Business data hot and cold layering storage and transparent access platform

Abstract

The application discloses a kind of service data hot and cold layered storage and transparent access platform, it is related to data protection technical field, including compliance adaptation module, strategy control and resource coordination module, data migration and verification module, data desensitization and traceability module, access adaptation and source switching module and security situation awareness module, each module is established two-way data interaction link by distributed network.The application is by building compliance adaptation, strategy control and resource coordination, data migration and verification, data desensitization and traceability, access adaptation and source switching, six big modules of security situation awareness distributed two-way interaction architecture, with compliance rule as front support, realize migration and desensitization parallel execution, cold and hot data source seamless switching and the integrated management of whole-link risk prevention and control, so it can solve the problem of cold and hot data management fragmentation in the prior art, compliance requirements and storage operation disconnection, data access needs manual intervention switching and security risk difficult to cover the whole world.

Description

Technical Field

[0001] This invention relates to the field of data protection technology, and in particular to a business data cold and hot tiered storage and transparent access platform. Background Technology

[0002] The business data hot and cold tiered storage and transparent access platform identifies the hot and cold attributes of business data and implements tiered storage and low-impact migration and archiving. Under the premise of ensuring data security, integrity and compliance, it realizes transparent data access, optimizes storage resource allocation, reduces operation and storage costs, and avoids data migration from interfering with business operations, thus supporting the efficient and stable operation of the business.

[0003] Currently, existing solutions for tiered cold and hot data storage and transparent access in business technologies suffer from fragmented cold and hot data management, a disconnect between compliance requirements and storage operations, the need for manual intervention in data access switching, and difficulties in fully covering security risks. These issues result in low data management efficiency, increased compliance risks, and a poor business access experience, while data security, integrity, and system stability cannot be effectively guaranteed.

[0004] Therefore, a business data cold and hot tiered storage and transparent access platform is proposed to solve the above problems. Summary of the Invention

[0005] The main objective of this invention is to provide a business data cold and hot tiered storage and transparent access platform to solve the problems mentioned in the background above.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: a business data cold and hot layered storage and transparent access platform, including a compliance adaptation module, a policy control and resource collaboration module, a data migration and verification module, a data desensitization and traceability module, an access adaptation and source switching module, and a security situation awareness module. Each module establishes a two-way data interaction link through a distributed network. The compliance adaptation module outputs a hierarchical storage set of compliance rules, providing pre-rule support for subsequent modules. The policy control and resource coordination module receives the hierarchical storage compliance rule set input from the compliance adaptation module, configures data archiving and migration strategies, data backup strategies, monitors task execution status and system resource allocation, and builds metadata services to maintain the full-link metadata of hierarchical storage. The data migration and verification module receives the data archiving and migration strategy from the strategy control and resource collaboration module, performs cold and hot data migration and archiving operations, performs hash verification on data blocks before and after migration, and synchronously completes the integrity verification and erroneous data retransmission of the data transmission and storage links. The data desensitization and traceability module and the data migration and verification module operate in parallel, performing desensitization operations according to the data's hot / cold attributes and sensitivity levels, and recording the complete operation trajectory. The access adaptation and source switching module connects with the policy control and resource collaboration module's metadata service, enabling seamless switching between hot and cold data sources based on metadata query results, and completing business data access operations. The security situation awareness module covers the entire operation process of the other modules, integrates hierarchical storage full-link data, identifies security risks and storage node failure risks, and executes preset protection operations. When a node failure is detected, it triggers the backup data recovery process.

[0007] Preferably, the compliance adaptation module includes a compliance rule base construction unit, a policy monitoring unit, a compliance report generation unit, and a high-risk data processing unit; The compliance rule base construction unit collects current industry standards, regional regulations and corporate internal control clauses to establish a multi-dimensional set of compliance rules. The policy monitoring unit continuously monitors the dynamic updates of compliance policies, automatically updates the rule set, and maps it to the hierarchical storage strategy. The compliance report generation unit records the correspondence between hierarchical storage operations, data protection measures, and compliance clauses, and compiles a compliance audit report; The high-risk data processing unit automatically locates the storage node for high-compliance-risk data and enables enhanced encryption and multiple backup mechanisms.

[0008] Preferably, the policy control and resource collaboration module includes an access control unit, a credential management unit, a policy configuration unit, an alarm monitoring unit, a table structure synchronization unit, and a metadata management unit; The permission management unit allocates operation permissions according to the least privilege standard and the separation of duties mechanism, and performs a dual-role cross-approval process for high-risk operations. The voucher management unit uses encrypted storage to uniformly manage sensitive vouchers in the database, eliminating hard-coded and plaintext input behaviors. The strategy configuration unit sets the backup cycle, data filtering conditions, and table archiving strategy. The alarm monitoring unit provides a visual dashboard to display the task execution status, progress and resource usage, and sends notification information to preset terminals when an anomaly is detected. The table structure synchronization unit reads the source database table structure information at a fixed period and automatically updates the target stored table structure when a structure change is detected. The metadata management unit constructs and maintains a hierarchical storage metadata model, records the storage node addresses, storage status, data attributes, and flow trajectory of hot and cold data, and provides real-time metadata query services for the access adaptation and source switching modules.

[0009] Preferably, the strategy configuration unit of the strategy control and resource coordination module includes a data filtering subunit, a table partitioning strategy configuration subunit, and a scheduling mode configuration subunit; The data filtering subunit selects the time field in the data source table as the hierarchical filtering basis and allows the addition of custom filtering conditions. The table partitioning strategy configuration sub-unit sets the archiving table partitioning mode by day, month, or year, and automatically adds a table partitioning identifier suffix to the original table name; The scheduling configuration subunit defines the task execution time point through Cron expressions.

[0010] Preferably, the data migration and verification module includes a node scheduling unit, a batch adjustment unit, a data verification unit, and a source data processing unit; The node scheduling unit detects the current task load and resource usage ratio of each execution node in real time, and sends migration instructions to the node with the least task load and the lowest resource usage ratio. The batch adjustment unit adjusts the data volume and batch interval of subsequent batches based on the actual execution time of the preceding migration batches. After the data is written to cold storage, the data verification unit reads the original data and archived data sequentially to perform field-level consistency verification. After the data verification is passed, the source data processing unit performs source data cleaning operations according to preset rules.

[0011] Preferably, the data verification unit of the data migration and verification module includes a source data reading subunit, an archived data reading subunit, a data comparison subunit, and a verification result processing subunit; The source data reading subunit extracts the batch data that has been migrated from the source database; The archived data reading subunit extracts the corresponding archived batch data from the cold storage node; The data comparison subunit performs a field-level consistency comparison between the original data and the archived data; When the verification results are consistent, the verification result processing subunit triggers the source data processing unit to perform a cleanup operation; when the verification results are inconsistent, the subsequent migration operation is terminated and an alarm message is sent to the preset terminal.

[0012] Preferably, the data desensitization and traceability module includes a desensitization rule configuration unit, a desensitization execution unit, a traceability chain construction unit, and a permission-level restoration unit; The desensitization rule configuration unit is divided according to data type and sensitivity level to establish a dynamic desensitization rule set; The desensitization execution unit performs field-level desensitization operations on hot data and performs desensitization operations on cold data according to its sensitivity level, and synchronously switches the corresponding desensitization rules during the data migration process; The traceability chain construction unit writes the de-identification rule identifier, de-identification execution time, operation subject identifier, and data flow path information into the blockchain node; The permission-based restoration unit performs desensitization and restoration operations on hot data according to the user's preset permission level. The restoration operation requires secondary authorization verification and operation log recording.

[0013] Preferably, the traceability chain construction unit of the data desensitization and traceability module includes an operation information recording subunit, a blockchain storage subunit, and a traceability query subunit; The operation information recording subunit collects the rule application identifier, timestamp, and operation subject identifier information during the desensitization operation process; The blockchain storage subunit uploads the collected operation information to a preset blockchain node for distributed storage. The traceability query subunit provides an operation trajectory query interface, which supports retrieving the flow path and processing details of de-identified data.

[0014] Preferably, the access adaptation and source switching module includes a metadata query unit and a data source switching unit; The metadata query unit initiates a query request to the backend metadata service to obtain the storage node address and storage status information of the target data. The data source switching unit directly connects to the hot data storage node to access data based on the metadata query results, or prioritizes connecting to the cold data storage node to access data. If the cold data storage node does not find the target data, it switches to connecting to the hot data storage node.

[0015] Preferably, the security situation awareness module includes a data integration unit, a risk identification unit, a response measure execution unit, and a situation report generation unit; The data integration unit collects data access logs, migration operation records, encryption execution status, node running parameters, and compliance adaptation results. The risk identification unit uses a preset AI analysis model to perform calculations on the integrated data to identify risk types such as storage node security vulnerabilities, encryption mechanism failures, migration link anomalies, and compliance adaptation deviations. The response execution unit performs operations such as updating the encryption mechanism, fixing node vulnerabilities, or pausing and upgrading the encryption level according to the preset risk level classification standard. Under high-risk conditions, the full-level data protection mechanism is activated. The situation report generation unit presents the risk distribution range and response progress, and provides an access point for administrators.

[0016] The present invention has the following beneficial effects: 1. This invention constructs a distributed bidirectional interactive architecture with six modules: compliance adaptation, policy control and resource collaboration, data migration and verification, data anonymization and traceability, access adaptation and source switching, and security situation awareness. With compliance rules as the prerequisite support, it achieves integrated management of parallel execution of migration and anonymization, seamless switching of cold and hot data sources, and end-to-end risk prevention and control. Compared with existing technologies, it can improve the end-to-end collaboration and closed-loop management capabilities of cold and hot tiered storage. Therefore, it can solve the problems of fragmented cold and hot data management, disconnect between compliance requirements and storage operations, manual intervention for data access switching, and difficulty in fully covering security risks in existing technologies.

[0017] 2. This invention achieves fully automated execution of the data archiving and migration process and refined control of security permissions through automatic table structure synchronization, least privilege allocation, and dual-role cross-approval mechanism in the strategy control and resource collaboration module, combined with dynamic node scheduling and batch adaptive adjustment functions in the data migration and verification module, and a unified management scheme for sensitive credential encryption. Compared with existing technologies, it can improve the adaptability of migration tasks to business systems, operational security, and long-term maintainability of the system. Therefore, it can solve the problems of data migration relying on manual operation, table structure changes requiring manual synchronization, the risk of leakage of sensitive credentials, and the impact of migration operations on real-time business performance in existing technologies.

[0018] 3. This invention achieves precise protection of sensitive data throughout its entire lifecycle, tamper-proof traceability of operation tracing, and closed-loop assurance of data integrity by combining the dynamic desensitization rule adaptation and blockchain evidence storage and traceability mechanism of the data desensitization and traceability module with the field-level consistency verification function of the data migration and verification module, and the AI-driven full-link risk identification scheme of the security situation awareness module. Compared with existing technologies, it can improve the targeting of sensitive data protection, the credibility of operation traceability, and the timeliness of risk prevention and control. Therefore, it can solve the problems of lack of flexibility in desensitization strategies, incomplete data operation traceability, easy data loss and damage during migration, and delayed security risk identification in existing technologies. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the overall system architecture of the present invention; Figure 2 This is a schematic diagram of the compliance adaptation module architecture of the present invention; Figure 3 This is a schematic diagram of the strategy control and resource collaboration module architecture of the present invention; Figure 4 This is a schematic diagram of the data migration and verification module architecture of the present invention; Figure 5 This is a schematic diagram of the data desensitization and traceability module architecture of the present invention; Figure 6 This is a schematic diagram of the access adaptation and source switching module architecture of the present invention; Figure 7 This is a schematic diagram of the security situation awareness module architecture of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the technical features of the embodiments of the present invention. Obviously, the described embodiments belong to some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0021] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “said” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0022] Depending on the context, the word "if" or "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0023] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0024] In practice, the server-side equipment deployed in the business data cold and hot tiered storage and transparent access platform of this invention may consist of one or more devices. The platform can be implemented as: a business instance, a virtual machine, or hardware devices. For example, the platform can be implemented as a business instance deployed on one or more devices in a cloud node, i.e., software deployed on the cloud node, used to provide data cold and hot tiered storage and transparent access services for various business systems; or, the platform can also be implemented as a virtual machine deployed on one or more devices in a cloud node, with application software installed in the virtual machine for data tiered storage management; or, the platform can also be implemented as a server composed of numerous identical or different types of hardware devices, with one or more hardware devices specifically configured to provide integrated services such as data cold and hot tiered storage, data anonymization, access adaptation, and security protection.

[0025] In terms of implementation, the platform and business system of this invention are mutually compatible: that is, if the platform is an application installed on a cloud service platform, the business system is a client that establishes a communication connection with the application; or if the platform is implemented as a website, the business system accesses it through a web page; or if the platform is implemented as a cloud service platform, the business system accesses it through a mini-program or API interface in an instant messaging application.

[0026] The business data cold and hot tiered storage and transparent access platform of this invention can be set up in a cloud server. In terms of implementation, it can be used as one or more service devices, or as an application installed in the cloud (such as the server of a mobile service operator, server cluster, etc.), or developed as an independent website.

[0027] In this embodiment of the invention, each module of the platform can be implemented independently and establishes a bidirectional data interaction link with other modules through a distributed network, enabling inter-module invocation and collaboration. Here, invocation can be understood as a module connecting to multiple modules of another type and providing corresponding data support or functional services to those connected modules. In the platform provided by this embodiment, the applicability of the platform architecture can be adjusted by adding functional units and expanding interfaces without modifying the core program code, achieving cluster-based horizontal expansion to quickly and flexibly expand the platform's service capabilities. In practical applications, the above modules can be set in the same device or different devices, or in virtual devices, such as service instances in a cloud server.

[0028] The following detailed descriptions of the platform's components and specific workflows, using specific embodiments, provide a detailed explanation of each component.

[0029] Example 1, please refer to Figure 1 and Figure 2 As shown: A business data cold and hot tiered storage and transparent access platform, including a compliance adaptation module, a policy control and resource collaboration module, a data migration and verification module, a data desensitization and traceability module, an access adaptation and source switching module, and a security situation awareness module. Each module establishes a two-way data interaction link through a distributed network. The compliance adaptation module outputs a hierarchical storage set of compliance rules to provide pre-defined rule support for subsequent modules. The compliance adaptation module includes a compliance rule base construction unit, a policy monitoring unit, a compliance report generation unit, and a high-risk data processing unit; The compliance rule library building unit collects current industry standards, regional regulations, and corporate internal control clauses to establish a multi-dimensional set of compliance rules. The policy monitoring unit continuously monitors the dynamic updates of compliance policies, automatically updates the rule set, and maps it to the hierarchical storage strategy; The compliance report generation unit records the correspondence between hierarchical storage operations, data protection measures, and compliance clauses, and compiles compliance audit reports; The high-risk data processing unit automatically locates the storage nodes for high-compliance-risk data and enables enhanced encryption and multiple backup mechanisms.

[0030] Furthermore, the business data cold and hot tiered storage and transparent access platform includes a compliance adaptation module, a policy control and resource collaboration module, a data migration and verification module, a data anonymization and traceability module, an access adaptation and source switching module, and a security situation awareness module. Each module establishes a two-way data interaction link through a distributed network, forming a closed-loop management architecture for the entire chain, including compliance pre-positioning, policy control, migration verification, anonymization and traceability, access adaptation, and security protection.

[0031] The collaborative sequence logic of each module is as follows: The compliance adaptation module starts before other modules, outputting a set of compliance rules to the policy control and resource collaboration module; the policy control and resource collaboration module configures storage policies based on the compliance rules and simultaneously builds metadata services; the data migration and verification module and the data masking and traceability module start in parallel after receiving policy instructions, respectively executing data migration verification and masking operations; the access adaptation and source switching module calls the metadata service in real time to respond to business access requests; the security situation awareness module collects the running data of each module throughout the process and performs risk prevention and control in real time. Asynchronous data interaction between modules is achieved through a distributed message queue to ensure collaborative stability in high-concurrency scenarios.

[0032] The compliance adaptation module, serving as a front-end support unit, outputs a set of hierarchical storage compliance rules, providing a compliance basis for the operation of all subsequent modules. The policy control and resource collaboration module receives compliance rule inputs, configures various storage policies, and builds metadata services to provide policy guidance and resource scheduling for other modules. The data migration and verification module performs cold and hot data migration based on preset migration policies and ensures data integrity through hash verification. The data desensitization and traceability module runs in parallel with the migration module, performing desensitization operations on data with different cold / hot attributes and sensitivity levels, while recording the operation trajectory. The access adaptation and source switching module relies on metadata services to achieve seamless switching between cold and hot data sources, ensuring the transparency of business access. The security situation awareness module covers the entire process, monitors risks in real time, and performs protective operations to ensure stable system operation.

[0033] The compliance rule library building unit collects current industry standards, regional regulations, and corporate internal control clauses to establish a multi-dimensional set of compliance rules.

[0034] Specifically, the compliance rule base construction unit automatically collects fundamental laws and regulations such as the National Data Security Law and the Personal Information Protection Law, as well as industry standard texts for specific sectors such as finance, healthcare, and government, through legal means such as authorized compliance data source interfaces and targeted collection from official release channels. It also imports internal control system clauses related to data storage management and data security protection. The collected laws, standards, and system texts undergo natural language processing, using algorithms such as keyword extraction, semantic analysis, or clause classification to break down the text content into executable rule entries. Each rule entry includes core elements such as rule identifier, applicable scenario, constraints, and violation handling methods. The rule entries are categorized according to five dimensions: data classification and grading, storage period, encryption requirements, access permissions, and audit traceability, establishing a multi-dimensional compliance rule set. Priority weights are assigned to rules in each dimension, with rules involving sensitive personal information and core business data having the highest priority.

[0035] The policy monitoring unit continuously monitors the dynamic updates of compliance policies, automatically updates the rule set, and maps it to the hierarchical storage strategy.

[0036] Specifically, the policy monitoring unit has a pre-defined list of monitoring sources, including national legal databases, official websites of industry regulatory authorities, and publishing platforms of standard-setting bodies. It continuously monitors policy updates through scheduled web crawling and subscription-based push notifications. When a new regulation is released, an existing regulation is revised, or a standard is updated, the unit automatically captures the updated text content and compares it with existing rules in the rule base to identify newly added, modified, and invalid rule entries. Newly added rule entries are structured and incorporated into the rule set; modified rule entries have their corresponding constraints and applicable scenarios updated; and invalid rule entries are marked and their application stopped. Simultaneously, based on a pre-defined mapping relationship between rules and hierarchical storage strategies, the updated rules are automatically associated with the corresponding storage strategy.

[0037] The compliance report generation unit records the correspondence between hierarchical storage operations, data protection measures, and compliance clauses, and compiles compliance audit reports.

[0038] Specifically, the compliance report generation unit collects operation logs from various modules of the platform in real time, including data migration time, storage node information, anonymization operation types, access permission allocation records, and encryption execution status. It also records the compliance rules applicable to each operation. Statistical analysis is performed on the matching of the collected operation data with compliance rules according to the audit cycle to determine whether each operation meets the corresponding compliance requirements, and to mark compliance deviations and their reasons. Using a preset report template, the unit integrates operation records, compliance matching results, deviation analysis, and rectification suggestions into a compliance audit report. The report includes core indicators such as data classification statistics, compliance compliance rate, a list of high-risk operations, and rule adaptation status, and supports exporting to PDF, Excel, and other formats, providing complete compliance documentation for internal audits and regulatory inspections.

[0039] The high-risk data processing unit automatically locates the storage nodes for high-compliance-risk data and enables enhanced encryption and multiple backup mechanisms.

[0040] Specifically, the high-risk data processing unit assesses the risk of data stored on the platform based on pre-defined risk level classification standards in the compliance rule base, identifying data involving sensitive personal information, core trade secrets, and important government data as high-compliance-risk data. It automatically locates the physical storage location of high-risk data by querying metadata to obtain information such as the storage node address and storage status. For this type of data, a strengthened encryption mechanism is implemented, using conventional encryption algorithms for data storage encryption and employing secure transmission protocols for data transmission protection. A multiple backup mechanism is also implemented, synchronously backing up high-risk data to at least two storage nodes in different regions. Backup data is also stored encrypted, and its integrity is regularly verified to ensure the security and availability of high-risk data.

[0041] Example 2, please refer to Figure 1 and Figure 3 As shown: A business data cold and hot tiered storage and transparent access platform, the policy control and resource collaboration module receives the tiered storage compliance rule set input from the compliance adaptation module, configures data archiving and migration policies, data backup policies, monitors task execution status and system resource allocation, and builds metadata services to maintain the full-link metadata of tiered storage; The policy control and resource collaboration module includes an access control unit, a credential management unit, a policy configuration unit, an alarm monitoring unit, a table structure synchronization unit, and a metadata management unit. The access control unit allocates operational permissions according to the minimum permission standard and the separation of duties mechanism, and performs a dual-role cross-approval process for high-risk operations; The voucher management unit uses encrypted storage to uniformly manage sensitive vouchers in the database, eliminating hard-coded and plaintext input behaviors. The strategy configuration unit sets the backup cycle, data filtering conditions, and table archiving strategy; The alarm monitoring unit provides a visual dashboard that displays the task execution status, progress, and resource usage. When an anomaly is detected, it sends notification information to preset terminals. The table structure synchronization unit reads the table structure information of the source database at fixed intervals and automatically updates the table structure of the target storage when a structure change is detected. The metadata management unit builds and maintains a hierarchical storage metadata model, recording the storage node addresses, storage status, data attributes, and flow trajectory of hot and cold data, providing real-time metadata query services for the access adaptation and source switching modules.

[0042] The strategy configuration unit of the strategy control and resource coordination module includes a data filtering subunit, a table partitioning strategy configuration subunit, and a scheduling method configuration subunit; The data filtering sub-unit selects the time field in the data source table as the hierarchical filtering basis and allows the addition of custom filtering conditions. The table partitioning strategy configuration sub-unit sets the archiving table partitioning mode by day, month, or year, and automatically adds a table partitioning identifier suffix to the original table name; The scheduling configuration subunit defines the task execution time using Cron expressions.

[0043] Furthermore, the policy control and resource collaboration module, as the core scheduling unit of the platform, receives the set of tiered storage compliance rules output by the compliance adaptation module. Through a distributed network, it establishes a two-way data interaction link with the compliance adaptation module, data migration and verification module, access adaptation and source switching module, etc., to realize storage policy configuration, dynamic resource scheduling, full lifecycle management of metadata, and full-link monitoring and alarms. It provides unified policy guidance and resource support for each module, ensuring the compliance and efficiency of the tiered storage process.

[0044] Specifically, the access control unit designs its access allocation system based on the principle of least privilege and the separation of duties mechanism. Operational permissions are categorized by functional module and data sensitivity, including configuration permissions, execution permissions, and audit permissions, assigning precise permission ranges to users with different roles. For high-risk operations, including changes to storage policies, sensitive data migration and scheduling, or metadata modification, a mandatory dual-role cross-approval process is implemented. Two users with corresponding approval permissions must confirm the operation sequentially before it takes effect, and the entire approval process is recorded to ensure traceability.

[0045] Specifically, the credential management unit uses the AES-256 encryption algorithm to encrypt and store sensitive credentials such as database accounts, access keys, and API interface credentials. The storage medium is a dedicated encryption server, physically isolated from the business server. A unified credential management interface provides credential access services, eliminating insecure behaviors such as hard-coding credentials in business code or transmitting credentials in plaintext. A periodic credential rotation mechanism is also implemented to automatically remind administrators to update expired credentials, preventing security risks caused by credential leakage.

[0046] Specifically, the strategy configuration unit, as the core configuration carrier of storage strategies, supports custom storage rules according to business scenarios, including data filtering sub-units, table partitioning strategy configuration sub-units, and scheduling method configuration sub-units. The data filtering sub-unit defaults to selecting the time field in the data source table, such as creation time and last access time, as the core filtering benchmark for hot / cold data stratification. It also supports users adding custom filtering conditions, such as data access frequency thresholds, data importance levels, and business line identifiers, allowing for precise data stratification through multiple condition combinations. The table partitioning strategy configuration sub-unit provides three standardized archiving modes: daily partitioning, monthly partitioning, and yearly partitioning. Users can choose as needed, and the system automatically adds a structured partitioning identifier suffix to the original table name, ensuring traceable naming conventions for archived tables. The scheduling method configuration sub-unit uses Cron expression syntax to define task execution times, supporting scheduling configurations accurate to the second. It also supports three scheduling modes: manual triggering, periodic looping, and one-time execution, meeting the needs of different business scenarios.

[0047] Specifically, the alarm monitoring unit constructs a visual operation and maintenance dashboard, displaying the execution status of migration and backup tasks in real time through charts, including pending, in progress, successful, or failed tasks, progress percentage, and remaining time. It also monitors core system resources, such as CPU utilization, memory usage, disk storage space, and network bandwidth, and sets up a multi-level threshold alarm mechanism. When abnormal situations such as task timeouts, resource overruns, or operation failures are detected, alarm information is automatically sent to preset terminals, administrator email, the operation and maintenance management platform, and SMS messages. The alarm content includes key information such as the type of abnormality, the time of occurrence, the associated task ID, and handling suggestions.

[0048] Specifically, the table structure synchronization unit supports user-preset cycles ranging from 1 minute to 24 hours. It actively reads table structure information from the source database, including field names, data types, lengths, constraints, and index information, and uses a structure comparison algorithm to detect whether the table structure has changed. When changes such as added fields, modified field types, or adjusted constraints are detected, a structure synchronization script is automatically generated. The script updates the target storage node, including cold and hot storage table structures, according to the principle of backup first and then synchronization, ensuring consistency between the source and target table structures and avoiding structural incompatibility issues during data migration or access.

[0049] Specifically, the metadata management unit constructs a multi-dimensional, hierarchical storage metadata model, which corely records the following metadata information: physical storage node addresses (IP addresses and ports) for hot and cold data, storage status (active, archived, backup, etc.), data attributes (data type, sensitivity level, hierarchical identifier, storage period, etc.), and data flow trajectory (migration time, migration batch, operator, etc.). The metadata adopts a real-time update mechanism; when data status changes, such as hot data being archived as cold data or cold data being restored as hot data, the metadata records are updated synchronously. It also provides a high-concurrency metadata query interface, offering millisecond-level response metadata query services for the access adaptation and source switching modules, supporting seamless data source switching.

[0050] Furthermore, the policy control and resource collaboration module supports dynamic policy adjustment. Users can modify configured storage policies through a visual interface, and the system automatically synchronizes the changes to relevant dependent modules without requiring a service restart. The metadata management unit adopts a distributed storage architecture and supports metadata copy backup to ensure high availability of metadata services.

[0051] Example 3, please refer to Figure 1 and Figure 4 As shown: A business data cold and hot tiered storage and transparent access platform, the data migration and verification module receives the data archiving and migration strategy from the policy control and resource collaboration module, executes the migration and archiving operation of cold and hot data, performs hash verification on data blocks before and after migration, and synchronously completes the integrity verification and erroneous data retransmission of the data transmission and storage links; The data migration and verification module includes a node scheduling unit, a batch adjustment unit, a data verification unit, and a source data processing unit; The node scheduling unit monitors the current task load and resource utilization ratio of each execution node in real time, and selects the node with the least task load and the lowest resource utilization ratio to issue migration instructions. The batch adjustment unit adjusts the data volume and batch interval of subsequent batches based on the actual execution time of the previous migration batch; After the data is written to cold storage, the data verification unit reads the original data and archived data sequentially to perform field-level consistency verification. After the data verification is passed, the source data processing unit performs source data cleaning operations according to preset rules.

[0052] The data verification unit of the data migration and verification module includes a source data reading subunit, an archived data reading subunit, a data comparison subunit, and a verification result processing subunit; The source data reading subunit extracts the batch data that has been migrated from the source database; The archived data reading subunit extracts the corresponding archived batch data from the cold storage node; The data comparison subunit performs a field-level consistency comparison between the original data and the archived data; When the verification results are consistent, the verification result processing subunit triggers the source data processing unit to perform a cleanup operation. When the verification results are inconsistent, the subsequent migration operation is terminated and an alarm message is sent to the preset terminal.

[0053] Furthermore, the data migration and verification module, as the core execution unit for hot and cold data flow, receives data archiving and migration strategies issued by the distributed network receiving strategy control and resource collaboration module. It operates in parallel with the data desensitization and traceability module, responsible for completing the migration and archiving of hot data to cold storage and the recovery migration of cold data to hot storage. Simultaneously, it performs hash verification on data blocks before and after migration to ensure the integrity of data transmission and storage, and synchronously handles erroneous data retransmission and source data cleanup, ensuring the reliability and security of data migration.

[0054] Specifically, the node scheduling unit collects real-time operational status data from each execution node, including metrics such as the number of tasks currently being handled, CPU utilization, memory usage, disk I / O rate, and network transmission rate. It then calculates the load pressure value of each node using a load balancing algorithm. The node with the fewest tasks and the lowest load pressure value is selected as the optimal execution node, and data migration instructions are issued to it. Simultaneously, a node fault tolerance mechanism is set up. When an execution node fails, unfinished migration tasks are automatically scheduled to a backup node, ensuring that the migration task is not interrupted.

[0055] Specifically, the batch adjustment unit records key indicators such as the actual execution time, data transfer rate, and failure rate of each batch of data migration, and analyzes the execution efficiency of previous batches through an adaptive algorithm. If the execution time of a previous batch exceeds a preset threshold, the data volume of subsequent batches is automatically reduced, with each reduction not exceeding 50%, and the batch interval is extended by 1.2 to 2 times the original interval. If the execution efficiency of previous batches is high, with the execution time below 60% of the threshold, the data volume of subsequent batches is appropriately increased to achieve dynamic optimization of the migration task and avoid system congestion caused by excessive data volume.

[0056] Specifically, the data verification unit uses the SHA-256 hash algorithm to ensure data integrity. The data verification unit includes a source data reading subunit, an archived data reading subunit, a data comparison subunit, and a verification result processing subunit. The source data reading subunit extracts the target batch data that has completed migration from the source database, hot storage nodes, cold storage nodes, etc., splits it into data blocks, calculates the hash value of each data block, and generates an original data hash verification list. The archived data reading subunit extracts the corresponding archived batch data from the target storage nodes, cold storage nodes, hot storage nodes, etc., uses the same splitting rules and hash algorithm as the original data, calculates the hash value of each data block, and generates an archived data hash verification list. The data comparison subunit performs field-level consistency comparisons between the hash verification lists of the original data and the archived data, and simultaneously verifies whether the number of data entries and the total number of bytes are consistent to ensure that no data is lost or tampered with. If the verification result processing subunit finds that the verification results are completely consistent, it sends a trigger signal to the source data processing unit to initiate the source data cleanup operation. If the verification results are inconsistent, the subsequent migration task will be terminated immediately, the location and reason of the inconsistent data block will be recorded, a verification failure alarm will be sent to the alarm monitoring unit, and the error data retransmission process will be automatically triggered. After retransmission, the verification will be re-executed.

[0057] Specifically, after receiving a verification pass signal from the data verification unit, the source data processing unit executes source data processing operations according to user-preset rules. Three processing modes are supported: permanent deletion, logical deletion, and archive backup, which users can configure as needed. If permanent deletion is selected, the source data is permanently deleted. If logical deletion is selected, a deletion flag is added to the source data, retaining the data record but not participating in business queries. If archive backup is selected, the source data is backed up to a temporary storage node, retained for a preset duration (7 to 365 days, customizable), and then automatically deleted. The entire processing process is logged, including processing time, processing mode, data volume, operator, and other information, supporting audit traceability.

[0058] Furthermore, the data migration and verification module supports breakpoint resume functionality. If the migration process is paused due to network interruption, node failure, or other reasons, it can resume from the point of interruption after recovery, without needing to re-migrate all data. It also supports pausing, restarting, and terminating migration tasks, meeting the flexible management needs of operations and maintenance personnel.

[0059] Example 4, please refer to Figure 1 and Figure 5 As shown: A business data cold and hot tiered storage and transparent access platform, in which the data desensitization and traceability module and the data migration and verification module run in parallel, perform desensitization operations according to the data cold and hot attributes and sensitivity levels, and record the complete operation trajectory; The data masking and traceability module includes a masking rule configuration unit, a masking execution unit, a traceability chain construction unit, and a permission-based restoration unit; The desensitization rule configuration unit is divided according to data type and sensitivity level to establish a dynamic desensitization rule set; The desensitization execution unit performs field-level desensitization operations on hot data and performs desensitization operations on cold data according to its sensitivity level, and switches the corresponding desensitization rules synchronously during the data migration process; The traceability chain construction unit writes the de-identification rule identifier, de-identification execution time, operation subject identifier, and data flow path information into the blockchain node; The permission-based restoration unit performs de-identification and restoration operations on hot data according to the user's preset permission level. The restoration operation requires secondary authorization verification and operation log recording.

[0060] The traceability chain construction unit of the data anonymization and traceability module includes an operation information recording subunit, a blockchain storage subunit, and a traceability query subunit; The operation information recording subunit collects the rule application identifier, timestamp, and operation subject identifier information during the desensitization operation process; The blockchain storage sub-unit uploads the collected operation information to preset blockchain nodes for distributed storage; The traceability query subunit provides an operation trajectory query interface, which supports retrieving the flow path and processing details of de-identified data.

[0061] Furthermore, the data anonymization and traceability module and the data migration and verification module operate in parallel. They receive policy instructions from the policy control and resource collaboration module through a distributed network, and perform differentiated anonymization operations based on the compliance rules of the compliance adaptation module according to the hot / cold attributes and sensitivity levels of the data. At the same time, an immutable operation traceability chain is constructed, supporting data anonymization and restoration with hierarchical permissions, ensuring data privacy and security as well as operation traceability.

[0062] Specifically, the data masking rule configuration unit establishes a dynamic set of masking rules based on data type (personal information, trade secrets, government data, general business data, etc.) and sensitivity level (high, medium, and low). It supports both custom rule configuration and template-based configuration. For highly sensitive data, such as ID card numbers, bank card numbers, and passwords, three rules are provided: mask replacement, encryption masking, and data replacement. For moderately sensitive data, such as mobile phone numbers, email addresses, and names, two rules are provided: partial hiding and format preservation masking. For low-sensitivity data, such as ambiguous address information and business transaction numbers, two rules are provided: adding data masking identifiers and removing redundant fields. Users can bind corresponding masking rules to different types and levels of data as needed, and the system supports adding, modifying, disabling, and deleting rules.

[0063] Specifically, the data masking execution unit employs a combination of real-time and batch data masking. Hot data processing performs field-level real-time data masking on real-time data currently accessed by business systems in hot storage. This masking process does not affect business access response speed, ensuring privacy and security during data use. Cold data processing performs batch masking according to the sensitivity level of data archived to cold storage, applying corresponding masking rules. The masked data is then stored in association with its metadata. During the migration process, when data is migrated between hot and cold storage, the masking rules are switched synchronously. For example, if the sensitivity level is upgraded when hot data is migrated to cold data, the system automatically switches to stricter masking rules to ensure consistency in masking before and after the migration.

[0064] Specifically, the traceability chain construction unit utilizes blockchain technology to achieve immutable storage of the operation trajectory, comprising an operation information recording subunit, a blockchain storage subunit, and a traceability query subunit. The operation information recording subunit collects key information from the entire de-identification operation process in real time, including de-identification rule identifiers, de-identification execution timestamps, operation entity identifiers, username plus account ID, unique data identifiers, data ID plus batch number, data flow path, source node address to target node address, etc. The blockchain storage subunit encapsulates the collected operation information into blockchain transactions according to a preset format and uploads them to consortium blockchain nodes for distributed storage. Each block contains the hash value of the previous block, ensuring that the data is immutable and tamper-proof. The traceability query subunit provides a standardized traceability query interface, supporting searches by data ID, operation time, operation entity, de-identification rule identifier, etc. The query results include a complete operation trajectory chain and related supporting data, and support the export of traceability reports.

[0065] Specifically, the permission-based restoration unit only supports the restoration of de-identified hot data; de-identified cold data is not allowed to be restored, ensuring the security of archived data. Access control is based on user roles, with restoration permission levels divided into super administrators, business administrators, and ordinary users. Only super administrators and authorized business administrators have restoration permissions. The restoration process requires a secondary authorization verification after a user with the necessary permissions initiates a restoration request, such as SMS verification code plus dynamic token. The restoration operation can only be executed after successful verification. The entire restoration operation is logged in detail, including the restoration request time, operator, data identifier, restoration rules, verification results, etc. The logs are synchronously uploaded to blockchain storage to ensure the traceability of the restoration operation.

[0066] Furthermore, the data masking and traceability module supports the canary release function of masking rules. Newly configured masking rules can be tested in designated business lines or data batches first, and then fully implemented after verification, reducing the risk caused by rule configuration errors.

[0067] Example 5, please refer to Figure 1 and Figure 6As shown: A business data cold and hot tiered storage and transparent access platform, which connects the access adaptation and source switching module with the policy control and resource collaboration module metadata service, realizes seamless switching of cold and hot data sources based on metadata query results, and completes business data access operations; The access adaptation and source switching module includes a metadata query unit and a data source switching unit; The metadata query unit sends a query request to the backend metadata service to obtain the storage node address and storage status information of the target data. Based on the metadata query results, the data source switching unit directly connects to the hot data storage node to access the data, or prioritizes connecting to the cold data storage node to access the data. If the cold data storage node does not find the target data, it switches to connecting to the hot data storage node.

[0068] Furthermore, the access adaptation and source switching module serves as an intermediate adaptation layer between the business system and the storage node. Through the metadata service of the distributed network connection strategy management and resource collaboration module, it enables seamless switching between hot and cold data sources based on metadata query results, responds to data access requests from the business system, and ensures the transparency of business access. The business system does not need to be aware of the actual storage location and continuity of the data.

[0069] Specifically, the metadata query unit encapsulates a standardized metadata query interface. When it receives an access request from a business system (e.g., query, add, modify, delete), it automatically extracts data identifiers from the request, such as table name, data ID, and business keywords, and initiates a real-time query request to the backend metadata service. The query request uses asynchronous communication to avoid blocking the business access process. The metadata service returns core information about the target data, including the actual storage node address, hot storage node IP, cold storage node IP, storage status (active, archived, etc.), data anonymization status, access permission requirements, etc. The metadata query response time does not exceed 100 milliseconds.

[0070] Specifically, the data source switching unit executes data source routing decisions based on metadata query results, and its switching logic is as follows: Priority Access Logic: By default, it prioritizes connecting to cold storage nodes to access data, reducing the access pressure on hot storage nodes. Abnormal Switching Logic: If the target data is not found on the cold storage node, or if the cold storage node malfunctions or times out, it automatically switches to connecting to the hot storage node to ensure uninterrupted business access. Transparent Switching Process: The data source switching process is completely transparent to the business system. The business system does not need to modify the access address or configuration parameters, and the access response time is essentially the same as directly accessing a single storage node, with no significant delay.

[0071] Furthermore, the access adaptation and source switching module supports an access caching mechanism, caching frequently accessed metadata query results and hot data locally to reduce the number of metadata service queries and storage node access pressure, thereby improving access response speed. It also features fault isolation functionality; when a storage node malfunctions, the faulty node is automatically isolated, and access requests are routed to normal nodes, ensuring overall system availability.

[0072] Example 6, please refer to Figure 1 and Figure 7 As shown: A business data cold and hot tiered storage and transparent access platform, the security situation awareness module covers the entire operation process of the other modules, integrates the data of the entire tiered storage link, identifies security risks and storage node failure risks, and executes preset protection operations. When a node failure is detected, the backup data recovery process is triggered.

[0073] The security situation awareness module includes a data integration unit, a risk identification unit, a response measure execution unit, and a situation report generation unit; The data integration unit collects data access logs, migration operation records, encryption execution status, node running parameters, and compliance adaptation results. The risk identification unit uses a pre-set AI analysis model to process the integrated data and identify risk types such as storage node security vulnerabilities, encryption mechanism failures, migration link anomalies, and compliance adaptation deviations. The response execution unit performs operations such as updating encryption mechanisms, fixing node vulnerabilities, or suspending migration operations and upgrading encryption levels according to the preset risk level classification standards. Under high-risk conditions, a full-level data protection mechanism is activated. The situation report generation unit presents the risk distribution range and response progress, and provides an access point for administrators.

[0074] Furthermore, the security situation awareness module, as the core of the platform's end-to-end security protection, covers the entire operation process of the compliance adaptation module, policy control and resource collaboration module, data migration and verification module, data desensitization and traceability module, access adaptation and source switching module. It establishes a two-way data interaction link with each module through a distributed network, integrates hierarchical storage end-to-end data resources, identifies security risks and storage node failure risks in real time, automatically executes preset protection operations, and triggers the backup data recovery process when a storage node failure is detected, ensuring the overall security, stability and continuity of the platform's operation.

[0075] Specifically, the data integration unit collects all data from each module of the platform in real time through a standardized data acquisition interface. The collection scope covers various types of information, including data access logs, data migration operation records, data encryption execution status, storage node operating parameters, and compliance adaptation results. Data acquisition employs an asynchronous transmission mode to avoid performance impact on the normal operation of each module. The collected data undergoes format standardization processing, redundant information is removed, and the data is categorized and archived according to timestamps, business types, and risk correlation dimensions to form a unified security posture analysis dataset, providing complete data support for subsequent risk identification.

[0076] Specifically, the risk identification unit incorporates a pre-set AI analysis model, trained using machine learning algorithms. This model can perform real-time analysis on the standardized dataset output by the data integration unit. Identified risk types include security vulnerabilities in storage nodes, encryption mechanism failures, abnormal data migration links, and compliance adaptation deviations. The model continuously learns from historical operational data of each module, constantly optimizing the risk identification algorithm parameters to improve the accuracy and timeliness of risk identification. For identified risks, the unit automatically classifies them into low, medium, and high levels based on their impact and severity, providing a basis for subsequent response measures.

[0077] Specifically, the response execution unit performs differentiated protection operations based on the risk level and risk type output by the risk identification unit. For low-risk events, the remediation program is automatically initiated to complete operations such as patching storage node vulnerabilities and updating encryption mechanism configurations. For medium-risk events, high-risk operations of relevant modules, such as data migration tasks, are suspended, and the encryption level of the corresponding data is upgraded to strengthen protection. For high-risk events, a full-layer data protection mechanism is immediately activated, access permissions to relevant data are frozen, and an emergency backup process is initiated. When a storage node failure is detected, the backup data recovery process is automatically triggered to quickly synchronize backup data to the standby storage node, ensuring that business access is not affected. All response operations are logged in a complete log, including information such as operation time, risk type, and feedback on the effectiveness of the implemented measures.

[0078] Specifically, the situation report generation unit summarizes risk identification results and the implementation status of countermeasures in real time, presenting core information such as risk distribution, risk level percentage, and response progress in a visual manner. It provides an intuitive situation display interface, allowing administrators to view the platform's security status in real time. Simultaneously, this unit provides an administrator access point, allowing administrators to manually intervene in high-risk events and adjust response parameters. It automatically generates security situation reports periodically, summarizing risk occurrence and trend analysis of handling effects within a specified period, providing data reference for platform security optimization.

[0079] Furthermore, the security situation awareness module supports customizable risk warning thresholds, allowing administrators to adjust the identification thresholds for different risk types according to business needs. The module employs a distributed architecture deployment, supporting horizontal scaling to ensure stable risk identification and protection capabilities even under high concurrency scenarios. Simultaneously, the module features an emergency response linkage mechanism, enabling it to interface with external security management platforms. In the event of a major security risk, it synchronously sends warning information to the external platform, initiating cross-system collaborative protection.

[0080] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A business data cold and hot tiered storage and transparent access platform, characterized in that, It includes a compliance adaptation module, a policy control and resource collaboration module, a data migration and verification module, a data anonymization and traceability module, an access adaptation and source switching module, and a security situation awareness module. Each module establishes a two-way data interaction link through a distributed network. The compliance adaptation module outputs a hierarchical storage set of compliance rules, providing pre-rule support for subsequent modules. The policy control and resource coordination module receives the hierarchical storage compliance rule set input from the compliance adaptation module, configures data archiving and migration strategies, data backup strategies, monitors task execution status and system resource allocation, and builds metadata services to maintain the full-link metadata of hierarchical storage. The data migration and verification module receives the data archiving and migration strategy from the strategy control and resource collaboration module, performs cold and hot data migration and archiving operations, performs hash verification on data blocks before and after migration, and synchronously completes the integrity verification and erroneous data retransmission of the data transmission and storage links. The data desensitization and traceability module and the data migration and verification module operate in parallel, performing desensitization operations according to the data's hot / cold attributes and sensitivity levels, and recording the complete operation trajectory. The access adaptation and source switching module connects with the policy control and resource collaboration module's metadata service, enabling seamless switching between hot and cold data sources based on metadata query results, and completing business data access operations. The security situation awareness module covers the entire operation process of the other modules, integrates hierarchical storage full-link data, identifies security risks and storage node failure risks, and executes preset protection operations. When a node failure is detected, it triggers the backup data recovery process.

2. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The compliance adaptation module includes a compliance rule base construction unit, a policy monitoring unit, a compliance report generation unit, and a high-risk data processing unit; The compliance rule base construction unit collects current industry standards, regional regulations and corporate internal control clauses to establish a multi-dimensional set of compliance rules. The policy monitoring unit continuously monitors the dynamic updates of compliance policies, automatically updates the rule set, and maps it to the hierarchical storage strategy. The compliance report generation unit records the correspondence between hierarchical storage operations, data protection measures, and compliance clauses, and compiles a compliance audit report; The high-risk data processing unit automatically locates the storage node for high-compliance-risk data and enables enhanced encryption and multiple backup mechanisms.

3. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The policy control and resource collaboration module includes an access control unit, a credential management unit, a policy configuration unit, an alarm monitoring unit, a table structure synchronization unit, and a metadata management unit. The permission management unit allocates operation permissions according to the least privilege standard and the separation of duties mechanism, and performs a dual-role cross-approval process for high-risk operations. The voucher management unit uses encrypted storage to uniformly manage sensitive vouchers in the database, eliminating hard-coded and plaintext input behaviors. The strategy configuration unit sets the backup cycle, data filtering conditions, and table archiving strategy. The alarm monitoring unit provides a visual dashboard to display the task execution status, progress and resource usage, and sends notification information to preset terminals when an anomaly is detected. The table structure synchronization unit reads the source database table structure information at a fixed period and automatically updates the target stored table structure when a structure change is detected. The metadata management unit constructs and maintains a hierarchical storage metadata model, records the storage node addresses, storage status, data attributes, and flow trajectory of hot and cold data, and provides real-time metadata query services for the access adaptation and source switching modules.

4. The business data cold and hot tiered storage and transparent access platform according to claim 3, characterized in that, The strategy configuration unit of the strategy control and resource coordination module includes a data filtering subunit, a table partitioning strategy configuration subunit, and a scheduling mode configuration subunit. The data filtering subunit selects the time field in the data source table as the hierarchical filtering basis and allows the addition of custom filtering conditions. The table partitioning strategy configuration sub-unit sets the archiving table partitioning mode by day, month, or year, and automatically adds a table partitioning identifier suffix to the original table name; The scheduling configuration subunit defines the task execution time point through Cron expressions.

5. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The data migration and verification module includes a node scheduling unit, a batch adjustment unit, a data verification unit, and a source data processing unit; The node scheduling unit detects the current task load and resource usage ratio of each execution node in real time, and sends migration instructions to the node with the least task load and the lowest resource usage ratio. The batch adjustment unit adjusts the data volume and batch interval of subsequent batches based on the actual execution time of the preceding migration batches. After the data is written to cold storage, the data verification unit reads the original data and archived data sequentially to perform field-level consistency verification. After the data verification is passed, the source data processing unit performs source data cleaning operations according to preset rules.

6. The business data cold and hot tiered storage and transparent access platform according to claim 5, characterized in that, The data verification unit of the data migration and verification module includes a source data reading subunit, an archived data reading subunit, a data comparison subunit, and a verification result processing subunit. The source data reading subunit extracts the batch data that has been migrated from the source database; The archived data reading subunit extracts the corresponding archived batch data from the cold storage node; The data comparison subunit performs a field-level consistency comparison between the original data and the archived data; When the verification results are consistent, the verification result processing subunit triggers the source data processing unit to perform a cleanup operation; when the verification results are inconsistent, the subsequent migration operation is terminated and an alarm message is sent to the preset terminal.

7. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The data desensitization and traceability module includes a desensitization rule configuration unit, a desensitization execution unit, a traceability chain construction unit, and a permission-level restoration unit. The desensitization rule configuration unit is divided according to data type and sensitivity level to establish a dynamic desensitization rule set; The desensitization execution unit performs field-level desensitization operations on hot data and performs desensitization operations on cold data according to its sensitivity level, and synchronously switches the corresponding desensitization rules during the data migration process; The traceability chain construction unit writes the de-identification rule identifier, de-identification execution time, operation subject identifier, and data flow path information into the blockchain node; The permission-based restoration unit performs desensitization and restoration operations on hot data according to the user's preset permission level. The restoration operation requires secondary authorization verification and operation log recording.

8. The business data cold and hot tiered storage and transparent access platform according to claim 7, characterized in that, The traceability chain construction unit of the data desensitization and traceability module includes an operation information recording subunit, a blockchain storage subunit, and a traceability query subunit. The operation information recording subunit collects the rule application identifier, timestamp, and operation subject identifier information during the desensitization operation process; The blockchain storage subunit uploads the collected operation information to a preset blockchain node for distributed storage. The traceability query subunit provides an operation trajectory query interface, which supports retrieving the flow path and processing details of de-identified data.

9. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The access adaptation and source switching module includes a metadata query unit and a data source switching unit; The metadata query unit initiates a query request to the backend metadata service to obtain the storage node address and storage status information of the target data. The data source switching unit directly connects to the hot data storage node to access data based on the metadata query results, or prioritizes connecting to the cold data storage node to access data. If the cold data storage node does not find the target data, it switches to connecting to the hot data storage node.

10. The business data cold and hot tiered storage and transparent access platform according to claim 1, characterized in that, The security situation awareness module includes a data integration unit, a risk identification unit, a response measure execution unit, and a situation report generation unit. The data integration unit collects data access logs, migration operation records, encryption execution status, node running parameters, and compliance adaptation results. The risk identification unit uses a preset AI analysis model to process the integrated data and identify risk types such as storage node security vulnerabilities, encryption mechanism failures, migration link anomalies, and compliance adaptation deviations. The response execution unit performs operations such as updating the encryption mechanism, fixing node vulnerabilities, or pausing and upgrading the encryption level according to the preset risk level classification standard. Under high-risk conditions, the full-level data protection mechanism is activated. The situation report generation unit presents the risk distribution range and response progress, and provides an access point for administrators.

Images