Computer information security storage method

Abstract

The invention belongs to the technical field of computer information security storage, and particularly relates to a computer information security storage method, which comprises the following steps of: constructing a dynamic confusing data set based on a computer information set associated; multi-layer intrusion attacks are monitored in real time through an early warning module, and early warning signals are generated; when an early warning signal is triggered, the real data set and the confused data set are mixed and disorganized through pseudo logic sorting by using the mixed encryption module to form a mixed data set; adopting a puzzle key group and a real key in a key management module to perform asymmetric encryption on part of puzzle data fragments and real information fragments in the mixed data set; a visitor is required to continuously input an effective puzzle key and then verify a real key through a multi-layer decryption verification module, so that information can be obtained; the administrator is allowed to customize a key strategy through the dynamic encryption configuration module, and re-encryption is automatically triggered after access. According to the method, dynamic and active defense is realized, attackers can be effectively misled, and the data storage security is improved.

Description

Technical Field

[0001] This invention belongs to the field of computer information security storage technology, and specifically relates to a computer information security storage method. Background Technology

[0002] With the rapid development of information technology, the secure storage of computer information faces increasingly severe challenges. Traditional secure storage methods mainly rely on static encryption and access control. However, when faced with continuous and ever-changing intrusion attacks (such as advanced persistent threats and internal personnel abusing their privileges), once static encryption is breached, all protected information will be completely exposed. Furthermore, single encryption methods are insufficient to cope with complex attacks at the network, permission, physical, and data layers. After stealing encrypted data, attackers often have ample time to crack it offline, while the system cannot effectively proactively defend against and mislead attackers when an attack occurs. While some existing solutions introduce decoy data, it is often statically existing, clearly separated from the real data, and lacks dynamic obfuscation and attack-linked mechanisms, failing to effectively deplete attacker resources and provide early warnings. Therefore, there is an urgent need for a secure storage method capable of real-time threat detection, dynamic obfuscation of real information, and the establishment of multi-layered interactive verification mechanisms to enhance the proactive defense and survivability of information in its stored state. Summary of the Invention

[0003] To address the aforementioned shortcomings in existing technologies, this invention provides a computer information security storage method. This method constructs a dynamic and deceptive dataset, and under the trigger of an early warning module, mixes and encrypts real information with deceptive information. Combined with a multi-layer key verification mechanism, it constructs a dynamic, proactive, and highly deceptive information security storage system.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: a method for secure storage of computer information. S1: Obtain a computer information set and construct a dynamic deceptive dataset based on the computer information set; S2: Deploy an early warning module, which monitors intrusion attacks in real time and generates attack early warning signals; S3: Construct a hybrid encryption module. When the early warning module does not generate an attack warning signal, the computer information set and the dynamic deceptive dataset are stored independently. When an attack warning signal is received, the hybrid encryption module mixes and scrambles the computer information set and the dynamic deceptive dataset through pseudo-logical sorting to form a hybrid data set. S4: Configure the key management module. The key management module includes a deceptive key group and a real key. The deceptive key group contains several independent deceptive keys, which encrypt some deceptive data fragments in the mixed data set through asymmetric encryption. The real key encrypts some computer information fragments in the mixed data set. S5: Build a multi-layer decryption verification module. When the administrator accesses the system, he / she must first enter a preset number of valid deception keys, and then enter the real key. After successful verification, the computer information set can be obtained. If the number of incorrect key entries exceeds the threshold, a temporary locking mechanism is triggered. S6: Set up a dynamic encryption configuration module. Administrators can define the number of valid decryption keys, the threshold for consecutive inputs, the complexity of the real key, and the key update cycle. After the access is completed, re-encryption is automatically triggered, and a new mixed data set is generated based on the updated key parameters.

[0005] The acquired computer information set includes structural features, data formats, and related logic; the intrusion attack includes network attack traffic, abnormal privilege access, physical access behavior, and abnormal data operation.

[0006] Furthermore, the construction process of the dynamic deceptive dataset includes: S101: Extract the data field types, field lengths, association rules, and numerical distribution characteristics of the target computer information set; S102: Use feature mapping to generate pseudo-data that is from the same source as the target computer information set. The field matching degree of the pseudo-data is 80-60%, and the numerical distribution deviation is 50-30%. S103: Based on the business logic of the target computer information set, construct the relationship between pseudo data to form a dynamic deceptive dataset, and the dynamic deceptive dataset supports automatic updating of pseudo data content and association rules according to a preset period.

[0007] Furthermore, the encrypted deceptive data fragments and computer information fragments form an error message set, which is used to mislead attackers into believing that the decryption has been successfully completed.

[0008] Furthermore, the attacks monitored by the early warning module include: Network layer monitoring: abnormal IP connections, port scanning, DDoS attack traffic, and encrypted tunnel communication; Access control monitoring: unauthorized account login, unauthorized access, and abnormal operations by privileged accounts; Physical layer monitoring: unauthorized USB access, device disassembly, and unauthorized physical access; Data layer monitoring: batch data reading, abnormal data export, and data tampering operations.

[0009] Furthermore, the pseudo-logical sorting includes: The target computer information set and the dynamic deceptive dataset are divided into data segments, each containing a complete field structure; based on preset pseudo-logic rules, the data segments are cross-sorted to form a mixed data set that superficially conforms to business logic but is actually confusing; the integrity of the data segments is preserved during the mixing process to ensure that each encrypted segment can be independently decrypted and verified.

[0010] Furthermore, the verification process of the multi-layer decryption verification module includes: The administrator enters the first deceptive key, and the system verifies the key's validity through hash verification. Enter other valid deception keys sequentially according to the preset number of attempts, with an interval of ≤60 seconds between each entry. If the keys are entered correctly consecutively, the process will proceed to the real key verification stage. After the real key is verified, the system separates the computer information set from the dynamic deceptive dataset and outputs the target computer information set. If any deception key is entered incorrectly or times out, the system records the operation log and triggers a temporary lock, with the lock duration increasing with the number of errors.

[0011] Furthermore, it also includes a backup module, which is used to synchronously back up the computer information set when the administrator accesses it, thereby preventing accidental deletion.

[0012] It also includes a computer information security storage system, comprising a dataset construction module, an early warning module, a hybrid encryption module, a key management module, a multi-layer decryption and verification module, and a dynamic configuration module.

[0013] Compared with the prior art, the present invention has the following advantages: 1. Proactively deceiving attack behavior and reducing the risk of data leakage: By constructing a dynamic deceptive dataset, which is mixed with real data and encrypted when attacked, a set of false information is formed to induce attackers, making it difficult for attackers to distinguish between real data and deceptive data, significantly extending the attack time and buying time for security response, thus solving the problem that existing technologies lack proactive deception mechanisms; 2. Enhanced protection through multi-layered key verification: The system employs a multi-layered verification method combining a "deceptive key group + real key," along with hash verification, input interval restrictions, and locking mechanisms. This effectively prevents risks such as brute-force attacks and key theft, and solves the problem of single key verification in existing technologies. 3. Dynamic configuration to adapt to diverse needs: Administrators can independently define parameters such as the number of deception keys, key complexity, and update cycle. After access, the encryption is automatically re-encrypted, enabling security protection to adapt to the security needs of different enterprises and different scenarios, thus solving the problem of fixed encryption rules in existing technologies. 4. Synchronous backup to prevent data loss: The backup module synchronously backs up data when the administrator accesses it, and uses encrypted storage to effectively deal with data deletion or damage caused by accidental operation, providing a safety net for data security; 5. Multi-dimensional early warning for comprehensive protection: The early warning module covers intrusion attack monitoring at the network layer, permission layer, physical layer, and data layer, ensuring that all types of attack behaviors can be detected in a timely manner and trigger the protection process, solving the problem of incomplete attack monitoring in existing technologies; 6. Pseudo-logical sorting enhances data obfuscation: The pseudo-logical sorting of the hybrid encryption module makes the hybrid data set appear to conform to business logic, further enhancing the deceptive effect, while preserving the integrity of data fragments and not affecting normal decryption access, thus balancing security and availability. Attached Figure Description

[0014] Figure 1 This illustration shows an overall schematic diagram of a computer information security storage method proposed in an embodiment of this application; Figure 2 This illustration shows a schematic diagram of the module workflow of a computer information security storage method proposed in an embodiment of this application. Detailed Implementation

[0015] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on the specific implementation methods, structures, features and effects of the present invention.

[0016] Example 1: like Figure 1-2 As shown, the present invention includes the following steps: S1: Obtain computer information sets and construct dynamic deceptive datasets. The construction of a dynamic deceptive dataset relies on the Python data analysis ecosystem, feature mining libraries, and regular expression engines for technical support. It utilizes a combination of linear mapping and nonlinear perturbation—feature mapping, rule engines, graph structure modeling tools, scheduling tools, and data synchronization monitoring tools—to automate the entire process. Specifically, the Python data analysis ecosystem first reads the computer information set. The feature selection module of the feature mining library accurately extracts data field types, field lengths, association rules, and numerical distribution features. A regular expression engine verifies the consistency of field formats to ensure the accuracy of feature extraction. Based on the extracted features, a custom format template library is used to match the target data format, employing a combination of linear mapping and nonlinear perturbation. The model generates pseudo-data from the same source, strictly controlling the field matching degree of the pseudo-data to 60%-80% (field types and lengths are completely matched, and core content is partially differentiated through random replacement), and the numerical distribution deviation to 30%-50% (based on the distribution range of real data, reasonable perturbation is applied through a random number generator; for example, when the mean of real data is 100, the mean of pseudo-data is controlled between 70-130). Subsequently, the business logic of the target information set is transformed into executable rules through a rule engine. A graph structure modeling tool is used to visualize the relationship network of real data, and false relationships between pseudo-data are constructed based on this network, such as simulating the field dependencies of real data, to ensure logical self-consistency between pseudo-data and form a complete dynamic deceptive dataset. At the same time, a timed scheduling tool is used to set a preset period to trigger the automatic update of pseudo-data content and relationship rules. A data synchronization monitoring tool is used to capture structural changes of the target information set in real time (such as adding fields or adjusting relationship rules), and the pseudo-data structure is updated synchronously to always maintain a balance between similarity and difference with the target data. This step, through the core logic of "feature extraction - pseudo-data generation - association construction - automatic update", not only achieves a high degree of homogeneity between pseudo-data and target data in terms of structure and format, but also ensures the difference between the two by quantitatively controlling the field matching degree and numerical distribution deviation. The dynamic update mechanism effectively avoids the risk of misleading data being identified due to long-term fixation, providing a high-quality and highly deceptive data foundation for subsequent hybrid encryption.

[0017] S2: Deploy an early warning module to monitor intrusion attacks. The deployment of the early warning module is supported by technologies such as traffic analysis tools, intrusion detection systems, log parsing tools, access control systems, hardware sensors, physical access control systems, file operation log monitoring tools, and data operation auditing tools, constructing a multi-dimensional monitoring system. Specifically, at the network layer, traffic analysis tools capture network traffic in real time, parsing IP addresses, ports, and transmission protocols, comparing them with a preset list of legitimate IPs and port ranges to identify abnormal IP connections and port scans. Traffic statistics analysis (connection requests exceeding a preset threshold within a unit of time) identifies DDoS attacks, and protocol parsing captures encrypted tunnel communication. At the access control layer, log parsing tools collect system login and operation logs, and through indexing and visualization analysis, accurately identify unauthorized access. The system detects account logins (non-whitelisted accounts), unauthorized access (operations outside authorized scope), and abnormal operations by privileged accounts (logins outside of working hours). At the physical layer, a USB port monitoring module monitors connected devices in real time and compares them with the authorized device list to identify unauthorized USB connections. A chassis opening sensor captures device disassembly, and the physical access control system records unauthorized physical access. At the data layer, a file operation log monitoring tool monitors file read, export, and modification operations, statistically analyzing batch data reads, abnormal data exports, and data tampering, generating detailed anomaly records. When an anomaly is detected in any dimension, the system automatically integrates information such as the anomaly type, occurrence time, and scope, generating a standardized attack warning signal and transmitting it to the hybrid encryption module in real time. This multi-dimensional, comprehensive monitoring design provides seamless protection across network, access, physical, and data layers. Streaming technology ensures real-time identification of abnormal behavior and rapid generation of warning signals. Combined with whitelists, threshold judgments, and log parsing, the system effectively reduces false alarm rates, providing accurate and timely triggering criteria for subsequent emergency protection.

[0018] S3: Storage and Encryption Control of Hybrid Encryption Modules The hybrid encryption module is built upon data sharding, a custom cross-sorting engine, and storage isolation technology. In operation, the module receives signals from the early warning module in real time to determine the current storage status. When no warning is received, file system isolation technology stores the computer information set and the dynamically deceptive dataset in independent logical partitions, setting strict access permissions to ensure they do not interfere with each other and guarantee read efficiency during normal access. Upon receiving an attack warning signal, it immediately initiates sharding based on data logical units, dividing the two datasets into independent fragments based on complete records or data objects. Each fragment retains the complete field structure and logical information to prevent data loss during subsequent encryption and decryption. Based on preset pseudo-logic rules (such as sorting by alternating field similarity and virtual timestamps), a custom cross-sorting engine is used to cross-sort all data fragments, forming a mixed data set that superficially conforms to general data association logic but is actually obfuscated. During the sorting process, the index information of each fragment is recorded synchronously to ensure the field integrity and independent verifiability of a single fragment. The entire process is designed with dual-mode switching. Under normal circumstances, access efficiency is prioritized, while in emergency situations, high-intensity data obfuscation is achieved through scientific fragmentation and sorting. This not only ensures the strong deception of the mixed data but also provides a reliable foundation for subsequent decryption and separation, perfectly balancing data access efficiency and security protection strength.

[0019] S4: Encryption configuration of the key management module The key management module is based on asymmetric encryption and relies on the technical support provided by the key management system and key generation tools. In practice, the key management system uses a high-strength random number seed to generate several independent deceptive keys (forming a deceptive key group) and a high-complexity real key. After key generation, the keys are stored in an encrypted storage medium physically isolated from the mixed data set to reduce the risk of leakage. Then, asymmetric encryption is performed using a custom encryption SDK tool. Different keys from the deceptive key group are used to encrypt 60% of the deceptive data fragments in the mixed data set, while the real key is used to encrypt 80% of the computer information fragments in the mixed data set. During the encryption process, a unique key identifier is added to each encrypted fragment to facilitate subsequent decryption matching. Finally, the encrypted deceptive data fragments and computer information fragments are selected and combined according to a common data format to form an error message set. This set has a complete data structure but no real and valid information, and is specifically used to mislead attackers into believing that they have successfully cracked the code, thus interfering with their attack behavior. The key management module constructs a dual-layer protection through a dual-key system. The design of the error information set achieves a dual effect of "protection + inducement". The application of asymmetric encryption and the physical isolation storage of the key further enhance the security of the key itself, effectively reduce the risk of key leakage, and provide high-strength encryption protection for mixed data.

[0020] S5: Access control for multi-layer decryption verification module The multi-layered decryption verification module integrates hash verification technology, a custom input control tool, a reverse pseudo-logic sorting and data separation tool, an operation log system, and a dynamic locking access control component. In operation, after the administrator initiates an access request, the module first prompts for the input of a first decoy key. The system compares the hash value of the input key character-by-character with the hash value of the pre-stored decoy keys to confirm validity. Subsequently, it prompts for the input of other decoy keys sequentially according to the administrator's preset input threshold. The input control program strictly monitors the input interval; failure to input within the time limit or an interval exceeding 60 seconds is considered a verification failure. Once all preset decoy keys are entered consecutively and all verifications are successful, the module proceeds... In the real key verification phase, the validity of the real key is confirmed through hash verification. After successful verification, the reverse pseudo-logic sorting tool is activated. Based on the fragment index information of the mixed data set and the verification fields hidden in the real data fragments, it accurately separates the computer information set from the dynamically deceptive dataset, outputting only the real computer information set to the administrator. If any key input is incorrect or times out, the operation log system records detailed information such as operation time, terminal information, and number of errors, and triggers a temporary locking mechanism. The locking duration increases with the number of errors, such as locking for 1 minute the first time, half an hour the second time, and 2 hours the third time, effectively preventing brute-force attacks. The multi-layer decryption verification module constructs a robust access barrier through multi-layer key verification. Input interval control and dynamic locking mechanisms specifically resist brute-force attacks, and the reverse pseudo-logic sorting algorithm ensures the accuracy of data separation. The entire process not only guarantees normal access for authorized administrators but also effectively blocks unauthorized access attempts.

[0021] S6: Parameter adjustment of the dynamic encryption configuration module The dynamic encryption configuration module relies on a visual web-based configuration management tool, a parameter synchronization component, and an automated re-encryption engine that integrates hybrid encryption and key management functions. In practice, administrators can define multiple encryption parameters through the visual configuration backend, including the number of valid decryption keys to adapt to different security levels, the threshold for consecutive inputs, the complexity of the real key (e.g., the requirement of a combination of uppercase and lowercase letters + numbers + special symbols, with a length of no less than 16 characters), and the key update cycle to adapt to the security update requirements of different business data. After the parameters are configured, the updated parameters are synchronized to the key management module and the multi-layer decryption verification module in real time through the parameter synchronization component to ensure the consistency of parameters in each module. After the administrator finishes accessing the computer information set and exits, the system automatically triggers the re-encryption engine, which generates a new decryption key group and a real key based on the updated parameters. The computer information set and the updated dynamic decryption dataset are then re-sharded, sorted, mixed, and encrypted to generate a new mixed data set, and the old key automatically becomes invalid. This module features a highly customizable parameter configuration design, allowing administrators to flexibly adjust the protection strength according to actual security needs. The parameter synchronization and automatic re-encryption mechanism ensures the dynamic optimization of the protection system. Re-encryption after each access keeps data security protection in the optimal state at all times. It is also compatible with changes in security requirements in different scenarios, improving the adaptability and flexibility of the entire protection system.

[0022] The present invention also provides a computer information security storage system applied to the above-mentioned computer information security storage method, the system comprising: Dataset building module: used to acquire computer information sets and construct dynamic deceptive datasets based on these computer information sets; Early warning module: Used to monitor various intrusion attacks in real time and generate attack early warning signals; Hybrid encryption module: used to control the independent storage or mixed scrambling and encryption of computer information sets and dynamic deceptive datasets based on attack warning signals, forming a hybrid data set; Key management module: used to generate deceptive key sets and real keys, and to encrypt deceptive data fragments and computer information fragments in the mixed data set respectively using asymmetric encryption algorithms; Multi-layer decryption verification module: used to verify the key sequence input by the administrator, and after successful verification, separate and output the computer information set; Dynamic configuration module: Allows administrators to define encryption parameters and trigger re-encryption after access is completed; Backup module: Used to synchronously back up computer information sets when an administrator accesses the system, preventing accidental deletion.

[0023] Example 2 uses the secure storage of corporate financial data as a typical application scenario. In this scenario, the financial data includes highly sensitive information such as financial statements, transaction records, and employee salaries. It is necessary to guard against risks such as external network attacks, unauthorized internal access, data tampering, and accidental deletion, while ensuring the efficiency of normal access for financial administrators and the flexibility of parameter adjustment. The following provides a detailed explanation of the workflow, technical characteristics, working logic, and collaborative effects of each module.

[0024] The dataset construction module, serving as the foundational support of the entire secure storage system, first acquires the enterprise's financial data—a computer information set. This data possesses clear structural characteristics (tabular format), data formats (numerical amounts, date-based transaction dates, and text-based employee names and transaction objects), and association logic (associating transaction records and salary data through employee IDs, and financial statements and transaction records through time periods). The dataset construction module uses machine learning-based feature mapping to extract the data's field types, field lengths, association rules, and numerical distribution characteristics, generating pseudo-data that is identical to the real data. The module strictly controls the field matching degree of the pseudo-data to be between 60% and 80%, and the numerical distribution deviation to be between 30% and 50%. This ensures similarity to the real data for a deceptive effect while preventing misjudgment as real data through deviations. Based on the business logic of the real financial data, the module constructs the relationships between the pseudo-data, forming a complete dynamic deceptive dataset. A preset 7-day update cycle is set, and an automated background program periodically updates the pseudo-data with core content such as employee names, transaction objects, and specific amounts, ensuring the timeliness and continuity of the deceptive effect.

[0025] As the front-end sensing unit for security protection, the early warning module monitors the multi-dimensional status of the enterprise's financial data storage system in real time after activation. Its working logic is based on "full-scenario coverage + precise identification," and technically integrates multiple methods such as traffic analysis, log parsing, and hardware monitoring. At the network layer, it monitors abnormal IP connections in real time through professional traffic analysis tools, identifying access requests from non-enterprise intranet IPs, scanning behavior targeting common ports such as 21, 22, and 3389, DDoS attack traffic exceeding preset thresholds in connection requests per unit time, and abnormal SSL / TLS encrypted tunnel communication. At the permission layer, it captures abnormal behaviors such as unauthorized account logins, unauthorized access to financial statements by ordinary employee accounts, and administrator account logins outside of working hours by parsing system login and operation logs. At the physical layer, it relies on the server hardware monitoring module to detect physical intrusion behaviors such as unregistered USB device access, server chassis open signals, and unauthorized access to the data center access control system. At the data layer, it identifies batch read behaviors that read more than 100 financial records at a time, abnormal export behaviors that export data to unauthorized storage media, and data tampering operations that modify the timestamp and amount fields of financial records by monitoring file operation logs. When an intrusion attack is detected in any dimension, the early warning module immediately generates a standardized attack warning signal and transmits it to the hybrid encryption module in real time, triggering subsequent protection processes.

[0026] The hybrid encryption module operates under a dual-mode design of "normal high efficiency + emergency protection," with its core technology lying in the precise application of a pseudo-logic sorting algorithm. When no attack warning signal is received, the module stores the company's financial data and the dynamic deceptive dataset in separate logical partitions. A file system isolation mechanism ensures efficient read access during normal operations, meeting the convenience needs of financial administrators. Upon receiving an attack warning signal from the warning module, the module immediately activates the emergency protection mode. First, it segments the real financial data and the dynamic deceptive dataset, ensuring each segment contains a complete field structure (such as employee ID, transaction amount, transaction object, and date), guaranteeing the independence and verifiability of data segments during subsequent encryption and decryption. Then, based on preset pseudo-logic rules (such as alternating sorting by amount field similarity and date field), all data segments are cross-sorted, forming a hybrid data set that superficially conforms to the "sorted by date + amount" business logic but is actually obfuscated, making it difficult for attackers to distinguish between real and deceptive data. The entire hybrid process strictly preserves the integrity of the data segments, providing fundamental support for the encryption operations of the subsequent key management module and the separation operations of the multi-layered decryption verification module.

[0027] The key management module, as the core unit of data encryption, employs RSA asymmetric encryption to construct a dual-key system. Its working logic revolves around "deception and inducement + real protection." The module first generates a deception key set containing three independent deception keys and one highly complex real key. The deception key set is used to encrypt 60% of the pseudo-data fragments in the mixed data set, while the real key is used to encrypt 80% of the real financial data fragments. During encryption, the module ensures security through the public-private key pair mechanism of the asymmetric encryption algorithm. Simultaneously, it integrates the encrypted deception data fragments with the real data fragments to form an error message set. This error message set possesses complete financial data structure characteristics, capable of misleading attackers into believing they have obtained the real data after cracking the deception keys, thus interfering with the attack and buying time for the real data security. The keys are stored independently on encrypted storage media, physically isolated from the mixed data set, further enhancing key security.

[0028] The multi-layer decryption verification module, serving as the core checkpoint for authorized access, operates based on a "multi-layer verification + risk control" logic, technically integrating hash verification, time threshold control, and locking mechanisms. When a financial administrator initiates an access request, the module first prompts for the input of a first decoy key. After the administrator enters it, the system performs a hash verification, comparing the hash value of the input key with the pre-stored hash value of the decoy key character by character to confirm the key's validity. Subsequently, according to the administrator's preset input threshold (e.g., 3 times), the module sequentially prompts for the input of other decoy keys, while setting a time limit of no more than 60 seconds between each input to prevent brute-force attacks. After all preset decoy keys are entered consecutively and verified successfully, the module proceeds to the real key verification stage, similarly confirming the validity of the real key through hash verification. Once the real key verification is successful, the module initiates a data separation program. Based on the verification fields hidden in the real data fragments (such as encryption identifiers at specific locations), it accurately separates the real financial data fragments from the pseudo-data fragments from the mixed data set, outputting only the real financial data to the administrator. If any deceptive key is entered incorrectly or the input interval is exceeded, the module automatically records detailed logs such as operation time, terminal IP, and number of errors, and triggers a temporary locking mechanism. The locking duration increases with the number of errors (1 minute for the first time, half an hour for the second time, and 1 hour for the third time), effectively preventing brute-force attacks and malicious attempts.

[0029] The dynamic configuration module provides flexible adaptability to the entire security system. Its working logic embodies the design philosophy of "user autonomy + automatic updates," and technically supports custom configuration of multi-dimensional parameters and automatic triggering mechanisms. Financial administrators can define the number of valid decryption keys, the threshold for consecutive inputs, the complexity requirements of the real key (such as the combination rules of uppercase and lowercase letters + numbers + special symbols, and a length of no less than 16 characters), and the key update cycle through the system's visual interface. When the administrator completes access to financial data and exits the system, the dynamic configuration module automatically triggers a re-encryption process. Based on the updated parameters, it generates a new decryption key set and a real key, and re-performs the mixing and encryption operation on the financial data and the updated dynamic decryption dataset, generating a new mixed data set. This ensures that the data security protection status is at an optimal level after each access, adapting to changes in the enterprise's security needs at different times.

[0030] The backup module serves as a safety net for data security, operating on the principle of "real-time synchronization + encrypted storage," and employing the same encryption protection mechanism as the master data. When an administrator successfully accesses financial data after passing through multiple layers of decryption verification, the backup module simultaneously activates, capturing the administrator's actions in real time. If the administrator performs read or modify operations, the module immediately performs a complete backup of the original data prior to the operation. The backup data is stored on an independent encrypted storage medium and protected using the same asymmetric encryption algorithm as the master data, ensuring its security. If the module detects accidental data deletion by the administrator, it can quickly recover the data based on the latest backup data, preventing permanent data loss due to human error and providing dual protection for the integrity of financial data.

[0031] The advantages of this invention are: actively deceiving attack behavior and reducing the risk of data leakage: by constructing a dynamic deceptive dataset, which is mixed with real data and encrypted when attacked, an error information set is formed to induce attackers, making it difficult for attackers to distinguish between real data and deceptive data, significantly extending the attack time, and buying time for security response, thus solving the problem of the lack of an active deception mechanism in the prior art; Multi-layer key verification enhances protection strength: It adopts a multi-layer verification method of "deceptive key group + real key", combined with hash verification, input interval restriction and locking mechanism, to effectively prevent risks such as brute-force attack and key theft, and solves the problem of single key verification in existing technology; Dynamic configuration adapts to diverse needs: Administrators can independently define parameters such as the number of deception keys, key complexity, and update cycle. After access, the encryption is automatically re-encrypted, enabling security protection to adapt to the security needs of different enterprises and different scenarios, thus solving the problem of fixed encryption rules in existing technologies. Synchronous backup prevents data loss: The backup module synchronously backs up data when the administrator accesses it, and uses encrypted storage to effectively deal with data deletion or damage caused by accidental operation, providing a safety net for data security. Multi-dimensional early warning achieves comprehensive protection: The early warning module covers intrusion attack monitoring at the network layer, permission layer, physical layer, and data layer, ensuring that all kinds of attack behaviors can be detected in time and trigger the protection process, solving the problem of incomplete attack monitoring in existing technologies; Pseudo-logical sorting enhances data obfuscation: The pseudo-logical sorting of the hybrid encryption module makes the hybrid data set appear to conform to business logic, further enhancing the deceptive effect, while preserving the integrity of data fragments and not affecting normal decryption access, thus balancing security and availability.

[0032] The above are merely embodiments of the present invention. The circuits, electronic components, and modules involved are all prior art, fully achievable by those skilled in the art, and require no further explanation. The content protected by this application does not involve improvements to the software and methods. Commonly known structures and characteristics in the solutions are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are able to access all prior art in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the application.

Claims

1. A method for securely storing computer information, characterized in that: Includes the following steps: S1: Obtain a computer information set and construct a dynamic deceptive dataset based on the computer information set; S2: Deploy an early warning module, which monitors intrusion attacks in real time and generates attack early warning signals; S3: Construct a hybrid encryption module. When the early warning module does not generate an attack warning signal, the computer information set and the dynamic deceptive dataset are stored independently. When an attack warning signal is received, the hybrid encryption module mixes and scrambles the computer information set and the dynamic deceptive dataset through pseudo-logical sorting to form a hybrid data set. S4: Configure the key management module. The key management module includes a deceptive key group and a real key. The deceptive key group contains several independent deceptive keys, which encrypt some deceptive data fragments in the mixed data set through asymmetric encryption. The real key encrypts some computer information fragments in the mixed data set. S5: Build a multi-layer decryption verification module. When the administrator accesses the system, he / she must first enter a preset number of valid deception keys, and then enter the real key. After successful verification, the computer information set can be obtained. If the number of incorrect key entries exceeds the threshold, a temporary locking mechanism is triggered. S6: Set up a dynamic encryption configuration module. Administrators can define the number of valid decryption keys, the threshold for consecutive inputs, the complexity of the real key, and the key update cycle. After the access is completed, re-encryption is automatically triggered, and a new mixed data set is generated based on the updated key parameters.

2. The computer information security storage method as described in claim 1, characterized in that: The acquired computer information set includes structural features, data formats, and related logic; the intrusion attack includes network attack traffic, abnormal privilege access, physical access behavior, and abnormal data operation.

3. The computer information security storage method as described in claim 2, characterized in that: The process of constructing a dynamic deceptive dataset includes: S101: Extract the data field types, field lengths, association rules, and numerical distribution characteristics of the target computer information set; S102: Use feature mapping to generate pseudo-data that is from the same source as the target computer information set. The field matching degree of the pseudo-data is 80-60%, and the numerical distribution deviation is 50-30%. S103: Based on the business logic of the target computer information set, construct the relationship between pseudo data to form a dynamic deceptive dataset, and the dynamic deceptive dataset supports automatic updating of pseudo data content and association rules according to a preset period.

4. A computer information security storage method as described in claim 1, characterized in that: The encrypted deceptive data fragments and computer information fragments form an error message set, which is used to mislead attackers into believing that the decryption has been successfully completed.

5. A computer information security storage method as described in claim 1, characterized in that: Attacks monitored by the early warning module include: Network layer monitoring: abnormal IP connections, port scanning, DDoS attack traffic, and encrypted tunnel communication; Access control monitoring: unauthorized account login, unauthorized access, and abnormal operations by privileged accounts; Physical layer monitoring: unauthorized USB access, device disassembly, and unauthorized physical access; Data layer monitoring: batch data reading, abnormal data export, and data tampering operations.

6. A computer information security storage method as described in claim 1, characterized in that: The pseudo-logical sorting includes: The target computer information set and the dynamic deceptive dataset are divided into data segments, each containing a complete field structure; based on preset pseudo-logic rules, the data segments are cross-sorted to form a mixed data set that superficially conforms to business logic but is actually confusing; the integrity of the data segments is preserved during the mixing process to ensure that each encrypted segment can be independently decrypted and verified.

7. A computer information security storage method as described in claim 1, characterized in that: The verification process of the multi-layer decryption verification module includes: The administrator enters the first deceptive key, and the system verifies the key's validity through hash verification. Enter other valid deception keys sequentially according to the preset number of attempts, with an interval of ≤60 seconds between each entry. If the keys are entered correctly consecutively, the process will proceed to the real key verification stage. After the real key is verified, the system separates the computer information set from the dynamic deceptive dataset and outputs the target computer information set. If any deception key is entered incorrectly or times out, the system records the operation log and triggers a temporary lock, with the lock duration increasing with the number of errors.

8. A computer information security storage method as described in claim 1, characterized in that: It also includes a backup module, which is used to synchronously back up the computer information set when the administrator accesses it, thereby preventing accidental deletion.

9. It also includes a computer information security storage system, applied to the computer information security storage method according to any one of claims 1-8, comprising a dataset construction module, an early warning module, a hybrid encryption module, a key management module, a multi-layer decryption verification module, and a dynamic configuration module.

Images