Data storage method and device, electronic equipment and program product

Abstract

The invention discloses a data storage method and device, electronic equipment and a program product, and relates to the field of financial science and technology, and the data storage method comprises the steps: generating a message body based on incremental data when it is monitored that the incremental data exists in a file in a preset position, and transmitting the message body to a distributed message queue; determining a verification hash value of the data block, and verifying the hash value in the distributed message queue based on the verification hash value to obtain a verification result; under the condition that the verification result indicates that the hash value carried by the message body is the same as the verification hash value, decrypting the data block by using the key to obtain decrypted data; and processing the decrypted data to obtain structured data, and generating a hash chain based on the structured data so as to store the structured data by adopting the hash chain. According to the method and the device, the technical problem that data cannot be safely stored locally in the server in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and more specifically, to a data storage method and apparatus, electronic device, and program product. Background Technology

[0002] To meet compliance audit requirements (such as information security level protection, internal and external audits, etc.) and security incident tracing requirements, data center servers need to store operation logs containing sensitive information for extended periods (e.g., SSH (Secure Shell, a network protocol) login / command execution records, user account creation / modification records, critical file modification records, privileged command execution, etc.). However, with logs scattered across various servers, unified security analysis, threat hunting, and audit queries are difficult to perform, and the data value cannot be fully exploited. Furthermore, the lack of effective protection mechanisms (such as strong access control and encrypted storage) means that if a single server is compromised (privilege escalation, malware), the stored logs are highly susceptible to theft or tampering.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a data storage method, apparatus, electronic device, and program product to at least solve the technical problem in the related art of being unable to securely store data locally on a server.

[0005] According to one aspect of the embodiments of this application, a data storage method is provided, comprising: when incremental data is detected in a file at a preset location, generating a message body based on the incremental data and transmitting the message body to a distributed message queue, wherein the message body carries a data block and a hash value; determining a verification hash value of the data block, and verifying the hash value in the distributed message queue based on the verification hash value to obtain a verification result; if the verification result indicates that the hash value carried by the message body is the same as the verification hash value, decrypting the data block using a key to obtain decrypted data; processing the decrypted data to obtain structured data, and generating a hash chain based on the structured data to store the structured data using the hash chain, wherein the hash chain is used for tamper-proof storage of the structured data.

[0006] Furthermore, before generating the message body based on incremental data, the process also includes: configuring the server's environment variables; executing operation commands based on the environment variables; and, upon completion of the operation command execution, obtaining operation execution information and storing the operation execution information in a file at a preset location.

[0007] Furthermore, after storing the operation execution information in a file in a preset location, the method also includes: cleaning up the file content of the files in the preset location based on a preset time frequency; and configuring access permissions for all files in the preset location.

[0008] Furthermore, the step of generating a message body based on incremental data includes: encrypting the incremental data to obtain a data block and calculating the hash value of the data block; encapsulating the data block and the hash value to generate a message body.

[0009] Furthermore, the step of generating a hash chain based on structured data includes: calculating the current hash value of the structured data and concatenating the current hash value with a preset hash value to obtain concatenated data; calculating the concatenated hash value of the concatenated data and using the concatenated hash value as the target hash value of the structured data; and generating a hash chain based on all target hash values.

[0010] Furthermore, after generating a hash chain based on structured data, the process also includes: upon detecting that a preset user is accessing data using preset credentials, generating response data based on the preset credentials and generating alarm information of a preset level, wherein the alarm information includes at least: access information of the preset user; and sending the access information to a target terminal, wherein the target terminal is a terminal used by operations and maintenance personnel, who analyze the access information through the target terminal and generate a data storage strategy to prevent data from being tampered with.

[0011] Furthermore, before generating response data based on preset credentials, the process includes: analyzing the credential information of multiple users, wherein the credential information is used to verify the user's identity when the user accesses data; and generating preset credentials based on all credential information.

[0012] According to another aspect of the embodiments of this application, a data storage device is also provided, applied to a data information protection system, comprising: a generation unit, configured to generate a message body based on incremental data when incremental data is detected in a file at a preset location, and transmit the message body to a distributed message queue, wherein the message body carries a data block and a hash value; a determination unit, configured to determine the verification hash value of the data block, and verify the hash value in the distributed message queue based on the verification hash value to obtain a verification result; a decryption unit, configured to decrypt the data block using a key when the verification result indicates that the hash value carried in the message body is the same as the verification hash value, to obtain decrypted data; and a processing unit, configured to process the decrypted data to obtain structured data, and generate a hash chain based on the structured data to store the structured data using the hash chain, wherein the hash chain is used for tamper-proof storage of the structured data.

[0013] Furthermore, the data storage device also includes: a first configuration module, used to configure the server's environment variables before generating the message body based on incremental data; and a first acquisition module, used to execute operation commands based on the environment variables, and, upon completion of the operation command execution, acquire operation execution information and store the operation execution information in a file at a preset location.

[0014] Furthermore, the data storage device also includes: a first cleaning module, used to clean the file content of the file in the preset location based on a preset time frequency after storing the operation execution information to the file in the preset location; and a second configuration module, used to configure the access permissions of all files in the preset location.

[0015] Furthermore, the generation unit includes: a first encryption module for encrypting incremental data to obtain data blocks and calculating the hash value of the data blocks; and a first encapsulation module for encapsulating the data blocks and hash values ​​to generate a message body.

[0016] Furthermore, the processing unit includes: a first concatenation module, used to calculate the current hash value of the structured data and concatenate the current hash value with a preset hash value to obtain concatenated data; a first calculation module, used to calculate the concatenated hash value of the concatenated data and use the concatenated hash value as the target hash value of the structured data; and a first generation module, used to generate a hash chain based on all target hash values.

[0017] Furthermore, the data storage device also includes: a second generation module, used to generate response data based on the preset credentials after generating a hash chain based on structured data, and to generate alarm information of a preset level based on the preset credentials when it is detected that a preset user is accessing data using preset credentials, wherein the alarm information includes at least: access information of the preset user; and a first sending module, used to send the access information to a target terminal, wherein the target terminal is a terminal used by operation and maintenance personnel, and the operation and maintenance personnel analyze the access information through the target terminal to generate a data storage strategy, the data storage strategy being used to prevent data from being tampered with.

[0018] Furthermore, the data storage device also includes: a first analysis module, used to analyze the credential information of multiple users before generating response data based on preset credentials, wherein the credential information is used to verify the identity of users when they access data; and a third generation module, used to generate preset credentials based on all credential information.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, which implements any of the above data storage methods when executed by a processor.

[0020] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any of the above data storage methods.

[0021] In this invention, when incremental data is detected in a file at a preset location, a message body is generated based on the incremental data and transmitted to a distributed message queue. The verification hash value of the data block is determined, and the hash value in the distributed message queue is verified based on the verification hash value to obtain a verification result. If the verification result indicates that the hash value carried by the message body is the same as the verification hash value, the data block is decrypted using a key to obtain the decrypted data. The decrypted data is processed to obtain structured data, and a hash chain is generated based on the structured data to store the structured data. This solves the technical problem in related technologies that data cannot be securely stored locally on the server.

[0022] In this invention, by monitoring files at preset locations in real time, once incremental data is detected, a message body carrying data blocks and hash values ​​can be generated based on the incremental data and securely pushed to a distributed message queue to ensure data continuity and integrity. After receiving the message body from the message queue, the data center first calculates the verification hash value of the data block, compares the hash value in the message body with the calculated verification hash value, and obtains the verification result. If it is confirmed that the hash value carried in the message body is exactly the same as the verification hash value, the data block can be decrypted to obtain the original decrypted data. Then, the decrypted data is standardized and converted into structured data. Based on the structured data, a blockchain-style hash chain can be generated and stored in an immutable hash chain manner, comprehensively improving the security level of data center server information. Even if the data is attacked, the hash chain can quickly identify tampering points and maintain the originality and authenticity of the data. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data storage method is shown;

[0025] Figure 2 This is a flowchart of a data storage method according to Embodiment 1 of this application;

[0026] Figure 3This is a schematic diagram of an optional data protection system structure according to an embodiment of this application;

[0027] Figure 4 This is a flowchart of an optional data protection method according to an embodiment of this application;

[0028] Figure 5 This is a schematic diagram of an optional data storage device according to an embodiment of this application;

[0029] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and it does not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0033] In this invention, a lightweight distributed monitoring agent deployed on the server can capture incremental changes in information in real time. After lightweight preprocessing, it is transmitted in a peak-shaving manner using a high-throughput, scalable distributed message middleware. The data is finally aggregated to a physically isolated, high-security data center for centralized processing, storage, and protection. This environment uses strong encrypted storage and blockchain-based hash chain technology to ensure data immutability. A dynamic trapping defense mechanism is deployed to detect and respond to unauthorized access in real time, which can achieve data tamper prevention and ensure data integrity. It can detect, trap, and alarm unauthorized access attempts against stored data in real time.

[0034] The present invention will now be described in detail with reference to various embodiments.

[0035] Example 1

[0036] According to an embodiment of this application, an embodiment of a data storage method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data storage method is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0038] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data storage method in the embodiments of this application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned data storage method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0040] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0041] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0042] Under the aforementioned operating environment, this application provides the following: Figure 2 The data storage method shown. Figure 2 This is a flowchart of the data storage method according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:

[0043] Step S201: If incremental data is detected in a file at a preset location, a message body is generated based on the incremental data and transmitted to a distributed message queue. The message body carries a data block and a hash value.

[0044] In this embodiment of the invention, real-time monitoring is performed on file changes in a preset location, such as a temporary circular buffer file (e.g., / var / log / secure_ops.log) that is only allowed to be written to by specific system accounts (such as root or a dedicated collection account). When incremental data (i.e., newly added or modified data in the file) is detected in the preset location, the incremental data is collected, and the cryptographic strong hash value of the incremental data is calculated in real time as the unique fingerprint of the data block. The data block and its hash value can be encapsulated into a message body and pushed to a highly available distributed message queue through a two-way authenticated TLS (Transport Layer Security, an encryption protocol) connection. The distributed message queue allows multiple producers to send messages to multiple consumer application components, ensuring that messages can be delivered in an orderly, efficient, and reliable manner between producers and consumers, maintaining message integrity and delivery reliability even in the event of network congestion or system failure.

[0045] Step S202: Determine the verification hash value of the data block, and verify the hash value in the distributed message queue based on the verification hash value to obtain the verification result.

[0046] In this embodiment of the invention, by consuming data (including data blocks and hash values) from the message queue, the verification hash value of the data block is calculated, and the hash value in the distributed message queue can be verified based on the verification hash value (that is, whether the hash value carried in the message body is consistent with the hash value calculated from the data block carried in the message body), thus determining the integrity and tamper-proof status of the data block and obtaining the verification result.

[0047] Step S203: If the hash value carried in the verification result indication message body is the same as the verification hash value, the data block is decrypted using the key to obtain the decrypted data.

[0048] In this embodiment of the invention, if the verification result indicates that the hash value carried in the message body is different from the verification hash value, the data block is considered untrusted, may have been tampered with, and can be marked as abnormal, triggering the corresponding security response mechanism. If the two hash values ​​are the same, the data block passes verification. This data block is obtained by encrypting incremental data, and can be decrypted using a key to obtain the decrypted data.

[0049] Step S204: Process the decrypted data to obtain structured data, and generate a hash chain based on the structured data to store the structured data. The hash chain is used to store the structured data in a tamper-proof manner.

[0050] In this embodiment of the invention, the decrypted data is parsed, standardized (e.g., unified timestamp format, parsed geographic location), associated (associated with user ID (Identifier) ​​and name), and tagged to obtain structured data. This structured data can then be stored in a high-performance, highly reliable distributed Elasticsearch cluster for search and analysis. Furthermore, a hash chain can be generated based on the structured data to store it, providing proof of data integrity and historical authenticity, preventing data tampering.

[0051] In summary, by monitoring incremental data in files at preset locations and generating a message body with a strong hash value based on this incremental data, data integrity is ensured and the data can be securely transmitted in a distributed message queue. Then, by verifying the hash value carried in the message body, the data is decrypted using a key provided by the central key management system to obtain structured data. Subsequently, a hash chain can be generated based on the structured data, which can prevent data tampering and improve the security of information on data center servers. This solves the technical problem of not being able to securely store data locally on the server in related technologies.

[0052] To achieve file redirection and local protection, the data storage method provided in Embodiment 1 of this application configures the server's environment variables; based on the environment variables, an operation command is executed, and upon completion of the operation command execution, operation execution information is obtained and stored in a file at a preset location.

[0053] In this embodiment of the invention, by setting the server's environment variable PROMPT_COMMAND, when a user performs any operation on the server via command line, such as creating a user account, modifying critical files, or running privileged commands, the corresponding operation information can be automatically recorded. Furthermore, upon completion of the operation command, operation execution information (such as command, execution time, username, execution directory, and other metadata) can be obtained and appended to a file in a preset location, such as / var / log / secure_ops.log. This file is configured to only allow specific system accounts (such as the root account or a dedicated data collection account) to write to, ensuring the security and privacy of the information.

[0054] To improve the security of data storage, in the data storage method provided in Embodiment 1 of this application, the file content of files in a preset location is cleaned up based on a preset time frequency; and access permissions for all files in the preset location are configured.

[0055] In this embodiment of the invention, a period (i.e., a preset time frequency) can be set according to security policies and operational needs to periodically clean up old data in files, ensuring the timeliness and security of file content in preset locations. Strict file permissions can be set to ensure that only authorized processes and specific administrators can read the files, thereby preventing unauthorized access and potential data leaks, and enhancing the physical security and data timeliness of data center server information protection. By periodically cleaning up expired information in operation logs, not only is the risk of long-term information storage reduced, but the pressure on local storage is also reduced. Simultaneously, by strictly controlling file access permissions, unauthorized access and data leaks are effectively prevented, ensuring the security of information during local storage.

[0056] In order to accurately generate the message body, in the data storage method provided in Embodiment 1 of this application, the incremental data is encrypted to obtain a data block, and the hash value of the data block is calculated; the data block and the hash value are encapsulated to generate the message body.

[0057] In this embodiment of the invention, incremental data is encrypted to obtain a data block. A cryptographic hash function is then used to calculate a fixed-length string (i.e., a hash value). The data block and its corresponding hash value are then encapsulated to generate a structured message body. By encrypting incremental data and encapsulating it together with the hash value of the data block into a message body, encrypted protection and integrity verification of data transmission are achieved, ensuring the security and tamper-proof nature of information during transmission.

[0058] To ensure the integrity and reliability of information during the storage phase, the data storage method provided in Embodiment 1 of this application calculates the current hash value of the structured data and concatenates the current hash value with a preset hash value to obtain concatenated data; calculates the concatenated hash value of the concatenated data and uses the concatenated hash value as the target hash value of the structured data; and generates a hash chain based on all target hash values.

[0059] In this embodiment of the invention, the current hash value of the structured data is calculated, and then concatenated with a preset hash value (i.e., the hash value of the previous data block, or the hash value of the current end of the hash chain) to obtain concatenated data. The concatenated hash value can be calculated and used as the target hash value of the structured data. Based on all target hash values ​​of all stored data blocks, a continuous, cryptographically associated hash chain can be generated. Furthermore, the end hash value of each newly generated hash chain can be anchored to a publicly verifiable source of trust. Any tampering with historical data will cause all subsequent hash values ​​to mismatch, and the anchor point can prove the time of the tampering. For example, if the current hash value is abc123, according to the hash chain construction rules, this current hash value can be concatenated with the previous target hash value xyz789 (i.e., the preset hash value) in the hash chain, such as abc123xyz789. Then, the concatenated data is hashed, and the output is 123abc. This output can be used as the target hash value of this structured data and added to the hash chain, becoming the preset hash value when concatenating the next piece of structured data.

[0060] To provide real-time alarm information to operations and maintenance personnel, in the data storage method provided in Embodiment 1 of this application, when it is detected that a preset user is accessing data using preset credentials, response data is generated based on the preset credentials, and alarm information of a preset level is generated. The alarm information includes at least: access information of the preset user; the access information is sent to a target terminal, wherein the target terminal is a terminal used by operations and maintenance personnel. Through the target terminal, operations and maintenance personnel analyze the access information and generate a data storage strategy. The data storage strategy is used to prevent data from being tampered with.

[0061] In this embodiment of the invention, when a pre-defined user (i.e., a user account attempting to access sensitive data using inducement credentials) is detected using pre-defined credentials (dynamically generated inducement credentials used only for security testing and unauthorized access detection) to access data, false response data is dynamically generated to deceive attackers without revealing the real data. A pre-defined high-priority alarm message can also be generated, triggered immediately upon detection of an attempt to use the pre-defined credentials, including the pre-defined user's access information, for rapid response. The access information can be sent to the target terminal used by operations and maintenance personnel. Through the target terminal, operations and maintenance personnel analyze the access information and generate data storage strategies, such as optimizing data storage methods to prevent data tampering. This not only traps attackers by generating response data but also immediately triggers high-priority alarm messages, ensuring operations and maintenance personnel can take swift action. By analyzing access information to formulate or update data storage strategies, the anti-tampering capability of data is further enhanced. By combining proactive defense with passive monitoring, unauthorized access attempts can be blocked immediately, and the data protection system can be continuously optimized through in-depth analysis and strategy adjustments by operations and maintenance personnel, effectively improving the overall security level of the data center.

[0062] In order to accurately generate preset credentials, the data storage method provided in Embodiment 1 of this application analyzes the credential information of multiple users, wherein the credential information is used to verify the identity of users when they access data; and a preset credential is generated based on all the credential information.

[0063] In this embodiment of the invention, by analyzing the credential information of multiple users in the data center server, including login credentials, access tokens, etc., the credential usage under normal data access mode is obtained. Based on all credential information, the usage patterns and characteristics of credentials are identified, such as common username prefixes, password strength distribution, and access token expiration time, thereby generating preset credentials. The generation of preset credentials simulates the behavior patterns of normal users, setting a trap for attackers. Once triggered, potential threats can be quickly located and dealt with, while increasing the complexity of the system and raising the cost of attack.

[0064] Figure 3 This is a schematic diagram of an optional data protection system structure according to an embodiment of this application, such as... Figure 3As shown, the data protection system structure includes the D001 information redirection and local protection module, the D002 information monitoring, acquisition and transmission module, the D003 centralized data processing and analysis module, and the D004 data protection and proactive defense module. The D003 centralized data processing and analysis module and the D004 data protection and proactive defense module are located in a high-security data center. The D001 information redirection and local protection module is responsible for redirecting discrete user information and other metadata from the server to a designated location (i.e., a specified local file). Simultaneously, it sets access permissions for the specified file to prohibit unauthorized access, thus achieving local protection. For ground protection, the D002 information monitoring, acquisition, and transmission module performs information acquisition tasks. It is responsible for monitoring changes in specified files on the server, encrypting incremental data to obtain hash values, encapsulating the hash values, and pushing them to a distributed message queue. The D003 centralized data processing and analysis module is responsible for consuming data from the D002 module and performing data mining and analysis based on the collected data (including verification, decryption, processing, and generating hash chain storage). The D004 data protection and proactive defense module is responsible for anti-tampering processing and dynamic trapping protection. If data is accessed without authorization, it will promptly report to the protection center to notify relevant personnel.

[0065] Figure 4 This is a flowchart of an optional data protection method according to an embodiment of this application, such as... Figure 4As shown, the process includes nine steps. In step S001, the D001 information redirection and local protection module redirects discrete user operation records to a specified local location after completing the necessary elements by setting the PROMPT_COMMAND (i.e., environment variable) redirection information. This is done in conjunction with a scheduled task to periodically clean up file content. In step S002, the D001 information redirection and local protection module controls file access permissions and sets password encryption, ensuring that only authorized users possess the access password. In step S003, the D002 information monitoring, acquisition, and transmission module executes a log acquisition task, generating hash values ​​from incremental data in local server files in real time, writing them into the message header, and transmitting them to the D003 centralized data processing and analysis module via a distributed message queue. In step S004, the D003 centralized data processing and analysis module, located in an encrypted data center physically isolated from the local server, consumes messages from the distributed message queue. In step S005, the D003 centralized data processing and analysis module verifies the hash value of the message header. In step S006, when the hash value verification passes, the D003 centralized data processing and analysis module decrypts the data blocks in the message and standardizes the decrypted data to obtain structured data. In step S007, the processed structured data is stored in a distributed cluster. In step S008, the D004 data protection and proactive defense module generates a blockchain-style hash chain after data storage to prevent data tampering. In step S009, an inducement protection mechanism is set; if the inducement password is matched, forged data is returned and the protection center is notified.

[0066] The data storage method provided in this application can capture data and store it in a file at a preset location by configuring server environment variables. Simultaneously, it monitors data changes in the file at the preset location, encrypts incremental data to obtain data blocks, calculates the hash value of the data blocks, encapsulates the data blocks and hash values ​​to generate a message body, and dynamically generates an immutable blockchain-style hash chain based on the data blocks and hash values ​​carried in the message body. This ensures data integrity and trustworthiness. Furthermore, a dynamic "honeypot" trapping mechanism can be used to immediately generate false response data and trigger a high-priority alarm upon detecting illegal use of preset credentials, notifying maintenance personnel for in-depth analysis. This allows for dynamic adjustment of data storage strategies, effectively preventing data tampering. Through multi-layered security measures, efficient encrypted collection, transmission, storage, and proactive defense of information are achieved, improving data center security and reducing the risk of information leakage.

[0067] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0068] Example 2

[0069] This application also provides a data storage device. It should be noted that the data storage device of this application can be used to execute the data storage method provided in this application. The data storage device provided in this application is described below.

[0070] According to an embodiment of this application, an apparatus for implementing the above-described data storage method is also provided. Figure 5 This is a schematic diagram of an optional data storage device according to an embodiment of this application, such as... Figure 5 As shown, the data storage device may include: a generation unit 50, a determination unit 51, a decryption unit 52, and a processing unit 53.

[0071] The generation unit 50 is used to generate a message body based on the incremental data when incremental data is detected in a file at a preset location, and transmit the message body to a distributed message queue. The message body carries a data block and a hash value.

[0072] The determining unit 51 is used to determine the verification hash value of the data block, and based on the verification hash value, to verify the hash value in the distributed message queue and obtain the verification result;

[0073] The decryption unit 52 is used to decrypt the data block using a key when the hash value carried in the verification result indication message body is the same as the verification hash value, so as to obtain the decrypted data.

[0074] The processing unit 53 is used to process the decrypted data to obtain structured data, and generate a hash chain based on the structured data to store the structured data. The hash chain is used to store the structured data in a tamper-proof manner.

[0075] The data storage device provided in this application embodiment can generate a message body based on the incremental data when the generation unit 50 detects incremental data in a file at a preset location, and transmit the message body to a distributed message queue. The determination unit 51 can determine the verification hash value of the data block, and verify the hash value in the distributed message queue based on the verification hash value to obtain the verification result. The decryption unit 52 can decrypt the data block using a key when the verification result indicates that the hash value carried in the message body is the same as the verification hash value to obtain the decrypted data. The processing unit 53 can process the decrypted data to obtain structured data, and generate a hash chain based on the structured data to store the structured data using the hash chain.

[0076] Optionally, the data storage device further includes: a first configuration module, used to configure the server's environment variables before generating the message body based on incremental data; and a first acquisition module, used to execute operation commands based on the environment variables, and, upon completion of the operation command execution, acquire operation execution information and store the operation execution information in a file at a preset location.

[0077] Optionally, the data storage device further includes: a first cleaning module, used to clean the file content of the file in the preset location based on a preset time frequency after storing the operation execution information to the file in the preset location; and a second configuration module, used to configure the access permissions of all files in the preset location.

[0078] Optionally, the generation unit 50 includes: a first encryption module for encrypting incremental data to obtain a data block and calculating the hash value of the data block; and a first encapsulation module for encapsulating the data block and the hash value to generate a message body.

[0079] Optionally, the processing unit 53 includes: a first concatenation module, used to calculate the current hash value of the structured data and concatenate the current hash value with a preset hash value to obtain concatenated data; a first calculation module, used to calculate the concatenated hash value of the concatenated data and use the concatenated hash value as the target hash value of the structured data; and a first generation module, used to generate a hash chain based on all target hash values.

[0080] Optionally, the data storage device further includes: a second generation module, configured to generate response data based on the preset credentials after generating a hash chain based on structured data, and generate alarm information of a preset level when it is detected that a preset user is accessing data using preset credentials, wherein the alarm information includes at least: access information of the preset user; and a first sending module, configured to send the access information to a target terminal, wherein the target terminal is a terminal used by operation and maintenance personnel, and the operation and maintenance personnel analyze the access information through the target terminal to generate a data storage strategy, the data storage strategy being used to prevent data from being tampered with.

[0081] Optionally, the data storage device further includes: a first analysis module, used to analyze the credential information of multiple users before generating response data based on preset credentials, wherein the credential information is used to verify the identity of users when they access data; and a third generation module, used to generate preset credentials based on all credential information.

[0082] The aforementioned data storage device may also include a processor and a memory. The aforementioned generation unit 50, determination unit 51, decryption unit 52, processing unit 53, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0083] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, the decrypted data is processed to obtain structured data. Based on this structured data, a hash chain is generated for storing the structured data. The hash chain is used to prevent tampering with the structured data.

[0084] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0085] It should be noted that the generation unit 50, determination unit 51, decryption unit 52, and processing unit 53 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0086] Example 3

[0087] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0088] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0089] In this embodiment, the computer terminal described above can execute the program code for the following steps in the data storage method: When incremental data is detected in a file at a preset location, a message body is generated based on the incremental data, and the message body is transmitted to a distributed message queue, wherein the message body carries a data block and a hash value; the verification hash value of the data block is determined, and the hash value in the distributed message queue is verified based on the verification hash value to obtain a verification result; if the verification result indicates that the hash value carried by the message body is the same as the verification hash value, the data block is decrypted using a key to obtain decrypted data; the decrypted data is processed to obtain structured data, and a hash chain is generated based on the structured data to store the structured data, wherein the hash chain is used for tamper-proof storage of the structured data.

[0090] Optionally, the computer terminal described above can execute the program code for the following steps in the data storage method: configuring the server's environment variables; executing operation commands based on the environment variables; and, upon completion of the operation command execution, obtaining operation execution information and storing the operation execution information in a file at a preset location.

[0091] Optionally, the computer terminal described above can execute program code for the following steps in the data storage method: cleaning up the file content of files in a preset location based on a preset time frequency; configuring access permissions for all files in the preset location.

[0092] Optionally, the computer terminal described above can execute program code for the following steps in the data storage method: encrypting incremental data to obtain data blocks and calculating the hash value of the data blocks; encapsulating the data blocks and hash values ​​to generate a message body.

[0093] Optionally, the aforementioned computer terminal may execute program code for the following steps in the data storage method: calculating the current hash value of the structured data, and concatenating the current hash value with a preset hash value to obtain concatenated data; calculating the concatenated hash value of the concatenated data, and using the concatenated hash value as the target hash value of the structured data; and generating a hash chain based on all target hash values.

[0094] Optionally, the aforementioned computer terminal may execute the program code for the following steps in the data storage method: upon detecting that a preset user is accessing data using preset credentials, generating response data based on the preset credentials and generating alarm information of a preset level, wherein the alarm information includes at least: access information of the preset user; sending the access information to a target terminal, wherein the target terminal is a terminal used by maintenance personnel, and the maintenance personnel analyze the access information through the target terminal to generate a data storage strategy, the data storage strategy being used to prevent data from being tampered with.

[0095] Optionally, the aforementioned computer terminal may execute program code for the following steps in the data storage method: analyzing the credential information of multiple users, wherein the credential information is used to verify the user's identity when the user accesses data; and generating a preset credential based on all the credential information.

[0096] Optionally, Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) Processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0097] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the data storage method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned data storage method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0098] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the data storage method.

[0099] The embodiments of this application provide a data storage solution. By redirecting and encrypting operation logs locally, and collecting and transmitting encrypted incremental data to a physically isolated center in real time, secure data accumulation can be achieved on the server. Blockchain-based hash chain technology is used to ensure the tamper-proof and integrity of data storage. At the same time, a dynamic trapping mechanism is set up to detect and respond to illegal access attempts in real time. This achieves efficient encrypted collection, secure transmission and tamper-proof storage of information, thereby solving the technical problem in related technologies that it is impossible to securely store data on the server.

[0100] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0101] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0102] Example 4

[0103] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data storage method provided in Embodiment 1.

[0104] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0105] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing data storage method steps.

[0106] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0107] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0108] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0111] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0112] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data storage method, characterized in that, Applications in data information protection systems include: If incremental data is detected in a file at a preset location, a message body is generated based on the incremental data and transmitted to a distributed message queue. The message body carries a data block and a hash value. Determine the verification hash value of the data block, and verify the hash value in the distributed message queue based on the verification hash value to obtain the verification result; If the verification result indicates that the hash value carried in the message body is the same as the verification hash value, the data block is decrypted using the key to obtain the decrypted data; The decrypted data is processed to obtain structured data, and a hash chain is generated based on the structured data to store the structured data. The hash chain is used to store the structured data in a tamper-proof manner.

2. The data storage method according to claim 1, characterized in that, Before generating the message body based on the incremental data, the process also includes: Configure the server's environment variables; Based on the environment variables, an operation command is executed, and upon completion of the operation command, operation execution information is obtained and stored in the file at the preset location.

3. The data storage method according to claim 2, characterized in that, After storing the operation execution information in the file at the preset location, the method further includes: Based on a preset time frequency, clean up the file content of the files in the preset location; Configure access permissions for all files in the preset location.

4. The data storage method according to claim 1, characterized in that, The step of generating a message body based on the incremental data includes: The incremental data is encrypted to obtain the data block, and the hash value of the data block is calculated. The data block and the hash value are encapsulated to generate the message body.

5. The data storage method according to claim 1, characterized in that, The step of generating a hash chain based on the structured data includes: Calculate the current hash value of the structured data, and concatenate the current hash value with a preset hash value to obtain concatenated data; Calculate the concatenation hash value of the concatenated data, and use the concatenation hash value as the target hash value of the structured data; The hash chain is generated based on all the target hash values.

6. The data storage method according to claim 1, characterized in that, After generating the hash chain based on the structured data, the process also includes: If a preset user is detected accessing data using a preset credential, response data is generated based on the preset credential, and an alarm message of a preset level is generated, wherein the alarm message includes at least: the access information of the preset user; The access information is sent to the target terminal, which is a terminal used by the operation and maintenance personnel. The operation and maintenance personnel analyze the access information through the target terminal and generate a data storage strategy to prevent data from being tampered with.

7. The data storage method according to claim 6, characterized in that, Before generating response data based on the preset credentials, the process also includes: Analyze the credentials information of multiple users, wherein the credentials information is used to verify the identity of the user when the user accesses data; Based on all the aforementioned voucher information, the preset voucher is generated.

8. A data storage device, characterized in that, Applications in data information protection systems include: The generation unit is used to generate a message body based on the incremental data when incremental data is detected in a file at a preset location, and to transmit the message body to a distributed message queue, wherein the message body carries a data block and a hash value; A determining unit is configured to determine the verification hash value of the data block, and based on the verification hash value, verify the hash value in the distributed message queue to obtain a verification result; The decryption unit is configured to decrypt the data block using a key when the verification result indicates that the hash value carried by the message body is the same as the verification hash value, thereby obtaining the decrypted data; The processing unit is used to process the decrypted data to obtain structured data, and generate a hash chain based on the structured data to store the structured data, wherein the hash chain is used to store the structured data in a tamper-proof manner.

9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the data storage method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the data storage method according to any one of claims 1 to 7.

Images