, store them using white-box encryption technology, and monitor abnormal process behavior in real time; when an attack is detected, it automatically erases the data in the isolation area and generates an forensic snapshot; The shutdown transfer encryption unit is used to split the file into 128KB data fragments when the computer is shut down for transfer. Each fragment is encrypted with a different key, and the hash value of each data fragment is written into a distributed ledger. Copies of the encrypted data are stored on nodes in several different cities.

[0011] As a further aspect of the present invention: the GPU model adaptation module includes: The GPU model filtering unit is used to determine the idle GPU model and filter out GPU nodes that have hardware alarms in the last 2 hours. The GPU model matching unit is used to calculate the matching degree between the user task and the GPU based on the model's computing power and memory satisfaction rate. The load balancing control unit is used to control load balancing, distributing continuous user tasks to different physical machines to avoid hotspots.

[0012] As a further aspect of the present invention: the resource demand prediction module includes: The hardware and software monitoring unit is used for hardware monitoring, including monitoring GPU core temperature, recording instantaneous power consumption, and tracking fan speed; and for software probing, recording GPU utilization and memory usage information for each CUDA process. The user behavior analysis unit is used to analyze user operation logs, record all console commands and API calls, and detect abnormal data access behavior through clustering algorithms. The resource demand forecasting unit is used to collect resource usage curves within the most recent set time period and predict resource demand within the future set time period based on the Prophet time series algorithm.

[0013] As a further aspect of the present invention: the system further includes a fast recovery module, which specifically includes: The identity authentication and authorization unit is used for identity authentication and authorization. After successful verification, it automatically executes a pre-set smart contract to read encrypted data fragments in parallel from several geographically distributed nodes. The integrity verification unit is used for fragment-level integrity verification and dynamic key reconstruction. The metadata hot-loading unit is used to read container configuration, restore snapshots of incomplete tasks, pre-allocate GPU resources of a specified model, and load the CUDA context cache. The data prefetching acceleration unit is used to identify frequently accessed data blocks and preload them into the GPU memory using RDMA technology.

[0014] Compared with the prior art, the beneficial effects of the present invention are: This invention effectively protects data security in the cloud computing environment by constructing a hardware-level isolation layer, an encrypted memory sandbox, and persistent encryption measures. It reduces the risk of data leakage, provides users with a more reliable data storage and processing environment, and enhances user trust in cloud computing services. By updating libraries in real time, automatically adapting to GPU models, and building cross-server computing clusters, resource allocation can be dynamically adjusted according to user tasks, ensuring full resource utilization and avoiding waste. Simultaneously, through user behavior analysis and resource demand prediction, resource preparation is made in advance, improving the responsiveness and flexibility of resource management and further enhancing resource utilization efficiency. Comprehensive hardware status monitoring and software probe monitoring can promptly detect hardware failures and software anomalies, taking proactive measures to prevent system crashes or task interruptions, ensuring the stable operation of the cloud computing system. Timely release of GPU resources and retention of container metadata facilitate subsequent resource allocation and task recovery, improving system reliability and maintainability. Attached Figure Description

[0015] Figure 1 This is a flowchart of a cloud-based data security management method.

[0016] Figure 2 This is a flowchart illustrating encryption protection in a cloud-based data security management method.

[0017] Figure 3This is a flowchart illustrating GPU model adaptation in a cloud-based data security management method.

[0018] Figure 4 This is a flowchart for predicting future resource needs in a cloud-based data security management method.

[0019] Figure 5 This is a flowchart illustrating the execution of a fast recovery mechanism in a cloud-based data security management method.

[0020] Figure 6 This is a schematic diagram of the structure of a cloud-based data security management system. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0022] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0023] like Figure 1 As shown in the figure, this embodiment of the invention provides a data security management method based on cloud computing, the method comprising the following steps: S100 constructs a hardware-level isolation layer and creates an encrypted memory sandbox on the physical server based on the ComfyUI driver; it performs runtime encryption protection and persistent encryption during shutdown and data transfer. S200 updates the GPU model library, user requirement library, and resource status library in real time. It automatically adapts the GPU model according to the user's task and automatically builds a cross-server computing cluster when a single GPU cannot meet the requirements. The S300 performs hardware status monitoring and software probe monitoring; it also performs user behavior analysis to predict resource requirements within a set timeframe. The S400 determines whether to automatically shut down based on monitoring results and resource requirements within a set future timeframe. After shutdown, it immediately releases GPU resources to the public pool while retaining container metadata.

[0024] It should be noted that traditional cloud computing environments lack effective isolation and encryption protection for data in memory, allowing attackers to obtain sensitive data through memory theft and other means. When data is transferred after shutdown, existing technologies may suffer from untimely or incomplete encryption, leading to data leakage risks during storage. Furthermore, different user tasks have varying requirements for GPU models and quantities, and existing cloud computing systems struggle to automatically and accurately adapt GPU models based on user tasks. When a single GPU cannot meet the demand, it cannot efficiently and automatically build cross-server computing clusters. Moreover, traditional cloud computing environments lack effective analysis of user behavior, making it impossible to predict resource demands within a set timeframe. This results in resource allocation failing to respond promptly to changes in demand, leading to resource waste or shortages. After server shutdown, existing systems may not immediately release GPU resources to the shared pool, resulting in idle resources and reduced resource utilization. The embodiments of this invention aim to solve the above problems.

[0025] In this embodiment of the invention, a hardware-level isolation layer is first constructed. Upon container startup, an encrypted memory sandbox is created on the physical server based on the ComfyUI driver. A secure memory region is defined using Intel SGX technology, a virtualization I / O filter is installed, all disk reads and writes are automatically redirected to the isolated space, and a dynamic hardware fingerprint (based on CPU serial number + motherboard BIOS version + TPM chip data) is generated. Then, runtime encryption protection and persistent encryption are implemented during shutdown and data transfer. Next, global GPU resource pooling scheduling is performed, with real-time updates to three databases: 1. GPU model database (recording the number of CUDA cores, memory bandwidth, and computing power of all graphics cards); 2. User requirement database (analyzing historical task characteristics and establishing typical load models); 3. Resource status database (refreshing GPU temperature, utilization, and task queues for each node every 15 seconds). GPU model adaptation is automatically performed based on user tasks. When a single GPU cannot meet the requirements, a cross-server computing cluster is automatically formed, implementing a relay computing mode. NVIDIA GPUDirect RDMA technology is used to achieve memory pass-through, reducing data transmission latency. Next, hardware status monitoring and software probes are used, along with user behavior analysis to predict resource demands within a set future timeframe. Based on the monitoring results and the predicted resource demands, an automatic shutdown is initiated. For example, if the following conditions are met simultaneously: 1. GPU utilization is less than 5% for 15 minutes; 2. Memory access is idle for more than 20 minutes; 3. Predictions indicate no new tasks will be added in the next 2 hours, then automatic shutdown will occur. After shutdown, GPU resources are immediately released to a shared pool, while container metadata such as CPU core count, memory configuration, environment variables, and snapshots of incomplete tasks are preserved. A 15-minute buffer period is set after shutdown, during which the GPU can be temporarily used by low-priority tasks. Users can reclaim resources at any time during the buffer period. Intelligent resource management and efficient data security protection allow users to focus more on their business without worrying about data security or resource shortages. Automated resource adaptation and cluster setup reduce the tedious manual configuration process, improve task execution efficiency, and provide users with a superior and more convenient cloud computing service experience.

[0026] like Figure 2 As shown, in a preferred embodiment of the present invention, the steps of performing runtime encryption protection and persistent encryption during shutdown and data transfer specifically include: S101 generates a random AES key during read and write operations, stores it using white-box encryption technology, and monitors abnormal process behavior in real time; when an attack is detected, it automatically erases data in the quarantine area and generates a forensic snapshot. S102, when the file is transferred after shutdown, splits it into 128KB data fragments, encrypts each fragment with a different key, writes the hash value of each data fragment into a distributed ledger, and saves encrypted data copies on nodes in several different cities.

[0027] In this embodiment of the invention, a one-time key mechanism is used during data interaction. A random AES key is generated for each read / write operation, stored using white-box encryption technology, and abnormal process behavior, such as unauthorized memory access and malicious code injection, is monitored in real time. When an attack is detected, memory circuit breaker protection is implemented, automatically erasing isolated data and generating an forensic snapshot within 30 seconds. Furthermore, when transferring data after shutdown, the file is split into 128KB data fragments, each encrypted with a different key. The hash value of each data fragment is written into a distributed ledger, forming an immutable evidence chain. Encrypted data copies are stored at nodes in several (e.g., three) different cities, resulting in excellent encryption performance.

[0028] like Figure 3 As shown in the preferred embodiment of the present invention, the step of automatically adapting the GPU model according to the user task specifically includes: S201, identify the idle GPU model and filter out GPU nodes that have had hardware alarms in the last 2 hours; S202 calculates the matching degree between user tasks and GPU based on model computing power and memory availability. S203 controls load balancing, distributing continuous user tasks to different physical machines to avoid hotspots.

[0029] In this embodiment of the invention, the currently available GPU models are first determined, and GPU nodes with hardware alarms within the last two hours are filtered out. Then, GPU matching is performed, determining the GPU model that matches the user task based on the GPU's computing power and memory availability. Furthermore, load balancing is considered, distributing consecutive user tasks across different physical machines to avoid hotspots and make the cloud computing service more stable.

[0030] like Figure 4 As shown, in a preferred embodiment of the present invention, the steps of performing hardware status monitoring and software probe monitoring; performing user behavior analysis; and predicting resource requirements within a set future time period specifically include: The S301 performs hardware monitoring, tracking GPU core temperature, recording instantaneous power consumption, and monitoring fan speed; it also performs software probes, recording GPU utilization and memory usage information for each CUDA process. S302 analyzes user operation logs, records all console commands and API calls, and detects abnormal data access behavior through clustering algorithms; S303 collects resource usage curves within a recently set time period and predicts resource demand within a future set time period based on the Prophet time series algorithm.

[0031] In this embodiment of the invention, during hardware monitoring, the GPU core temperature is monitored, instantaneous power consumption is recorded (sampling frequency 1Hz), and fan speed and health are tracked. During software probing, GPU utilization and memory usage information for each CUDA process are recorded, and I / O analysis is performed to track PCIe bus bandwidth usage. Next, user behavior is analyzed, recording all console commands and API calls based on user operation logs, and abnormal data access behavior is detected using clustering algorithms. Additionally, a prediction model is trained using 72 hours of resource usage curves (sampled at 5-minute granularity), allowing the prediction of resource demands within a specified future timeframe based on the Prophet time series algorithm.

[0032] like Figure 5 As shown, in a preferred embodiment of the present invention, the method further includes executing a fast recovery mechanism, the specific steps of which are as follows: S501 performs identity authentication and authorization. After successful verification, it automatically executes a pre-set smart contract to read encrypted data fragments in parallel from several geographically distributed nodes. S502 performs fragment-level integrity verification and dynamic key reconstruction; S503 reads container configuration, restores snapshots of incomplete tasks, pre-allocates GPU resources of a specified model, and loads the CUDA context cache; S504 identifies high-frequency access data blocks and preloads them into GPU memory using RDMA technology.

[0033] In this embodiment of the invention, a rapid recovery mechanism is also included. First, multi-layered identity authentication and authorization are performed, such as biometric verification and blockchain identity anchoring. The user's identity hash value stored in the distributed ledger is queried and compared with the on-chain data of this authentication to ensure that the identity has not been tampered with (preventing man-in-the-middle attacks). After successful identity verification, a pre-set smart contract is automatically executed to read encrypted data fragments in parallel from at least three geographically distributed nodes. A SHA-3 hash value is calculated for each 128KB data block and compared with the hash chain stored on the blockchain, automatically repairing up to two damaged fragments. Then, a decryption master key is generated by combining the user's fingerprint feature code and hardware fingerprint. White-box encryption technology is used to decrypt the data fragments layer by layer, achieving dynamic key reconstruction. Next, the container environment is rapidly rebuilt, reading the container configuration (CPU core count, memory size, environment variables), restoring incomplete task snapshots, pre-allocating specified GPU resources (prioritizing devices of the same model as before shutdown), and loading the CUDA context cache, which can reduce kernel initialization time by 30%. Finally, frequently accessed data blocks are identified and pre-loaded into GPU memory using RDMA technology, reducing latency to the microsecond level.

[0034] like Figure 6As shown in the figure, this embodiment of the invention also provides a cloud computing-based data security management system, the system comprising: Hardware isolation layer construction module 100 is used to build a hardware-level isolation layer, creating an encrypted memory sandbox on the physical server based on the ComfyUI driver; performing runtime encryption protection and persistent encryption during shutdown and data transfer; The GPU model adaptation module 200 is used to update the GPU model library, user requirement library and resource status library in real time. It automatically adapts the GPU model according to the user task. When a single GPU cannot meet the requirements, it automatically builds a cross-server computing cluster. The resource demand forecasting module 300 is used for hardware status monitoring and software probe monitoring; it also performs user behavior analysis to predict resource demand within a set future time period. The shutdown data management module 400 is used to determine whether to automatically shut down based on monitoring results and resource requirements within a set future time. After shutdown, GPU resources are immediately released to the public pool, while container metadata is retained.

[0035] In a preferred embodiment of the present invention, the hardware isolation layer construction module 100 includes: The read / write interaction encryption unit is used to generate random AES keys during read / write operations, store them using white-box encryption technology, and monitor abnormal process behavior in real time; when an attack is detected, it automatically erases the data in the isolation area and generates an forensic snapshot; The shutdown transfer encryption unit is used to split the file into 128KB data fragments when the computer is shut down for transfer. Each fragment is encrypted with a different key, and the hash value of each data fragment is written into a distributed ledger. Copies of the encrypted data are stored on nodes in several different cities.

[0036] In a preferred embodiment of the present invention, the GPU model adaptation module 200 includes: The GPU model filtering unit is used to determine the idle GPU model and filter out GPU nodes that have hardware alarms in the last 2 hours. The GPU model matching unit is used to calculate the matching degree between the user task and the GPU based on the model's computing power and memory satisfaction rate. The load balancing control unit is used to control load balancing, distributing continuous user tasks to different physical machines to avoid hotspots.

[0037] In a preferred embodiment of the present invention, the resource demand prediction module 300 includes: The hardware and software monitoring unit is used for hardware monitoring, including monitoring GPU core temperature, recording instantaneous power consumption, and tracking fan speed; and for software probing, recording GPU utilization and memory usage information for each CUDA process. The user behavior analysis unit is used to analyze user operation logs, record all console commands and API calls, and detect abnormal data access behavior through clustering algorithms. The resource demand forecasting unit is used to collect resource usage curves within the most recent set time period and predict resource demand within the future set time period based on the Prophet time series algorithm.

[0038] In a preferred embodiment of the present invention, the system further includes a fast recovery module, which specifically includes: The identity authentication and authorization unit is used for identity authentication and authorization. After successful verification, it automatically executes a pre-set smart contract to read encrypted data fragments in parallel from several geographically distributed nodes. The integrity verification unit is used for fragment-level integrity verification and dynamic key reconstruction. The metadata hot-loading unit is used to read container configuration, restore snapshots of incomplete tasks, pre-allocate GPU resources of a specified model, and load the CUDA context cache. The data prefetching acceleration unit is used to identify frequently accessed data blocks and preload them into the GPU memory using RDMA technology.

[0039] The above description only details the preferred embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0040] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0041] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0042] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the disclosure in the specification and embodiments. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A data security management method based on cloud computing, characterized in that, The method includes the following steps: A hardware-level isolation layer is constructed, and an encrypted memory sandbox is created on the physical server based on the ComfyUI driver; runtime encryption protection and persistent encryption are performed when the data is transferred during shutdown. The system updates the GPU model library, user requirement library, and resource status library in real time, automatically adapts the GPU model according to the user task, and automatically builds a cross-server computing cluster when a single GPU cannot meet the requirements. Perform hardware status monitoring and software probe monitoring; conduct user behavior analysis to predict resource requirements within a set timeframe in the future; Based on monitoring results and resource requirements within a set future timeframe, determine whether to automatically shut down the system. After shutdown, immediately release GPU resources to the public pool while retaining container metadata.

2. The data security management method based on cloud computing according to claim 1, characterized in that, The steps for performing runtime encryption protection and persistent encryption during shutdown and data transfer specifically include: During read and write operations, a random AES key is generated and stored using white-box encryption technology to monitor abnormal process behavior in real time; when an attack is detected, the data in the quarantine area is automatically erased and a forensic snapshot is generated. When the system is shut down and the data is transferred, the file is split into 128KB data fragments, each encrypted with a different key. The hash value of each data fragment is written into a distributed ledger, and copies of the encrypted data are stored on nodes in several different cities.

3. The data security management method based on cloud computing according to claim 1, characterized in that, The step of automatically adapting the GPU model according to the user task specifically includes: Identify available GPU models and filter out GPU nodes that have had hardware alarms in the last 2 hours; The matching degree between user tasks and GPUs is calculated based on the model's computing power and memory availability. Control load balancing to distribute continuous user tasks across different physical machines and avoid hotspots.

4. The data security management method based on cloud computing according to claim 1, characterized in that, The steps of performing hardware status monitoring and software probe monitoring, and performing user behavior analysis to predict resource requirements within a set future time period, specifically include: Perform hardware monitoring to monitor GPU core temperature, record instantaneous power consumption, and track fan speed; perform software probes to record GPU utilization and memory usage information for each CUDA process. Analyze user operation logs, record all console commands and API calls, and detect abnormal data access behavior through clustering algorithms; Collect resource usage curves within a recently set time period and predict resource demand within a future set time period based on the Prophet time series algorithm.

5. The data security management method based on cloud computing according to claim 2, characterized in that, The method further includes implementing a fast recovery mechanism, the specific steps of which are as follows: After identity authentication and authorization are performed, the pre-set smart contract is automatically executed to read encrypted data fragments in parallel from several geographically distributed nodes. Perform fragment-level integrity verification and dynamic key reconstruction; Read container configuration, restore snapshots of incomplete tasks, pre-allocate GPU resources of a specified model, and load CUDA context cache; High-frequency access data blocks are identified and preloaded into GPU memory using RDMA technology.

6. A cloud computing-based data security management system, characterized in that, The system includes: The hardware isolation layer building module is used to build a hardware-level isolation layer, creating an encrypted memory sandbox on the physical server based on the ComfyUI driver; it performs runtime encryption protection and persistent encryption during shutdown and data transfer. The GPU model adaptation module is used to update the GPU model library, user requirement library, and resource status library in real time. It automatically adapts the GPU model according to the user task and automatically builds a cross-server computing cluster when a single GPU cannot meet the requirements. The resource demand forecasting module is used for hardware status monitoring and software probe monitoring; it also performs user behavior analysis to predict resource demand within a set future time period. The shutdown data management module is used to determine whether to automatically shut down based on monitoring results and resource requirements within a set future time. After shutdown, GPU resources are immediately released to the public pool, while container metadata is retained.

7. The cloud-based data security management system according to claim 6, characterized in that, The hardware isolation layer construction module includes: The read / write interaction encryption unit is used to generate random AES keys during read / write operations, store them using white-box encryption technology, and monitor abnormal process behavior in real time; when an attack is detected, it automatically erases the data in the isolation area and generates an forensic snapshot; The shutdown transfer encryption unit is used to split the file into 128KB data fragments when the computer is shut down for transfer. Each fragment is encrypted with a different key, and the hash value of each data fragment is written into a distributed ledger. Copies of the encrypted data are stored on nodes in several different cities.

8. The cloud-based data security management system according to claim 6, characterized in that, The GPU model adaptation module includes: The GPU model filtering unit is used to determine the idle GPU model and filter out GPU nodes that have hardware alarms in the last 2 hours. The GPU model matching unit is used to calculate the matching degree between the user task and the GPU based on the model's computing power and memory satisfaction rate. The load balancing control unit is used to control load balancing, distributing continuous user tasks to different physical machines to avoid hotspots.

9. The cloud computing-based data security management system according to claim 6, characterized in that, The resource demand forecasting module includes: The hardware and software monitoring unit is used for hardware monitoring, including monitoring GPU core temperature, recording instantaneous power consumption, and tracking fan speed; and for software probing, recording GPU utilization and memory usage information for each CUDA process. The user behavior analysis unit is used to analyze user operation logs, record all console commands and API calls, and detect abnormal data access behavior through clustering algorithms. The resource demand forecasting unit is used to collect resource usage curves within the most recent set time period and predict resource demand within the future set time period based on the Prophet time series algorithm.

10. The cloud-based data security management system according to claim 7, characterized in that, The system also includes a fast recovery module, which specifically includes: The identity authentication and authorization unit is used for identity authentication and authorization. After successful verification, it automatically executes a pre-set smart contract to read encrypted data fragments in parallel from several geographically distributed nodes. The integrity verification unit is used for fragment-level integrity verification and dynamic key reconstruction. The metadata hot-loading unit is used to read container configuration, restore snapshots of incomplete tasks, pre-allocate GPU resources of a specified model, and load the CUDA context cache. The data prefetching acceleration unit is used to identify frequently accessed data blocks and preload them into the GPU memory using RDMA technology.

Images