A data transfer security protection device

Abstract

This utility model relates to the field of data security technology, specifically a data flow security protection device, including a quantum security terminal, a data security gateway, a distributed storage cluster, and a secure communication module. The quantum security terminal is connected to the data security gateway through the secure communication module, and is used to collect data in real time and perform quantum encrypted transmission. The data security gateway includes a dynamic monitoring module, a quantum encryption engine, a dynamic desensitization unit, and a blockchain node. The modules are interconnected. This utility model can achieve the purpose of security protection throughout the entire life cycle of data collection, transmission, processing, and storage, and improve the overall security and integrity of data flow.

Description

Technical Field

[0001] This utility model relates to the field of data security technology, specifically a data flow security protection device. Background Technology

[0002] In the digital age, data flows more frequently in areas such as financial transactions, medical diagnosis, and government services, highlighting security challenges. Regarding encryption, traditional algorithms like AES and RSA are weak against quantum attacks, and their security is seriously threatened with the development of quantum computing technology. Furthermore, long key rotation cycles and reliance on centralized storage pose a high risk of single-point leakage.

[0003] Data anonymization often employs static methods, performing a one-time fixation of the data. This results in either excessive anonymization for high-privilege users, impacting business analysis, or insufficient anonymization for ordinary users, easily leading to information leaks. Existing technologies have significant shortcomings in many aspects, and there is an urgent need for a data flow security protection device to solve the above problems. Utility Model Content

[0004] The purpose of this invention is to provide a data flow security protection device to solve the problems mentioned in the background art.

[0005] The technical solution of this utility model is: a data flow security protection device, including a quantum security terminal, a data security gateway, a distributed storage cluster, and a secure communication module; the quantum security terminal is connected to the data security gateway through the secure communication module, and is used to collect data in real time and perform quantum encrypted transmission; the data security gateway includes a dynamic monitoring module, a quantum encryption engine, a dynamic desensitization unit, and a blockchain node, and the modules are interconnected; the data security gateway is connected to the distributed storage cluster through the secure communication module, and the distributed storage cluster uses quantum key distribution (QKD) technology to encrypt and protect static data; the secure communication module supports data transmission based on TLS / SSL protocol and quantum encryption channel, and is used to connect user terminals and the data security gateway.

[0006] The aforementioned components achieve the following effects: through the collaborative work of the quantum-safe terminal, data security gateway, distributed storage cluster, and secure communication module, the quantum-safe terminal collects data and transmits it to the data security gateway via quantum encryption. The gateway's dynamic monitoring module analyzes the traffic in real time, the quantum encryption engine performs secondary encryption, the dynamic desensitization unit processes the data, the blockchain node records logs, and finally, the encrypted data is stored in the distributed storage cluster. Each link is connected to a secure communication module supporting quantum encryption and the TLS / SSL protocol. This end-to-end collaboration achieves secure protection throughout the entire lifecycle of data collection, transmission, processing, and storage, improving the overall security and integrity of data flow.

[0007] Preferably, the quantum-safe terminal includes a quantum-safe Cat1 module, a quantum-safe eSIM card, and an edge computing unit, wherein the edge computing unit is used to perform local preprocessing and lightweight security verification on the collected data.

[0008] The effects achieved by the above components are as follows: the quantum-safe Cat1 module, the quantum-safe eSIM card, and the edge computing unit of the quantum-safe terminal work together. After the edge computing unit preprocesses and performs lightweight verification on the collected data locally, the Cat1 module and the eSIM card perform quantum-encrypted transmission. By reducing invalid data transmission through local preprocessing and combining with quantum encryption components, efficient security protection is achieved at the data collection end, improving data transmission efficiency and terminal-side security.

[0009] Preferably, the dynamic desensitization unit supports rewriting SQL statements and desensitizing query result sets, combining SM4 / SM9 national cryptographic algorithms to achieve field-level encryption, and can dynamically select desensitization strategies according to user roles and access scenarios. The desensitization strategies include one or more of K-anonymity, differential privacy, and field masking.

[0010] The aforementioned components achieve the following effects: the dynamic data masking unit supports SQL statement rewriting and result set masking, and, combined with the SM4 / SM9 national cryptographic algorithms, dynamically selects masking strategies such as K-anonymity and differential privacy based on user roles and access scenarios. The coordinated functions enable the masking operation to accurately adapt to different scenarios, protecting sensitive fields while meeting business needs, increasing the flexibility and security of data masking, and reducing the risk of sensitive information leakage.

[0011] Preferably, the blockchain node adopts a consortium blockchain architecture to store data flow logs and operation records, ensuring the immutability of the data; the blockchain node includes a master node and slave nodes, with the master node responsible for log writing and the slave nodes responsible for log synchronization and consensus maintenance.

[0012] The aforementioned components achieve the following effects: the master node of the blockchain writes data flow logs and operation records, the slave nodes synchronize logs and maintain consensus, and the consortium blockchain architecture ensures that the data is tamper-proof. The division of labor and cooperation between master and slave nodes ensures real-time synchronization and consistency of logs, realizes reliable traceability of data flow, and improves the reliability and audit credibility of logs.

[0013] Preferably, the quantum encryption engine employs a hybrid encryption mechanism of quantum key distribution (QKD) and TLS / SSL, with a key rotation cycle of 100 milliseconds.

[0014] The aforementioned components achieve the following effect: the quantum encryption engine employs a hybrid encryption mechanism of quantum key distribution (QKD) and TLS / SSL. QKD provides keys resistant to quantum attacks, while TLS / SSL ensures compatibility with conventional transmission. The combination of these two encryption methods balances quantum resistance and transmission compatibility, improving the encryption strength and environmental adaptability of data transmission.

[0015] Preferably, the secure communication module integrates the OAuth2.0 authentication protocol with the role-based access control (RBAC) model to achieve fine-grained permission control.

[0016] The effects achieved by the above components are as follows: the secure communication module integrates the OAuth2.0 authentication protocol and the RBAC model. OAuth2.0 implements user identity authentication, and RBAC assigns permissions according to roles. The two work together to achieve precise control over user access, ensuring that only authorized users can access data according to their permissions, reducing the risk of unauthorized access, and improving the granularity and security of access control.

[0017] This utility model provides an improved data flow security protection device, which has the following improvements and advantages compared with the prior art:

[0018] This invention utilizes the collaborative operation of a quantum-safe terminal, a data security gateway, a distributed storage cluster, and a secure communication module. After the quantum-safe terminal collects data, it transmits it to the data security gateway via quantum encryption. The gateway's dynamic monitoring module analyzes the traffic in real time, the quantum encryption engine performs secondary encryption, a dynamic desensitization unit processes the data, blockchain nodes record logs, and finally, the encrypted data is stored in the distributed storage cluster. All stages are connected via a secure communication module that supports quantum encryption and the TLS / SSL protocol. This end-to-end collaboration achieves secure protection throughout the entire lifecycle of data acquisition, transmission, processing, and storage, improving the overall security and integrity of data flow. Attached Figure Description

[0019] The present invention will be further explained below with reference to the accompanying drawings and embodiments:

[0020] Figure 1 This is a schematic diagram of the structure of this utility model;

[0021] Figure 2 This is a three-dimensional structural diagram of the present invention. Detailed Implementation

[0022] The present invention will now be described in detail, and the technical solutions in the embodiments of the present invention will be clearly and completely described. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0023] This utility model provides an improved data transfer security protection device. The technical solution of this utility model is as follows:

[0024] In embodiments of this utility model, such as Figure 1-2 As shown, a data flow security protection device includes a quantum-secure terminal, a data security gateway, a distributed storage cluster, and a secure communication module. The secure communication module integrates the OAuth 2.0 authentication protocol and the Role-Based Access Control (RBAC) model to achieve fine-grained access control. OAuth 2.0 handles user authentication, while RBAC assigns permissions based on roles. The combination of these two mechanisms enables precise control over user access, ensuring that only authorized users access data according to their permissions, thus reducing the risk of unauthorized access.

[0025] The quantum-safe terminal is connected to the data security gateway through a secure communication module for real-time data acquisition and quantum-encrypted transmission. The quantum-safe terminal includes a quantum-safe Cat1 module, a quantum-safe eSIM card, and an edge computing unit. The edge computing unit is used for local preprocessing and lightweight security verification of the acquired data. The quantum-safe Cat1 module, quantum-safe eSIM card, and edge computing unit work together. After the edge computing unit performs local preprocessing and lightweight verification of the acquired data, the Cat1 module and eSIM card perform quantum-encrypted transmission. Local preprocessing reduces invalid data transmission, and combined with quantum encryption components, efficient security protection is achieved at the data acquisition end.

[0026] The data security gateway comprises a dynamic monitoring module, a quantum encryption engine, a dynamic de-identification unit, and blockchain nodes. These modules communicate with each other. The dynamic de-identification unit supports rewriting SQL statements and de-identifying query result sets, achieving field-level encryption using the SM4 / SM9 national cryptographic algorithms. It can dynamically select de-identification strategies based on user roles and access scenarios, including one or more of K-anonymity, differential privacy, and field masking. The blockchain nodes adopt a consortium blockchain architecture to store data flow logs and operation records, ensuring data immutability. Each blockchain node includes a master node and slave nodes. The master node is responsible for log writing, while the slave nodes are responsible for log synchronization and consensus maintenance. The master node writes data flow logs and operation records, while the slave nodes synchronize logs and maintain consensus. This consortium blockchain architecture ensures data immutability. The master-slave node collaboration ensures real-time log synchronization and consistency, enabling reliable traceability of data flow and improving log reliability and audit credibility. The quantum encryption engine employs a hybrid encryption mechanism of quantum key distribution (QKD) and TLS / SSL, with a key rotation cycle of 100 milliseconds. QKD provides quantum-resistant keys, while TLS / SSL ensures compatibility with conventional transmission. This combination of encryption methods balances quantum resistance and transmission compatibility.

[0027] The data security gateway connects to the distributed storage cluster via a secure communication module. The distributed storage cluster uses quantum key distribution (QKD) technology to encrypt and protect static data. The secure communication module supports data transmission based on the TLS / SSL protocol and quantum encryption channel, and is used to connect user terminals and the data security gateway.

[0028] The working principle of the data transfer security protection device provided by this utility model is as follows:

[0029] The quantum-safe terminal collects data through a quantum-safe Cat1 module and an eSIM card. After local preprocessing and security verification by the edge computing unit, the data is transmitted to the data security gateway through a secure communication module using quantum encryption technology.

[0030] After receiving data, the data security gateway's dynamic monitoring module analyzes traffic characteristics in real time; the quantum encryption engine uses a hybrid encryption mechanism of QKD and TLS / SSL for secondary encryption; the dynamic desensitization unit combines the SM4 / SM9 algorithm and implements dynamic desensitization such as K-anonymity and field masking through SQL rewriting or result set processing based on user roles and scenarios; the master node of the blockchain node synchronously records the flow log and operation record, and the slave nodes complete the consensus maintenance.

[0031] The processed data is transmitted to the distributed storage cluster via a secure communication module. The static storage security is protected by quantum key distribution technology. When a user terminal requests data, the secure communication module returns the de-identified data through an encrypted channel via OAuth2.0 authentication and RBAC access control, thus achieving secure protection and trusted flow of data throughout its entire lifecycle.

[0032] Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data flow switching security device, characterized in that, This includes quantum-safe terminals, data security gateways, distributed storage clusters, and secure communication modules; The quantum-safe terminal is connected to the data security gateway through the secure communication module, and is used to collect data in real time and perform quantum-encrypted transmission. The data security gateway includes a dynamic monitoring module, a quantum encryption engine, a dynamic desensitization unit, and a blockchain node, with communication connections between the modules; The data security gateway is connected to the distributed storage cluster through the secure communication module, and the distributed storage cluster uses quantum key distribution technology to encrypt and protect static data; The secure communication module supports data transmission based on the TLS / SSL protocol and quantum encryption channel, and is used to connect the user terminal and the data security gateway.

2. The apparatus of claim 1, wherein, The quantum-safe terminal includes a quantum-safe Cat1 module, a quantum-safe eSIM card, and an edge computing unit. The edge computing unit is used to perform local preprocessing and lightweight security verification on the collected data.

3. The apparatus of claim 1, wherein, The dynamic desensitization unit supports rewriting SQL statements and desensitizing query result sets. It combines SM4 / SM9 national cryptographic algorithms to achieve field-level encryption and can dynamically select desensitization strategies based on user roles and access scenarios. The desensitization strategies include one or more of K-anonymity, differential privacy, and field masking.

4. The apparatus of claim 1, wherein, The blockchain nodes adopt a consortium blockchain architecture to store data flow logs and operation records, ensuring the immutability of the data. The blockchain nodes include master nodes and slave nodes. The master node is responsible for writing logs, and the slave nodes are responsible for log synchronization and consensus maintenance.

5. The apparatus of claim 1, wherein, The quantum encryption engine employs a hybrid encryption mechanism combining quantum key distribution (QKD) and TLS / SSL.

6. The apparatus according to claim 1, characterized in that, The secure communication module integrates the OAuth2.0 authentication protocol and the role-based access control (RBAC) model to achieve fine-grained permission control.

Images