Data processing method and system based on cloud storage system

Abstract

The invention provides a data processing method and system based on a cloud storage system, which can be applied to the technical field of artificial intelligence, and the method comprises the following steps: receiving a cloud storage system access request of a target user, and obtaining equipment environment information and login information of the target user according to the cloud storage system access request; determining a login risk category of the target user according to the login information and an abnormal login detection model, and if the login risk category conforms to a login risk category range, determining a terminal equipment environment risk category of the target user according to the login risk category, the equipment environment information and an equipment environment risk assessment model; if the equipment environment risk category conforms to the equipment environment risk category range, authorizing the target user to access the cloud storage system; and receiving a data processing request of the target user, and completing data processing of the cloud storage system according to the data processing request. According to the invention, the security of accessing the cloud storage system by the user can be improved, and the data security of the cloud storage system can be ensured.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a data processing method and system based on a cloud storage system. Background Technology

[0002] A personal cloud storage system is a cloud computing service designed to provide individual users with solutions for data storage, management, and access. This system allows users to store various types of data (such as documents, photos, videos, and music) in the cloud and access and manage this data anytime, anywhere via the internet.

[0003] In the data processing of existing cloud storage systems, user access rights are usually determined solely by account and password. If account and password are leaked, the data in the cloud storage system is easily compromised. Summary of the Invention

[0004] To address at least one of the problems in the prior art, this application proposes a data processing method and system based on a cloud storage system, which can improve the security of user access to the cloud storage system and thus ensure the data security of the cloud storage system.

[0005] To address the aforementioned technical problems, this application provides the following technical solution:

[0006] Firstly, this application provides a data processing method based on a cloud storage system, including:

[0007] Receive a cloud storage system access request from a target user, and obtain the target user's device environment information and login information based on the cloud storage system access request;

[0008] Based on the preset correspondence between login risk scores and login risk categories, the login information, and the preset abnormal login detection model, the login risk category of the target user is determined. The preset abnormal login detection model is obtained by pre-training a first neural network model based on batch historical login information and their respective corresponding actual login risk scores.

[0009] If the login risk category falls within the preset login risk category range, then the terminal device environment risk category of the target user is determined based on the preset correspondence between device environment risk score and device environment risk category, the login risk category, the device environment information, and the preset device environment risk assessment model. The preset device environment risk assessment model is obtained by pre-training a second neural network model based on a batch of first training samples and their respective corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information.

[0010] If the device environment risk category falls within the preset device environment risk category range, then the target user is authorized to access the cloud storage system;

[0011] Receive the data processing request from the target user, and complete the data processing corresponding to the cloud storage system according to the data processing request.

[0012] In one embodiment, the step of completing the data processing corresponding to the cloud storage system according to the data processing request further includes:

[0013] Obtain the data processing information corresponding to the data processing request;

[0014] Based on the equipment environment risk category, data processing information, and the preset continuous monitoring model, the continuous monitoring risk category of the target user is determined. The preset continuous monitoring model is obtained by pre-training a third neural network model based on a batch of second training samples and their respective corresponding actual continuous monitoring risk categories.

[0015] In one embodiment, receiving the data processing request from the target user and completing the data processing corresponding to the cloud storage system based on the data processing request includes:

[0016] Receive the data modification request from the target user;

[0017] According to the data modification request, the encrypted data corresponding to the data modification request is obtained from the cloud storage system and transmitted to the target user's terminal device. The target user's terminal device decrypts the encrypted data, modifies the decrypted data, encrypts the modified data, and returns it to the cloud storage system.

[0018] In one embodiment, receiving the data processing request from the target user and completing the data processing corresponding to the cloud storage system based on the data processing request includes:

[0019] Receive a data upload request from the target user, the data upload request including: data encrypted with the application key of the target user's terminal device;

[0020] The encrypted data is uploaded to the cloud storage system.

[0021] In one embodiment, the data processing method based on a cloud storage system further includes:

[0022] Generate user operation logs corresponding to the cloud storage system access requests and data processing requests;

[0023] The user operation logs are stored on the blockchain.

[0024] In one embodiment, storing the user operation log on the blockchain includes:

[0025] The user operation logs are uploaded to each node of the blockchain. Each node performs signature verification, format verification, permission verification, and hash verification on the user operation logs to obtain the verification result of that node.

[0026] If the user operation log is verified as valid based on the consensus mechanism and the verification results of each node, then the user operation log will be stored on the blockchain.

[0027] In one embodiment, the data processing method based on a cloud storage system further includes:

[0028] Receive audit requests;

[0029] Obtain the user operation log of the audit request from the blockchain, and complete the audit operation corresponding to the audit request based on the user operation log.

[0030] Secondly, this application provides a data processing system based on a cloud storage system, comprising:

[0031] The acquisition device is used to receive a cloud storage system access request from a target user, and to obtain the target user's device environment information and login information based on the cloud storage system access request.

[0032] A login detection device is used to determine the login risk category of the target user based on a preset login risk score and login risk category correspondence, the login information, and a preset abnormal login detection model. The preset abnormal login detection model is obtained by pre-training a first neural network model based on batch historical login information and their respective corresponding actual login risk scores.

[0033] The device environment detection device is used to determine the terminal device environment risk category of the target user if the login risk category meets the preset login risk category range, based on the preset correspondence between device environment risk score and device environment risk category, the login risk category, the device environment information, and the preset device environment risk assessment model. The preset device environment risk assessment model is obtained by pre-training a second neural network model based on a batch of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information.

[0034] An authorization device is used to authorize the target user to access the cloud storage system if the device environment risk category meets the preset device environment risk category range;

[0035] A data processing device is used to receive data processing requests from the target user and, based on the data processing requests, complete the data processing corresponding to the cloud storage system.

[0036] In one embodiment, the data processing apparatus further includes:

[0037] The acquisition module is used to acquire the data processing information corresponding to the data processing request;

[0038] The continuous monitoring module is used to determine the continuous monitoring risk category of the target user based on the equipment environment risk category, data processing information, and a preset continuous monitoring model. The preset continuous monitoring model is obtained by pre-training a third neural network model based on a batch of second training samples and their respective corresponding actual continuous monitoring risk categories.

[0039] In one embodiment, the data processing apparatus includes:

[0040] The first receiving module is used to receive the data modification request from the target user;

[0041] The modification module is used to obtain the encrypted data corresponding to the data modification request from the cloud storage system according to the data modification request and transmit it to the target user's terminal device. The target user's terminal device decrypts the encrypted data, modifies the decrypted data, encrypts the modified data, and returns it to the cloud storage system.

[0042] In one embodiment, the data processing apparatus includes:

[0043] The second receiving module is used to receive the data upload request from the target user, the data upload request including: data encrypted with the application key of the target user's terminal device;

[0044] The upload module is used to upload the encrypted data to the cloud storage system.

[0045] In one embodiment, the data processing system based on the cloud storage system further includes:

[0046] The generating device is used to generate user operation logs corresponding to the cloud storage system access requests and data processing requests, respectively.

[0047] A storage device for storing the user operation logs on the blockchain.

[0048] In one embodiment, the storage device includes:

[0049] The verification module is used to upload the user operation log to each node of the blockchain. Each node performs signature verification, format verification, permission verification, and hash verification on the user operation log to obtain the verification result of that node.

[0050] The storage module is used to store the user operation log on the blockchain if the verification of the user operation log is determined to be successful based on the consensus mechanism and the verification results of each node.

[0051] In one embodiment, the data processing system based on the cloud storage system further includes:

[0052] A receiving device for receiving audit requests;

[0053] An auditing device is used to obtain the user operation log of the audit request from the blockchain, and to complete the audit operation corresponding to the audit request based on the user operation log.

[0054] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data processing method based on the cloud storage system.

[0055] Fourthly, this application provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the data processing method based on the cloud storage system.

[0056] As can be seen from the above technical solution, this application provides a data processing method and system based on a cloud storage system. The method includes: receiving a cloud storage system access request from a target user; obtaining the target user's device environment information and login information based on the cloud storage system access request; determining the target user's login risk category based on a preset login risk score-login risk category correspondence, the login information, and a preset abnormal login detection model, wherein the preset abnormal login detection model is obtained by pre-training a first neural network model based on batch historical login information and their respective corresponding actual login risk scores; if the login risk category conforms to a preset login risk category range, then determining the target user's terminal device based on a preset device environment risk score-device environment risk category correspondence, the login risk category, the device environment information, and a preset device environment risk assessment model. The system provides an environmental risk category. The preset device environment risk assessment model is pre-trained on a second neural network model based on a batch of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information. If the device environment risk category matches the preset device environment risk category range, the target user is authorized to access the cloud storage system. The system receives the target user's data processing request and completes the corresponding data processing for the cloud storage system according to the request. This improves the security of user access to the cloud storage system and thus ensures the data security of the cloud storage system. Specifically, the integration of zero-knowledge privacy, zero-trust architecture, blockchain, and artificial intelligence can greatly improve data privacy protection and security. Users can store sensitive data with greater confidence; a higher level of security protection can be achieved, not only against external attacks but also providing effective protection against potential internal risks; and the transparency and auditability of data management can be improved, helping to meet data compliance requirements. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a first flowchart illustrating the data processing method based on a cloud storage system in an embodiment of this application;

[0059] Figure 2 This is a schematic diagram of the second process of the data processing method based on the cloud storage system in the embodiments of this application;

[0060] Figure 3 This is a schematic diagram of the third process of the data processing method based on a cloud storage system in the embodiments of this application;

[0061] Figure 4 This is a flowchart illustrating the data processing method based on a cloud storage system in an application example of this application;

[0062] Figure 5 This is a schematic diagram illustrating the process of a user's terminal device accessing the cloud storage system in an application example of this application;

[0063] Figure 6 This is a flowchart illustrating the process of accessing and operating blockchain records in an application example of this application;

[0064] Figure 7 This is a schematic diagram of the structure of a data processing system based on a cloud storage system in an embodiment of this application;

[0065] Figure 8 This is a schematic block diagram illustrating the system configuration of an electronic device according to an embodiment of this application. Detailed Implementation

[0066] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0067] Existing personal cloud storage systems typically encrypt and decrypt data on the server side, relying on fixed security boundaries for protection. Server-side encryption and decryption makes it vulnerable for service providers or third parties with server access privileges to access the data. Furthermore, relying on fixed security boundaries is insufficient to address the complex threats present in today's network environment. Therefore, existing personal cloud storage systems fall short in protecting user data privacy and security.

[0068] To address the problems existing in the prior art, this application provides a data processing method and system based on a cloud storage system. It employs zero-knowledge encryption to protect the privacy of data stored in the cloud, ensuring that data content cannot be accessed without authorization even in the cloud. It implements a zero-trust security architecture, strictly verifying and authorizing all access requests, thereby enhancing internal and external security. Blockchain technology and smart contracts can be used to manage data access permissions, ensuring the transparency and immutability of data access. The entire process from user login to data operation includes identity verification, data encryption, uploading, and blockchain recording. Each step is a critical part of the system, guaranteeing security and privacy, with the zero-trust architecture, zero-knowledge privacy principle, and blockchain technology working together.

[0069] This application embodiment can coordinate blockchain-based record access and zero-knowledge privacy-based access to cloud storage; blockchain-based record access and zero-knowledge privacy-based access to cloud storage are not contradictory. In fact, they can complement each other and jointly enhance the system's security and privacy protection. The following explains in detail how the zero-knowledge privacy principle and blockchain work together in this solution:

[0070] 1. Zero-Knowledge Privacy Principle: The zero-knowledge privacy principle focuses on protecting user data from unauthorized access by third parties. In this approach, data is encrypted on the client side, and the key is held only by the user. Even if the data is stored in a cloud storage system, the service provider cannot decrypt or view the actual content of the data.

[0071] 2. Blockchain-based Record Access: Blockchain-based record access refers to using blockchain technology to record and manage the historical record of data access, including who accessed which data and when. Due to the immutable nature of blockchain, these records provide a secure and transparent way to track data usage.

[0072] 3. Synergistic effect: When used together, zero-knowledge-based encryption ensures the privacy of data content, while blockchain provides a reliable way to log access and operations. This means that even if the logs are made public, sensitive information remains secure because the data content is encrypted.

[0073] Furthermore, logs on the blockchain can help monitor and prevent unauthorized data access attempts, improving the overall security of the system. In summary, these two technologies complement each other in terms of data privacy and security, together providing a powerful solution. Zero-knowledge privacy principles ensure the security of data content, while blockchain technology provides transparency and traceability for data access, which is crucial for preventing data misuse and protecting user privacy.

[0074] This application embodiment can provide a desktop application or mobile application as the main user interface, while providing a web interface to increase accessibility and providing API services for developers. This multi-channel approach can meet the needs of different users, while leveraging the advantages of each approach to provide users with the best experience. (1) Desktop application: Provide a downloadable desktop application through which users can access and manage their cloud storage space. This is suitable for users who need to frequently access large amounts of data. (2) Mobile application: Develop mobile applications for smartphone and tablet users, enabling them to access cloud storage anytime, anywhere. This approach is particularly useful for users who require high mobility. (3) Web application interface: A web application interface accessed through a browser provides cross-platform compatibility and convenience. This is suitable for users who prefer to access services through a web browser. (4) Command line tool: For advanced users and developers, providing command line tools can provide more flexibility and control. This is particularly valuable for scenarios that require batch processing or automated script operations. (5) Integration API: Provide an application programming interface (API) that allows other applications or services to integrate and access cloud storage functions. This is particularly useful for business processes that need to share data among multiple applications.

[0075] It should be noted that the information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, and necessary confidentiality measures have been taken. This does not violate public order and good morals, and corresponding operation entry points are provided for users to choose to authorize or refuse. This application provides users with corresponding operation entry points for them to choose to agree to or refuse the automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage. The data table comparison method and apparatus disclosed in this application can be used in the field of financial technology, as well as in any field other than financial technology. The application field of the data table comparison method and apparatus disclosed in this application is not limited.

[0076] The following examples illustrate this in detail.

[0077] To improve the security of user access to cloud storage systems and thus ensure the data security of those systems, this embodiment provides a data processing method based on a cloud storage system. This data processing system includes, but is not limited to, servers. Figure 1 As shown, this method specifically includes the following:

[0078] Step 100: Receive the target user's cloud storage system access request, and obtain the target user's device environment information and login information based on the cloud storage system access request.

[0079] Specifically, before step 200, the process may further include: performing multi-factor authentication based on the cloud storage system access request; if authentication is successful, then proceeding to step 200; otherwise, terminating the current operation. The login information may represent the login information of the target user when accessing the cloud storage system. The login information may include: the target user's identity verification information (e.g., username, password, multi-factor authentication data), device information (e.g., device type, operating system version, browser type, device ID, hardware fingerprint), network information (e.g., IP address, geographical location, network type, network operator), historical behavior data (e.g., past login patterns, frequently used devices, frequently used login locations), and time information (e.g., the time and date of the login attempt).

[0080] Step 200: Determine the login risk category of the target user based on the preset correspondence between login risk score and login risk category, the login information, and the preset abnormal login detection model. The preset abnormal login detection model is obtained by pre-training the first neural network model based on batch historical login information and their respective corresponding actual login risk scores.

[0081] Specifically, the login information can be input into a preset abnormal login detection model, and the output of the preset abnormal login detection model can be determined as a login risk score. The login risk category corresponding to the login risk score can be obtained from a preset correspondence between login risk scores and login risk categories. The login risk category can include: high-risk login operation, suspicious login operation, low-risk login operation, and normal login operation.

[0082] Specifically, the first neural network model can be at least one of a multimodal autoencoder model and a long short-term memory network model with an attention mechanism. If the first neural network model includes a multimodal autoencoder model and a long short-term memory network model with an attention mechanism, then the multimodal autoencoder model and the long short-term memory network model with an attention mechanism can be trained using batch historical login information and their respective corresponding actual login risk categories. When applying the preset abnormal login detection model, the login information can be input into the trained multimodal autoencoder model and the long short-term memory network model with an attention mechanism, respectively, to obtain the corresponding output results of the trained multimodal autoencoder model and the long short-term memory network model with an attention mechanism. The output result can be a login risk score. The login risk score is weighted and summed to obtain a total login risk score. Based on the preset correspondence between login risk score and login risk category and the total login risk score, the login risk category of the target user is determined. The preset correspondence between login risk score and login risk category can be set according to the actual situation, and this application does not limit it.

[0083] Step 300: If the login risk category meets the preset login risk category range, then the terminal device environment risk category of the target user is determined according to the preset correspondence between device environment risk score and device environment risk category, the login risk category, the device environment information, and the preset device environment risk assessment model. The preset device environment risk assessment model is obtained by pre-training the second neural network model based on a batch of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information.

[0084] Specifically, the second neural network model can be composed of at least one of the following: a random forest model, a gradient boosting decision tree model, a deep neural network model, and a long short-term memory network model. If the second neural network model includes a random forest model and a gradient boosting decision tree model, the random forest model and the gradient boosting decision tree model can be trained using a batch of first training samples and their corresponding device environment risk scores, respectively. When applying the preset device environment risk assessment model, the login information can be input into the trained random forest model and the gradient boosting decision tree model, respectively, to obtain the corresponding output results of the trained random forest model and the gradient boosting decision tree model. The output result can be a device environment risk score. The device environment risk scores are weighted and summed to obtain a total device environment risk score. Based on the preset correspondence between device environment risk scores and device environment risk categories and the total device environment risk score, the terminal device environment risk category of the target user is determined. The preset correspondence between device environment risk scores and device environment risk categories can be set according to actual conditions, and this application does not impose any restrictions on this.

[0085] Specifically, the preset login risk category range can be set according to the actual situation, and this application does not limit it. For example, if the login risk category is one of suspicious login operation, low-risk login operation and normal login operation, then the login risk category is determined to be within the preset login risk category range.

[0086] Specifically, the device environment information may include: terminal device information of the target user (e.g., device status, hardware events), network information (e.g., network connection status, traffic patterns, IP address changes, network latency), time and geographical location information (e.g., operation timestamps, geographical location changes), and historical behavioral data (i.e., past device and network environment usage patterns). The device environment risk categories include: high-risk device or network operation, suspicious device or network operation, low-risk device or network operation, and normal device or network operation.

[0087] Step 400: If the device environment risk category matches the preset device environment risk category range, then authorize the target user to access the cloud storage system.

[0088] Specifically, the preset range of device environment risk categories can be set according to actual conditions, and this application does not limit it. If the device environment risk category is one of suspicious device or network operation, low-risk device or network operation, or normal device or network operation, then it can be determined that the device environment risk category conforms to the preset range of device environment risk categories. The cloud storage system in this embodiment can be a personal cloud storage system, and the data processing system can be deployed with the personal cloud storage system. The main characteristics and functions of the personal cloud storage system in this embodiment may include:

[0089] 1. Data Storage and Backup: Users can upload data from their devices to the cloud for centralized management and backup. The system provides a certain amount of storage space, which users can expand as needed. 2. Data Synchronization: Supports multi-device synchronization, ensuring users access the latest data version on different devices. Users can seamlessly switch between PCs, mobile phones, tablets, and other devices to access and manage their data. 3. Security and Privacy Protection: Employs multi-layered security mechanisms, such as data encryption, access control, and multi-factor authentication, to ensure the security of user data. Ensures user data privacy protection; unauthorized third parties cannot access users' personal data. 4. Data Sharing and Collaboration: Users can share their stored data with others by generating shared links or inviting others to access shared folders, enabling collaborative data management. Provides permission management functionality, allowing users to set different access permissions (such as read-only, edit, etc.) to control data sharing methods. 5. Version Control: The system supports file version management, allowing users to view and restore historical versions to avoid accidental deletion or modification of data. Provides a version comparison function to help users identify differences between different versions. 6. Intelligent Search and Management: Utilizing AI technology, the system enables intelligent search and categorization, allowing users to quickly find the data they need. The system provides automatic tagging and classification functions to help users efficiently manage their stored data. 7. Cross-Platform Compatibility: Personal cloud storage systems typically support multiple operating systems and devices, including Windows, macOS, Android, and iOS, ensuring user access across different platforms. Web versions and client software are provided, allowing users to choose the appropriate access method. In summary, the personal cloud storage system in this embodiment provides users with a secure, convenient, and efficient data storage and management platform. It not only focuses on data storage and backup but also enhances data security, traceability, and operational transparency through artificial intelligence and blockchain.

[0090] Step 500: Receive the data processing request from the target user, and complete the data processing corresponding to the cloud storage system according to the data processing request.

[0091] Specifically, after the target user is authorized, the system can receive data processing requests from the target user. The data processing methods corresponding to the data processing requests may include uploading, modifying, and deleting.

[0092] To achieve continuous monitoring of the data processing process based on the cloud storage system and improve its reliability, in one embodiment of this application, step 500, which involves completing the data processing corresponding to the cloud storage system based on the data processing request, further includes:

[0093] Step 501: Obtain the data processing information corresponding to the data processing request.

[0094] Step 502: Determine the continuous monitoring risk category of the target user based on the equipment environment risk category, data processing information and the preset continuous monitoring model. The preset continuous monitoring model is obtained by pre-training a third neural network model based on a batch of second training samples and their corresponding actual continuous monitoring risk categories.

[0095] Specifically, the data processing information may include: user operation logs (e.g., file access, modification, deletion, upload, and download), device activity information (e.g., CPU usage, memory usage, disk activity, network traffic), network activity information (e.g., network connection status, traffic patterns, packet analysis), time and geographic location information (e.g., operation timestamps, geographic location changes), and historical behavior data (e.g., past operation and activity patterns). The continuously monitored risk categories may include: high-risk behavior, suspicious behavior, low-risk behavior, and normal behavior. The third neural network model may be one of the following: a multimodal long short-term memory network model incorporating an attention mechanism, a k-means clustering model, and a graph neural network model.

[0096] Specifically, the abnormal login detection model can analyze user login behavior in real time, compare current behavior with historical behavior patterns, calculate a risk score, and classify it as high-risk, suspicious, low-risk, or normal login operation. If the output is a high-risk login operation, the login operation is aborted, and an alert is sent to the user or administrator. If the output is a suspicious, low-risk, or normal login operation, the output data is passed to the device environment risk assessment model as part of the input data. The device environment risk assessment model can analyze the device and network environment in real time, compare the current device and network environment with historical behavior patterns, calculate a risk score, and classify it as high-risk, suspicious, low-risk, or normal operation. If the output is a high-risk operation, the login operation is aborted, and an alert is sent to the user or administrator. If the output is a suspicious, low-risk, or normal operation, the output data is passed to the continuous monitoring model as part of the input data. The continuous monitoring model can continuously monitor user behavior, analyze input data in real time, compare current behavior with historical behavior patterns, calculate a risk score, and classify it as high-risk, suspicious, low-risk, or normal behavior. If high-risk behavior is detected, the current operation will be suspended, potentially terminating the session or temporarily locking the account, and an alert will be sent to the user or administrator. For suspicious behavior, the system may require additional authentication steps, such as sending an additional push notification for confirmation or requiring answers to security questions. For low-risk and normal behavior, the system will allow the operation to continue while logging the behavior for future auditing.

[0097] In other words, the abnormal login detection model can identify the risk level of a user's login. If it's high-risk, the operation is aborted; if it's suspicious, low-risk, or normal, device and network environment checks continue. The device environment risk assessment model, based on the login risk category obtained from the abnormal login detection model, combined with device and network environment data, further assesses the overall login risk. If it's high-risk, the operation is aborted; if it's suspicious, low-risk, or normal, continuous monitoring and adaptive response continue. Based on the device environment risk category obtained from the device environment risk assessment model, combined with real-time user operation and environment data, continuous monitoring and response ensure that user behavior remains within a safe range. This provides continuous security monitoring and risk assessment throughout the entire user login and subsequent operations, ensuring system security and user data protection. The abnormal login detection model, device environment risk assessment model, and continuous monitoring model can continuously learn from each login attempt, regardless of success or failure. In this way, the system continuously optimizes its risk assessment model and access control policies to better adapt to new security threats and changes in user behavior. This not only ensures the highest level of security but also provides a flexible and user-friendly access experience. The introduction of artificial intelligence models significantly improves the intelligence and accuracy of access control decisions, ensuring that every access is based on comprehensive and real-time data analysis. This intelligent access decision-making mechanism is the core of the zero-trust architecture, effectively enhancing the system's security and adaptability.

[0098] To prevent data leakage from cloud storage systems and improve the security of data modification in cloud storage systems, in one embodiment of this application, step 500 includes:

[0099] Step 511: Receive the data modification request from the target user.

[0100] Step 512: Based on the data modification request, obtain the encrypted data corresponding to the data modification request from the cloud storage system and transmit it to the target user's terminal device. The target user's terminal device decrypts the encrypted data, modifies the decrypted data, encrypts the modified data, and returns it to the cloud storage system.

[0101] Specifically, the principle of zero-knowledge privacy can be adopted, with the key held by the user and data encryption and decryption only possible on the user's terminal device. Even if the data is stored in a cloud storage system, the service provider cannot decrypt or view the actual content of the data.

[0102] To prevent data leakage in cloud storage systems and improve the security of data uploads to cloud storage systems, in one embodiment of this application, step 500 includes:

[0103] Step 521: Receive the data upload request from the target user, the data upload request including: data encrypted with the application key of the target user's terminal device.

[0104] Step 522: Upload the encrypted data to the cloud storage system.

[0105] To facilitate subsequent access to cloud storage systems and the traceability and auditing of data processing, such as Figure 2 As shown in one embodiment of this application, the data processing method based on a cloud storage system further includes:

[0106] Step 600: Generate user operation logs corresponding to the cloud storage system access requests and data processing requests.

[0107] Specifically, the user operation log may include: the target user's identity information, the operations performed, and the timestamps of the operations. The user operation log can be digitally signed using the private key of a cloud storage system before being uploaded to the blockchain.

[0108] Step 700: Store the user operation log on the blockchain.

[0109] To ensure the integrity and tamper-proof nature of user operation logs in the blockchain, and to verify the validity of these logs, such as... Figure 3 As shown, in one embodiment of this application, step 700 includes:

[0110] Step 701: Upload the user operation log to each node of the blockchain. Each node performs signature verification, format verification, permission verification, and hash verification on the user operation log to obtain the verification result of that node.

[0111] Specifically, nodes in the blockchain can be servers. Nodes can use the public key of a cloud storage system to verify the validity of the digital signature of the user operation log, determine whether the user operation log conforms to a preset format, verify whether the user's actions in the user operation log are within their authorized scope, recalculate the hash value of the user operation log, and verify whether the hash value of the user operation log is the same as the recalculated hash value. If a node determines that the digital signature is valid, the user operation log conforms to the preset format, the user's actions are within their authorized scope, and the hash value of the user operation log is the same as the recalculated hash value, then the node's verification result is determined to be successful. The preset format can be set according to actual conditions.

[0112] Step 702: If the user operation log is verified as valid based on the consensus mechanism and the verification results of each node, then the user operation log is stored on the blockchain.

[0113] For example, if the verification result of a preset number of nodes is successful, the user operation log can be determined to have passed verification; otherwise, the user operation log can be determined to have failed verification. The preset number can be set according to actual conditions, and this application does not impose any restrictions on it.

[0114] To improve the reliability of auditing while ensuring the data security of the cloud storage system, in one embodiment of this application, the data processing method based on the cloud storage system further includes:

[0115] Receive an audit request; obtain the user operation log of the audit request from the blockchain; and complete the audit operation corresponding to the audit request based on the user operation log.

[0116] Specifically, the system can receive audit requests from auditing users. These requests may include audit parameters such as the time period, operation type, and user ID of the user operation logs. User operation logs matching these audit parameters are identified as the user operation logs for the audit request. Based on a preset correspondence between auditing users, users, and operations, and the user operation logs themselves, the system can determine whether the auditing user has permission to audit the user operation logs. If so, a Merkle tree can be applied to verify the integrity of the user operation logs. If the verification passes, multiple audit permissions are used to complete the audit operation corresponding to the audit request. The preset correspondence between auditing users, users, and operations can be set according to actual circumstances; this application does not impose any restrictions on this. Here, "user" can represent the user corresponding to the user operation logs that the auditing user can audit, and "operation" can represent the operation corresponding to the user operation logs that the auditing user can audit.

[0117] To further illustrate this solution, this application provides an application example of a data processing method based on a cloud storage system, such as... Figure 4 As shown, in this application example, the method may include: the user's terminal device sending a user access request, multi-factor authentication of the cloud storage system, login and device environment check of the cloud storage system, the cloud storage system determining authorization, encryption and local data processing of the user's terminal device, uploading of encrypted data by the user's terminal device, and recording of the operation on the blockchain, as described in detail below:

[0118] Step 1: Based on a zero-trust architecture, perform multi-factor authentication to complete user login.

[0119] When a user attempts to log in to the cloud storage system, authentication is the first step. "Zero trust" means the system does not trust any user by default, even those previously verified. Users need to authenticate with a username and password. This is the first step in security. A dynamic access control mechanism can be established, requiring all devices and users to verify their identity and access permissions, whether internal or external. This includes multi-factor authentication, continuous behavioral analysis, and automated security policy enforcement. To enhance security, the system requires multi-factor authentication. This means that in addition to a username and password, users need to prove their identity in a second way, such as receiving a verification code via SMS or using biometrics. This is another layer of security, ensuring that the person logging in is indeed the account owner. In other words, when a user attempts to log in, multi-factor authentication is required, which may include: password, biometric data, mobile tokens, etc. This data is collected, and the level of trust provided by each factor is evaluated. For example, a login attempt from a known and secure device might be considered more trustworthy, while an attempt from an unknown device or region might trigger additional vigilance.

[0120] Step 2: AI-driven behavior analysis.

[0121] The system uses artificial intelligence and machine learning technologies to analyze user login behavior. A pre-set abnormal login detection model learns from users' regular login patterns, habits, and behaviors to identify any abnormal or suspicious login activity. In the user login process based on a zero-trust architecture, AI-driven behavioral analysis is crucial for ensuring system security. By leveraging machine learning algorithms, the system can analyze user login behavior in real time and identify potential abnormal or risky behaviors.

[0122] 1. The input data for the pre-defined abnormal login detection model may include: A. User authentication information: username, password, multi-factor authentication data (such as SMS verification code, email verification code, biometric data, etc.); B. Device information: type of user login device, operating system version, browser type, device ID, hardware fingerprint, etc.; C. Network information: IP address, geographical location information, network operator, network connection type (such as Wi-Fi, cellular network, etc.); D. Time information: time and date / time zone information of the login attempt; E. Historical behavior data: past login patterns and behavior data of the user: frequently used devices, frequently used login locations, login time, access frequency, and behavior patterns; F. Environmental context information: the security status of the current environment, such as the security patch status of the operating system, and the running status of firewalls and antivirus software.

[0123] 2. The output data of the pre-defined abnormal login detection model may include: A. Risk Score: A comprehensive risk score used to quantify the risk level of the current login attempt. The score can be a specific numerical value indicating a high risk. B. Abnormal Behavior Identifier: An identifier indicating whether abnormal behavior was detected, usually a Boolean value (yes / no), indicating whether the current behavior does not conform to the expected normal behavior pattern. C. Response Suggestions: Suggested response measures that the system should take, such as whether to require additional authentication, whether to send an alert, whether to terminate the session, or whether to temporarily lock the account. D. Login Status Decision: Based on the risk score and abnormal behavior identifier, the model outputs the final login status decision, including "Allow Access", "Further Verification Required", or "Deny Access".

[0124] (1) Example of the artificial intelligence model used in this step:

[0125] A. Deep Learning-Based Anomaly Detection Model: Autoencoder: An autoencoder is an unsupervised learning model suitable for anomaly detection. It identifies anomalous behavior by learning a low-dimensional representation of a user's normal login behavior. The model consists of an encoder and a decoder. The encoder compresses the input data into a low-dimensional feature representation, and the decoder reconstructs it back to the original input. A large reconstruction error indicates the presence of anomalous behavior.

[0126] B. Time-series analysis-based model: Long Short-Term Memory Network (LSTM): LSTM is a recurrent neural network (RNN) used to process and predict time-series data. It can capture the temporal dependencies of user behavior and is suitable for analyzing user login patterns and detecting anomalous behavior over time.

[0127] (2) Structural improvements to artificial intelligence models:

[0128] A. Multimodal Data Fusion: Building upon traditional autoencoders, this approach improves upon them with multimodal autoencoders, fusing multiple data sources (such as user behavior, device information, and network environment). This captures the correlations between different data sources, improving the accuracy of anomaly detection. Encoder: Composed of multiple branches, each processing a specific data modality (e.g., behavior, device, network). Fusion Layer: Merges the encoding results from each branch to form a comprehensive low-dimensional feature representation. Decoder: Reconstructs the input data for each modality from the fused low-dimensional feature representation.

[0129] B. Incorporating Attention Mechanisms: Attention-Based LSTM: Introducing an attention mechanism into the LSTM network enables the model to automatically focus on important features in the time series, improving its ability to identify abnormal behavior. Attention Layer: An attention layer is added after the hidden layers of the LSTM network, using a weighted summation method to highlight important time-step features. Improved LSTM Network: The output of the attention layer is combined to make the final anomaly detection decision.

[0130] C. Ensemble Learning Methods: Ensemble Models for Anomaly Detection: By integrating multiple models (such as autoencoders, LSTMs, decision trees, etc.), the robustness and accuracy of anomaly detection are improved. Model Integrator: The outputs of multiple individual models are weighted and combined to form the final risk score and anomaly label. Voting Mechanism: A weighted voting mechanism is used to determine the final anomaly detection result based on the accuracy and confidence of each model.

[0131] (3) The AI-driven behavior analysis workflow includes:

[0132] A. Data Collection and Preprocessing: The system collects the above input data from multiple sources and performs preprocessing, such as standardization and noise reduction, to ensure data quality and consistency.

[0133] B. Feature Extraction and Modeling: Extract key features from the preprocessed data and use machine learning algorithms (such as anomaly detection algorithms, classifiers, etc.) to build a pre-defined abnormal login detection model.

[0134] C. Real-time analysis and evaluation: When a user attempts to log in, the preset abnormal login detection model analyzes the input data in real time, compares the current behavior with historical behavior patterns, calculates a risk score, and detects abnormal behavior.

[0135] D. Output and Response Generation: Based on the analysis results, the model generates output data and provides corresponding response suggestions to the system. The system then takes appropriate security measures based on these suggestions to ensure the security of user data and the system itself.

[0136] Through this detailed behavioral analysis process, the artificial intelligence model can not only improve the system's accuracy in detecting abnormal login attempts, but also provide a more flexible and dynamic security response, ensuring the security of user data and the system. This not only improves the accuracy of detection, but also enhances the overall security and robustness of the system.

[0137] Step 3: Equipment and network environment check.

[0138] The system checks the user's device and network environment, such as operating system security, whether it's updated, and whether the IP address is located in the geographical area where they typically log in. This helps identify any unusual or suspicious login attempts. Artificial intelligence models can be used to identify device or network characteristics that are inconsistent with the user's usual behavior.

[0139] 1. The input data for the preset device environment risk assessment model may include: user device information: device type (e.g., mobile phone, tablet, computer), operating system version (e.g., Windows, macOS, iOS, Android), browser type and version, device unique identifier (e.g., device ID, MAC address), hardware fingerprint information (e.g., CPU model, memory size, storage device); network information: IP address, geographical location information (e.g., GPS coordinates, country, city), network type (e.g., Wi-Fi, 4G, 5G, Ethernet), network operator information, network latency and speed, firewall and security software status; historical behavior data: user's past device usage patterns, commonly used network environments and connection methods, historical login locations and times.

[0140] 2. The output data of the pre-defined device environment risk assessment model may include: Device and network risk score: A comprehensive risk score used to quantify the risk level of the current device and network environment. The score can be a specific numerical value representing the level of risk; Abnormal behavior identifier: An identifier indicating whether abnormal device or network behavior has been detected, usually a Boolean value (yes / no), indicating whether the current device or network environment does not conform to the expected normal behavior pattern; Response suggestions: Suggested response measures that the system should take, such as whether to require additional authentication, whether to send an alert, whether to terminate the session, or whether to temporarily lock the account; Device and network status decision: Based on the risk score and abnormal behavior identifier, the model outputs the final device and network environment status decision, including "Allow access", "Further verification required", or "Deny access".

[0141] (1) Example of the artificial intelligence model used in this step:

[0142] Device and network environment inspection model based on ensemble learning:

[0143] Random Forest: Random forest is an ensemble learning method that constructs multiple decision trees and combines their outputs to perform classification or regression. It is suitable for processing multidimensional feature data from devices and network environments.

[0144] Gradient Boosting Decision Trees (GBDT): GBDT is another powerful ensemble learning algorithm that improves model accuracy by progressively reducing prediction error. It is suitable for detecting anomalous behavior in device and network environments.

[0145] (2) Structural improvements to artificial intelligence models:

[0146] A. Combining with Deep Learning Models: Deep Neural Networks (DNNs): Building upon traditional ensemble learning models, deep neural networks are combined to capture complex nonlinear relationships within device and network environments. Input Layer: Processes multidimensional feature inputs from devices and networks, such as device type, operating system version, IP address, and geographic location. Hidden Layers: Multiple hidden layers, each containing a different number of neurons, learn and extract complex relationships between features. Output Layer: Outputs risk scores and abnormal behavior identifiers.

[0147] B. Introduction of Time Series Models: Long Short-Term Memory (LSTM) Networks: LSTM networks are suitable for processing and analyzing time series data. By introducing LSTM, patterns and anomalies in device and network environments over time can be better captured. Input Layer: Receives time series data, such as historical login times and network environment information. LSTM Layer: Learns and extracts long- and short-term dependencies in the time series through memory units and forgetting gate mechanisms. Fully Connected Layer: Connects the output of the LSTM layer to a fully connected layer to generate the final risk score and anomalous behavior identifier.

[0148] C. Adaptive Attention Mechanism: Attention-Based Model: Introducing an attention mechanism enables the model to automatically focus on important features in the device and network environment, improving the accuracy of anomaly detection. Attention Layer: Adding an attention layer to a deep neural network or LSTM network, using a weighted sum method to highlight important features and time steps. Improved Network Structure: Combining the output of the attention layer for final risk assessment and anomaly detection.

[0149] (3) Workflow for equipment and network environment inspection:

[0150] A. Data Collection and Preprocessing: The system collects the above input data from user equipment and the network, and performs preprocessing, such as standardization and noise reduction, to ensure data quality and consistency.

[0151] B. Feature Extraction and Modeling: The AI ​​model extracts key features from the preprocessed data and uses machine learning algorithms (such as anomaly detection algorithms, classifiers, etc.) to build an equipment environmental risk assessment model.

[0152] C. Real-time Analysis and Assessment: When a user attempts to log in, the device environment risk assessment model analyzes the input data in real time, comparing the current device and network environment with historical behavior patterns, calculating a risk score, and detecting abnormal behavior. The system can perform real-time risk assessment, combining the preceding information to evaluate security risks.

[0153] D. Output and Response Generation: Based on the analysis results, the model generates output data and provides corresponding response suggestions to the system. The system then takes appropriate security measures based on these suggestions to ensure the security of user data and the system itself.

[0154] Step 4: Access the cloud storage system based on the zero-knowledge privacy principle. For example... Figure 5 As shown, the process of accessing a cloud storage system can include: locally generating an encryption key, selecting the file or data to access, requesting encrypted data, transmitting encrypted data, locally decrypting data, using or modifying data, and uploading the modified encrypted data.

[0155] Once users have passed all security verifications, they can begin using the cloud storage service to select, upload, or download files. Under the "zero-knowledge privacy" principle, user data is encrypted locally before being uploaded to the cloud. This means that even if the cloud service provider stores the data, they cannot view its actual content. The user's data is only visible to the user. If security verification fails and access is denied, the user may be prompted to retry or provide additional verification. Step 4 specifically includes:

[0156] Step 41: The user device generates a key locally for encrypting or decrypting data. This key is private and accessible only to the user, ensuring that even cloud storage service providers cannot decrypt the data.

[0157] Step 42: Once logged in successfully, users select the files or data they want to access or manipulate in the cloud storage system.

[0158] Step 43: The user requests access to specific encrypted data from the cloud storage system. This request does not contain any content information such as decryption keys or data.

[0159] Step 44: The cloud storage system responds to the user's request and transmits encrypted data to the user's device. Because the data is encrypted, it remains secure throughout the transmission process.

[0160] Step 45: Once the encrypted data arrives at the user's device, the user decrypts the data locally using the previously generated private key. This process is entirely performed on the user's device, ensuring data privacy.

[0161] Step 46: The user uses or modifies the data locally. If the data is modified, these changes will be re-encrypted and can be uploaded back to cloud storage.

[0162] Step 47: If the user modifies the data, the modified data will be re-encrypted and then uploaded back to the cloud storage system. Because the data is encrypted before leaving the user's device, its privacy is protected.

[0163] This process illustrates how users can access and manipulate data in cloud storage while ensuring data privacy, demonstrating the application of the zero-knowledge privacy principle in practice. Each step is encrypted to ensure data security, and the privacy of the keys guarantees that even though the data is stored in the cloud, its content will not be known to the cloud service provider.

[0164] Step 5: Data Upload and Storage. Users can choose to upload files to the cloud storage system. Uploaded files remain encrypted during transmission, ensuring data security.

[0165] Step 6: Use blockchain to record access and operations. For example... Figure 6 As shown, the process of recording access and operation on the blockchain can include: generating user operation logs, encrypting and signing user operation logs, sending them to the blockchain, verifying user operation logs on the blockchain, generating new blocks, and updating the blockchain.

[0166] For auditing and monitoring purposes, the system logs every data access and operation, but these logs do not contain the actual data content or key information. This process illustrates how to access and manipulate data in cloud storage without revealing the data content, demonstrating how the zero-knowledge privacy principle works in practice. In this way, users can securely store, access, and manipulate data without worrying about privacy breaches.

[0167] Whenever someone attempts to access or modify data stored in the cloud, these operations (such as uploading, downloading, and editing) are recorded on the blockchain, ensuring transparency and immutability. Blockchain is a secure, decentralized technology that stores information in the form of chained data blocks that cannot be altered once recorded. This means every operation is transparent and traceable, enhancing the system's security and reliability. Access to encrypted data is recorded on the blockchain, and smart contracts are used to automate the enforcement of access control rules. In this way, every data access and modification is transparently recorded, and the immutability of the blockchain guarantees the authenticity and integrity of the records. If a user successfully passes all security verifications, the system grants access and records login details. These logs can be used to monitor security and optimize the model. Step 6 specifically includes:

[0168] Step 61: Each time a user accesses or operates on data, the system generates a user operation log, i.e., a transaction record. Each user operation log contains information such as the user's identity information, the operation performed, and the timestamp of the operation.

[0169] Step 62: The generated user operation logs are encrypted and digitally signed to ensure their immutability and verifiability of origin.

[0170] To ensure privacy, the actual data content in user operation logs is encrypted during transmission and storage. Only authorized users can decrypt and access the actual data content. Only encrypted metadata and operation logs are stored on the blockchain.

[0171] Step 63: The encrypted and signed user operation log is sent to the blockchain network. This network consists of multiple nodes, each of which maintains a copy of the blockchain. Each time a user accesses or operates on data, the system generates a user operation log, containing information such as the user's identity, operation type, and operation timestamp. This user operation log is encrypted and digitally signed before being sent to the blockchain network, where each node verifies its validity and integrity. Once verified, the user operation log is added to the blockchain, forming an immutable chain of records.

[0172] Step 64: Nodes in the blockchain network verify the validity and completeness of the user operation log. Once verified, the user operation log is added to the blockchain.

[0173] In a blockchain network, one of the main tasks of a node is to verify the validity and completeness of each user operation log. These user operation logs include information such as the user's identity information, the operations performed, and the timestamps of the operations. The following are the detailed steps for a node to verify user operation logs: Step 641: Verify the validity of the user operation logs:

[0174] (1) Signature Verification: Each user operation log is digitally signed by the system using its private key after it is generated. After receiving the user operation log, the node first verifies the validity of the signature using the system's public key to ensure that the user operation log was indeed generated by the authorized system and that the content has not been tampered with. The signature verification process includes: extracting the user operation log and signature, decrypting the signature using the system's public key, and comparing the decrypted data with the original user operation log.

[0175] (2) User operation log format check: The node checks whether the format of the user operation log conforms to the predefined user operation log structure. For example, whether the user operation log contains the necessary fields (such as user identity information, operation type, timestamp, etc.), and whether the values ​​of these fields are valid.

[0176] (3) Permission Verification: The node verifies whether the user's actions in the user operation log are within their authorized scope. For example, it checks whether the user has permission to perform read, edit, or upload operations on a specific file. By comparing the user's permission records with the operation types in the user operation log, it ensures that the operation is authorized.

[0177] Step 642: Verify the integrity of the user operation log:

[0178] (1) User operation log hash verification: Each user operation log will generate a unique hash value (user operation ID) to identify the user operation log. The node will recalculate the hash value of the user operation log and compare it with the hash value contained in the user operation log to ensure that the user operation log has not been tampered with during transmission.

[0179] (2) Data Encryption and Signature Check: Verify that the data in the user operation log has been properly encrypted and digitally signed to ensure its integrity and security. Check the integrity of the data encryption to ensure that the user operation log has not been intercepted or tampered with during transmission.

[0180] Step 643: Apply consensus mechanism:

[0181] (1) Consensus Protocol: Nodes in a blockchain network reach a consensus on user operation logs through a consensus protocol (such as PoW, PoS, DPoS, etc.). The consensus protocol specifies how nodes participate in the verification process and how to reach an agreement on new user operation logs and blocks.

[0182] (2) Consensus Verification: After verifying the user operation logs, each node shares its results with other nodes and confirms the legitimacy of these user operation logs through a consensus mechanism. Once a majority of nodes reach a consensus, the user operation logs will be considered valid and recorded in the blockchain.

[0183] (3) Recording user operation logs: Once the user operation logs are verified and recognized by the consensus mechanism, the node will add the user operation logs to the current block. Each node will update its blockchain copy to reflect the new user operation logs.

[0184] Step 65: Once enough user action logs have been collected, they are packaged into a new block. The new block is encrypted and locked using a specific algorithm (such as proof-of-work).

[0185] Step 66: A new block is added to the end of the blockchain, updating it. Each network node updates its copy of the blockchain to reflect the new data.

[0186] Steps 63 to 66 reflect how user actions are recorded and protected through blockchain technology, demonstrating the role of blockchain in ensuring transparency and security in data operations. Each step highlights the core characteristics of blockchain technology: security, immutability, and distributed verification.

[0187] Furthermore, due to the immutable nature of blockchain, all access and operation records can be traced and audited without exposing the actual content of the data. An efficient indexing mechanism can be employed, using metadata such as user ID, timestamp, and operation type to quickly locate user operation logs requiring auditing. A Merkle tree structure is used for rapid verification; the Merkle root hash value verifies the integrity and consistency of user operation logs, ensuring data reliability during the audit process. Specifically, retrieval speed is faster on large-scale datasets, and using the Merkle tree structure to verify the integrity and consistency of user operation logs improves the reliability of audit results. Auditors can verify the Merkle root hash value to ensure that audit data has not been tampered with. Encryption protects the data content, ensuring that even during the audit process, the actual content of the data is not leaked; only operation logs and metadata are audited and analyzed.

[0188] Multi-level audit permissions are supported: Multiple levels of audit permissions can be set according to different audit needs. Regular users can trace their own operation records, administrators can trace the records of specific users or specific operations, and senior auditors can conduct comprehensive system audits. Flexible audit analysis is supported; auditors can set different audit parameters as needed, such as time periods, operation types, and user IDs, to achieve customized audit requirements. Efficient query and statistical functions support real-time auditing and historical data analysis, helping administrators quickly identify and handle abnormal behavior. Audit operations at each permission level undergo strict identity verification and authorization, ensuring that only legitimate audit requests can be executed, which not only improves audit flexibility but also enhances system security. The multi-level permission design ensures that sensitive operation records can only be accessed by authorized auditors, reducing the risk of data leakage.

[0189] This process illustrates how blockchain provides a transparent, secure, and immutable record of every access and operation within a cloud storage system. This approach enhances the transparency and credibility of data operations, contributing to data security and compliance management.

[0190] Step 7: Continuous security monitoring.

[0191] Even after a user successfully logs in and uses the cloud storage service, the system continues to monitor user behavior and the network environment to ensure no suspicious or abnormal activity occurs. If any anomalies are detected, the system may require the user to re-authenticate or automatically disconnect the user. This helps in detecting and responding to suspicious activity after login.

[0192] 1. Input data for the preset continuous monitoring model used for continuous monitoring and adaptive response includes: (1) User operation logs: All operation logs of users in the system, including file access, modification, deletion, uploading and downloading behaviors. User system usage patterns, such as opening applications, accessing web pages, and using functions. (2) Device activity information: Device status information, such as CPU utilization, memory usage, disk activity, network traffic, etc. Device hardware events, such as plugging and unplugging devices, connecting external storage, etc. (3) Network activity information: Network connection status, traffic patterns, packet analysis, communication protocol usage. IP address changes, network latency, data transmission volume, etc. (4) Time and geographical location information: Timestamp information of user operations. Changes in the geographical location of user operations. (5) Historical behavior data: User's past operation and activity patterns. User's commonly used devices and network environment.

[0193] 2. The output data of the preset continuous monitoring model includes: (1) Risk score: A comprehensive risk score used to quantify the risk level of the current user behavior. The score can be a specific numerical value indicating the level of risk. (2) Abnormal behavior identifier: An identifier indicating whether abnormal behavior has been detected, usually a Boolean value (yes / no), indicating whether the current behavior is inconsistent with the expected normal behavior pattern. (3) Response suggestions: Suggestions for response measures that the system should take, such as whether to require additional authentication, whether to send an alert, whether to terminate the session, or whether to temporarily lock the account. (4) Behavior pattern update: Update the user's behavior pattern data to reflect new operations and activities. This helps the system continuously learn and optimize its understanding of user behavior.

[0194] (1) Examples of applied artificial intelligence models:

[0195] A. Anomaly Detection Model Based on Time Series Analysis: Long Short-Term Memory Network (LSTM): LSTM is a recurrent neural network (RNN) suitable for processing and predicting time series data. LSTM can capture the time dependence of user behavior, identify changes in behavioral patterns over long and short periods, and thus detect potential abnormal behavior.

[0196] B. User Behavior Model Based on Cluster Analysis: k-means Clustering Algorithm: k-means is a commonly used clustering algorithm used to group user behavior data and distinguish between normal and abnormal behavior by identifying different behavior clusters. The model can adapt to changes in user behavior by continuously updating the cluster centers.

[0197] C. Graph Neural Networks (GNNs): Graph-based behavior analysis models: By constructing a graph structure of user behavior (e.g., user-device-network node), GNNs analyze the nodes and edges in the graph structure to identify abnormal behavior. Graph Convolutional Layers: Extract local features from the graph structure. Graph Pooling Layers: Pool the graph structure to extract global features. Fully Connected Layers: Use the extracted features for risk assessment and anomaly detection.

[0198] (2) Structural improvements to artificial intelligence models:

[0199] A. Deep Learning Models Combining Multimodal Data: Multimodal LSTM Network: Building upon traditional LSTM, this model incorporates multimodal data (such as user operation logs, device activity information, and network activity information) to improve anomaly detection accuracy. Input Layer: Processes multimodal data input, such as operation logs, device status, and network activity. Multimodal Fusion Layer: Merges data from different modalities to form a unified feature representation. LSTM Layer: Captures long-term and short-term dependencies in time series data. Output Layer: Generates risk scores and anomalous behavior identifiers.

[0200] B. Adaptive Attention Mechanism: Attention-Based LSTM Network: An attention mechanism is introduced into the LSTM network, enabling the model to automatically focus on important features in the time series, improving the accuracy of anomaly detection. Attention Layer: An attention layer is added on top of the LSTM layer, using a weighted sum method to highlight important time-step features. Improved LSTM Network: The output of the attention layer is combined for final risk assessment and anomaly detection.

[0201] (3) The workflow for continuous security monitoring includes:

[0202] A. Data Collection and Preprocessing: The system continuously collects the above-mentioned input data from user operations, devices, and networks, and performs preprocessing, such as standardization and noise reduction, to ensure data quality and consistency.

[0203] B. Feature Extraction and Modeling: The AI ​​model extracts key features from the preprocessed data and uses machine learning algorithms (such as anomaly detection algorithms, time series analysis models, etc.) to build a continuous monitoring model.

[0204] C. Real-time analysis and evaluation: When users operate in the system, the continuous monitoring model analyzes the input data in real time, compares the current behavior with historical behavior patterns, calculates risk scores, and detects abnormal behavior.

[0205] D. Output and Response Generation: Based on the analysis results, the model generates output data and provides corresponding response suggestions to the system. The system then takes appropriate security measures based on these suggestions to ensure the security of user data and the system itself.

[0206] E. Behavioral Pattern Updates: Based on the latest operational and activity data, the monitoring model continuously updates user behavioral patterns. This helps the system better adapt to normal changes in user behavior while improving the accuracy of detecting abnormal behavior.

[0207] Through steps 1 to 7, the cloud storage system can ensure the security and privacy of user data, guaranteeing the secure transmission and storage of data while maintaining the user's complete control over their own data.

[0208] From a software perspective, to improve the security of user access to the cloud storage system and thus ensure the data security of the cloud storage system, this application provides an embodiment of a cloud storage system-based data processing system for implementing all or part of the aforementioned cloud storage system-based data processing method. See [link to embodiment]. Figure 7 The data processing system based on the cloud storage system specifically includes the following components:

[0209] The acquisition device 01 is used to receive a cloud storage system access request from a target user, and to obtain the target user's device environment information and login information based on the cloud storage system access request.

[0210] Login detection device 02 is used to determine the login risk category of the target user based on the preset login risk score and login risk category correspondence, the login information and the preset abnormal login detection model. The preset abnormal login detection model is obtained by pre-training a first neural network model based on batch historical login information and their respective corresponding actual login risk scores.

[0211] The device environment detection device 03 is used to determine the terminal device environment risk category of the target user if the login risk category meets the preset login risk category range, based on the preset correspondence between device environment risk score and device environment risk category, the login risk category, the device environment information, and the preset device environment risk assessment model. The preset device environment risk assessment model is obtained by pre-training a second neural network model based on a batch of first training samples and their respective corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information.

[0212] The authorization device 04 is used to authorize the target user to access the cloud storage system if the device environment risk category meets the preset device environment risk category range;

[0213] The data processing device 05 is used to receive the data processing request from the target user and, based on the data processing request, complete the data processing corresponding to the cloud storage system.

[0214] The embodiments of the data processing system based on the cloud storage system provided in this specification can be used to execute the processing flow of the embodiments of the data processing method based on the cloud storage system described above. Its functions will not be repeated here, but can be referred to the detailed description of the embodiments of the data processing method based on the cloud storage system described above.

[0215] Figure 8 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 8 As shown, the electronic device includes: a memory 501, a processor 502, and a computer program stored in the memory 501 and executable on the processor 502. When the processor 502 executes the computer program, it implements the following method:

[0216] The system receives a cloud storage system access request from a target user. Based on the access request, it obtains the target user's device environment information and login information. According to a preset login risk score and login risk category correspondence, the login information, and a preset abnormal login detection model, the system determines the target user's login risk category. The preset abnormal login detection model is pre-trained on a first neural network model based on batches of historical login information and their corresponding actual login risk scores. If the login risk category falls within a preset login risk category range, the system determines the target user's terminal device environment risk category based on a preset device environment risk score and device environment risk category correspondence, the login risk category, the device environment information, and a preset device environment risk assessment model. The preset device environment risk assessment model is pre-trained on a second neural network model based on batches of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information. If the device environment risk category falls within a preset device environment risk category range, the system authorizes the target user to access the cloud storage system. The system also receives a data processing request from the target user and completes the corresponding data processing for the cloud storage system based on the request.

[0217] This embodiment discloses a computer program product, which includes a computer program that, when executed by a processor, implements the following method:

[0218] The system receives a cloud storage system access request from a target user. Based on the access request, it obtains the target user's device environment information and login information. According to a preset login risk score and login risk category correspondence, the login information, and a preset abnormal login detection model, the system determines the target user's login risk category. The preset abnormal login detection model is pre-trained on a first neural network model based on batches of historical login information and their corresponding actual login risk scores. If the login risk category falls within a preset login risk category range, the system determines the target user's terminal device environment risk category based on a preset device environment risk score and device environment risk category correspondence, the login risk category, the device environment information, and a preset device environment risk assessment model. The preset device environment risk assessment model is pre-trained on a second neural network model based on batches of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information. If the device environment risk category falls within a preset device environment risk category range, the system authorizes the target user to access the cloud storage system. The system also receives a data processing request from the target user and completes the corresponding data processing for the cloud storage system based on the request.

[0219] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the following method:

[0220] The system receives a cloud storage system access request from a target user. Based on the access request, it obtains the target user's device environment information and login information. According to a preset login risk score and login risk category correspondence, the login information, and a preset abnormal login detection model, the system determines the target user's login risk category. The preset abnormal login detection model is pre-trained on a first neural network model based on batches of historical login information and their corresponding actual login risk scores. If the login risk category falls within a preset login risk category range, the system determines the target user's terminal device environment risk category based on a preset device environment risk score and device environment risk category correspondence, the login risk category, the device environment information, and a preset device environment risk assessment model. The preset device environment risk assessment model is pre-trained on a second neural network model based on batches of first training samples and their corresponding device environment risk scores. Each first training sample includes: historical login risk category and historical device environment information. If the device environment risk category falls within a preset device environment risk category range, the system authorizes the target user to access the cloud storage system. The system also receives a data processing request from the target user and completes the corresponding data processing for the cloud storage system based on the request.

[0221] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0222] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0223] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0224] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0225] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0226] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A data processing method based on a cloud storage system, characterized by, The method comprises: receiving a cloud storage system access request of a target user, obtaining device environment information and login information of the target user according to the cloud storage system access request; determining a login risk category of the target user according to a preset login risk score and login risk category correspondence relationship, the login information and a preset abnormal login detection model, the preset abnormal login detection model being obtained by pre-training a first neural network model based on a batch of historical login information and respective actual login risk scores corresponding to the historical login information; if the login risk category meets a preset login risk category range, determining a terminal device environment risk category of the target user according to a preset device environment risk score and device environment risk category correspondence relationship, the login risk category, the device environment information and a preset device environment risk assessment model, the preset device environment risk assessment model being obtained by pre-training a second neural network model based on a batch of first training samples and respective device environment risk scores corresponding to the first training samples, each first training sample comprising a historical login risk category and historical device environment information; if the device environment risk category meets a preset device environment risk category range, authorizing the target user to access the cloud storage system; receiving a data processing request of the target user, and completing data processing corresponding to the cloud storage system according to the data processing request. 2.The cloud storage system based data processing method of claim 1, wherein, The method further comprises: obtaining data processing information corresponding to the data processing request; determining a continuous monitoring risk category of the target user according to the device environment risk category, the data processing information and a preset continuous monitoring model, the preset continuous monitoring model being obtained by pre-training a third neural network model based on a batch of second training samples and respective actual continuous monitoring risk categories corresponding to the second training samples. 3.The cloud storage system based data processing method of claim 1, wherein, The method further comprises: receiving a data modification request of the target user; obtaining encrypted data corresponding to the data modification request from the cloud storage system according to the data modification request and transmitting the encrypted data to a terminal device of the target user, the terminal device of the target user decrypting the encrypted data, modifying the decrypted data, encrypting the modified data and returning the encrypted data to the cloud storage system. 4.The cloud storage system based data processing method of claim 1, wherein, The method further comprises: receiving a data upload request of the target user, the data upload request comprising data encrypted by a terminal device application key of the target user; uploading the encrypted data to the cloud storage system. 5.The cloud storage system based data processing method according to claim 1, wherein, The method further comprises: generating user operation logs corresponding to the cloud storage system access request and the data processing request respectively; storing the user operation logs on a blockchain. 6.The cloud storage system based data processing method according to claim 5, wherein, The method further comprises: The user operation log is uploaded to each node of the blockchain, each node performs signature verification, format verification, permission verification and hash verification on the user operation log, and obtains a verification result of the node; If the user operation log is determined to pass the verification based on the consensus mechanism and the verification results of the nodes, the user operation log is stored on the blockchain. 7.The cloud storage system based data processing method according to claim 5, wherein, Also comprising: Receiving an audit request; Obtaining the user operation log of the audit request from the blockchain, and completing the audit operation corresponding to the audit request according to the user operation log.

8. A data processing system based on a cloud storage system, characterized by, Comprising: An acquisition device configured to receive a cloud storage system access request of a target user, and obtain device environment information and login information of the target user according to the cloud storage system access request; A login detection device configured to determine a login risk category of the target user according to a preset correspondence between login risk scores and login risk categories, the login information, and a preset abnormal login detection model, the preset abnormal login detection model being obtained by pre-training a first neural network model based on a batch of historical login information and respective actual login risk scores corresponding to the historical login information; A device environment detection device configured to, if the login risk category meets a preset login risk category range, determine a terminal device environment risk category of the target user according to a preset correspondence between device environment risk scores and device environment risk categories, the login risk category, the device environment information, and a preset device environment risk assessment model, the preset device environment risk assessment model being obtained by pre-training a second neural network model based on a batch of first training samples and respective device environment risk scores corresponding to the first training samples, each first training sample comprising a historical login risk category and historical device environment information; An authorization device configured to, if the device environment risk category meets a preset device environment risk category range, authorize the target user to access the cloud storage system; A data processing device configured to receive a data processing request of the target user, and complete data processing corresponding to the cloud storage system according to the data processing request.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the cloud storage system-based data processing method of any one of claims 1 to 7.

10. A computer readable storage medium having stored thereon computer instructions, wherein, The instructions are executed by the processor to implement the cloud storage system-based data processing method of any one of claims 1 to 7.

Images