Internet data center information security management method and system

Abstract

The invention relates to the technical field of data management, and discloses an Internet data center information security management method and system, and the method comprises data in-storage management, data storage management and data out-storage management. The system corresponds to the method. According to the information security management method and system for the Internet data center, closed-loop management of data receiving-data storage and data distribution of the data center is realized through data in-storage management, data storage management and data out-storage management, and in the data storage, the stored data is modulated and encrypted, so that the security of the data center is improved. Therefore, the data stored in the data center is stored in an encrypted form, so that the corresponding dangerous source cannot directly obtain the corresponding data even if network security vulnerabilities occur, and the security of data storage is ensured.

Description

Technical Field

[0001] This application relates to the field of data management technology, specifically an information security management method and system for Internet data centers. Background Technology

[0002] The internet generates massive amounts of data, necessitating the storage and management of core data. A crucial function of data centers is data storage. To ensure data security, existing technologies typically employ security measures. For example, Chinese Patent Application No. CN202010713842.7 discloses a data security auditing method and system based on big data computing technology. This technology utilizes big data computing to perform security audits on data received by the data center. However, data center management encompasses receiving, storing, and distributing data; therefore, this technology only addresses the security management of received data, leaving shortcomings in the areas of data storage and distribution. Therefore, this application discloses an internet data center information security management method and system. Summary of the Invention

[0003] The purpose of this application is to provide a method and system for managing information security in Internet data centers, so as to achieve comprehensive management of information security in data centers.

[0004] To achieve the above objectives, this application discloses the following technical solutions:

[0005] In the first aspect, this application discloses an information security management method for Internet data centers, including data inbound management, data storage management, and data outbound management;

[0006] The data import management includes the following steps:

[0007] DataAccess1: Receives internet data to be managed and performs security verification on the received internet data to be managed;

[0008] DataAccess2: When the security verification passes, perform the data storage management on the Internet data to be managed;

[0009] The data storage management includes the following steps:

[0010] DataStorage1: Performs data parsing on the internet data to be managed, and extracts the corresponding identification tags for the internet data to be managed according to the preset tag extraction rules;

[0011] DataStorage2: Modulates and encrypts the internet data to be managed to obtain modulated data;

[0012] DataStorage3: Encrypt the identification tag according to the preset tag encryption method to obtain an encrypted tag;

[0013] DataStorage4: Store the modulated data in a storage node named after the encrypted tag;

[0014] The data outbound management includes the following steps:

[0015] DataFetch1: Receives data read requests sent by the data requesting client and verifies the identity of the data read requester;

[0016] DataFetch2: Parses the data read request that has been successfully verified to obtain the target data tag in the data read request;

[0017] DataFetch3: Encrypt the target data tag according to the described tag encryption method to obtain the encrypted target tag, and compare the encrypted target tag with the encrypted tags corresponding to all storage nodes;

[0018] DataFetch4: When a tag match is successful, the modulated data in the storage node corresponding to the successfully matched encrypted tag will be used as the data to be sent.

[0019] DataFetch5: The data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

[0020] Preferably, the security verification includes: performing threat detection on the Internet data to be managed.

[0021] Preferably, the threat detection is achieved through a preset threat detection model, wherein the threat detection model is obtained through deep learning based on network threat characteristics;

[0022] When the security verification of the Internet data to be managed fails, threat analysis is performed on the threat detection results of the Internet data to be managed, and the threat detection model is reinforced by the network threat characteristics corresponding to the threat analysis.

[0023] Preferably, when the security verification of the Internet data to be managed fails, a vulnerability verification is performed on the Internet data to be managed, the vulnerability analysis results corresponding to the Internet data to be managed are obtained, and the data modulation and encryption process is optimized based on the vulnerability analysis results.

[0024] Preferably, the tag extraction rules include one or more of the following: extraction based on the source of the internet data to be managed, extraction based on the data type of the internet data to be managed, extraction based on the data content of the internet data to be managed, and extraction based on the data format of the internet data to be managed.

[0025] Preferably, the data modulation encryption specifically includes:

[0026] Random number M is generated based on a hash function;

[0027] The internet data to be managed is sequentially split into M data segments from the first character to the last character.

[0028] Add the sorting number N of each data segment during splitting to the last character of each data segment to obtain M numbered data segments;

[0029] Generate a base string of random length and define the length of the base string as L;

[0030] Generate M-1 additional strings of the same length as the base string;

[0031] The reference string and the additional string are inserted one-to-one into the last character of the M numbered data segments to obtain M extended data segments as the modulated data;

[0032] Generate an extended decryption key (M, N, L) and send it to the administrator for storage.

[0033] Preferably, the DataStorage4 also includes:

[0034] The M extended data segments are stored in the storage node in an out-of-order manner.

[0035] Preferably, the step of generating the extended decryption key (M, N, L) and sending it to the administrator for storage specifically includes:

[0036] The extended dekey is encrypted by adding salt to obtain the encrypted extended dekey;

[0037] Send the encrypted extended decryption key to the administrator for safekeeping.

[0038] Preferably, the tag comparison specifically includes:

[0039] Feature value extraction is performed on the encrypted target tag;

[0040] The extracted feature values ​​are matched with the feature values ​​corresponding to each encrypted tag to obtain the count result G of successful matches. count ;

[0041] Calculate the matching degree P matching , Among them, G rated G represents the total number of feature values ​​corresponding to the encrypted tags. total The total number of feature values ​​corresponding to the encrypted target tag;

[0042] The calculated P matching Compared with the preset benchmark threshold P threshold Compare the results when all calculated P matching P exists in all cases matching <P threshold If the target data cannot be found, a message indicating that the target data cannot be found will be sent back to the data requesting end; otherwise, a condition satisfying P will be selected. matching ≥P threshold The encryption tag corresponding to the maximum value in the matching degree is used as the encryption tag of the data to be sent.

[0043] Secondly, this application discloses an Internet data center information security management system, which is applicable to the Internet data center information security management method described above. The Internet data center information security management system includes: a data inbound management module, a data storage management module, and a data outbound management module.

[0044] The data entry management module is configured to: receive Internet data to be managed, perform security verification on the received Internet data to be managed, and send the Internet data to be managed that has passed the security verification to the data storage management module;

[0045] The data storage management module is configured to: perform data parsing on the Internet data to be managed, and extract the corresponding identification tags of the Internet data to be managed according to the preset tag extraction rules; perform data modulation and encryption on the Internet data to be managed to obtain modulated data, and encrypt the identification tags according to the preset tag encryption method to obtain encrypted tags; and store the modulated data in a storage node named after the encrypted tags.

[0046] The data outbound management module is configured to: receive data read requests sent by the data requesting end, verify the identity of the data read requests, parse the data read requests that have been successfully verified, obtain the target data tag in the data read request, encrypt the target data tag according to the tag encryption method to obtain the encrypted target tag, compare the encrypted target tag with the encrypted tags corresponding to all storage nodes, and when the tag comparison is successful, take the modulated data in the storage node corresponding to the successfully compared encrypted tag as the data to be sent; wherein, the data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

[0047] Beneficial effects: The Internet data center information security management method and system of this application realizes closed-loop management of data reception, data storage and data distribution in the data center through data inbound management, data storage management and data outbound management. In addition, in data storage, the stored data is modulated and encrypted, so that the data stored in the data center is stored in encrypted form. This ensures that even if a network security vulnerability occurs, the corresponding danger source cannot directly obtain the corresponding data, thereby ensuring the security of data storage. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 A flowchart illustrating the Internet data center information security management method provided in this application embodiment. Detailed Implementation

[0050] The technical solutions in the embodiments of this application will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0051] In this document, the term "comprising" is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0052] This embodiment discloses a method such as Figure 1 The internet data center information security management method shown includes data inbound management, data storage management, and data outbound management.

[0053] Specifically, the data entry management includes the following steps:

[0054] DataAccess1: Receives internet data to be managed and performs security verification on the received internet data to be managed;

[0055] DataAccess2: When the security check passes, perform the data storage management on the Internet data to be managed.

[0056] Specifically, the data storage management includes the following steps:

[0057] DataStorage1: Performs data parsing on the internet data to be managed, and extracts the corresponding identification tags for the internet data to be managed according to the preset tag extraction rules;

[0058] DataStorage2: Modulates and encrypts the internet data to be managed to obtain modulated data;

[0059] DataStorage3: Encrypt the identification tag according to the preset tag encryption method to obtain an encrypted tag;

[0060] DataStorage4: Store the modulated data in a storage node named after the encrypted tag.

[0061] Specifically, the data outbound management includes the following steps:

[0062] DataFetch1: Receives data read requests sent by the data requesting client and verifies the identity of the data read requester;

[0063] DataFetch2: Parses the data read request that has been successfully verified to obtain the target data tag in the data read request;

[0064] DataFetch3: Encrypt the target data tag according to the described tag encryption method to obtain the encrypted target tag, and compare the encrypted target tag with the encrypted tags corresponding to all storage nodes;

[0065] DataFetch4: When a tag match is successful, the modulated data in the storage node corresponding to the successfully matched encrypted tag will be used as the data to be sent.

[0066] DataFetch5: The data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

[0067] In this embodiment, the security verification includes: performing threat detection on the internet data to be managed. The threat detection is implemented using a preset threat detection model, which is obtained through deep learning based on network threat characteristics.

[0068] When the security verification of the internet data to be managed fails, threat analysis is performed on the threat detection results of the internet data to be managed, and the threat detection model is reinforced using the network threat characteristics corresponding to the threat analysis. This improves the efficiency and effectiveness of threat detection, ensures the security of data reception, and prevents dangerous data from entering the data center.

[0069] In this embodiment, the tag extraction rules include one or more of the following: extraction based on the source of the internet data to be managed, extraction based on the data type of the internet data to be managed, extraction based on the data content of the internet data to be managed, and extraction based on the data format of the internet data to be managed. Based on the setting of tag extraction rules, corresponding information can be displayed for storage nodes, thereby ensuring that the data center can accurately and quickly complete the retrieval and management of data without affecting the original working efficiency of the data center.

[0070] As a preferred embodiment of this invention, the data modulation encryption specifically includes:

[0071] Random number M is generated based on a hash function;

[0072] The internet data to be managed is sequentially split into M data segments from the first character to the last character.

[0073] Add the sorting number N of each data segment during splitting to the last character of each data segment to obtain M numbered data segments;

[0074] Generate a base string of random length and define the length of the base string as L;

[0075] Generate M-1 additional strings of the same length as the base string;

[0076] The reference string and the additional string are inserted one-to-one into the last character of the M numbered data segments to obtain M extended data segments as the modulated data;

[0077] Generate an extended decryption key (M, N, L) and send it to the administrator for storage.

[0078] Therefore, by configuring the extended decryption key, when the modulated data in the data center is illegally obtained, the modulated data cannot be accurately decrypted without the corresponding extended decryption key, and thus the original data cannot be accurately obtained. Therefore, even if data leakage / outflow occurs, the original data will not be leaked, which has a high degree of information security.

[0079] To further enhance the security of the extended decryption key, in this embodiment, DataStorage4 also includes:

[0080] The M extended data segments are stored in the storage node in an out-of-order manner.

[0081] Furthermore, the process of generating the extended decryption key (M, N, L) and sending it to the administrator for storage specifically includes:

[0082] The extended dekey is encrypted by adding salt to obtain the encrypted extended dekey;

[0083] Send the encrypted extended decryption key to the administrator for safekeeping.

[0084] This allows for further enhancement of the security level of the extended decryption key, enabling multi-dimensional and multi-layered security management of data information in the data center and ensuring data security.

[0085] Correspondingly, after the modulated data is legally obtained (i.e., obtained through data outbound management) at the data request end, the corresponding values ​​of M, N, and L can be obtained through the extended decryption key shared by the administrator. This allows us to determine the number of segments the original data was divided into (i.e., corresponding to M), the last few characters of each segment (i.e., L characters) which are added strings (i.e., the base string or the appended string), and the order of each extended data segment in the original data. After deleting the added strings and the bytes corresponding to the order, the original data can be obtained by concatenating the data according to the order.

[0086] In this embodiment, the tag comparison specifically includes:

[0087] Feature value extraction is performed on the encrypted target tag;

[0088] The extracted feature values ​​are matched with the feature values ​​corresponding to each encrypted tag to obtain the count result G of successful matches. count ;

[0089] Calculate the matching degree P matching , Among them, G rated G represents the total number of feature values ​​corresponding to the encrypted tags. total The total number of feature values ​​corresponding to the encrypted target tag;

[0090] The calculated P matching Compared with the preset benchmark threshold P threshold Compare the results when all calculated P matching P exists in all cases matching <P thresholdIf the target data cannot be found, a message indicating that the target data cannot be found will be sent back to the data requesting end; otherwise, a condition satisfying P will be selected. matching ≥P threshold The encryption tag corresponding to the maximum value in the matching degree is used as the encryption tag of the data to be sent.

[0091] It should be noted that the target data tag in the data read request is pre-agreed in the interaction protocol between the device capable of data interaction with the data center, i.e., the trusted or pre-configured device, and the data center. When each legitimate data read request is generated, it can be automatically or manually generated based on this protocol. Since this technology is not the focus of this application and can be obtained through existing technology, it will not be elaborated here.

[0092] Based on the above, the degree of matching between the encrypted target tag and the encrypted tag is comprehensively considered by calculating the number of successful feature value matches and the number of unsuccessful matches, which improves the accuracy and reliability of the matching results, thereby increasing the difficulty of legally obtaining data in the data center.

[0093] In a second aspect, this embodiment discloses an Internet data center information security management system applicable to the Internet data center information security management method described above. This Internet data center information security management system includes: a data inbound management module, a data storage management module, and a data outbound management module.

[0094] The data entry management module is configured to: receive Internet data to be managed, perform security verification on the received Internet data to be managed, and send the Internet data to be managed that has passed the security verification to the data storage management module;

[0095] The data storage management module is configured to: perform data parsing on the Internet data to be managed, and extract the corresponding identification tags of the Internet data to be managed according to the preset tag extraction rules; perform data modulation and encryption on the Internet data to be managed to obtain modulated data, and encrypt the identification tags according to the preset tag encryption method to obtain encrypted tags; and store the modulated data in a storage node named after the encrypted tags.

[0096] The data outbound management module is configured to: receive data read requests sent by the data requesting end, verify the identity of the data read requests, parse the data read requests that have been successfully verified, obtain the target data tag in the data read request, encrypt the target data tag according to the tag encryption method to obtain the encrypted target tag, compare the encrypted target tag with the encrypted tags corresponding to all storage nodes, and when the tag comparison is successful, take the modulated data in the storage node corresponding to the successfully compared encrypted tag as the data to be sent; wherein, the data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

[0097] It should be noted that since the Internet Data Center Information Security Management System of this embodiment corresponds to the aforementioned Internet Data Center Information Security Management Method, the undisclosed technical content and effects of the Internet Data Center Information Security Management System can be referred to the description in the aforementioned Internet Data Center Information Security Management Method, and will not be repeated here.

[0098] In summary, the Internet data center information security management method and system of this embodiment achieve closed-loop management of data reception, data storage and data distribution in the data center through data inbound management, data storage management and data outbound management. Furthermore, in data storage, the stored data is modulated and encrypted, so that the data stored in the data center is stored in encrypted form. This ensures that even if a network security vulnerability occurs, the corresponding danger source cannot directly obtain the corresponding data, thereby ensuring the security of data storage.

[0099] In the embodiments provided in this application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor may be implemented in one or more of the following: application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to implement the functions described herein, or combinations thereof. For software implementation, some or all of the processes of the embodiments may be performed by a computer program instructing the associated hardware. During implementation, the program may be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media may be any available medium accessible to a computer. Computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having the form of instructions or data structures and accessible to a computer.

[0100] Finally, it should be noted that the above description is only a preferred embodiment of this application and is not intended to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for information security management of Internet data centers, characterized in that, This includes data inbound management, data storage management, and data outbound management; The data import management includes the following steps: DataAccess1: Receives internet data to be managed and performs security verification on the received internet data to be managed; DataAccess2: When the security verification passes, perform the data storage management on the Internet data to be managed; The data storage management includes the following steps: DataStorage1: Performs data parsing on the internet data to be managed, and extracts the corresponding identification tags for the internet data to be managed according to the preset tag extraction rules; DataStorage2: Modulates and encrypts the internet data to be managed to obtain modulated data; DataStorage3: Encrypt the identification tag according to the preset tag encryption method to obtain an encrypted tag; DataStorage4: Store the modulated data in a storage node named after the encrypted tag; The data outbound management includes the following steps: DataFetch1: Receives data read requests sent by the data requesting client and verifies the identity of the data read requester; DataFetch2: Parses the data read request that has been successfully verified to obtain the target data tag in the data read request; DataFetch3: Encrypt the target data tag according to the described tag encryption method to obtain the encrypted target tag, and compare the encrypted target tag with the encrypted tags corresponding to all storage nodes; DataFetch4: When a tag match is successful, the modulated data in the storage node corresponding to the successfully matched encrypted tag will be used as the data to be sent. DataFetch5: The data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

2. The Internet data center information security management method according to claim 1, characterized in that, The security verification includes: performing threat detection on the internet data to be managed.

3. The Internet data center information security management method according to claim 2, characterized in that, The threat detection is achieved through a preset threat detection model, which is obtained by deep learning based on network threat characteristics. When the security verification of the Internet data to be managed fails, threat analysis is performed on the threat detection results of the Internet data to be managed, and the threat detection model is reinforced by the network threat characteristics corresponding to the threat analysis.

4. The Internet data center information security management method according to claim 1, characterized in that, When the security verification of the Internet data to be managed fails, a vulnerability verification is performed on the Internet data to be managed, the vulnerability analysis result corresponding to the Internet data to be managed is obtained, and the data modulation and encryption process is optimized based on the vulnerability analysis result.

5. The Internet data center information security management method according to claim 1, characterized in that, The tag extraction rules include one or more of the following: extraction based on the source of the internet data to be managed, extraction based on the data type of the internet data to be managed, extraction based on the data content of the internet data to be managed, and extraction based on the data format of the internet data to be managed.

6. The Internet data center information security management method according to claim 1, characterized in that, The aforementioned data modulation and encryption specifically includes: Random number M is generated based on a hash function; The internet data to be managed is sequentially split into M data segments from the first character to the last character. Add the sorting number N of each data segment during splitting to the last character of each data segment to obtain M numbered data segments; Generate a base string of random length and define the length of the base string as L; Generate M-1 additional strings of the same length as the base string; The reference string and the additional string are inserted one-to-one into the last character of the M numbered data segments to obtain M extended data segments as the modulated data; Generate an extended decryption key (M, N, L) and send it to the administrator for storage.

7. The Internet data center information security management method according to claim 6, characterized in that, The DataStorage4 also includes: The M extended data segments are stored in the storage node in an out-of-order manner.

8. The Internet data center information security management method according to claim 6, characterized in that, The process of generating the extended decryption key (M, N, L) and sending it to the administrator for storage specifically includes: The extended dekey is encrypted by adding salt to obtain the encrypted extended dekey; Send the encrypted extended decryption key to the administrator for safekeeping.

9. The Internet data center information security management method according to claim 1, characterized in that, The tag comparison specifically includes: Feature value extraction is performed on the encrypted target tag; The extracted feature values ​​are matched with the feature values ​​corresponding to each encrypted tag to obtain the count result G of successful matches. count ; Calculate the matching degree P matching , Among them, G rated G represents the total number of feature values ​​corresponding to the encrypted tags. total The total number of feature values ​​corresponding to the encrypted target tag; The calculated P matching Compared with the preset benchmark threshold P threshold Compare the results when all calculated P matching P exists in all cases matching <P threshold If the target data cannot be found, a message indicating that the target data cannot be found will be sent back to the data requesting end; otherwise, a condition satisfying P will be selected. matching ≥P threshold The encryption tag corresponding to the maximum value in the matching degree is used as the encryption tag of the data to be sent.

10. An Internet data center information security management system, applicable to the Internet data center information security management method as described in any one of claims 1-9, characterized in that, This Internet data center information security management system includes: a data inbound management module, a data storage management module, and a data outbound management module; The data entry management module is configured to: receive Internet data to be managed, perform security verification on the received Internet data to be managed, and send the Internet data to be managed that has passed the security verification to the data storage management module; The data storage management module is configured to: perform data parsing on the Internet data to be managed, and extract the corresponding identification tags of the Internet data to be managed according to the preset tag extraction rules; perform data modulation and encryption on the Internet data to be managed to obtain modulated data, and encrypt the identification tags according to the preset tag encryption method to obtain encrypted tags; and store the modulated data in a storage node named after the encrypted tags. The data outbound management module is configured to: receive data read requests sent by the data requesting end, verify the identity of the data read requests, parse the data read requests that have been successfully verified, obtain the target data tag in the data read request, encrypt the target data tag according to the tag encryption method to obtain the encrypted target tag, compare the encrypted target tag with the encrypted tags corresponding to all storage nodes, and when the tag comparison is successful, take the modulated data in the storage node corresponding to the successfully compared encrypted tag as the data to be sent; wherein, the data requesting end receives the data to be sent and obtains the corresponding Internet data after successful decryption.

Images