Network space data protection device

Abstract

The utility model discloses a network space data protection device, which belongs to the technical field of data protection and comprises a data acquisition module, a data isolation module, a dynamic encryption module, a central processing unit, an identity authentication module, a network security module, a security storage module and a data backup module. According to the utility model, through integrating the data acquisition module, the dynamic encryption module, the identity authentication module, the network security monitoring and defense module and the like, the comprehensive protection of data in transmission and static states is realized, and the security strategy effectively improves the confidentiality, the integrity and the availability of the data; the dynamic encryption module is combined with the encryption processor, the random number generator and the HSM, so that the real-time data encryption capability is provided, the security management of an encryption key is ensured, and the security of data in the transmission and storage process is greatly enhanced.

Description

Technical Field

[0001] The utility model relates to the technical field of data protection, and in particular to a network space data protection device. Background Art

[0002] With the rapid development of information technology, especially the widespread application of cloud computing, big data, the Internet of Things and 5G communication technology, cyberspace has become the basic framework for the operation of modern society, which also poses unprecedented challenges to network security.

[0003] Existing cyberspace data protection devices still have the following defects when in use: Existing cyberspace data protection devices focus on single protection during data transmission or static state, but fail to achieve all-round data protection, lack of integrated comprehensive solutions, resulting in data being vulnerable to leakage risks during transmission and storage, using static encryption methods, lacking real-time dynamic encryption capabilities, and unable to cope with ever-changing security threats. Utility Model Content

[0004] The purpose of the utility model is to solve the shortcomings of the prior art and to propose a network space data protection device.

[0005] In order to achieve the above-mentioned purpose, the utility model adopts the following technical scheme: a cyberspace data protection device, including a data acquisition module, a data isolation module, a dynamic encryption module, a central processing unit, an identity authentication module, a network security module, a security storage module and a data backup module, the data acquisition module is communicatively connected to the data isolation module, the data isolation module is communicatively connected to the dynamic encryption module, the dynamic encryption module is communicatively connected to the central processing unit, the central processing unit is communicatively connected to the identity authentication module, the identity authentication module is communicatively connected to the network security module, the network security module is communicatively connected to the security storage module, and the security storage module is communicatively connected to the data backup module.

[0006] As a further description of the above technical solution:

[0007] The data acquisition module includes a network interface card, a GPS clock, a decompression engine and an ASIC chip. The network interface card is communicatively connected to the ASIC chip, the ASIC chip is communicatively connected to the GPS clock, and the ASIC chip is communicatively connected to the decompression engine.

[0008] As a further description of the above technical solution:

[0009] The data isolation module includes an isolation switch, a security protocol processor and a high-performance switching chip. The isolation switch is communicatively connected to the security protocol processor, and the isolation switch and the security protocol processor are communicatively connected to the high-performance switching chip.

[0010] As a further description of the above technical solution:

[0011] The dynamic encryption module includes an encryption processor, a random number generator, and an HSM security module. The random number generator is communicatively connected to the encryption processor, and the encryption processor is communicatively connected to the HSM security module.

[0012] As a further description of the above technical solution:

[0013] The central processing unit includes a CPU processor, a RAM storage, and an NPU. The CPU processor is communicatively connected to the RAN storage, the CPU processor is communicatively connected to the NPU, and the RAM storage is communicatively connected to the NPU.

[0014] As a further description of the above technical solution:

[0015] The identity authentication module includes a biometric recognition module, a security token module and an authentication server. The biometric recognition module is communicatively connected to the authentication server, and the security token module is communicatively connected to the authentication server.

[0016] As a further description of the above technical solution:

[0017] The network security module includes an intrusion detection module and an intrusion prevention module, and the intrusion detection module is communicatively connected with the intrusion prevention module.

[0018] As a further description of the above technical solution:

[0019] The secure storage module includes a SED driver, a RAID controller and an SSD. The SED driver is communicatively connected to the RAID controller, and the RAID controller is communicatively connected to the SSD.

[0020] The utility model has the following beneficial effects:

[0021] 1. In the utility model, by integrating modules such as data collection, dynamic encryption, identity authentication, network security monitoring and defense, all-round protection of data in transmission and static state is achieved. This security strategy effectively improves the confidentiality, integrity and availability of data.

[0022] 2. In the utility model, the dynamic encryption module combines the encryption processor, random number generator and HSM, which not only provides real-time data encryption capabilities, but also ensures the secure management of encryption keys, greatly enhancing the security of data during transmission and storage.

[0023] 3. In the present invention, the SED drive is used in conjunction with RAID technology and SSD through the secure storage module, which not only improves the efficiency and capacity of data storage, but also ensures that data can be protected and restored even if the hard disk is damaged through hardware encryption and data redundancy technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of the structure of a network space data protection device proposed by the utility model Figure 1 ;

[0025] Figure 2 A schematic diagram of the structure of a network space data protection device proposed by the utility model Figure 2 . DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the utility model to clearly and completely describe the technical solutions in the embodiments of the utility model. Obviously, the described embodiments are only part of the embodiments of the utility model, not all of the embodiments. Based on the embodiments in the utility model, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the utility model.

[0027] Reference Figure 1-2, an embodiment provided by the utility model: includes a data acquisition module, a data isolation module, a dynamic encryption module, a central processing unit, an identity authentication module, a network security module, a security storage module and a data backup module, the data acquisition module is communicatively connected to the data isolation module, the data isolation module is communicatively connected to the dynamic encryption module, the dynamic encryption module is communicatively connected to the central processing unit, the central processing unit is communicatively connected to the identity authentication module, the identity authentication module is communicatively connected to the network security module, the network security module is communicatively connected to the security storage module, the security storage module is communicatively connected to the data backup module, the data acquisition module includes a network interface card, a GPS clock, a decompression engine and an ASIC chip, the network interface card is communicatively connected to the ASIC chip, the ASIC chip is communicatively connected to the GPS clock, the ASIC chip is communicatively connected to the decompression engine, the data isolation module includes an isolation switch, a security protocol processor and a high-performance switching chip, the isolation switch is communicatively connected to the security protocol processor, The isolation switch and the security protocol processor are communicatively connected to the high-performance switching chip, the dynamic encryption module includes an encryption processor, a random number generator, and an HSM security module, the random number generator is communicatively connected to the encryption processor, the encryption processor is communicatively connected to the HSM security module, the central processing unit includes a CPU processor, RAM storage, and NPU, the CPU processor is communicatively connected to the RAN storage, the CPU processor is communicatively connected to the NPU, the RAM storage is communicatively connected to the NPU, the identity authentication module includes a biometric module, a security token module, and an authentication server, the biometric module is communicatively connected to the authentication server, the security token module is communicatively connected to the authentication server, the network security module includes an intrusion detection module and an intrusion prevention module, the intrusion detection module is communicatively connected to the intrusion prevention module, the security storage module includes a SED drive, a RAID controller, and an SSD, the SED drive is communicatively connected to the RAID controller, and the RAID controller is communicatively connected to the SSD.

[0028] Working principle: The data acquisition module receives data from the external network through the network interface card. At the same time, the GPS clock provides an accurate timestamp. The decompression engine is responsible for processing the received compressed data and converting it into a processable format. The ASIC chip cooperates with the network interface card, GPS clock and decompression engine to complete the preliminary processing and time stamping of the data, and then sends the processed data to the data isolation module. After the data isolation module receives the data, the isolation switch screens and separates the data stream according to the preset security policy. The security protocol processor is responsible for protocol analysis of the data packet. The high-performance switching chip improves the efficient transmission of data between modules. The encryption processor of the dynamic encryption module encrypts the data with the key provided by the random number generator. The HSM is used to store and manage the encryption key. The encrypted data is passed to the central processor, where the CPU processor is responsible for the main data processing tasks, the RAM storage provides temporary data storage space, and the NPU optimizes the processing speed of network data. The identity authentication module collects user identity information through the biometrics and security token modules, and is verified by the authentication server. Only verified users can access subsequent resources. The intrusion detection module of the network security module monitors network traffic and identifies potential attack behaviors. Once an abnormality is found, it immediately notifies the intrusion prevention module to take measures to block the attack. The processed data is finally stored in the secure storage module.

[0029] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network space data protection device, characterized in that: It includes a data acquisition module, a data isolation module, a dynamic encryption module, a central processing unit, an identity authentication module, a network security module, a security storage module and a data backup module. The data acquisition module is communicatively connected to the data isolation module, the data isolation module is communicatively connected to the dynamic encryption module, the dynamic encryption module is communicatively connected to the central processing unit, the central processing unit is communicatively connected to the identity authentication module, the identity authentication module is communicatively connected to the network security module, the network security module is communicatively connected to the security storage module, and the security storage module is communicatively connected to the data backup module.

2. A network space data protection device according to claim 1, characterized in that: The data acquisition module includes a network interface card, a GPS clock, a decompression engine and an ASIC chip. The network interface card is communicatively connected to the ASIC chip, the ASIC chip is communicatively connected to the GPS clock, and the ASIC chip is communicatively connected to the decompression engine.

3. A network space data protection device according to claim 1, characterized in that: The data isolation module includes an isolation switch, a security protocol processor and a high-performance switching chip. The isolation switch is communicatively connected to the security protocol processor, and the isolation switch and the security protocol processor are communicatively connected to the high-performance switching chip.

4. A network space data protection device according to claim 1, characterized in that: The dynamic encryption module includes an encryption processor, a random number generator, and an HSM security module. The random number generator is communicatively connected to the encryption processor, and the encryption processor is communicatively connected to the HSM security module.

5. A network space data protection device according to claim 1, characterized in that: The central processing unit includes a CPU processor, a RAM storage, and an NPU. The CPU processor is communicatively connected to the RAN storage, the CPU processor is communicatively connected to the NPU, and the RAM storage is communicatively connected to the NPU.

6. A network space data protection device according to claim 1, characterized in that: The identity authentication module includes a biometric recognition module, a security token module and an authentication server. The biometric recognition module is communicatively connected to the authentication server, and the security token module is communicatively connected to the authentication server.

7. A network space data protection device according to claim 1, characterized in that: The network security module includes an intrusion detection module and an intrusion prevention module, and the intrusion detection module is communicatively connected with the intrusion prevention module.

8. A network space data protection device according to claim 1, characterized in that: The secure storage module includes a SED driver, a RAID controller and an SSD. The SED driver is communicatively connected to the RAID controller, and the RAID controller is communicatively connected to the SSD.

Images