A cloud computing-based big data security storage method and system

Abstract

The application relates to the field of cloud computing big data security storage, in particular to a big data security storage method and system based on cloud computing. The method comprises the following steps: encrypting and fragmenting an original data stream to generate an indexed fragment sequence; generating a dynamic key sequence and a verification key group based on the fragment information; combining a geographical position weight and a load balancing strategy to construct a safe transmission channel through a quantum key distribution mechanism to realize encapsulation and transmission of a safe fragment package; implementing node state monitoring and redundancy management to generate an update mapping table; and finally recovering a complete data stream through fragment positioning retrieval, data recombination and dynamic decryption. The application improves the security, reliability and overall load balancing capability of data storage.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud computing big data security storage, and particularly relates to a cloud computing-based big data security storage method and system. BACKGROUND

[0002] In the field of cloud computing big data security storage, the existing scheme usually adopts static key encryption and fixed node allocation mechanism, which has limitations such as fixed key update period, unbalanced storage node load allocation, and insufficient transmission channel protection. The existing method relies on pre-set key library and centralized storage node mapping table, which is prone to increase the risk of key leakage, delay fluctuation of sharded storage, and expansion of transmission link attack surface in a dynamic cloud computing environment, and is difficult to meet the stable implementation of data sharding encryption and distributed storage. For the joint processing of sharding index and node allocation table in dynamic key generation, sharding routing optimization, and transmission encryption, the existing technology generally lacks the ability to cooperatively control the key rotation period and geographic location awareness, and is difficult to form a consistent process of sharding index-key generation-node matching-encrypted transmission in a cloud storage scenario, resulting in a compromise between data storage security and distributed efficiency. SUMMARY

[0003] The present application provides a cloud computing-based big data security storage method and system to solve the problem of how to implement data sharding encryption and distributed storage in cloud storage based on sharding index and node allocation table through dynamic key sequence and secure sharding package.

[0004] To solve the above technical problems, the present application provides a cloud computing-based big data security storage method, comprising:

[0005] Obtain the original data stream, use the key provided by the dynamic key management module for AES encryption processing to obtain the encrypted data block; based on the data characteristics including the hash value and the length information, perform sharding cutting to generate a sharding sequence, and perform metadata marking processing to obtain a sharding index; the original data stream includes the big data content to be stored; the process of AES encryption processing includes key scheduling, data grouping, substitution and permutation; the dynamic key management module specifically includes key seed generation, rotation period calculation, dynamic key sequence generation, and key verification structure generation;

[0006] Based on the sharding index, use the sharding identifier, timestamp, and sharding check code to generate an initial key through the key seed, perform rotation period calculation based on the timestamp parameter to generate a dynamic key sequence, and perform hash check on the dynamic key sequence to generate a verification key group;

[0007] Based on the verification key group and the slice index, geographic location matching is performed through a geographic location weight matrix, load balancing calculation is performed based on a load balancing optimization function, and transmission channel encryption is performed using a quantum key distribution mechanism, to obtain a secure slice package;

[0008] The secure slice package is obtained, node heartbeat monitoring is performed to generate a node state table, redundancy detection and new node matching are performed, and an updated mapping table is obtained;

[0009] The updated mapping table is obtained, a channel key is generated using quantum key distribution technology, a verification factor is extracted from the channel key for slice integrity verification and log recording, and a storage credential is generated;

[0010] Based on the storage credential, slice positioning retrieval, data block reorganization, and dynamic key decryption are performed to obtain a complete data stream.

[0011] Further, the encrypted data block specifically includes:

[0012] Data features are extracted from the encrypted data block, including hash values, length information, and data distribution characteristics of the data content, which are used to guide the reasonable division of slice cutting.

[0013] Further, the process of extracting data features specifically includes:

[0014] Based on the data features, a slice cutting operation is performed, and the encrypted data block is divided into multiple independent slices according to a preset slice strategy, including fixed-size slices and variable-length slices based on content, and the specific selection is determined according to data type and network transmission performance requirements;

[0015] During the slicing process, boundary alignment and integrity checking are performed for each slice to ensure the integrity and continuity of the slice data, and each slice can be independently stored and transmitted.

[0016] Further, the process of obtaining the slice index through metadata labeling specifically includes:

[0017] Metadata labeling is performed on each slice in the slice sequence;

[0018] The metadata includes a slice identifier, a timestamp, an identifier of the associated encrypted data block, and a slice verification code;

[0019] The verification code is generated based on the slice content through a hash algorithm and is used for subsequent data integrity verification;

[0020] The metadata is associated with the slice content to construct a slice index structure;

[0021] The slice index includes a slice position index, a slice state identifier, and slice access permission information, supporting fast positioning and secure access.

[0022] Further, based on the shard index, the process of generating an initial key using the shard identifier, timestamp and shard check code through the key seed specifically includes:

[0023] According to the preset key generation algorithm, combined with the dynamic elements in the shard index, the timestamp and the shard check code, multiple hash operations and entropy collection are implemented to generate a key seed with high randomness and unpredictability;

[0024] The key seed generation complies with the security parameters defined in the key management policy configuration file, including seed length, hash function type and entropy collection frequency.

[0025] Further, based on the timestamp parameter, the rotation period is calculated to generate a dynamic key sequence, specifically including:

[0026] The timestamp parameter extraction unit adopts a time synchronization mechanism, combined with the system clock and the network time protocol service, so that the extracted timestamp has high precision and consistency;

[0027] Based on the timestamp and the system configured key rotation strategy, the effective period of the current key and the trigger time point of the next key update are calculated;

[0028] The rotation period calculation adopts a dynamic adjustment mechanism, dynamically adjusts the key rotation frequency according to system load, node state and security event feedback, to balance the key security and system performance.

[0029] Further, the dynamic key sequence is hashed to generate a verification key group, specifically including:

[0030] The hash algorithm is adopted. The high-strength algorithm in the secure hash algorithm family is combined with the key version number and the timestamp information to realize the uniqueness and anti-collision property of the check code;

[0031] The hash algorithm adopts a high-strength algorithm in the secure hash algorithm family, combined with the key version number and the timestamp information, to realize the uniqueness and anti-collision property of the check code;

[0032] The hash check code is associated with the dynamic key sequence to construct a verification key group.

[0033] Further, the expression of generating the verification key group includes:

[0034] The key seed generation function is constructed:

[0035]

[0036] Wherein, is the calculated initial key; is the total number of shards in the shard index; is the shard index number; This represents the probability of the uniqueness of the fragment identifier; This is the fragment identifier; This is a timestamp value; This is a fragment checksum; The base of the logarithm is the adjustment factor; This is an XOR operation; Logarithmic operations; The probability of the value obtained by XORing the timestamp and the checksum;

[0037] Constructing a dynamic key evolution function:

[0038]

[0039] in, The calculated dynamic key sequence; This is the key sequence number; The AES encryption algorithm with a 256-bit key; For byte concatenation operations; For timestamp gradient; The timestamp parameter is obtained by decoding from the initial key; The attenuation coefficient; The baseline rotation cycle;

[0040] Perform hash chain verification:

[0041]

[0042] in, The calculated hash verification value; This is a SHA-3 hash algorithm with an output length of 512 bits. This is the hash verification sequence number; This is an XOR operation; This is the preceding hash value.

[0043] Furthermore, the expression for obtaining secure fragment packets includes:

[0044] Establish a geographic location weight matrix:

[0045]

[0046] in, This is the calculated geographic location weight matrix; The candidate node number; Assign a security level number to each segment; Indicates the geographical distance between the node and the data source; The physical location coordinates of the candidate node; The geographic coordinates of the data source for the sharding; is a distance attenuation index; is a node security level coefficient;

[0047] Construct a load balancing optimization function:

[0048]

[0049] wherein, is a mathematical minimum function; is a current number of node shard loads; is a maximum capacity of the node; is a node bandwidth change rate; is a maximum theoretical bandwidth of the node; is a bandwidth weight factor;

[0050] Encrypt the routing instruction using a quantum key distribution mechanism:

[0051]

[0052] wherein, is an encrypted secure shard package; is a quantum channel number; is a polarization angle parameter of the quantum channel; is a CHSH inequality quantum correlation degree function; is a random orthogonal transformation operation; : is a dynamic key sequence; is a routing instruction cyclic redundancy check code; is a routing instruction plaintext to be encrypted.

[0053] Further, a big data security storage system based on cloud computing, applied to any of the above methods, comprises:

[0054] A key seed generation module for obtaining a shard index and generating an initial key;

[0055] A dynamic key calculation module for extracting a timestamp parameter from the initial key and generating a dynamic key sequence;

[0056] A hash check module for checking the dynamic key sequence and generating a verification key group;

[0057] A node allocation module for matching the shard index with the geographic location and generating a node allocation table;

[0058] A routing instruction generation module for extracting a node ID and calculating load balancing to generate a routing instruction;

[0059] An encrypted transmission module for channel encryption of the routing instruction to generate a secure shard package.

[0060] The key innovations of the present application include:

[0061] (1) By acquiring the shard index for key seed generation, an initial key is generated to realize the generation of a dynamic key sequence and the establishment of a key verification structure.

[0062] (2) In the generation process of the node allocation table, the node ID extraction and load balancing calculation are realized by combining the geographic location matching technology to generate a shard routing instruction.

[0063] (3) The generated routing instruction is encrypted for transmission channel to generate a secure shard package, thereby ensuring the security of data in the transmission process.

[0064] The following are its main beneficial effects:

[0065] (1) By generating a dynamic key sequence and establishing a verification key group, the dynamic update and security of the key are ensured, the risk of key leakage is reduced, and it is suitable for dynamic cloud computing environment.

[0066] (2) The node allocation table is generated by combining the geographic location matching, and the load distribution of the node is optimized by load balancing calculation, which effectively reduces the delay fluctuation of shard storage, and is suitable for distributed storage scene.

[0067] (3) By encrypting the transmission channel of the routing instruction, a secure shard package is generated, which enhances the security of the data transmission link, and is suitable for data transmission scenarios that require high security. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 A flowchart of a big data security storage method based on cloud computing provided by an embodiment of the present application;

[0069] Figure 2 A structural block diagram of a big data security storage system based on cloud computing provided by an embodiment of the present application. DETAILED DESCRIPTION

[0070] Embodiment one: refer to Figure 1 A flowchart of a big data security storage method based on cloud computing provided by an embodiment of the present application, which can at least include steps S100-S600:

[0071] S100, acquire the original data stream, use the key provided by the dynamic key management module for AES encryption processing to obtain the encrypted data block; based on the data characteristics including the hash value and the length information, perform shard cutting to generate a shard sequence, and perform metadata marking processing to obtain a shard index;

[0072] S200, based on the slice index, using the slice identifier, timestamp and slice check code to generate the initial key through the key seed, based on the timestamp parameter to generate the dynamic key sequence through the rotation period calculation, and to generate the verification key group through the hash check of the dynamic key sequence;

[0073] S300, based on the verification key group and the slice index, through the geographic position weight matrix to perform the geographic position matching, based on the load balancing optimization function to perform the load balancing calculation, and using the quantum key distribution mechanism to perform the transmission channel encryption, to obtain the secure slice package;

[0074] S400, obtaining the secure slice package, performing the node heartbeat monitoring to generate the node state table, performing the redundancy detection and the new node matching, to obtain the update mapping table;

[0075] S500, obtaining the update mapping table, using the quantum key distribution technology to generate the channel key, extracting the verification factor from the channel key to perform the slice integrity check and the log record, to generate the storage credential;

[0076] S600, based on the storage credential, performing the slice positioning retrieval, the data block reorganization and the dynamic key decryption, to obtain the complete data stream.

[0077] The step S100 at least contains steps S110-S130:

[0078] S110, obtaining the original data stream, performing the AES encryption processing, to obtain the encrypted data block;

[0079] The original data stream from the system input interface is received, and the original data stream includes large data content to be stored. Specifically, the original data stream is taken as an input, and pre-processing is first performed to adapt to subsequent encryption operations. The pre-processing includes data format checking, integrity verification, and necessary buffering operations. Subsequently, encryption processing is performed on the pre-processed original data stream based on an Advanced Encryption Standard (AES) algorithm. Specifically, the data stream is block-encrypted using the AES symmetric encryption algorithm. The encryption process includes key scheduling, data grouping, substitution, and permutation steps to ensure the confidentiality and security of the encrypted data. In the encryption process, the key is derived from the current valid key provided by a dynamic key management module. The dynamic key management module is used to perform key generation, rotation strategy management, and key distribution. The dynamic key management module specifically includes key seed generation, rotation period calculation and dynamic key sequence generation, and key verification structure generation. The key is transmitted through a secure channel and dynamically updated to prevent key leakage. After encryption is completed, a continuous encrypted data block is generated. The encrypted data block has a fixed length and contains encrypted data content and necessary metadata identifiers for subsequent fragmentation processing. The encrypted data block is transmitted to the "encrypted data block" input end of the next step S120 of the module as an output field for subsequent fragmentation operations.

[0080] S120, data features are extracted from the encrypted data block, and fragmentation cutting is performed to generate a fragmentation sequence.

[0081] Specifically, data feature information is extracted from the encrypted data block. The data features include the hash value, length information, and data distribution characteristics of the data content, which are used to guide the reasonable division of fragmentation cutting. Further, based on the data features, fragmentation cutting operations are performed to divide the encrypted data block into multiple independent fragments according to a pre-set fragmentation strategy. The fragmentation strategy includes fixed-size fragmentation and content-based variable-length fragmentation. The specific selection is determined according to data types and network transmission performance requirements. During fragmentation, boundary alignment and integrity checking are performed for each fragment to ensure the integrity and continuity of the fragment data, and each fragment can be independently stored and transmitted. After fragmentation cutting is completed, a fragmentation sequence containing multiple fragments is generated. The fragmentation sequence is arranged in order and contains the unique identifier and size information of each fragment. The fragmentation sequence is transmitted to the "fragmentation sequence" input end of the next step S130 of the module as an output field for metadata labeling and index structure generation.

[0082] S130, metadata labeling is performed on the fragmentation sequence to generate a fragmentation index.

[0083] Specifically, a metadata tagging operation is performed on each shard in the shard sequence, the metadata including a shard identifier, a timestamp, a belonging encrypted data block identification, and a shard check code, the check code being generated based on shard content through a hash algorithm for subsequent data integrity verification. Further, the metadata is associated with the shard content to construct a shard index structure, the shard index structure including a shard location index, a shard state identification, and shard access permission information, supporting fast positioning and secure access. In the generation process of the shard index structure, the shard permission and access control list are configured in combination with the storage strategy and security strategy configured by the system, to ensure the secure storage and management of the shards. In addition, the shard index structure supports dynamic updating, facilitating mapping adjustment when the subsequent node state changes. The shard index serves as an output field and is transmitted to the "shard index" input end of the next main step S200, for key seed generation and dynamic key management, and also provides basic index information for subsequent modules such as node allocation of S300 and data reorganization and decryption of S600.

[0084] Step S200 at least includes steps S210-S230:

[0085] S210, obtain the shard index, generate a key seed, and obtain an initial key;

[0086] Specifically, the shard index structure is introduced into the key seed generation module. The module first analyzes the key metadata in the shard index, including the shard identifier, the timestamp, and the shard check code, extracts the unique identification information and the time sequence characteristics, and uses them to form the initial parameters for key generation. Specifically, the key seed generation module generates a key seed with high randomness and unpredictability by implementing multiple hash operations and entropy collection according to a preset key generation algorithm and in combination with dynamic elements in the shard index, such as the timestamp and the shard check code. In this process, the system performs integrity verification on the input shard index data. If an anomaly or data loss is found, an abnormal log recording mechanism is triggered, and fault tolerance processing or re-requesting of the shard index data is performed according to a preset strategy. The key seed generation follows the security parameters defined in the key management strategy configuration file, including the seed length, the hash function type, and the entropy collection frequency, to ensure that the generated initial key has sufficient security strength and adaptability. After completing the key seed generation, the seed is transmitted as an input to the initial key generation unit, which performs key scheduling according to a key expansion algorithm to output the initial key. The initial key is transmitted as an output field to the "initial key" input end of the next step S220 of this module, for dynamic key sequence generation processing. Meanwhile, the initial key can also be used as a basic key for subsequent modules such as key verification and shard encryption of S300.

[0087] S220, extracting a timestamp parameter from the initial key, performing a rotation period calculation, and generating a dynamic key sequence;

[0088] In this step S220, the initial key is input, first entering the timestamp parameter extraction unit, which decodes and extracts the embedded timestamp information from the initial key. The timestamp information includes the starting time point of key generation and the rotation period parameter. Specifically, the timestamp parameter extraction unit uses a time synchronization mechanism, combined with system clock and Network Time Protocol (NTP) service, to ensure that the extracted timestamp has high precision and consistency. Subsequently, the rotation period calculation module calculates the effective period of the current key and the trigger time point of the next key update based on the timestamp and the system configured key rotation strategy. The rotation period calculation uses a dynamic adjustment mechanism to dynamically adjust the key rotation frequency according to system load, node state and security event feedback, to balance key security and system performance. Further, based on the calculated rotation period, the dynamic key generation module generates a series of dynamic key sequences according to the predefined key evolution algorithm, combined with the initial key and timestamp parameter. The sequence contains multiple time period corresponding key versions, each key version is processed through multiple encryption transformation and hash, to ensure the timeliness and irreversibility of the key. During the generation process, the system performs continuity and consistency check on the key sequence, if the sequence is found to be interrupted or abnormal, it will trigger the key update exception handling process, including resetting the key generation parameter and resynchronizing the timestamp. The dynamic key sequence is output as the input field of the next step S230 of this module, "dynamic key sequence", for key verification structure generation, and the sequence also provides dynamic key support for S300 fragmentation encryption and S600 data decryption.

[0089] S230, performing hash check on the dynamic key sequence, and generating a key verification structure;

[0090] In this step S230, the dynamic key sequence is input into a hash check unit, which specifically performs a hash algorithm on each key version in the dynamic key sequence to generate a corresponding hash check code. The hash algorithm uses a high-strength algorithm in the Secure Hash Algorithm (SHA) family, combined with the key version number and timestamp information, to ensure the uniqueness and collision resistance of the check code. Further, the key verification structure generation module associates the hash check code with the dynamic key sequence to construct a verification key group. The verification key group includes key version identification, timestamp, hash check code, and verification rules, supporting subsequent key validity verification and rapid check. Specifically, the key verification structure supports distributed storage and real-time updating, and can respond to key rotation events and security policy adjustments to achieve secure management of dynamic keys. The system verifies the integrity of the input dynamic key sequence during generation, and if abnormal data or check failure is found, triggers an error record and alarm mechanism, and starts a key recovery process. The verification key group is output to the input of the next main step S300, "verification key group", for key verification and node allocation for sharding encryption, and also provides key verification basis for subsequent modules such as node state monitoring of S400 and data recombination decryption of S600.

[0091] In another embodiment, in S210, the shard index from S130 is obtained, the shard identifier, timestamp, and check code are extracted as input, a key seed generation function is constructed, formula ①:

[0092]

[0093] Wherein:

[0094] : the calculated initial key;

[0095] is the total number of shards in the shard index;

[0096] is the shard index number, with a value domain [1, n];

[0097] represents the uniqueness probability of the shard identifier, calculated by normalizing the shard identifier hash value;

[0098] : shard identifier, taken from the identifier field of the shard index;

[0099] is the timestamp value, taken from the timestamp field of the shard index;

[0100] The hash check code field from the slice index, a hexadecimal string, is taken as the slice check code.

[0101] The logarithm base adjustment factor is used to enhance the time sensitivity of the entropy weight.

[0102] XOR operation on the binary bits of the timestamp and the check code.

[0103] Logarithmic operation with base 2 and exponent =1.5, i.e., for any input x, perform .

[0104] The probability of the value obtained by XORing the timestamp and the check code.

[0105] The slice identifier, timestamp, and check code are extracted from the slice index data source and mapped to the input variables of formula ①. The calculation result is passed to the "initial key" input terminal of S220 as the initial key.

[0106] In S220, the initial key from S210 is received, and its embedded timestamp parameter is decoded. The dynamic key evolution function is constructed: formula ②

[0107]

[0108] Where:

[0109] The calculated dynamic key sequence.

[0110] The key sequence number, taking the value domain [1, m], m is calculated from the rotation period.

[0111] AES encryption algorithm for 256-bit keys, using CBC mode.

[0112] Byte concatenation operation, concatenating with the time gradient value as the input of the AES algorithm.

[0113] The timestamp gradient is calculated from the time difference between adjacent keys.

[0114] The timestamp parameter decoded from the initial key.

[0115] The decay coefficient controls the timeliness decay rate of key evolution.

[0116] Reference rotation period, taken from the key management policy table, unit hour;

[0117] The formula ① As an input item, combined with the timestamp parameter to generate a dynamic key sequence , passed to the "dynamic key sequence" input end of S230.

[0118] In S230, the key sequence of S220 is checked by hash chain verification: formula ③

[0119]

[0120] Where:

[0121] : the calculated hash verification value;

[0122] : output length of 512-bit SHA-3 hash algorithm;

[0123] Hash check number;

[0124] : XOR operation, mix the dynamic key with the previous hash value;

[0125] The previous hash value, the initial value is the system preset salt value;

[0126] The formula ② As an input, generate a verification key group through chain hash , passed to the "verification key group" input end of S310.

[0127] Step S300 at least contains steps S310-S330:

[0128] S310, get the shard index, match the geographic location, and generate a node allocation table;

[0129] In this step S310, the verification key group and the shard index are taken as input sources, specifically, the verification key group is imported into the node allocation module, and the system preset geographic location database and cloud node resource information are processed. First, the node allocation module collects the current available cloud node list, which includes node identification, geographic coordinates, network delay, storage capacity, node security level and other key attributes. Further, combined with the shard identifier in the shard index and its corresponding security level requirement, the node allocation module filters the cloud node set that meets the security level and storage capacity requirements based on the geographic location matching algorithm. The geographic location matching algorithm specifically selects nodes that are geographically dispersed and have shorter network response time by calculating the physical distance and network topology delay between the node and the data source or user access end, aiming to achieve a balance between reasonable distribution of data shards and access efficiency. During the matching process, the system excludes nodes with abnormal state or in maintenance according to the node health information provided by the node state monitoring module, to ensure the availability of the allocated nodes. The node allocation module further performs node load balancing judgment to avoid performance bottlenecks caused by node overload, and the judgment basis includes the current storage usage, network bandwidth occupancy and processor load of the node. For the matching result, the system uses priority queue management to sort according to the node comprehensive score, which takes into account the geographic location, node security level and load situation. Finally, the node allocation module generates a node allocation table, which records in detail the cloud node identification corresponding to each shard, node geographic location, allocation timestamp and shard storage strategy, forming structured data. The node allocation table is taken as the output field and delivered to the "node allocation table" input end of the next step S320, for load balancing calculation and shard routing instruction generation, and the node allocation table also provides basic data support for the node state monitoring and fault recovery of the subsequent module S400.

[0130] S320, extract node ID from the node allocation table, perform load balancing calculation, and generate shard routing instruction;

[0131] In this step S320, the node allocation table is taken as input, first entering the node ID extraction unit, which extracts the unique identifiers (node IDs) of all allocated nodes from the node allocation table and classifies and summarizes them according to node attributes. Further, the load balancing calculation module performs a load balancing algorithm based on the node performance indicators corresponding to the node IDs, including storage capacity, network bandwidth, CPU utilization, and historical response time. This algorithm specifically uses a weighted round robin combined with a dynamic load prediction model to dynamically adjust the distribution ratio of shards among nodes. The dynamic load prediction model is based on historical node load data and real-time monitoring information, using machine learning algorithms to predict future load trends and thus optimize shard routing strategies. During the load balancing calculation process, the system sets threshold parameters such as the maximum number of shards a single node can carry and the upper limit of network bandwidth usage. Nodes that exceed these thresholds will be marked as candidate nodes, with their allocation weights correspondingly reduced. The load balancing module also considers node security levels, prioritizing the reasonable allocation of loads on high-security level nodes to prevent potential risks caused by overloading low-security level nodes. After completing the load balancing calculation, the system generates shard routing instructions, which detail the target storage nodes, transmission priority, transmission time window, and backup node information for each shard. The shard routing instructions are in a structured format, facilitating subsequent transmission scheduling and fault switching. The routing instructions are taken as output fields and passed to the "routing instructions" input end of the next step S330, where they are used for transmission channel encryption processing. At the same time, the routing instructions also serve as routing references for subsequent module S400 node fault recovery and S500 security transmission protocol execution.

[0132] S330, transmission channel encryption of routing instructions to generate secure shard packets;

[0133] In this step S330, the routing instruction is input, and specifically, it first enters the transmission channel encryption module. The module generates key material for encrypting the transmission channel according to the current system security policy and the quantum key distribution (QKD) mechanism. The transmission channel encryption module dynamically establishes a point-to-point encrypted channel in combination with the target node information specified in the routing instruction, including key negotiation, identity verification, and encryption algorithm negotiation sub-processes. The key negotiation uses quantum key distribution technology to achieve secure distribution of keys by using the non-cloning property of quantum states, preventing man-in-the-middle attacks. The identity verification uses digital certificates and multi-factor authentication mechanisms to verify the legal identity of both parties, ensuring the security of the channel establishment. The encryption algorithm negotiation selects symmetric encryption algorithms (such as AES) or post-quantum encryption algorithms based on node capabilities and system policies, balancing security and performance. After completing the encrypted channel establishment, the transmission channel encryption module encrypts the fragmented data packets contained in the routing instruction, specifically performing group encryption, padding, and message authentication code (MAC) generation of the encryption algorithm to form a secure fragmented package. The secure fragmented package contains encrypted fragmented content, encryption header information, and integrity check code, supporting integrity verification and tamper detection in subsequent transmission processes. During encryption, the system monitors encryption performance indicators and abnormal events in real time, and triggers a security event response mechanism if an abnormality is detected, including log recording, alarm sending, and channel reconstruction. The secure fragmented package is output to the input of the next main step S400, providing node heartbeat monitoring and fault recovery processing, and also providing encrypted data for the security transmission protocol execution of the subsequent module S500.

[0134] In another embodiment, in S310, the verification key group and the fragment index of S230 are obtained, and a geographic location weight matrix is established: formula (IV)

[0135]

[0136] Wherein:

[0137] : the calculated geographic location weight matrix;

[0138] is the candidate node number, with a value range of [1, p], and p is the total number of available nodes;

[0139] is the fragment security level number, taken from the security policy field of the fragment index;

[0140] represents the geographic distance between the node and the data source;

[0141] : Physical location coordinates of candidate nodes, provided by node attribute table;

[0142] : Geographical location coordinates of shard data source, taken from security policy field;

[0143] is the distance attenuation index;

[0144] is the node security level coefficient, taken from node attribute table;

[0145] Formula (4) outputs the node allocation weight matrix, which, combined with the shard index, generates the node allocation table and is passed to the "node allocation table" input end of S320.

[0146] Further, in S320, based on the node allocation table of S310, a load balancing optimization function is constructed: Formula (5)

[0147]

[0148] wherein:

[0149] : Mathematical minimum function;

[0150] is the current shard load of the node, taken from node state monitoring data;

[0151] is the maximum capacity of the node, taken from the node attribute table;

[0152] is the node bandwidth change rate;

[0153] : Maximum theoretical bandwidth of the node;

[0154] is the bandwidth weight factor;

[0155] The solution set of Formula (5) generates the shard routing instruction, which is passed to the "routing instruction" input end of S330.

[0156] Further, in S330, the quantum key distribution mechanism is used to encrypt the routing instruction: Formula (6)

[0157]

[0158] wherein:

[0159] : Encrypted secure shard package;

[0160] : Quantum channel number;

[0161] : polarization angle parameter of quantum channel;

[0162] : quantum correlation degree function of CHSH inequality;

[0163] : random orthogonal transformation operation;

[0164] : dynamic key sequence;

[0165] : routing instruction cyclic redundancy check (Cyclic Redundancy Check, CRC) code;

[0166] : routing instruction plaintext to be encrypted, in the form of binary data block;

[0167] The formula (6) outputs the encrypted secure fragment package, which is transmitted to the "secure fragment package" input end of S410.

[0168] The technical effect of this paragraph is to realize the anti-attack protection of the fragment routing instruction by generating and encrypting the quantum channel with the entropy optimization of the dynamic key sequence, and to guarantee the end-to-end security of the distributed storage.

[0169] Step S400 at least contains steps S410-S430:

[0170] S410, obtain a secure fragment package, perform node heartbeat monitoring, and generate a node state table;

[0171] In this step S410, the security fragment package is taken as the input source, and specifically, the security fragment package is imported into the node heartbeat monitoring module. The module first collects the real-time state of each storage node in the distributed cloud node environment, and the state collection includes the online state, response time, storage capacity usage, network connection status, and security event log of the node, and other key indicators. The node heartbeat monitoring module sends heartbeat request signals to each node periodically, receives the corresponding response signals, and combines the timestamp information to calculate the response time delay and form the node response performance data. Specifically, the heartbeat request and response use a lightweight protocol, support multi-thread concurrent processing, and adapt to the real-time monitoring needs of large-scale node environment. The module further detects the heartbeat data received for abnormalities, uses threshold comparison and trend analysis methods to identify possible signs of node failure, such as response timeout, abnormal increase in packet loss rate, or abnormal fluctuations in node load. The abnormal detection result is recorded through the log system and triggers the warning mechanism to notify the fault recovery module. For nodes that do not respond or have multiple abnormalities, the system will mark their state as "fault" or "unavailable" and update the node state identifier. In the generation process of the node state table, the heartbeat monitoring module will collect the node identifier, state code, last response time, and abnormal event summary and structure them to form a comprehensive state information table containing all monitored nodes. The node state table is taken as the output field and is transmitted to the "node state table" input end of the next step S420 to identify the fault node and detect the fragment redundancy, and the node state table also provides basic data support for the recovery instruction generation of the subsequent module S430.

[0172] S420, extract the fault node ID from the node state table, detect the fragment redundancy, and generate a set of recovery instructions;

[0173] In this step S420, the node state table is inputted into the fault node extraction unit, and specifically, the node identifiers (fault node IDs) marked as "fault" or "unavailable" are filtered out from the node state table. The filtering process combines multi-dimensional monitoring data, including the number of node response failures, the frequency of abnormal logs, and the node load abnormal indicators, and adopts a weighted scoring model for comprehensive judgment. Further, the fault node extraction result is transmitted to the shard redundancy detection module, which analyzes the number of shards stored on the affected node and their redundancy backup according to the system's pre-set shard redundancy strategy. The shard redundancy detection specifically identifies the number of redundant copies of the shard and their distribution location by querying the shard index structure and the storage mapping table, and evaluates whether the current redundancy meets the system-defined fault tolerance threshold. For shards with insufficient redundancy or single-point failure risk, the system automatically generates recovery instructions to instruct shard redistribution or replica supplementation. The generation of the recovery instruction set adopts a rule engine to dynamically adjust the recovery scheme based on node priority, geographical location distribution, and network topology, ensuring the rationality and efficiency of shard replication. The recovery instruction set content includes the shard identifier to be recovered, the target node candidate list, the recovery priority, and the execution time window. The module also analyzes the impact range of the fault node and generates a fault impact report for system administrators to reference. In abnormal cases, if the recovery instruction generation fails or the target node is unavailable, the system triggers the failover mechanism, records abnormal logs, and sends an alarm. The recovery instruction set is outputted as an input field to the "recovery instruction set" input end of the next step S430, which is used for new node matching and mapping table updating. The recovery instruction set also provides fault recovery basis for the execution of the security transmission protocol of the subsequent module S510.

[0174] S430, new node matching is performed on the recovery instruction set to generate an updated mapping table.

[0175] In this step S430, the recovery instruction set is imported into the new node matching module as input. The module first accesses the current cloud node resource pool to obtain node online state, storage remaining capacity, network bandwidth, security level and other attribute information. In combination with the target node candidate list in the recovery instruction set, a multi-dimensional matching algorithm is used for node screening, which comprehensively considers geographical location distribution, load balancing, node security level and fault history record to ensure that the selected node meets the sharding storage requirements. The new node matching module further performs node health assessment to exclude nodes that have recently occurred abnormities or are under maintenance, and preferentially selects nodes that are stable in state and excellent in performance. The matching result is prioritized to generate a final node allocation scheme. Subsequently, the mapping table updating module updates the mapping relationship according to the node allocation scheme in combination with the existing storage mapping table. Specifically, new mapping entries are established between the shards involved in the recovery instruction and the newly matched nodes to update the shard storage location and access permission information. The mapping table updating process uses a transaction mechanism to ensure data consistency and atomicity, support concurrent updating and version control. The updated mapping table contains the latest shard-node correspondence, mapping timestamp and change record, supporting subsequent access request routing and fault monitoring. After the mapping table is updated, the system notifies relevant modules through the message queue to synchronize the change information, ensuring the consistency of the overall system state. The updated mapping table is output to the input end of the next main step S510, "update mapping table", for quantum key distribution and transmission channel key generation. At the same time, the updated mapping table also provides the latest mapping basis for the subsequent node state continuous monitoring module S400. The technical effect of this step is to realize accurate generation of fault recovery instructions through fault node identification and shard redundancy detection, and to guarantee the high availability and data continuity of the distributed storage system through new node matching and dynamic mapping table updating.

[0176] Step 500 includes at least steps S510-S530:

[0177] S510, obtain the updated mapping table, perform quantum key distribution, and generate channel keys;

[0178] In this step S510, the update mapping table is taken as an input source, specifically, the update mapping table is imported into the quantum key distribution module. The module first collects the key demand information of all cloud nodes participating in the sharded storage in the current system, and the key demand information includes node identification, node security level, current key version and key update state. The quantum key distribution module determines the target node set that needs to distribute the key according to the latest sharding and node correspondence recorded in the update mapping table, and dynamically plans the quantum key distribution path combining the geographical position and network topology of the node. Specifically, the quantum key distribution module uses quantum key distribution (QKD) technology to realize the secure generation and transmission of keys through a quantum channel. The quantum channel uses the non-cloning property of quantum states and the irreversibility of measurement to prevent eavesdropping and tampering of the key during transmission. During the distribution process, the system prioritizes key refreshing for nodes whose keys are about to expire or have security risks, and the refreshing operation includes key resetting, key version switching and key synchronization confirmation. To ensure the real-time and continuity of key distribution, the module sets up a multi-level cache mechanism and a key update queue to support batch processing and asynchronous transmission of keys. The quantum key distribution module also monitors channel quality indicators such as bit error rate, packet loss rate and delay during the distribution process, and automatically triggers retransmission and channel reconstruction processes when abnormalities occur, and records abnormal events to the security log system. After completing the key distribution, the module generates a transmission channel key according to the distribution result, which combines quantum keys and traditional symmetric encryption keys through a key fusion algorithm, taking into account the security of the key and the performance requirements of the system. The transmission channel key contains a key version number, a key generation timestamp and an encryption algorithm identifier, which is used for subsequent security transmission protocol execution. The channel key is taken as an output field and transmitted to the "channel key" input end of the next step S520 for sharded integrity checking and transmission confirmation, and the channel key also provides key support for data recombination and decryption of the subsequent module S600.

[0179] S520, extract the verification factor from the channel key, perform sharded integrity checking, and generate a confirmation signal;

[0180] In this step S520, the channel key is taken as input, and specifically, it first enters a verification factor extraction unit which parses the verification factors from the channel key, including the key check code, timestamp signature and key version digest. The verification factor extraction unit combines system security policies and uses multiple verification mechanisms to detect the integrity and validity of the channel key. Specifically, the check code verification passes the high-strength algorithm in the Secure Hash Algorithm (SHA) series to generate a hash value by performing a security hash algorithm on the key content, and compares it with the check code in the key to confirm that the key has not been tampered with. The timestamp signature verification combines digital signature technology to verify the generation time and validity period of the key, preventing replay attacks and expired key use. The key version digest verification ensures that the current key version is consistent with the version number configured by the system, avoiding version conflicts. After verification, the fragment integrity verification module performs fragment integrity verification based on the verification factors combined with the integrity check code in the received secure fragment package. This verification process uses Message Authentication Code (MAC) technology to authenticate the fragment data with the channel key, ensuring that the fragment has not been tampered with or damaged during transmission. Specifically, the system first extracts the encrypted header information and check code in the secure fragment package, performs MAC calculation using the channel key, and compares it with the check code in the fragment package. If the verification fails, the system triggers an exception handling process, including fragment retransmission request, exception log recording and security alarm. After successful verification, the system generates a transmission confirmation signal, which contains the fragment identification, verification result, timestamp and confirmation status, supporting the confirmation mechanism of the transmission layer protocol. The confirmation signal is transmitted in an encrypted format to prevent malicious tampering or forgery. The system sends the transmission confirmation signal to the fragment sending end and records it in the transmission log system to form a complete transmission link record. The confirmation signal is taken as an output field and transmitted to the "confirmation signal" input end of the next step S530, which is used for log recording and storage voucher generation. At the same time, the confirmation signal also provides the transmission status basis for the node fault monitoring and recovery of the subsequent module S400.

[0181] S530, log recording of the confirmation signal and generation of storage vouchers

[0182] In this step S530, the confirmation signal is input, specifically, first into the log recording module, which receives the confirmation signal and combines the current system time, node identifier and transmission channel information to form a structured transmission log entry. The transmission log entry content includes shard identifier, confirmation status code, timestamp, node source and target information and abnormal event marker, supporting multi-dimensional query and security audit. The log recording module uses a distributed log management system to ensure the high availability and tamper resistance of log data, specifically through multiple copies of log data storage and encrypted storage. The module further analyzes the log data in real time to identify abnormal transmission behavior and potential security threats, and the abnormal events are marked and trigger the security alarm mechanism. After completing the log recording, the storage credential generation module generates a shard storage credential based on the confirmation signal and transmission log data, which contains shard unique identifier, storage node information, confirmation timestamp and transmission integrity flag. The storage credential is encrypted using digital signature technology to ensure the authenticity and non-repudiation of the storage credential. The storage credential serves as a credential for shard access and management in the distributed storage system, supporting subsequent shard positioning, access control and audit tracking. After the storage credential is generated, it is distributed to the data recombination decryption module S600 through the system message mechanism, specifically to the "storage credential" input end of S610, for the generation of shard collection instructions and the recovery of complete data stream. At the same time, the storage credential information is synchronized to the node state monitoring module S400 to assist the comprehensive evaluation of node health status and fault recovery decision. The storage credential as an output field completes the closed loop of this step processing link.

[0183] Step S600 includes at least steps S610-S630:

[0184] S610, obtain the storage credential, perform shard positioning retrieval, and generate collection instructions;

[0185] In this step S610, the storage credential is taken as input, specifically, the storage credential is accessed to the shard positioning retrieval module. The module first parses the shard unique identifier and the corresponding storage node information in the storage credential, and combines the system distributed index database to perform retrieval operation. Specifically, the shard positioning retrieval module quickly locates the physical storage location of the shard in the multi-node storage environment by accessing the distributed hash table (Distributed Hash Table, DHT) or similar index structure. During the retrieval process, the system checks the legality and timeliness of the access request according to the timestamp and access permission information in the storage credential. If it is found that the credential is expired or the permission is abnormal, the security audit process is triggered and the relevant log is recorded. Further, the module combines the latest node state table to filter out the storage nodes in fault or unavailable state, ensuring the effectiveness and real-time of the positioning result. The shard positioning retrieval module also supports multi-condition query, including node geographical location, storage load and network state, etc., to optimize the shard collection path. After the retrieval is completed, the system generates a shard collection instruction, which contains the target shard identifier, storage node address, access credential and expected response time, etc. The format of the shard collection instruction adopts a standardized protocol, supports cross-platform calling and asynchronous transmission, and is convenient for subsequent data block recombination processing. The shard collection instruction is taken as the output field and is transmitted to the "collection instruction" input end of the next step S620 for shard index extraction and data recombination processing. At the same time, the collection instruction also provides access basis for the node state monitoring of the subsequent module S400.

[0186] S620, extract shard index from collection instruction, perform data block recombination, and generate encrypted data packet;

[0187] In this step S620, the collection instruction is input, specifically, into the shard index extraction unit. According to the shard identifier in the collection instruction, the unit accesses the shard index structure database, extracts the corresponding shard index information, including the shard position index, shard state identifier and shard access permission information. During the extraction process, the system checks the integrity and consistency of the shard index, and if it finds that the index data is abnormal or missing, it triggers an exception handling mechanism, including a re-indexing request and an error log record. Subsequently, the data block reorganization module combines the shard data in the order of the shard sequence according to the shard index information. Specifically, the reorganization module calls the distributed storage system interface, and according to the storage node address and access credentials, asynchronously requests each shard data block. During data transmission, the module implements multi-threaded concurrent processing and data stream buffering to optimize data reception efficiency and network bandwidth utilization. To cope with network delays and node failures, the system sets a timeout retry mechanism and a backup node switching strategy to ensure the complete collection of shard data. During the data block reorganization process, the module performs boundary alignment and integrity checking on the received shard data, and combines the shard check code for data checking to eliminate damaged or tampered shards and initiate a compensatory request. After all the shard data is effectively received, the module recombines the encrypted data packet according to the original shard sequence, which contains the complete encrypted data stream segment and the corresponding metadata information. The structure of the encrypted data packet takes into account storage efficiency and subsequent decryption needs, supporting block decryption and random access. The encrypted data packet is output to the input of the next step S630, "encrypted data packet", for dynamic key decryption processing, and also provides data basis for the initial data verification of the module S100.

[0188] S630, decrypting the encrypted data packet with a dynamic key to generate a complete data stream;

[0189] In this step S630, the encrypted data packet is input, specifically, into the dynamic key decryption module. The module first extracts the current valid key corresponding to the encrypted data packet from the system configured dynamic key sequence, and the selection of the key is based on the encryption timestamp and key version information. Specifically, the dynamic key decryption module combines the verification rules in the key verification group to verify the validity and integrity of the selected key, ensuring that the key has not been tampered with or expired. Subsequently, the module performs key expansion and key scheduling operations according to the key scheduling algorithm to generate the key stream required for decryption. The decryption process uses the Advanced Encryption Standard (AES) symmetric decryption algorithm, which includes key scheduling, data grouping, inverse substitution, and inverse permutation steps, to ensure the correctness and security of the decrypted data. The module further implements a block decryption strategy to support block-by-block decryption of the fragments in the encrypted data packet, optimizing decryption efficiency and resource utilization. During the decryption process, the system performs real-time integrity verification on the decrypted data, combining Message Authentication Code (MAC) technology to detect data tampering and transmission errors. If an anomaly is detected, the module triggers an error recovery mechanism, including re-requesting fragments, switching to a backup key, and recording security logs. After completing dynamic key decryption of all fragments, the module recombines the decrypted data blocks in the original order to generate a complete data stream. The complete data stream contains all the contents of the original data and meets the initial data format and integrity requirements. The complete data stream is output to the initial data verification link of the main process starting step S100, used for subsequent data integrity verification and business processing, while supporting system security auditing and anomaly detection.

[0190] Embodiment Two Figure 2 A structural block diagram of a cloud computing-based big data security storage system according to an embodiment of the present application is shown. As shown in the figure, the structure can include: Figure 2

[0191] The key seed generation module 01 is used to obtain the fragment index and generate an initial key. Specifically, the input object fragment index is received from the fragment index structure, and under the constraint of the configured key generation algorithm, the summary analysis of the fragment identifier, timestamp, and fragment check code, dynamic element extraction, and multiple hash operations are completed to form a key seed; the key seed is recorded as a seed field and kept consistent with the association of the security parameters defined in the key management strategy configuration file; the seed field is passed to the dynamic key calculation module as an initial key, while retaining abnormal log records for subsequent fault tolerance processing.

[0192] ​The dynamic key calculation module 02 is configured to extract a timestamp parameter from an initial key and generate a dynamic key sequence. Specifically, the initial key and system clock information output from the key seed generation module are received, the timestamp parameter extraction, rotation period calculation and dynamic key generation are performed on the initial key, the dynamic key sequence is formed according to the key rotation strategy, the dynamic key sequence is transmitted to the hash check module as a key sequence field, and the corresponding time information is registered in the key update queue for reading by subsequent modules.

[0193] The hash check module 03 is configured to check the dynamic key sequence and generate a verification key group. Specifically, the key sequence field is received from the dynamic key calculation module, the high-strength algorithm in the secure hash algorithm family is combined to perform the hash check and the key verification structure generation, and the verification key group is generated when the check rule is met; the verification key group is called by the node distribution module as a verification key group, and the corresponding relationship between the distributed storage system and the security policy is recorded.

[0194] The node distribution module 04 is configured to match the shard index and the geographical position and generate a node distribution table. Specifically, the matching of the shard index and the node geographical position is completed based on the verification key group from the hash check module, and the node distribution table is generated; the node distribution table is output to the routing instruction generation module, and the effective state is returned to the state update module for registration.

[0195] The routing instruction generation module 05 is configured to extract the node ID and calculate the load balancing to generate the routing instruction. Specifically, the node distribution table from the node distribution module and the load information from other modules are received, the node ID extraction, load balancing calculation and routing instruction generation are performed, and the routing instruction is obtained; the routing instruction is provided to the encryption transmission module as a routing instruction field, and the index relationship consistent with the load balancing strategy is maintained.

[0196] The encryption transmission module 06 is configured to perform channel encryption on the routing instruction to generate a secure shard package. Specifically, the routing instruction field from the routing instruction generation module is received, the encryption processing is performed on the channel encryption strategy, and the secure shard package is formed; the secure shard package is returned to the starting related module for link refreshing, and the transmission state is updated.

Claims

1. A cloud computing-based big data security storage method, characterized in that, The application comprises the following steps: Obtaining an original data stream, performing AES encryption processing on the original data stream using a key provided by a dynamic key management module to obtain an encrypted data block; Based on data characteristics, the encrypted data block is cut into fragments to generate a fragment sequence, the data characteristics include a hash value and length information, and metadata labeling processing is performed to obtain a fragment index; the original data stream includes big data content to be stored; the AES encryption processing process includes key scheduling, data grouping, substitution and permutation; The dynamic key management module specifically includes key seed generation, rotation period calculation, dynamic key sequence generation and key verification structure generation; Based on the fragment index, an initial key is generated using a fragment identifier, a timestamp and a fragment check code through a key seed, a dynamic key sequence is generated based on timestamp parameter rotation period calculation, and a verification key group is generated by performing hash verification on the dynamic key sequence; Based on the verification key group and the fragment index, geographic location matching is performed through a geographic location weight matrix, load balancing calculation is performed based on a load balancing optimization function, and transmission channel encryption is performed using a quantum key distribution mechanism to obtain a secure fragment package; Obtaining the secure fragment package, performing node heartbeat monitoring to generate a node state table, performing redundancy detection and new node matching to obtain an update mapping table; Obtaining the update mapping table, generating a channel key using quantum key distribution technology, extracting a verification factor from the channel key for fragment integrity verification and log recording, and generating a storage credential; Based on the storage credential, perform fragment positioning retrieval, data block reorganization and dynamic key decryption to obtain a complete data stream.

2. The method of claim 1, wherein, The encrypted data block specifically includes: Extracting data characteristics from the encrypted data block, the data characteristics including the hash value, length information and data distribution characteristics of the data content, for guiding the reasonable division of the fragment cutting.

3. The method of claim 2, wherein, The process of extracting data characteristics specifically includes: Based on the data characteristics, perform a fragment cutting operation to divide the encrypted data block into multiple independent fragments according to a preset fragment strategy, the fragment strategy including fixed-size fragments and variable-length fragments based on content, the specific selection being determined according to data type and network transmission performance requirements; During the fragmenting process, boundary alignment and integrity checking are performed for each fragment to ensure the integrity and continuity of the fragment data, and each fragment can be independently stored and transmitted.

4. The method of claim 1, wherein, The process of performing metadata labeling processing to obtain the fragment index specifically includes: Performing a metadata labeling operation on each fragment in the fragment sequence; The metadata includes a fragment identifier, a timestamp, an identifier of the encrypted data block to which the fragment belongs, and a fragment check code; The check code is generated based on the fragment content through a hash algorithm and is used for subsequent data integrity verification; Associate the metadata with the fragment content to construct a fragment index structure; The fragment index includes a fragment position index, a fragment state identifier and fragment access permission information, supporting fast positioning and secure access.

5. The method of claim 1, wherein, The process of generating an initial key using a fragment identifier, a timestamp and a fragment check code through a key seed based on the fragment index specifically includes: According to the preset key generation algorithm, combined with the dynamic elements in the shard index, the timestamp and the shard check code, multiple hash operations and entropy collection are implemented to generate a key seed with high randomness and unpredictability; The key seed generation complies with the security parameters defined in the key management policy configuration file, including seed length, hash function type and entropy collection frequency.

6. The method of claim 1, wherein, The dynamic key sequence is generated based on the rotation period calculation of the timestamp parameter, which specifically includes: The timestamp parameter extraction unit adopts a time synchronization mechanism, combined with the system clock and the network time protocol service, so that the extracted timestamp has high precision and consistency; Based on the timestamp and the system configured key rotation strategy, the effective period of the current key and the trigger time point of the next key update are calculated; The rotation period calculation adopts a dynamic adjustment mechanism, which dynamically adjusts the key rotation frequency according to system load, node state and security event feedback, to balance the key security and system performance.

7. The method of claim 1, wherein, The verification key group is generated by performing hash check on the dynamic key sequence, which specifically includes: Performing hash algorithm processing on each key version in the dynamic key sequence to generate the corresponding hash check code; The hash algorithm adopts a high-strength algorithm in the secure hash algorithm family, which combines the key version number and the timestamp information to realize the uniqueness and collision resistance of the check code; The hash check code is associated with the dynamic key sequence to build the verification key group.

8. The method of claim 1, wherein, The expression of generating the verification key group includes: Building a key seed generation function: ； wherein, is a calculated initial key; is a total number of shards in a shard index; is a shard index number; represents a probability of uniqueness of a shard identifier; is a shard identifier; is a timestamp value; is a shard check code; is a logarithm base adjustment factor; is an exclusive OR operation; is a logarithm operation; is a probability of a value resulting from an exclusive OR of a timestamp and a check code; Building a dynamic key evolution function: ； wherein, is a computed dynamic key sequence; is a key sequence number; is an AES encryption algorithm for 256-bit keys; is a byte concatenation operation; is a timestamp gradient; is a decoded timestamp parameter from the initial key; is a decay coefficient; is a reference rotation period; Performing hash chain check: ； wherein, is a computed hash verification value; is an SHA-3 hash algorithm with an output length of 512 bits; is a hash check sequence number; is an exclusive OR operation; is a previous hash value.

9. The method of claim 1, wherein, The expression of obtaining a secure shard package includes: Establishing a geographic location weight matrix: ； wherein, is a calculated geographic location weight matrix; is a candidate node serial number; is a sharding security level number; represents the geographic distance between the node and the data source; is the physical location coordinates of the candidate node; is the geographic location coordinates of the sharding data source; is a distance decay index; is a node security level coefficient; Building a load balancing optimization function: ； wherein, is a mathematical minimum function; is the current shard load of the node; is the maximum capacity of the node; is the bandwidth change rate of the node; is the maximum theoretical bandwidth of the node; is the bandwidth weight factor; p is the total number of available nodes; Encrypting the routing instruction using a quantum key distribution mechanism: ； wherein, is an encrypted security fragment package; is a quantum channel number; is a polarization angle parameter of the quantum channel; is a CHSH inequality quantum correlation degree function; is a random orthogonal transformation operation; : is a dynamic key sequence; is a routing instruction cyclic redundancy check code; is a routing instruction plaintext to be encrypted.

10. A cloud computing-based big data security storage system applied to the method of any one of claims 1-9, characterized in that, It includes: The key seed generation module is used to obtain the shard index and generate an initial key; The dynamic key calculation module is used to extract the timestamp parameter from the initial key and generate a dynamic key sequence; The hash check module is used to check the dynamic key sequence and generate a verification key group; The node allocation module is used to match the shard index with the geographic location and generate a node allocation table; The routing instruction generation module is used to extract the node ID and calculate the load balancing to generate the routing instruction; The encrypted transmission module is used to encrypt the routing instruction in the channel to generate a secure shard package.

Images