CN115022066B - Key data protection method based on firewall - Google Patents

Abstract

The present invention discloses a method for protecting critical data based on a firewall. The main design concept of the present invention is that when it is detected that there is a data flow crossing a virtual firewall, based on the signature information of each data in the data flow, the data to be stored in the data flow is determined, and then the target root firewall specified in the data to be stored is determined, and based on the private key parameters in the data to be stored, it is determined whether the data to be stored has the authority to enter the target root firewall. If the data to be stored has the authority to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored to obtain corresponding encrypted data. The present invention first determines the authority of the data to be stored to enter the target root firewall, and after determining that the data to be stored has the authority to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored, so that each data to be stored has its corresponding encrypted data, thereby improving the security of production critical data.

Description

Key data protection method based on firewall

Technical Field

The invention relates to the field of firewall data processing, and in particular to a key data protection method based on a firewall.

Background technique

As the cigarette and tobacco processing and manufacturing fields advance towards intelligent and digital iterative transformation, many process links in the processing and manufacturing involved in the industry involve the use of the network to transmit and store key production information. In order to ensure the security and reliability of key production data, most of them use firewall mechanisms for data storage.

Currently, the main method of storing data through a firewall is that as long as the data to be stored is allowed to enter the firewall, the data to be stored can be directly stored in the database, or simple processing rules can be added to the data to be stored and stored in the database.

It can be seen that the data to be stored is not encrypted during the storage process. If the firewall is illegally invaded, all the data in the database may be stolen or implanted with viruses, resulting in data leakage or data damage, which will bring immeasurable losses and impacts to the normal production, quality and safety of the cigarette and tobacco industry.

Summary of the invention

In view of the above, the present invention aims to provide a critical data protection method based on a firewall to solve the problem of network storage security of critical data in this industry.

The technical solution adopted by the present invention is as follows:

The present invention provides a critical data protection method based on a firewall, wherein the firewall includes a virtual firewall and a root firewall, and the critical data protection method includes:

When it is detected that there is a data flow crossing the virtual firewall, based on the signature information of each data in the data flow, determining the data to be stored in the data flow;

Determine a target root firewall specified in the data to be stored, and determine whether the data to be stored has permission to enter the target root firewall based on a private key parameter in the data to be stored;

If the data to be stored has permission to enter the target root firewall, the data to be stored is encrypted based on the domain-level application gateway of the target root firewall to obtain corresponding encrypted data.

In at least one possible implementation manner, the domain-level application gateway based on the target root firewall encrypts the data to be stored, and the corresponding encrypted data obtained includes:

Determining a first remainder theorem parameter of the domain-level application gateway based on a first Diophantine equation of the domain-level application gateway;

Determining domain-level signature data of the domain-level application gateway for the data to be stored;

The data to be stored is encrypted based on the first remainder theorem parameter and the domain-level signature data to obtain the encrypted data.

In at least one possible implementation manner, encrypting the data to be stored based on the first remainder theorem parameter and the domain-level signature data to obtain the encrypted data includes:

Multiplying the first remainder theorem parameter by the data to be stored to obtain corresponding first data to be processed;

The first data to be processed and the domain-level signature data are packaged to obtain the encrypted data.

In at least one possible implementation, after obtaining the corresponding encrypted data, the key data protection method further includes:

The regional application gateway based on the target root firewall re-encrypts the encrypted data to obtain corresponding target storage data.

In at least one possible implementation, the regional application gateway based on the target root firewall re-encrypts the encrypted data to obtain the corresponding target storage data, including:

If it is determined based on the regional application gateway that the domain-level signature data verification is passed, determining a second remainder theorem parameter of the regional application gateway based on a second Diophantine equation of the regional application gateway;

Determining regional signature data of the encrypted data by the regional application gateway;

If it is determined based on the target root firewall that the regional signature data verification is passed, the encrypted data is re-encrypted based on the second remainder theorem parameter to obtain the target storage data.

In at least one possible implementation manner, re-encrypting the encrypted data based on the second remainder theorem parameter to obtain the target storage data includes:

Determining a third remainder theorem parameter of the target root firewall based on the third Diophantine equation of the target root firewall;

Multiplying the second remainder theorem parameter by the third remainder theorem parameter to obtain a corresponding target remainder theorem parameter;

Multiplying the target remainder theorem parameter by the encrypted data to obtain corresponding second data to be processed, and determining firewall signature data of the target root firewall for the second data to be processed;

The firewall signature data and the second data to be processed are packaged to obtain the target storage data.

In at least one possible implementation manner, after the firewall signature data and the second data to be processed are packaged to obtain the target storage data, the key data protection method further includes:

Verifying the firewall signature data in the target storage data;

If the firewall signature data is verified, the data level corresponding to the target storage data is determined, and the target storage data is stored in a database of the corresponding level according to the data level;

If the firewall signature data verification fails, the firewall signature data in the target storage data is re-signed according to the target root firewall, and the re-signed target storage data is verified.

In at least one possible implementation manner, determining the data to be stored in the data stream based on signature information of each data in the data stream includes:

Obtaining a signature list in a database, wherein the signature list contains multiple user signature data;

Determine whether there is target signature information in each of the signature information, wherein the target signature information has corresponding user signature data in the signature list;

If the target signature information exists, the data corresponding to the target signature information is determined as the data to be stored in the data stream.

The main design concept of the present invention is that when it is detected that there is a data flow crossing a virtual firewall, based on the signature information of each data in the data flow, the data to be stored in the data flow is determined, and then the target root firewall specified in the data to be stored is determined, and based on the private key parameters in the data to be stored, it is determined whether the data to be stored has the authority to enter the target root firewall. If the data to be stored has the authority to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored to obtain the corresponding encrypted data. The present invention first determines the authority of the data to be stored to enter the target root firewall, and after determining that the data to be stored has the right to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored, so that each data to be stored has its corresponding encrypted data, thereby improving the security of production-critical data.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be further described below with reference to the accompanying drawings, in which:

FIG1 is a flow chart of a first embodiment of a method for protecting critical data based on a firewall provided by the present invention;

FIG2 is a flow chart of another embodiment of a method for protecting critical data based on a firewall provided by the present invention;

FIG3 is a detailed flow chart of step S30 of the firewall-based key data protection method provided by the present invention;

FIG4 is a flow chart of another embodiment of a method for protecting critical data based on a firewall provided by the present invention;

5 is a flowchart of another embodiment of a method for protecting critical data based on a firewall provided by the present invention;

FIG6 is a flow chart of another embodiment of a method for protecting critical data based on a firewall provided by the present invention.

Detailed ways

Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

The present invention proposes an embodiment of a critical data protection method based on a firewall. Specifically, as shown in FIG1 , FIG1 is a flow chart of a first embodiment of the critical data protection method based on a firewall of the present invention.

The embodiment of the present invention provides an embodiment of a critical data protection method based on a firewall. It should be noted that although a logical order is shown in the flow chart, under certain data, the steps shown or described may be completed in an order different from that shown here.

The execution subject of the method of this embodiment of the present invention is an example of a key data protection system based on a firewall as an execution subject. The key data protection method based on a firewall includes:

Step S10, when it is detected that there is a data flow crossing the virtual firewall, the data to be stored in the data flow is determined based on the signature information of each data in the data flow.

It should be noted that the firewall in the firewall-based critical data protection system includes a virtual firewall (Virtual Firewall) and multiple root firewalls (Root Firewall). The virtual firewall is the first barrier of the firewall-based critical data protection system, and the virtual firewall has no permission setting, that is, all data can cross the virtual firewall. When the firewall-based critical data protection system detects that data has crossed the virtual firewall, it determines that there is data about to enter the root firewall. Therefore, the virtual firewall plays a prompting role in the firewall-based critical data protection system. The root firewall is mainly composed of multiple domain-level application gateways (Residential Aggregating Gateway, RAGW) and multiple district application gateways (District Gateway, DGW). The domain-level application gateway and the district application gateway are mainly used to encrypt the data entering the root firewall.

The key data protection system based on the firewall will receive data streams sent from user terminals at any time. The data streams contain data that the user wants to store and other interfering data. In order to effectively separate the data that the user wants to store, the specific method is as follows: When the key data protection system based on the firewall detects that there is a data stream crossing the virtual firewall, it determines the signature information of each data in the data stream, verifies the signature information of each data, and determines the data with the signature information that meets the requirements as the data that can enter the root firewall, that is, the data to be stored in the data stream (data to be stored). Among them, the specific method of determining the data to be stored in the data stream is as shown in steps S101 to S103.

Step S101, obtaining a signature list in a database, wherein the signature list contains multiple user signature data;

Step S102, determining whether there is target signature information in each of the signature information, wherein the target signature information has corresponding user signature data in the signature list;

Step S103: If the target signature information exists, the data corresponding to the target signature information is determined as the data to be stored in the data stream.

Specifically, when the key data protection system based on the firewall detects that data has crossed the virtual firewall, the corresponding signature list is obtained from the database, wherein the signature list is a list formed by arranging the user signature data corresponding to all users who have the right to access the root firewall. Therefore, there are multiple user signature data in the signature list. Then, the key data protection system based on the firewall searches in the signature information according to the user signature data in the signature list to see whether there is target signature information corresponding to the user signature data, that is, the target signature information is the same as one of the user signature data in the signature list. If it is determined that the target signature information exists in the signature information, the data corresponding to the target signature information is determined as the data to be stored in the data stream. If it is determined that the target signature information does not exist in the signature information, it is determined that there is no data to be stored in the data stream, and it is determined that the data in the data stream are all interference data. Therefore, in this embodiment, the data to be stored in the data stream is determined according to the signature information of each data in the data stream, so as to accurately find the data to be stored in the data stream and prevent data omission.

Step S20, determining the target root firewall specified in the data to be stored, and determining whether the data to be stored has permission to enter the target root firewall based on the private key parameters in the data to be stored.

After the firewall-based key data protection system determines the data to be stored in the data stream, it further determines the target root firewall specified in the data to be stored. Then, the firewall-based key data protection system obtains the key parameters carried in the data to be stored, one of the expressions of the key parameters is a key sequence, that is, the key sequence carried in the data to be stored is verified according to the public key sequence of the target root firewall. If it is determined that the key sequence carried in the data to be stored is verified, it is determined that the data to be stored has the authority to enter the target root firewall. If it is determined that the key sequence carried in the data to be stored is not verified, it is determined that the data to be stored does not have the authority to enter the target root firewall, and the data to be stored is marked as interference data.

Step S30: If the data to be stored has permission to enter the target root firewall, the domain-level application gateway based on the target root firewall encrypts the data to be stored to obtain corresponding encrypted data.

If the firewall-based key data protection system determines that the data to be stored has the permission to enter the specified target root firewall, the data to be stored is allowed to cross the target root firewall. After the data to be stored crosses the target root firewall, the firewall-based key data protection system transmits the data to be stored to the domain-level application gateway corresponding to the target root firewall, and determines the characteristic parameters corresponding to the domain-level application gateway, one of which is expressed as a remainder theorem parameter. Then, the firewall-based key data protection system encrypts the data to be stored according to the characteristic parameters corresponding to the domain-level application gateway to obtain the corresponding encrypted data.

When this embodiment detects that there is a data flow crossing the virtual firewall, based on the signature information of each data in the data flow, the data to be stored in the data flow is determined; the target root firewall specified in the data to be stored is determined, and based on the private key parameters in the data to be stored, whether the data to be stored has the authority to enter the target root firewall; if the data to be stored has the authority to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored to obtain the corresponding encrypted data. It can be seen that after determining that the data to be stored enters the target root firewall, this embodiment encrypts the data to be stored through the domain-level application gateway of the target root firewall, so that each data to be stored has its corresponding encrypted data, thereby improving the security of the data.

Further, referring to FIG. 2 , FIG. 2 is a flow chart of another embodiment of the critical data protection method based on a firewall of the present invention, after step S30, further comprising:

Step S40: re-encrypting the encrypted data based on the regional application gateway of the target root firewall to obtain corresponding target storage data.

After the key data protection system based on the firewall completes the encryption of the data to be stored according to the domain-level application gateway, that is, after obtaining the encrypted data of the data to be stored, the encrypted data is transmitted to the regional application gateway corresponding to the target root firewall. Then, the key data protection system based on the firewall determines the characteristic parameters corresponding to the regional application gateway, one of which is expressed as a remainder theorem parameter, and re-encrypts the encrypted data according to the characteristic parameters corresponding to the regional application gateway to obtain the corresponding target storage data.

This embodiment re-encrypts the encrypted data based on the regional application gateway of the target root firewall to obtain the corresponding target storage data. It can be seen that after the encryption of the data to be stored is completed through the domain-level application gateway, the encrypted data is re-encrypted through the regional application gateway of the target root firewall, so that the data to be stored is multiply encrypted through the domain-level application gateway and the regional application gateway, which increases the data complexity of the data to be stored, thereby increasing the privacy of the data to be stored, improving the security of the data and the protection of key data.

Further, referring to FIG. 3 , FIG. 3 is a detailed flow chart of step S30 of the key data protection method based on a firewall of the present invention, wherein step S30 comprises:

Step S301, determining a first remainder theorem parameter of the domain-level application gateway based on a first Diophantine equation of the domain-level application gateway;

Step S302, determining the domain-level signature data of the domain-level application gateway for the data to be stored;

Step S303: encrypt the data to be stored based on the first remainder theorem parameter and the domain-level signature data to obtain the encrypted data.

It should be noted that the specific process of determining the parameters of the remainder theorem of the Diophantine equation is as follows: take two sets of solutions of the Diophantine equation χ＝(x ₁ , x ₂ , ..., x _n1 ) and γ＝(y ₁ , y ₂ , ..., _yn2 ), select two sets of coprime integer sets A _a ＝(a ₁ , a ₂ , ..., a _s ) and B _b ＝(b ₁ , b ₂ , ..., b _L ), and these two sets of coprime integer sets are both included in the solutions χ and γ of the Diophantine equation, that is, And the smallest element in the two sets of mutually prime integers is greater than n _max U, where n _max is the maximum number of domain-level application gateways and U is the upper limit of each dimension of data. In addition, the complement of A _a to χ is C _χ A _a ＝(x ₁₁ ，x ₁₂ ，...，x _1n3 ), n ₃ ＝n ₁ -s, the complement of B _b to γ is C _γ B _b ＝(y ₁₁ ，y ₁₂ ，...，y _1n4 ), n ₄ ＝n ₂ -L, calculate A＝a ₁ a ₂ ...a _s ，B＝b ₁ b ₂ ...b _L , and obtain the remainder theorem parameter set A _a ＝(A _k |A _k ＝A/a _k ，1≦k≦s)，B _b ＝(B _j |B _j ＝B/b _j ，1≦j≦L).

It should be noted that the specific process of determining the parameters of the remainder theorem of the Diophantine equation is as follows: take two sets of solutions of the Diophantine equation χ＝(x ₁ , x ₂ , ..., x _n1 ) and γ＝(y ₁ , y ₂ , ..., _yn2 ), select two sets of coprime integer sets A _a ＝(a ₁ , a ₂ , ..., a _s ) and B _b ＝(b ₁ , b ₂ , ..., b _L ), and these two sets of coprime integer sets are both included in the solutions χ and γ of the Diophantine equation, that is, And the smallest element in the two sets of mutually prime integers is greater than n _max U, where n _max is the maximum number of domain-level application gateways and U is the upper limit of each dimension of data. In addition, the complement of A _a to χ is C _χ A _a ＝(x ₁₁ ，x ₁₂ ，...，x _1n3 ), n ₃ ＝n ₁ -s, the complement of B _b to γ is C _γ B _b ＝(y ₁₁ ，y ₁₂ ，...，y _1n4 ), n ₄ ＝n ₂ -L, calculate A＝a ₁ a ₂ ...a _s ，B＝b ₁ b ₂ ...b _L , and obtain the remainder theorem parameter set A _a ＝(A _k |A _k ＝A/a _k ，1≦k≦s)，B _b ＝(B _j |B _j ＝B/b _j ，1≦j≦L).

Specifically, if the key data protection system based on the firewall determines that the data to be stored has the permission to enter the designated target root firewall, the data to be stored is transmitted to the domain-level application gateway corresponding to the target root firewall, and two sets of solutions of the Diophantine equation of the domain-level application gateway are taken as χ ₁ =(x ₁ , x ₂ , ..., x _n1 ) and γ ₁ =(y ₁ , y ₂ , ..., _yn2 ). Then, the key data protection system based on the firewall determines the remainder theorem parameter set of the domain-level application gateway as A _a1 =(A _k1 |A _k1 =A/a _k1 , 1≦k ₁ ≦s), B _b1 =(B _j1 |B j1 =B/b _j1 , 1≦j ₁ ≦L) according to the two sets of solutions of the Diophantine equation _of the domain-level application gateway. Then, the firewall-based key data protection system determines the domain-level signature data of the domain-level application gateway for the data to be stored, and the domain-level signature data is R=H(c||ID_RAGW), where H is a hash function, c is the data to be stored, and ID_RAGW is the ID (Identity Document) of the domain-level application gateway. Finally, the firewall-based key data protection system encrypts the data to be stored according to the remainder theorem parameters of the domain-level application gateway and the domain-level signature data to obtain encrypted data. The specific process is as follows: step S3031 to step S3032.

This embodiment determines the first remainder theorem parameter of the domain-level application gateway based on the first Diophantine equation of the domain-level application gateway; determines the domain-level signature data of the domain-level application gateway for the data to be stored; and encrypts the data to be stored based on the first remainder theorem parameter and the domain-level signature data to obtain encrypted data. It can be seen that this embodiment increases the data complexity of the data to be stored through the Diophantine equation of the domain-level application gateway and its remainder theorem parameter, thereby increasing the privacy of the data to be stored, improving the security of the data and the protection of key data.

Step S3031, multiplying the first remainder theorem parameter by the data to be stored to obtain corresponding first data to be processed;

Step S3032: Pack the first data to be processed and the domain-level signature data to obtain the encrypted data.

Specifically, the firewall-based key data protection system first multiplies the remainder theorem parameter set A _a1 and B _b1 of the domain-level application gateway by the data to be stored c, respectively, to obtain c*A _a1 and c*B _b1 , and then adds c*A _a1 and c*B _b1 to obtain the corresponding data to be processed S1=c*A _a1 +c*B _b1 . Next, the firewall-based key data protection system packages the data to be processed S1: {c*A _a1 +c*B _b1 } and the domain-level signature data R to obtain the encrypted data ct, where ct is {c*A _a1 +c*B _b1 , R}.

In this embodiment, the first remainder theorem parameter is multiplied with the data to be stored to obtain the corresponding first data to be processed; the first data to be processed and the domain-level signature data are packaged to obtain encrypted data. It can be seen that in this embodiment, the remainder theorem parameter of the domain-level application gateway is multiplied with the data to be stored and then added, and then the domain-level signature data is added to the data processed by the remainder theorem parameter and packaged to obtain encrypted data, thereby increasing the data complexity of the data to be stored, thereby increasing the privacy of the data to be stored, and improving the security of the data and the protection of key data.

Further, referring to FIG. 4 , FIG. 4 is a flow chart of another embodiment of the critical data protection method based on a firewall of the present invention, wherein step S40 comprises:

Step S401, if it is determined based on the regional application gateway that the domain-level signature data verification is passed, then based on the second Diophantine equation of the regional application gateway, determining the second remainder theorem parameter of the regional application gateway;

Step S402, determining the regional signature data of the encrypted data by the regional application gateway;

Step S403: If it is determined based on the target root firewall that the regional signature data verification is passed, the encrypted data is re-encrypted based on the second remainder theorem parameters to obtain the target storage data.

Specifically, after the firewall-based critical data protection system obtains the encrypted data ct of the data to be stored through the domain-level application gateway of the target root firewall specified by the data to be stored, the encrypted data ct is transmitted to the regional application gateway corresponding to the target root firewall. After receiving the encrypted data ct, the regional application gateway verifies whether the domain-level signature data R carried in the encrypted data ct is correct, that is, it determines whether the domain-level application gateway that encrypts the encrypted data ct is the domain-level application gateway associated with the regional application gateway. If the domain-level signature data R carried in the encrypted data ct fails the verification, that is, it is determined that the domain-level application gateway that encrypts the encrypted data ct is not the domain-level application gateway associated with the regional application gateway, then the corresponding prompt information is sent to the firewall-based critical data protection system, prompting the firewall-based critical data protection system to redetermine the domain-level application gateway, and re-encrypt according to the redetermined domain-level application gateway, and re-transmit the re-encrypted data. If the domain-level signature data R carried in the encrypted data ct is verified, that is, it is determined that the domain-level application gateway that encrypts the encrypted data ct is the domain-level application gateway associated with the application gateway of the region, a prompt message is sent to prompt the key data protection system based on the firewall to continue the subsequent operation. The key data protection system based on the firewall takes two sets of solutions of the Diophantine equation of the application gateway of the region as χ ₂ =(x ₁ , x ₂ , ..., x _n1 ) and γ ₂ =(y ₁ , y 2 , ..., _yn2 ). Then, the key data protection system based on the firewall determines the remainder theorem parameter set of the application gateway of the region as A _a2 =(A _k2 |A _k2 =A/a _k2 , 1≦k ₂ ≦s), B _b2 =(B _j2 |B _j2 =B/b _j2 , 1≦j _{2 ≦} L) according to the two sets of solutions of the Diophantine equation of the application gateway of the region. At the same time, the key data protection system based on the firewall determines the regional signature data of the encrypted data ct by the regional application gateway, and the regional signature data is D=H(ct||ID_DGW), where ID_DGW is the ID of the regional application gateway. At the same time, the key data protection system based on the firewall verifies the regional signature data through the target root firewall, that is, determines whether the regional application gateway is the associated regional application gateway. If it is determined that the regional signature data verification fails, that is, it is determined that the regional application gateway is not the associated regional application gateway, the regional application gateway is re-determined, and re-encryption and signing are performed based on the re-determined regional application gateway. If it is determined that the regional signature data verification passes, that is, it is determined that the regional application gateway is the associated regional application gateway, the encrypted data is re-encrypted according to the remainder theorem parameters of the regional application gateway to obtain the target storage data.

If the domain-level signature data is verified to be passed based on the regional application gateway, the second remainder theorem parameter of the regional application gateway is determined based on the second Diophantine equation of the regional application gateway; the regional signature data of the encrypted data by the regional application gateway is determined; if the regional signature data is verified to be passed based on the target root firewall, the encrypted data is re-encrypted based on the second remainder theorem parameter to obtain the target storage data. It can be seen that after the encrypted data is obtained through the domain-level application gateway processing, the Diophantine equation and its remainder theorem parameter of the regional application gateway are used to increase the data complexity of the data to be stored, thereby increasing the privacy of the data to be stored, improving the security of the data and the protection of key data.

Further, referring to FIG. 5 , FIG. 5 is a flow chart of another embodiment of the critical data protection method based on a firewall of the present invention, wherein step S403 comprises:

Step S4031, determining a third remainder theorem parameter of the target root firewall based on the third Diophantine equation of the target root firewall;

Step S4032, multiplying the second remainder theorem parameter by the third remainder theorem parameter to obtain a corresponding target remainder theorem parameter;

Step S4033, multiplying the target remainder theorem parameter by the encrypted data to obtain corresponding second data to be processed, and determining firewall signature data of the target root firewall for the second data to be processed;

Step S4034: Pack the firewall signature data and the second data to be processed to obtain the target storage data.

Specifically, after the key data protection system based on the firewall determines that the regional signature data has been verified according to the target root firewall, the two sets of solutions of the Diophantine equation of the target root firewall are taken as χ ₃ =(x ₁ , x ₂ , ..., x _n1 ) and γ ₃ =(y ₁ , y ₂ , ..., _yn2 ). Then, the key data protection system based on the firewall determines the remainder theorem parameter set of the target root firewall as A _a3 =(A _k3 |A _k3 =A/ _ak3 , 1≦k ₃ ≦s), B _b3 =(B _j3 |B _j3 =B/b _j3 , 1≦j ₃ ≦L) according to the two sets of solutions of the Diophantine equation of the target root firewall. Then, the key data protection system based on the firewall multiplies the remainder theorem parameters of the target root firewall with the remainder theorem parameters of the application gateway of the region to obtain the target remainder theorem parameters W=A _a2 *A _a3 +B _b2 *B _b3 . Then, the firewall-based key data protection system multiplies the target remainder theorem parameter with the encrypted data ct{c*A _a1 +c*B _b1 , R}, and obtains the corresponding data to be processed S2=c*A _a1 *A _a2 *A _a3 +c*B _b1 *B _b2 *B _b3 . At the same time, the firewall signature data of the target root firewall is determined, and the firewall signature data is RF=H(c||ID_Root Firewall), where ID_Root Firewall is the ID of the target root firewall. Finally, the firewall-based key data protection system packages the firewall signature data RF and the data to be processed S2: {c*A _a1 *A _a2 *A _a3 +c*B _b1 *B _b2 *B _b3 }, and obtains the target storage data {c*A _a1 *A _a2 *A _a3 +c*B _b1 *B _b2 *B _b3 , RF}.

This embodiment determines the third remainder theorem parameter of the target root firewall based on the third Diophantine equation of the target root firewall; multiplies the second remainder theorem parameter with the third remainder theorem parameter to obtain the corresponding target remainder theorem parameter; multiplies the target remainder theorem parameter with the encrypted data to obtain the corresponding second data to be processed, and determines the firewall signature data of the target root firewall for the second data to be processed; packages the firewall signature data and the second data to be processed to obtain the target storage data. This embodiment adds the remainder theorem parameter of the target root firewall on the basis of the remainder theorem parameter based on the regional application gateway, thereby making the data complexity of the final target storage data higher, increasing the privacy of the data to be stored, and improving the data security and the protection of key data.

Further, referring to FIG. 6 , FIG. 6 is a flow chart of another embodiment of the critical data protection method based on a firewall of the present invention, after step S4034, further comprising:

Step S50, verifying the firewall signature data in the target storage data;

Step S60, if the firewall signature data is verified, determining the data level corresponding to the target storage data, and storing the target storage data in a database of the corresponding level according to the data level;

Step S70: If the firewall signature data verification fails, the firewall signature data in the target storage data is re-signed according to the target root firewall, and the re-signed target storage data is verified.

Specifically, before the critical data protection system based on the firewall stores the target storage data into the database, it is necessary to verify whether the firewall signature data of the target root firewall in the target storage data is correct, that is, to determine whether the signature format of the firewall signature data is correct. If the firewall signature data verification fails, the original firewall signature data in the target storage data is deleted, and the firewall signature data in the target storage data is re-signed according to the target root firewall, and the re-signed target storage data is verified until the firewall signature data in the target storage data is verified. If the firewall signature data verification passes, the critical data protection system based on the firewall further determines the data level of the target storage data, and determines the level of the database according to the data level. Finally, the critical data protection system based on the firewall stores the target storage data in the database corresponding to the data level. In this embodiment, for example, if the data level of the target storage data is level 3, the target storage data is stored in a database of level 3.

Furthermore, when a user accesses the target storage data in the database, the user level corresponding to the user is first determined. If the user level is higher than the level of the target storage data to be obtained, the target storage data is read from the corresponding database and returned. If the user level is lower than the level of the target storage data to be obtained, access is denied. In this embodiment, for example, the user level of user A is level 3, which means that user A can only access target storage data of levels 1, 2, and 3.

This embodiment verifies the firewall signature data in the target storage data; if the firewall signature data verification passes, the data level corresponding to the target storage data is determined, and the target storage data is stored in a database of the corresponding level according to the data level; if the firewall signature data verification fails, the firewall signature data in the target storage data is re-signed according to the target root firewall, and the re-signed target storage data is verified. It can be seen that this embodiment needs to verify the firewall signature data in the target storage data again before storing the target storage data in the database. Through multiple verifications, the security of the target storage data is higher and it is more conducive to protecting key data. At the same time, the target storage data is stored according to the data level and managed according to data permissions, which optimizes the management efficiency of the data.

In summary, the main design concept of the present invention is that when it is detected that there is a data flow crossing a virtual firewall, based on the signature information of each data in the data flow, the data to be stored in the data flow is determined, and then the target root firewall specified in the data to be stored is determined, and based on the private key parameters in the data to be stored, it is determined whether the data to be stored has the authority to enter the target root firewall. If the data to be stored has the authority to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored to obtain the corresponding encrypted data. The present invention first determines the authority of the data to be stored to enter the target root firewall, and after determining that the data to be stored has the right to enter the target root firewall, the domain-level application gateway of the target root firewall is used to encrypt the data to be stored, so that each data to be stored has its corresponding encrypted data, thereby improving the security of production-critical data.

In the embodiments of the present invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B may represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. A and B may be singular or plural. The character "/" generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c may represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c may be single or multiple.

The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings, but the above are only preferred embodiments of the present invention. It should be noted that the technical features involved in the above embodiments and their preferred methods can be reasonably combined and matched into a variety of equivalent schemes by those skilled in the art without departing from or changing the design ideas and technical effects of the present invention; therefore, the present invention is not limited to the scope of implementation shown in the drawings, and all changes made in accordance with the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims (7)

1. A critical data protection method based on a firewall, characterized in that the firewall includes a virtual firewall and a root firewall, and the critical data protection method includes: When it is detected that there is a data flow crossing the virtual firewall, based on the signature information of each data in the data flow, determining the data to be stored in the data flow; Determine a target root firewall specified in the data to be stored, and determine whether the data to be stored has permission to enter the target root firewall based on a private key parameter in the data to be stored; If the data to be stored has the permission to enter the target root firewall, the data to be stored is encrypted based on the domain-level application gateway of the target root firewall to obtain corresponding encrypted data, including: determining the first remainder theorem parameter of the domain-level application gateway based on the first Diophantine equation of the domain-level application gateway; determining the domain-level signature data of the domain-level application gateway for the data to be stored; encrypting the data to be stored based on the first remainder theorem parameter and the domain-level signature data to obtain the encrypted data. 2. The method for protecting critical data based on a firewall according to claim 1, wherein the step of encrypting the data to be stored based on the first remainder theorem parameter and the domain-level signature data to obtain the encrypted data comprises: Multiplying the first remainder theorem parameter by the data to be stored to obtain corresponding first data to be processed; The first data to be processed and the domain-level signature data are packaged to obtain the encrypted data. 3. The method for protecting critical data based on a firewall according to claim 1, characterized in that after obtaining the corresponding encrypted data, the method for protecting critical data further comprises: The regional application gateway based on the target root firewall re-encrypts the encrypted data to obtain corresponding target storage data. 4. The method for protecting critical data based on a firewall according to claim 3, wherein the regional application gateway based on the target root firewall re-encrypts the encrypted data to obtain the corresponding target storage data including: If it is determined based on the regional application gateway that the domain-level signature data verification is passed, determining a second remainder theorem parameter of the regional application gateway based on a second Diophantine equation of the regional application gateway; Determining regional signature data of the encrypted data by the regional application gateway; If it is determined based on the target root firewall that the regional signature data verification is passed, the encrypted data is re-encrypted based on the second remainder theorem parameter to obtain the target storage data. 5. The firewall-based critical data protection method according to claim 4, characterized in that the step of re-encrypting the encrypted data based on the second remainder theorem parameter to obtain the target storage data comprises: Determining a third remainder theorem parameter of the target root firewall based on the third Diophantine equation of the target root firewall; Multiplying the second remainder theorem parameter by the third remainder theorem parameter to obtain a corresponding target remainder theorem parameter; Multiplying the target remainder theorem parameter by the encrypted data to obtain corresponding second data to be processed, and determining firewall signature data of the target root firewall for the second data to be processed; The firewall signature data and the second data to be processed are packaged to obtain the target storage data. 6. The method for protecting critical data based on a firewall according to claim 5, characterized in that after the firewall signature data and the second data to be processed are packaged to obtain the target storage data, the method for protecting critical data further comprises: Verifying the firewall signature data in the target storage data; If the firewall signature data is verified, the data level corresponding to the target storage data is determined, and the target storage data is stored in a database of the corresponding level according to the data level; If the firewall signature data verification fails, the firewall signature data in the target storage data is re-signed according to the target root firewall, and the re-signed target storage data is verified. 7. The method for protecting critical data based on a firewall according to any one of claims 1 to 6, characterized in that the step of determining the data to be stored in the data stream based on the signature information of each data in the data stream comprises: Obtaining a signature list in a database, wherein the signature list contains multiple user signature data; Determine whether there is target signature information in each of the signature information, wherein the target signature information has corresponding user signature data in the signature list; If the target signature information exists, the data corresponding to the target signature information is determined as the data to be stored in the data stream.