Encrypted data storage system with real-time monitoring function

Abstract

The invention relates to the technical field of data storage, in particular to a real-time monitoring encrypted data storage system which comprises the steps of dynamic data acquisition and preprocessing, hierarchical storage architecture design, security policy modeling, real-time monitoring and response, intelligent encryption scheduling and the like. A data access path is optimized through multi-level storage, and a dynamic security policy and an intelligent encryption scheduling mechanism are combined, so that data security and processing efficiency are improved. According to the method and the device, accurate prediction and quick response to the data access behavior can be realized, the influence of encryption operation on system performance is reduced, and the security, integrity and high efficiency of data storage are ensured.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security and data storage, and specifically relates to a real-time monitoring encrypted data storage system. BACKGROUND

[0002] The real-time monitoring encrypted data storage system refers to a kind of technical scheme with "whole process data protection, real-time security response and efficient storage and access" as the core, which realizes the security, integrity and efficient access in the process of data storage, realizes "whole process data protection, real-time security response and efficient storage and access" through dynamic monitoring and intelligent encryption strategy. The core logic is that the demand for data security is increasing, and real-time monitoring capability and efficient encryption mechanism need to be combined to ensure that data is always in a controlled state during storage and transmission. However, the existing technology has certain limitations in real-time monitoring support, dynamic security adaptability and data processing efficiency.

[0003] According to the search, the patent with publication number CN107395609B proposes a data encryption method based on cloud environment, which completes identity verification and data encryption operation through cooperation of authentication server and sub-authentication server. This technology enhances the security read policy control and reduces the calculation cost of write user. However, this scheme focuses on identity verification and cross-cloud data strategy application, and does not fully consider the real-time monitoring demand in the process of data storage. At the same time, it depends on multi-layer server interaction, which may increase data transmission delay and affect the satisfaction effect of real-time demand.

[0004] Another patent with publication number CN114730342B relates to a hardware encryption method, which performs encryption and decryption operation on data on storage medium through device controller and supports access of host system. This technology effectively protects the data security on non-volatile medium and realizes block-level encryption management. However, this scheme lacks real-time monitoring function for data storage process, and the encryption mechanism mainly targets static data, and the ability to adapt to real-time change security threat is limited. In addition, it has high dependence on hardware circuit system, which may increase system complexity and deployment cost.

[0005] The above problems show that the existing encrypted data storage system still needs to be improved in real-time monitoring capability, dynamic security response and system efficiency. Therefore, the present application aims to provide a real-time monitoring encrypted data storage system to optimize the dynamic security protection capability and data processing efficiency, and meet the demand for efficient and intelligent encryption storage in modern information security field. SUMMARY

[0006] The technical problems to be solved by the present application are to overcome the shortcomings of the prior art and provide a real-time monitoring encrypted data storage system. The technical solutions adopted to solve the above technical problems are: a real-time monitoring encrypted data storage system, including the following specific steps: step one: dynamic data acquisition and preprocessing: the collected objects include: data access request, encryption operation log, storage medium state, real-time monitoring index; step two: hierarchical storage architecture design: a multi-level storage structure (default three-level storage: cache layer, encryption processing layer, persistent storage layer) is adopted, data transmission between each layer is completed through a special interface, and data check points are set between each layer to ensure data consistency; step three: security policy modeling: based on behavior analysis algorithm, the data access mode is modeled to generate dynamic security policy; step four: real-time monitoring and response: a distributed monitoring node network is constructed, each node is responsible for data monitoring in a specific area, abnormal behavior is detected through a heartbeat mechanism, and a security response mechanism is triggered; step five: intelligent encryption scheduling: according to the data access frequency and sensitivity level, the encryption strength and storage location are dynamically adjusted to optimize the data processing efficiency.

[0007] Further, the specific implementation of the dynamic data acquisition and preprocessing is as follows: for each data access request, record the request timestamp, access source IP, target data block ID, operation type (read / write) and encryption state flag; for the encryption operation log, record the encryption algorithm type, key version number, encryption time consumption; for the storage medium state, monitor the remaining capacity, read / write speed and error rate of the storage medium; for the real-time monitoring index, count the number of abnormal accesses, the number of data integrity check failures and the number of encryption operation failures per unit time.

[0008] Further, the specific implementation of the hierarchical storage architecture design is as follows: the cache layer uses non-volatile memory (NVM) as the storage medium for storing high-frequency access data; the encryption processing layer uses a hardware accelerator to perform encryption and decryption operations, supporting AES-256 and SM4 encryption algorithms; the persistent storage layer uses a distributed file system to store encrypted data blocks, with a fixed data block size of 4KB, and each data block is attached with a 32-byte metadata header for storing encryption algorithm identification, key index and check code. The interlayer data transmission is completed through a PCIe interface, the data check point uses CRC32 algorithm to calculate the check value, and the check value is stored in the metadata header.

[0009] Further, the specific implementation of the security policy modeling is as follows: based on the data access frequency in a unit time, the window length is set to 10 minutes, the data in the window is divided into subintervals by second-level granularity, and the access frequency distribution is stored using a hash table; combined with the access frequency distribution and user behavior characteristics, a dynamic security policy is generated, the policy includes access permission control rules, encryption strength adjustment rules and abnormal detection threshold; the policy update period is 5 minutes, and after the new policy is generated, it is broadcast to all monitoring nodes through a message queue.

[0010] Further, the specific implementation of the real-time monitoring and response is as follows: the distributed monitoring node network adopts a tree topology structure, the root node is responsible for global monitoring data aggregation, the intermediate node is responsible for regional data aggregation, and the leaf node is responsible for local data collection; the heartbeat mechanism is realized through the UDP protocol, and the heartbeat packet contains node state information and abnormal event count; when a node detects abnormal behavior, the security response mechanism is triggered, the response mechanism includes blocking access requests, increasing encryption strength, and notifying administrators, and the response priority is determined by the severity of the abnormal event.

[0011] Further, the specific implementation of the intelligent encryption scheduling is as follows: according to the data access frequency, the data is divided into high-frequency access data, medium-frequency access data and low-frequency access data, and is respectively stored in the cache layer, the encryption processing layer and the persistent storage layer; according to the data sensitivity, the data is divided into high-sensitive data, medium-sensitive data and low-sensitive data, and is respectively stored using AES-256, SM4 and no encryption; the encryption strength adjustment rule is calculated based on the weighted score of data access frequency and sensitivity, and the score formula is: Wherein, F is the access frequency score, L is the sensitivity score, and a and β are weight coefficients, a > β.

[0012] Further, the dynamic security policy modeling adopts the following formula: abnormal detection threshold Wherein, μ is the historical access frequency mean, and σ is the standard deviation; when the current access frequency exceeds T, it is determined as abnormal behavior; the security response priority Wherein, C is the current access frequency, and the larger the P value, the higher the response priority.

[0013] Further, the intelligent encryption scheduling adopts the following formula: encryption strength adjustment weight Wherein, D is the data access delay, k is the adjustment coefficient, and k > 0; when W > 0.8, the encryption strength is reduced, and when W ≤ 0.8, the encryption strength is maintained or increased; the storage location adjustment rule is calculated based on the data access frequency and the storage medium load rate, and the adjustment formula is: Wherein, R is the remaining capacity of the storage medium, F is the data access frequency, C is the total capacity of the storage medium, and the larger the value of L is, the higher priority is allocated to the cache layer.

[0014] Further, the data acquisition module is deployed at the front-end interface of the storage system, and high-speed data capture is realized by using FPGA; the storage management module realizes a multi-level storage architecture based on a distributed file system; the security policy module trains a behavior analysis model by using a deep learning framework; the monitoring response module realizes distributed node communication based on a message queue; and the encryption scheduling module executes encryption and decryption operations by using a hardware accelerator.

[0015] The present application has the following advantages: by designing a hierarchical storage architecture and an intelligent encryption scheduling mechanism, and combining dynamic security policy modeling and real-time monitoring response, the present application improves the security, integrity and efficiency in the data storage process. The multi-level storage architecture optimizes the data access path and reduces the load pressure of the storage medium; the dynamic security policy modeling realizes accurate prediction and rapid response of data access behavior; and the intelligent encryption scheduling mechanism dynamically adjusts the encryption strength and storage location according to the data access frequency and sensitivity, thereby reducing the influence of encryption operations on system performance. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 The step flow of the real-time monitored encrypted data storage system of the present application is intended.

[0017] Figure 2 The overall architecture diagram of the real-time monitored encrypted data storage system of the present application is intended.

[0018] Figure 3 The structure diagram of the hierarchical storage architecture designed by the present application is intended.

[0019] Figure 4 The topological structure diagram of the distributed monitoring node network of the present application is intended.

[0020] The reference signs are as follows: 1, data acquisition module; 2, storage management module; 3, security policy module; 4, monitoring response module; 5, encryption scheduling module; 6, cache layer; 7, encryption processing layer; 8, persistent storage layer; 9, distributed monitoring node network; 10, heartbeat mechanism. DETAILED DESCRIPTION

[0021] The present application provides a real-time monitored encrypted data storage system, the overall architecture of which is as shown in the figure. Figures 1-2As shown, it includes data acquisition module 1, storage management module 2, security policy module 3, monitoring response module 4 and encryption scheduling module 5. These modules are connected to each other through logical relationship and realize interactive process. Data acquisition module 1 is located at the front end interface of the system, responsible for capturing data access request, encryption operation log, storage medium state and real-time monitoring index, and transferring the collected data to storage management module 2 and security policy module 3. Storage management module 2 realizes multi-level storage architecture based on distributed file system, including cache layer 6, encryption processing layer 7 and persistent storage layer 8, data transmission between layers is completed through PCIe interface and data checkpoint is set between layers to ensure data consistency. Security policy module 3 trains behavior analysis model using deep learning framework, generates dynamic security policy and broadcasts to monitoring response module 4 through message queue. Monitoring response module 4 realizes abnormal behavior detection and security response mechanism based on distributed monitoring node network 9, and heartbeat mechanism 10 transmits state information between nodes through UDP protocol. Encryption scheduling module 5 uses hardware accelerator to perform encryption and decryption operations, and dynamically adjusts encryption strength and storage location according to data access frequency and sensitivity.

[0022] In the implementation process, data acquisition module 1 is deployed at the front end interface of the storage system and uses FPGA to realize high-speed data capture. For each data access request, record the request timestamp, access source IP, target data block ID, operation type and encryption state flag; for encryption operation log, record encryption algorithm type, key version number and encryption time consumption; for storage medium state, monitor remaining capacity, read / write speed and error rate; for real-time monitoring index, count the number of abnormal access times, data integrity check failure times and encryption operation failure times per unit time. These data are transmitted to storage management module 2 and security policy module 3 through special interface for further processing. The design of storage management module 2 is as shown in Figure 3 As shown, it uses three-level storage structure, in which cache layer 6 uses non-volatile memory as storage medium and is used to store high-frequency access data; encryption processing layer 7 performs encryption and decryption operations on data through hardware accelerator using AES-256 and SM4 encryption algorithms; persistent storage layer 8 uses distributed file system to store encrypted data blocks, each data block size is fixed at 4KB and 32 bytes of metadata header is attached, used to store encryption algorithm identifier, key index and check code. Interlayer data transmission is completed through PCIe interface, and data checkpoint uses CRC32 algorithm to calculate check value and store the result in metadata header.

[0023] The security policy module 3 calculates the data access frequency in a sliding window unit time, sets the window length to 10 minutes, divides the data in the window into sub-intervals at a second-level granularity, and uses a hash table to store the access frequency distribution. Combined with the access frequency distribution and user behavior characteristics, a dynamic security policy is generated, including access permission control rules, encryption strength adjustment rules, and anomaly detection thresholds. The policy update period is 5 minutes, and after the new policy is generated, it is broadcast to all monitoring nodes of the monitoring response module 4 through the message queue. The distributed monitoring node network 9 of the monitoring response module 4 is shown in Figure 4 The tree topology structure is adopted, the root node is responsible for global monitoring data aggregation, the intermediate node is responsible for regional data aggregation, and the leaf node is responsible for local data collection. The heartbeat mechanism 10 is implemented through the UDP protocol, and the heartbeat packet contains node state information and abnormal event count. When a node detects abnormal behavior, the security response mechanism is triggered, including blocking access requests, increasing encryption strength, and notifying administrators, and the response priority is determined by the severity of the abnormal event.

[0024] The encryption scheduling module 5 divides the data into high-frequency access data, medium-frequency access data, and low-frequency access data according to the data access frequency, and stores them in the cache layer 6, the encryption processing layer 7, and the persistent storage layer 8, respectively. At the same time, according to the data sensitivity, the data is divided into high-sensitive data, medium-sensitive data, and low-sensitive data, and stored using AES-256, SM4, and no encryption, respectively. The encryption strength adjustment rule is based on the weighted score calculation of data access frequency and sensitivity, and the score formula is S = a x F + b x L, where F is the access frequency score, L is the sensitivity score, a and b are weight coefficients and a > b. In addition, the encryption strength adjustment weight W = exp(-k x D), where D is the data access delay, k is the adjustment coefficient and k > 0. When W > 0.8, the encryption strength is reduced, and when W ≤ 0.8, the encryption strength is maintained or increased. The storage location adjustment rule is based on the data access frequency and the storage medium load rate, and the adjustment formula is L = (R x F) / C, where R is the remaining capacity of the storage medium, F is the data access frequency, and C is the total capacity of the storage medium. The larger the value of L, the higher the priority of allocation to the cache layer 6.

[0025] In actual operation, the data acquisition module 1 first captures data access requests from the user end and records relevant information, and then transmits the information to the storage management module 2 for hierarchical storage processing. The storage management module 2 allocates data to corresponding storage layers according to data access frequency and sensitivity, for example, high-frequency access data is stored in the cache layer 6 for fast response, and low-frequency access data is stored in the persistent storage layer 8 to save resources. In this process, inter-layer data transmission is completed through the PCIe interface, and data checkpointing uses the CRC32 algorithm to ensure data consistency. At the same time, the security policy module 3 generates dynamic security policies based on the sliding window statistical data access frequency, and broadcasts the policies to the monitoring response module 4 through the message queue. The distributed monitoring node network 9 of the monitoring response module 4 detects node state and abnormal events in real time through the heartbeat mechanism 10, and triggers the security response mechanism when abnormal behavior is detected. For example, when the access frequency of a node exceeds the abnormal detection threshold T = μ + 3σ, it is determined as abnormal behavior and corresponding measures are taken according to the response priority P = max(1, (C-T) / σ), such as blocking access requests or increasing encryption strength. The encryption scheduling module 5 dynamically adjusts the encryption strength and storage location according to the data access frequency and sensitivity, for example, for high-frequency access but low-sensitive data, the encryption strength can be reduced to improve processing efficiency, while for low-frequency access but high-sensitive data, high-strength encryption is maintained to ensure security.

[0026] During the entire system operation, the data acquisition module 1, the storage management module 2, the security policy module 3, the monitoring response module 4 and the encryption scheduling module 5 work together to realize the safe storage and efficient management of data. For example, in the financial industry application scenario, the system can be used to store user transaction records and account information. The data acquisition module 1 captures user transaction requests in real time and records relevant information, and the storage management module 2 stores high-frequency access transaction records in the cache layer 6 for fast query, while storing historical transaction records in the persistent storage layer 8 to save resources. The security policy module 3 generates dynamic security policies based on user behavior characteristics, and the monitoring response module 4 detects abnormal behavior in real time through the distributed monitoring node network 9 and triggers the security response mechanism, for example, when a large number of abnormal access requests are detected within a short period of time, the request is automatically blocked and the administrator is notified. The encryption scheduling module 5 dynamically adjusts the encryption strength and storage location according to the access frequency and sensitivity of the transaction records, for example, for high-frequency access transaction records, lower strength encryption is used to improve processing efficiency, while for account information involving sensitive information, high-strength encryption is used to ensure security. Through the coordinated work of the above modules, the system can effectively improve the security, integrity and efficiency of data storage in the process of data storage, and meet the strict requirements of the financial industry on data storage.

[0027] In order to better enable the relevant personnel in the technical field to fully understand and implement the present application, the specific implementation principles of the present application are further supplemented below in conjunction with the drawings and specific application scenarios.

[0028] In the financial industry scenario, the real-time monitoring encrypted data storage system is mainly used to store user's transaction records and account information. This scenario requires the system to have efficient data storage and access capabilities, while being able to dynamically respond to potential security threats. To this end, the running process of the system unfolds in the following steps: First, the data acquisition module 1 captures the user's data access request through the front-end interface and records the relevant information. These include the request timestamp, access source IP, target data block ID, operation type, and encryption status flag bit. For example, when a user initiates a transaction request, the data acquisition module 1 will record the transaction time, the IP address of the source device, the data block number accessed, and the operation type (such as read or write) in real time. In addition, the encryption operation log is also recorded synchronously, covering information such as encryption algorithm type, key version number, and encryption time consumption. These data are then transmitted to the storage management module 2 and the security policy module 3 through a dedicated interface for further processing.

[0029] Next, the storage management module 2 allocates data to the cache layer 6, encryption processing layer 7, or persistent storage layer 8 according to data access frequency and sensitivity. High-frequency access transaction records are preferentially stored in the cache layer 6 to quickly respond to user query requirements. While historical transaction records and other low-frequency access data are stored in the persistent storage layer 8 to save resources. In this process, inter-layer data transmission is completed through the PCIe interface, and the CRC32 algorithm is used to calculate the check value for data checkpointing, and the result is stored in the metadata header to ensure the consistency of data transmission between layers. For example, when a high-frequency transaction record is transmitted from the cache layer 6 to the encryption processing layer 7, the system will verify the data integrity using the CRC32 algorithm, and if the verification fails, an exception handling mechanism will be triggered.

[0030] At the same time, the security policy module 3 generates dynamic security policies based on the data access frequency within a sliding window. Specifically, module 3 will divide the data in a 10-minute window into sub-intervals at a second-level granularity, and use a hash table to store the access frequency distribution. Combined with the access frequency distribution and user behavior characteristics, module 3 generates dynamic security policies containing access permission control rules, encryption strength adjustment rules, and anomaly detection thresholds. The new policy is updated every 5 minutes and broadcast to all monitoring nodes of the monitoring response module 4 through the message queue. For example, when a user's transaction frequency is significantly higher than the historical average, the system will mark it as a potential abnormal behavior and adjust the corresponding security policy.

[0031] The monitoring response module 4 detects node status and abnormal events in real time through the distributed monitoring node network 9. As shown in Figure 4 , the network adopts a tree topology structure, in which the root node is responsible for global monitoring data aggregation, the intermediate node is responsible for regional data aggregation, and the leaf node is responsible for local data acquisition. The heartbeat mechanism 10 transmits state information between nodes through the UDP protocol, and the heartbeat packet contains node state information and abnormal event count. When a node detects abnormal behavior, such as access frequency exceeding the abnormal detection threshold , the system will take corresponding measures according to the response priority . For example, if a large number of abnormal access requests are detected in a short time, the system will automatically block the request and notify the administrator, and at the same time, the encryption strength of the related data will be increased.

[0032] The encryption scheduling module 5 dynamically adjusts the encryption strength and storage location according to the data access frequency and sensitivity. For example, for high-frequency access but low-sensitive transaction records, the system will reduce the encryption strength to improve processing efficiency; while for low-frequency access but high-sensitive account information, high-strength encryption is maintained to ensure security. The encryption strength adjustment rule is based on the weighted scoring formula , where F is the access frequency score, L is the sensitivity score, and α and β are weight coefficients and α>β. In addition, the encryption strength adjustment weight , where D is the data access delay, k is the adjustment coefficient and k>0. When W>0.8, the encryption strength is reduced, and when W≤0.8, the encryption strength is maintained or increased. The storage location adjustment rule is based on the data access frequency and the storage medium load rate, and the adjustment formula is L=(R×F) / C, where R is the remaining capacity of the storage medium, F is the data access frequency, and C is the total capacity of the storage medium. The larger the value of L, the higher the priority of allocation to the cache layer 6.

[0033] During the entire operation process, the modules work together to achieve secure storage and efficient management of data. For example, when a user initiates a transaction request, the data acquisition module 1 first captures the request and transmits the relevant information to the storage management module 2. The storage management module 2 stores the transaction record in the cache layer 6 according to the data access frequency and sensitivity to facilitate fast response. At the same time, the security policy module 3 generates a dynamic security policy based on user behavior characteristics, and broadcasts the policy to the monitoring response module 4 through the message queue. The monitoring response module 4 detects abnormal behavior in real time through the distributed monitoring node network 9, such as when a large number of abnormal access requests are detected in a short time, the system will automatically block the request and notify the administrator. The encryption scheduling module 5 dynamically adjusts the encryption strength and storage location according to the access frequency and sensitivity of the transaction record, such as lower strength encryption for high-frequency access transaction records to improve processing efficiency, and high-strength encryption for account information involving sensitive information to ensure security.

[0034] Through the above steps, the application can effectively improve the security, integrity and efficiency in the data storage process, and meet the strict requirements of the financial industry on data storage. The contents not described in detail in the specification are all the existing technologies known to those skilled in the art, and the model parameters of each electric appliance are not specifically limited, and conventional equipment can be used. In the technical solution, the electric appliance control elements not mentioned belong to the prior art, so they are not shown in the figure and will not be described here.

[0035] The above only describes the preferred embodiments of the application and is not used to limit the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A real-time monitored encrypted data storage system, characterized in that, Comprise the following specific steps: Step one: dynamic data acquisition and pretreatment: the collection of objects including data access request, encryption operation log, storage medium state and real-time monitoring index; for each data access request, record the request timestamp, access source IP, target data block ID, operation type and encryption state flag; for encryption operation log, record encryption algorithm type, key version number and encryption time consumption; For the storage medium state, monitor the remaining capacity, read and write speed and error rate of the storage medium; for real-time monitoring index, count the number of abnormal access, data integrity check failure and encryption operation failure per unit time; Step two: hierarchical storage architecture design: adopt three-level storage structure, including cache layer (6), encryption processing layer (7) and persistent storage layer (8), data transmission between each layer is completed through PCIe interface, and data check point is set between each layer to ensure data consistency; Step three: security policy modeling: based on the sliding window statistics of data access frequency per unit time, the window length is 10 minutes, the data in the window is divided into subintervals according to second level granularity, and the access frequency distribution is stored using hash table; combined with access frequency distribution and user behavior characteristics, generate dynamic security policy, the policy content includes access permission control rule, encryption strength adjustment rule and abnormal detection threshold; the policy update period is 5 minutes; Step four: real-time monitoring and response: build a distributed monitoring node network (9), the network adopts tree topology structure, the root node is responsible for global monitoring data aggregation, the intermediate node is responsible for regional data aggregation, and the leaf node is responsible for local data acquisition; the heartbeat mechanism (10) is realized through UDP protocol, and the heartbeat packet contains node state information and abnormal event count; When a node detects abnormal behavior, a security response mechanism is triggered, including blocking access requests, increasing encryption strength, and notifying administrators; Step five: intelligent encryption scheduling: According to the data access frequency, the data is divided into high-frequency access data, medium-frequency access data and low-frequency access data, and stored in the cache layer (6), the encryption processing layer (7) and the persistent storage layer (8) respectively; According to the data sensitivity, the data is divided into high-sensitive data, medium-sensitive data and low-sensitive data, and stored using AES-256, SM4 and no encryption respectively; The encryption strength adjustment rule is calculated based on the weighted score of data access frequency and sensitivity, and the score formula is Where F is the access frequency score, L is the sensitivity score, and α and β are weight coefficients and α>β.

2. The real-time monitored encrypted data storage system of claim 1, wherein, The cache layer (6) uses nonvolatile memory as storage medium, which is used to store high-frequency access data; the encryption processing layer (7) uses hardware accelerator to execute encryption and decryption operation, which supports AES-256 and SM4 two encryption algorithms; the persistent storage layer (8) uses distributed file system to store encrypted data block, the data block size is fixed to 4KB, and each data block is attached with 32 bytes of metadata header, which is used to store encryption algorithm identifier, key index and check code; the data transmission between layers is completed through PCIe interface, and the data check point uses CRC32 algorithm to calculate check value and store the result in metadata header.

3. The real-time monitored encrypted data storage system of claim 1, wherein, The calculation formula of the abnormality detection threshold T is Wherein μ is the historical access frequency mean, σ is the standard deviation; when the current access frequency C exceeds T, it is determined as abnormal behavior; The formula for calculating the security response priority P is The greater the P value, the higher the response priority.

4. The real-time monitored encrypted data storage system of claim 1, wherein, The calculation formula of the encryption strength adjustment weight W is wherein D is the data access delay, k is an adjustment coefficient and k>0; the encryption strength is reduced when W>0.8, and the encryption strength is maintained or promoted when W≤0.

8.

5. The real-time monitored encrypted data storage system of claim 1, wherein, The calculation formula of the storage location adjustment rule is wherein R is the remaining capacity of the storage medium, F is the data access frequency, C is the total capacity of the storage medium, and the larger the value of L, the higher priority is allocated to the cache layer (6).

6. The real-time monitored encrypted data storage system of claim 1, wherein, The data acquisition module (1) is deployed in the front-end interface of the storage system, which uses FPGA to realize high-speed data capture; the storage management module (2) realizes multi-level storage architecture based on distributed file system; the security policy module (3) uses deep learning framework to train behavior analysis model; the monitoring response module (4) realizes distributed node communication based on message queue; the encryption scheduling module (5) uses hardware accelerator to execute encryption and decryption operation.

7. The real-time monitored encrypted data storage system of claim 1, wherein, The distributed monitoring node network (9) adopts a tree topology structure, a root node is responsible for global monitoring data aggregation, an intermediate node is responsible for regional data aggregation, and a leaf node is responsible for local data acquisition; a heartbeat mechanism (10) is realized through a UDP protocol, and a heartbeat packet contains node state information and abnormal event count.

8. The real-time monitored encrypted data storage system of claim 1, wherein, The generation period of the dynamic security policy is 5 minutes, and the new policy is broadcast to all monitoring nodes through a message queue after being generated.

Images