Sensitive data identification and protection system for object storage server

Abstract

The invention provides a sensitive data identification and protection system for an object storage server, which belongs to the technical field of information security, and comprises the following steps: a data storage module stores data information in a relational database and the object storage server; the data index module is used for querying the user associated data of the specific user identifier in the relational database based on the data security platform, acquiring the storage address of the user associated data in the object storage server, and acquiring corresponding object storage data in the object storage server; the sensitive data identification module identifies whether the object storage data contains sensitive data or not by calling a sensitive data identification model, and extracts unstructured data containing the sensitive data when identifying that the object storage data contains the sensitive data; and the sensitive data protection module sets access authority based on an access control list rule and adds protection measures to the unstructured data. According to the system, the detection efficiency of data information is effectively improved, and effective identification and protection of sensitive data are realized.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a sensitive data identification and protection system for an object storage server. Background Art

[0002] With the rapid development of information technology, enterprises and organizations are increasingly relying on digital business processes, which has led to the collection and storage of a large amount of personal sensitive data. This data is usually stored in an unstructured form in object storage servers.

[0003] In order to realize the identification and protection of sensitive data, traditional technology manually checks files one by one to identify sensitive information. Although it can realize the piece-by-piece inspection of data information, it is extremely inefficient. When faced with TB-level data information, it is impossible to effectively identify sensitive data, and the error rate of manual inspection is high. In order to improve the recognition efficiency, it is proposed to identify files containing specific words based on keyword search technology for sensitive data detection, but the search based on keywords alone may lead to the omission of some sensitive data, and in the face of large-scale data sets, the search based on keyword technology still requires a lot of computing resources, and it is impossible to effectively identify the context-related information of keywords.

[0004] In summary, the sensitive data identification method based on manual inspection and keyword search technology cannot effectively identify and protect all sensitive data, and the manual inspection method also increases the cost of data management and requires more manpower and material resources to process and monitor data information.

[0005] Therefore, a sensitive data identification and protection system for object storage servers is proposed. Summary of the invention

[0006] In order to solve the above technical problems, the present invention provides a sensitive data identification and protection system for an object storage server, which is used to solve the problem that the traditional technology has low efficiency in sensitive data identification and requires a lot of manpower and material resources to detect data information.

[0007] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, including:

[0008] A data storage module is used to store data information in a relational database and an object storage server through a business server;

[0009] A data indexing module, configured to query the user-related data of a specific user identifier in the relational database based on the data security platform, obtain the storage address of the user-related data in the object storage server, and obtain the corresponding object storage data in the object storage server according to the storage address of the user-related data;

[0010] A sensitive data identification module is used to call a corresponding sensitive data identification model according to the data type of the object storage data, identify whether the object storage data contains sensitive data, and extract unstructured data containing sensitive data when it is identified that the object storage data contains sensitive data;

[0011] The sensitive data protection module is used to set corresponding access rights based on the access control list rules according to the unstructured data obtained by the sensitive data identification module, prohibit the public network server from accessing the unstructured data, limit the access rights of the designated servers in the intranet, and add protection measures to the unstructured data.

[0012] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the data storage module comprises:

[0013] The server storage unit is used to obtain the corresponding data name, data type and data structure according to the data information, construct metadata, generate a unique identifier according to the data information, store the metadata, unique identifier and data information in a data container of the object storage database, and obtain a storage identifier of the data container in the object storage server as a data storage address;

[0014] The database storage unit is used to extract the user identity in the data information, establish a corresponding relationship between the user identity, the data storage address and the data information according to the data storage address of the data information in the object storage server, and store the data information in the relational database.

[0015] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the sensitive data identification module comprises:

[0016] a data type identification unit, used to identify the data type of the object storage data, and when identifying that the data type of the object storage data is a picture type, mark the object storage data as image storage data and transmit it to the image text recognition unit; when identifying that the data type of the object storage data is a sound type, mark the object storage data as sound storage data and transmit it to the voice recognition unit;

[0017] An image text recognition unit, used to recognize text information in the image storage data, obtain the image text information, detect whether the image text information contains sensitive data, and extract the image storage data when it is detected that the image text information contains sensitive data;

[0018] A voice recognition unit, configured to recognize user voice information in the voice storage data, and extract the voice storage data when recognizing that the voice storage data contains user voice information;

[0019] The unstructured data includes image storage data containing sensitive data and sound storage data containing user voice information;

[0020] The sensitive data includes user identity information, communication information, and work and residential address information.

[0021] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the image and text recognition unit comprises:

[0022] The model building subunit is used to build a pre-trained text recognition model through convolutional layers, pooling layers, and fully connected layers;

[0023] A model optimization subunit is used to train the pre-trained text recognition model through a sample training set to obtain a text recognition model; optionally, it includes:

[0024] Inputting a sample image containing text information in the sample training set into a pre-trained text recognition model, wherein the pre-trained text recognition model recognizes a sample text area in the sample image and outputs a sample text recognition result;

[0025] Constructing a comprehensive loss function, optimizing the control parameters of the pre-trained text recognition model, and obtaining the text recognition model when the comprehensive loss function meets a threshold condition;

[0026]

[0027] Among them, L is the comprehensive loss function, X E The sample text area in the sample image obtained by the pre-trained text recognition model, X c is the standard text area corresponding to the sample image, r is the number of characters in the standard text recognition result corresponding to the sample image, is the sample recognition value of the i-th character in the sample text recognition result, is the standard recognition value of the i-th character in the standard character recognition result corresponding to the sample image;

[0028] The model recognition unit is used to recognize the text information in the image storage data through the text recognition model to obtain the image text information.

[0029] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the speech recognition unit comprises:

[0030] A user feature analysis subunit, configured to extract the voiceprint features of the user's voice information in the temporal and spatial dimensions based on a voiceprint extraction model, and obtain a user voiceprint feature vector;

[0031] The storage data feature analysis subunit is used to extract the filter bank features of the sound storage data, perform feature enhancement processing, and obtain the storage data feature spectrum diagram;

[0032] The feature matching analysis subunit is used to calculate the matching score according to the user voiceprint feature vector and the stored data feature spectrum diagram, and recognize the user voice information in the sound storage data.

[0033] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the sensitive data protection module comprises:

[0034] An access permission unit, used to obtain the storage address of the unstructured data in the object storage server, and set the access permission to the unstructured data based on the access control list rule; optionally, including:

[0035] Obtaining a designated intranet server that is allowed to access the unstructured data, and adding the server name, source server address, protocol type, and port number of the designated intranet server that is allowed to access to the unstructured data to an allowed access list; obtaining a designated intranet server that is denied access to the unstructured data, and adding the server name, source server address, protocol type, and port number of the designated intranet server that is denied access to the unstructured data to a denied access list; identifying a server that is not in the allowed access list and the denied access list as a public network server, and denying the public network server access to the unstructured data;

[0036] A data protection unit is used to obtain the data type of the unstructured data, add a visible watermark and a hidden watermark to the unstructured data when the data type of the unstructured data is identified as a picture type, and add protective noise to the unstructured data when the data type of the unstructured data is identified as a voice type.

[0037] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the data protection unit comprises:

[0038] An image acquisition subunit, used for setting unstructured data of a picture type as an image to be protected;

[0039] A watermark acquisition subunit, used to acquire a unique identifier of the image to be protected in the relational database, add a solid color background, and generate a watermark image;

[0040] A hidden watermark adding subunit is used to perform pixel-level analysis on the image to be protected, randomly select pixel point areas to embed the watermark image, and obtain a hidden watermark image;

[0041] The display watermark adding subunit is used to adjust the transparency of the watermark image, superimpose the adjusted watermark image on the hidden watermark image, and perform position transformation and scaling processing to obtain a watermark protection image.

[0042] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the data protection unit further comprises:

[0043] A language preprocessing subunit, used to obtain unstructured data of speech type as audio data to be protected, and convert the audio data to be protected into a frequency domain for feature analysis to obtain audio feature information;

[0044] The speech feature extraction subunit is used to perform global correlation information analysis on the audio feature information through the attention mechanism network layer, obtain deep audio feature information, and construct a deep audio feature vector; perform convolution operation on the deep audio feature information through the convolutional neural network layer, extract hidden feature information in the deep audio feature information, and construct a hidden audio feature vector; the feedforward neural network layer maps the hidden feature information to a high-dimensional feature space for nonlinear activation to construct a high-dimensional feature vector; obtain audio representation information according to the deep audio feature vector, the hidden audio feature vector, and the high-dimensional feature vector;

[0045] A speech feature fusion subunit, used to convert the protection noise to be added into a protection noise feature vector of the same dimension as the audio representation information, perform feature fusion with the audio representation information, and obtain the added protection audio information;

[0046] The speech output subunit is used to convert the added protection audio information into the time domain and store it in the object storage server as unstructured data with added noise protection.

[0047] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the language preprocessing subunit comprises:

[0048] Performing Fourier transform on the audio data to be protected and converting it into frequency domain to obtain a frequency domain audio signal;

[0049] According to the frequency domain audio signal, corresponding energy spectrum data is calculated, and the energy spectrum data is converted into Mel spectrum parameters through a Mel filter to obtain Mel logarithm information;

[0050]

[0051] Among them, c i For S i (j) The corresponding Mel logarithm information, S i (j) is the spectrum value of the jth sampling point in the spectrum parameter of the i-th frame, G i (j) is the transfer function of the Mel filter, m is the number of sampling points in the spectrum parameter of the i-th frame;

[0052] Perform discrete cosine transform on the acquired Mel logarithm information to obtain audio feature information;

[0053]

[0054] Among them, T i is the audio feature information corresponding to the spectrum parameters of the i-th frame, is the Mel logarithmic information c i The r-th dimension feature, K is the audio feature information T i feature dimension.

[0055] Preferably, the present invention provides a sensitive data identification and protection system for an object storage server, wherein the speech feature extraction subunit further includes:

[0056] The attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are trained by using sample speech data, and the trained attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are used for feature extraction of the audio feature information; optionally, including:

[0057] The attention mechanism network layer extracts sub-sample data from the sample speech data for processing, obtains corresponding sample depth feature sub-information, calculates the similarity with the sample depth feature sub-information output by the attention mechanism network layer at the previous moment, and obtains the attention weight of the sub-sample data through regularization processing, performs convolution operation on the attention weight through a preset convolution kernel, extracts multi-channel features of the sub-sample data, and obtains the attention feature vector corresponding to the sub-sample data through an average pooling operation; by calculating the similarity between the attention feature vector and the standard attention feature vector corresponding to the sub-sample data, adjusts the preset convolution kernel size and number of channels of the attention mechanism network layer;

[0058] The convolutional neural network layer is trained according to the sample speech data to optimize the control parameters of the input layer and the hidden layer in the convolutional neural network layer; optionally, including:

[0059] Initializing the original state value of the input layer;

[0060] Initializing the original state value of each node of the hidden layer according to the sample speech data;

[0061]

[0062] Among them, p(h i ) is the i-th node h in the hidden layer i The original state value, sigmoid is the activation function, b i is the hidden layer h i The bias value of the i-th node, o x is the xth sub-sample data in the sample speech data, and the sample speech data contains n sub-sample data in total; α ix is the subsample data o x The corresponding weight value;

[0063] According to the original state value of each node in the hidden layer, the activation state value of each node in the input layer is calculated to reconstruct the state of each node in the input layer;

[0064]

[0065] Among them, I y is the activation state value of the yth node in the input layer, N(,) indicates that it obeys Gaussian distribution, is the bias value of the yth node in the input layer, and l is the number of nodes in the hidden layer;

[0066] Reconstructing the activation state value of the hidden layer according to the activation state value of each node of the reconstructed input layer;

[0067] According to the original state value of the input layer, the original state value of the hidden layer, and the activation state value of the reconstructed input layer and the activation state value of the hidden layer, the weight value is updated until the training of all the sample speech data is completed;

[0068] The feedforward neural network layer is trained according to the sample speech data, outputs a sample feature vector, analyzes the error between the sample feature vector and the standard feature vector corresponding to the sample speech data through a cost function, and optimizes the weight matrix and bias vector of the feedforward neural network layer.

[0069] Compared with the traditional technology, the beneficial effects of the present invention are: a sensitive data identification and protection system for an object storage server, which queries the user-related data of a specific user identifier in the data information through a data index module, and then identifies the sensitive data through a sensitive data identification module, thereby narrowing the data detection scope and only identifying the object storage data that potentially contains sensitive information, thereby reducing the amount of data processing and improving the processing efficiency. When unstructured data containing sensitive data is obtained, data protection of the unstructured data is implemented through a sensitive data protection module, thereby preventing unauthorized access to the server and reducing the risk of data leakage. The above system solves the defect of manually checking data information piece by piece in the traditional technology, effectively improves the detection efficiency of data information, and effectively identifies sensitive data by calling a sensitive data identification model through a sensitive data identification module, thereby avoiding the omission of some sensitive data based on keyword search technology in the traditional technology, reducing data management costs, and enabling the system to be applicable to sensitive data identification of large-scale data sets, without consuming a lot of manpower and material resources to process and monitor data information, and thus effectively identifying and protecting sensitive data.

[0070] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0071] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 A schematic diagram of the structure of a sensitive data identification and protection system for an object storage server provided by the present invention. DETAILED DESCRIPTION

[0073] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0074] Embodiment 1:

[0075] The embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, referring to Figure 1 ,include:

[0076] A data storage module is used to store data information in a relational database and an object storage server through a business server;

[0077] The data index module is used to query the user-related data of a specific user ID in the relational database based on the data security platform, obtain the storage address of the user-related data in the object storage server, and obtain the corresponding object storage data in the object storage server according to the storage address of the user-related data;

[0078] A sensitive data identification module is used to call a corresponding sensitive data identification model according to the data type of the object storage data, identify whether the object storage data contains sensitive data, and extract unstructured data containing sensitive data when it is identified that the object storage data contains sensitive data;

[0079] The sensitive data protection module is used to set corresponding access rights based on the access control list rules according to the unstructured data obtained by the sensitive data identification module, prohibit the public network server from accessing the unstructured data, limit the access rights of the designated servers in the intranet, and add protection measures for the unstructured data.

[0080] In the above embodiments, the data information transmitted by the business server is stored in the relational database and the object storage server through the data storage module. The data index module queries the user-related data of a specific user identifier in the relational database based on the data security platform, obtains the storage address of the user-related data in the object storage server, and further obtains the corresponding object storage data in the object storage server. The sensitive data identification module calls the corresponding sensitive data identification model according to the data type of the object storage data to identify whether the object storage data contains sensitive data. When it is identified that sensitive data is contained, the unstructured data containing the sensitive data is extracted, and the access rights are set for the unstructured data based on the access control list rules through the sensitive data protection module, and corresponding protection measures are added.

[0081] In the above embodiments, the sensitive data identification module includes a text recognition model and a voiceprint extraction model.

[0082] In the above embodiments, the specific user identification may be implemented as a user identification (UID).

[0083] The beneficial effects of the above technology are: a sensitive data identification and protection system for an object storage server realizes the storage of data information in a relational database and an object storage server through a data storage module, and obtains the storage address of user-related data in the object storage server based on a data security platform through a data index module, and further obtains the corresponding object storage data in the object storage server, thereby realizing the acquisition of object storage data for a specific user identifier, and realizing the identification of sensitive data in the object storage data by calling a corresponding sensitive data identification model through a sensitive data identification module, and setting access rights and adding protection measures through a sensitive data protection module; compared with traditional technologies, the above system queries user-related data for a specific user identifier in data information through a data index module, and then identifies sensitive data through a sensitive data identification module, thereby narrowing the scope of data detection. It only identifies the object storage data that potentially contains sensitive information, which reduces the amount of data processing and improves the processing efficiency. When unstructured data containing sensitive data is obtained, the sensitive data protection module is used to protect the unstructured data, thereby preventing unauthorized server access and reducing the risk of data leakage. The system solves the defect of manual inspection of data information piece by piece in traditional technology, effectively improves the detection efficiency of data information, and calls the sensitive data identification model through the sensitive data identification module to realize effective identification of sensitive data, avoiding the omission of some sensitive data based on keyword search technology in traditional technology, reducing data management costs, and enabling the system to be applicable to sensitive data identification of large-scale data sets. Effective identification and protection of sensitive data can be achieved without consuming a lot of manpower and material resources to process and monitor data information.

[0084] Embodiment 2:

[0085] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, a data storage module, including:

[0086] The server storage unit is used to obtain the corresponding data name, data type and data structure according to the data information, construct metadata, generate a unique identifier according to the data information, store the metadata, the unique identifier and the data information in a data container of the object storage database, and obtain a storage identifier of the data container in the object storage server as a data storage address;

[0087] The database storage unit is used to extract the user identity in the data information, establish a corresponding relationship between the user identity, the data storage address and the data information according to the data storage address of the data information in the object storage server, and store the data information in the relational database.

[0088] In the above embodiments, the server storage unit obtains data information transmitted by the business server, extracts the data name, data type and data structure, and constructs metadata; generates a unique identifier based on the data information, and stores the metadata, unique identifier and data information in a data container of the object storage database.

[0089] In the above embodiments, the database storage unit obtains the user identity in the data information and the data storage address of the data information in the object storage server, constructs the corresponding relationship between the user identity, the data storage address and the data information, and stores it in the relational database in the form of a list.

[0090] The beneficial effects of the above technology are: through the server storage unit, data information is stored in the object storage server, and through the database storage unit, the data information and the data storage address of the data information in the object storage server are stored in the relational database, which facilitates the data security platform to query the corresponding data information in the object storage server.

[0091] Embodiment 3:

[0092] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, and a sensitive data identification module, including:

[0093] A data type recognition unit is used to recognize the data type of the object storage data. When the data type of the object storage data is recognized as a picture type, the object storage data is marked as image storage data and transmitted to the image text recognition unit; when the data type of the object storage data is recognized as a sound type, the object storage data is marked as sound storage data and transmitted to the voice recognition unit;

[0094] An image text recognition unit is used to recognize text information in the image storage data, obtain the image text information, detect whether the image text information contains sensitive data, and extract the image storage data when it is detected that the image text information contains sensitive data;

[0095] A voice recognition unit, used to recognize user voice information in the sound storage data, and extract the sound storage data when recognizing that the sound storage data contains user voice information;

[0096] Unstructured data, including image storage data containing sensitive data and sound storage data containing user voice information;

[0097] Sensitive data, including user identity information, communication information, and work and residential address information.

[0098] In the above embodiments, the data type of the object storage data is identified by the data type identification unit. When the data type of the object storage data is identified as a picture type, the object storage data is marked as image storage data and transmitted to the image text recognition unit. The image text recognition unit identifies the text information in the image storage data and detects whether the image text information contains sensitive data. When it is detected that the image text information contains sensitive data, the image storage data is extracted as unstructured data. When the data type of the object storage data is identified as a sound type, the object storage data is marked as sound storage data and transmitted to the speech recognition unit. The speech recognition unit identifies the user voice information in the sound storage data. When it is identified that the sound storage data contains user voice information, the sound storage data is extracted as unstructured data.

[0099] In the above embodiments, the image text information in the image storage data includes user identity information, communication information or work and residence address information, which is determined as image storage data containing sensitive data as unstructured data.

[0100] In the above embodiments, the sound storage data includes user voice information as unstructured data.

[0101] The beneficial effects of the above technology are: the data type of the object storage data is identified through the data type identification unit, and the image and text recognition unit and the voice recognition unit are used to determine whether the object storage data contains sensitive data and user voice information, thereby realizing the acquisition of unstructured data, making it easier for the subsequent sensitive data protection module to execute corresponding protection measures.

[0102] Embodiment 4:

[0103] The embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, an image and text recognition unit, including:

[0104] The model building subunit is used to build a pre-trained text recognition model through convolutional layers, pooling layers, and fully connected layers;

[0105] The model optimization subunit is used to train the pre-trained text recognition model through the sample training set to obtain the text recognition model; optionally, it includes:

[0106] Input a sample image containing text information in a sample training set into a pre-trained text recognition model, and the pre-trained text recognition model recognizes a sample text area in the sample image and outputs a sample text recognition result;

[0107] Construct a comprehensive loss function, optimize the control parameters of the pre-trained text recognition model, and obtain the text recognition model when the comprehensive loss function meets the threshold condition;

[0108]

[0109] Among them, L is the comprehensive loss function, X E The sample text area in the sample image obtained by the pre-trained text recognition model, X c is the standard text area corresponding to the sample image, r is the number of characters in the standard text recognition result corresponding to the sample image, is the sample recognition value of the i-th character in the sample text recognition result, is the standard recognition value of the i-th character in the standard character recognition result corresponding to the sample image;

[0110] The model recognition unit is used to recognize the text information in the image storage data through the text recognition model to obtain the image text information.

[0111] In the above embodiments, the model optimization subunit trains the pre-trained text recognition model built by the model building subunit through a sample training set to obtain a text recognition model, and applies the text recognition model to recognize text information in image storage data through the model recognition unit to obtain image text information.

[0112] In the above embodiment, the model building subunit iterates four groups of combinations through "convolution layer + pooling layer", and finally connects the fully connected layer to build a pre-trained text recognition model, and sets the second group of convolution layers as grouped convolutions to reduce the model weight and improve the recognition accuracy of the model. The dimension is reduced by the pooling layer to improve the fault tolerance of the model, and finally the softmax classifier is called through the fully connected layer to recognize the text.

[0113] In the above embodiments, the model optimization subunit obtains a sample image containing text information in a sample training set, identifies a sample text area and a sample recognition value in the sample image based on a pre-trained text recognition model, evaluates the degree of difference between the sample text area, the sample text recognition result and the standard text area, the standard text recognition result through a comprehensive loss function, optimizes the control parameters of the pre-trained text recognition model, and obtains a text recognition model when the comprehensive loss function meets the threshold condition.

[0114] In the above embodiments, the text recognition model may be implemented as an OCR (Optical Character Recognition) model.

[0115] The beneficial effects of the above technology are: the construction of a pre-trained text recognition model is realized through the model building sub-unit, and the training of the pre-trained text recognition model is realized through the model optimization sub-unit to construct a comprehensive loss function, and the text recognition model is obtained. The text recognition model is used for the recognition of image storage data based on the model recognition unit, and the image text recognition unit further recognizes the text information in the image storage data, which facilitates the recognition of sensitive data in subsequent steps.

[0116] Embodiment 5:

[0117] The embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, a speech recognition unit, including:

[0118] A user feature analysis subunit is used to extract the voiceprint features of the user's voice information in the time series dimension and the space dimension based on the voiceprint extraction model, and obtain the user's voiceprint feature vector;

[0119] The storage data feature analysis subunit is used to extract the filter bank features of the sound storage data, perform feature enhancement processing, and obtain the storage data feature spectrum diagram;

[0120] The feature matching analysis subunit is used to calculate the matching score based on the user's voiceprint feature vector and the stored data feature spectrum diagram, and to recognize the user's voice information in the sound storage data.

[0121] In the above embodiments, the speech recognition unit obtains the voiceprint features of the user voice information based on the voiceprint extraction model through the user feature analysis subunit, generates a user voiceprint feature vector, extracts the filter group features of the sound storage data through the storage data feature analysis subunit, obtains the storage data feature spectrum graph, and calculates the matching score between the user voiceprint feature vector and the storage data feature spectrum graph through the feature matching analysis subunit, thereby realizing the judgment of whether the sound storage data contains the user voice information.

[0122] In the above embodiments, the voiceprint extraction model is implemented by a channel compensation algorithm.

[0123] In the above embodiments, the speech recognition unit may be implemented as an automatic speech recognition (ASR) unit.

[0124] The beneficial effects of the above technology are: through the user feature analysis subunit, the voiceprint features of the user voice information are extracted, through the storage data feature analysis subunit, the filter group features of the sound storage data are extracted, and the storage data feature spectrum diagram is obtained, and through the feature matching analysis subunit, the judgment of the sound storage data containing user voice information is realized, thereby realizing the acquisition of voice type unstructured data by the voice recognition unit.

[0125] Embodiment 6:

[0126] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, and a sensitive data protection module, including:

[0127] The access permission unit is used to obtain the storage address of the unstructured data in the object storage server and set the access permission to the unstructured data based on the access control list rules; optional, including:

[0128] Obtain the designated intranet servers that are allowed to access unstructured data, and add the server name, source server address, protocol type, and port number of the designated intranet servers that are allowed to access to the allowed access list; obtain the designated intranet servers that are denied access to unstructured data, and add the server name, source server address, protocol type, and port number of the designated intranet servers that are denied access to the denied access list; identify servers that are not in the allowed access list and the denied access list as public network servers, and deny public network servers access to unstructured data;

[0129] The data protection unit is used to obtain the data type of the unstructured data, add a visible watermark and a hidden watermark to the unstructured data when the data type of the unstructured data is identified as a picture type, and add protection noise to the unstructured data when the data type of the unstructured data is identified as a voice type.

[0130] In the above embodiments, the access permission unit sets the access permission to the unstructured data in the object storage server based on the access control list rules, and the data protection unit adds protection measures according to the data type of the unstructured data to improve the security of the unstructured data.

[0131] In the above embodiments, the access control list rules are implemented as ACL (Access Control List) rules.

[0132] In the above embodiments, the access permission unit constructs an allowed access list and a denied access list for the specified intranet server, and stores the server name, source server address, protocol type and port number of the corresponding specified intranet server in the constructed allowed access list and denied access list.

[0133] In the above embodiment, the specified intranet server in the access list is allowed, and an access request is initiated to the object storage server based on the transmission protocol according to the source server address. The object storage server verifies the server name and port number of the specified intranet server. After the verification is passed, data is transmitted with the object storage server through the API interface.

[0134] In the above embodiments, the access permission unit identifies a server that is not in the allowed access list and the denied access list as a public network server, and denies the public network server access to the unstructured data.

[0135] In the above embodiments, the data protection unit adds a visible watermark and a hidden watermark to the unstructured data of the picture type, and adds protection noise to the unstructured data of the voice type, so as to protect the unstructured data.

[0136] The beneficial effects of the above technology are: through the access permission unit, the access permission setting for unstructured data in the object storage server is realized based on the access control list rule setting, the access of public network servers is prohibited, and the access of designated servers in the intranet is restricted; and through the data protection unit, protection measures are added to unstructured data of different data types, which further improves the security of unstructured data stored in the object storage server and reduces the risk of data leakage.

[0137] Embodiment 7:

[0138] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, and a data protection unit, including:

[0139] An image acquisition subunit, used for setting unstructured data of a picture type as an image to be protected;

[0140] The watermark acquisition subunit is used to obtain the unique identifier of the image to be protected in the relational database, add a solid color background, and generate a watermark image;

[0141] The hidden watermark adding subunit is used to perform pixel-level analysis on the image to be protected, randomly select pixel point areas to embed the watermark image, and obtain the hidden watermark image;

[0142] The display watermark adding subunit is used to adjust the transparency of the watermark image, superimpose the adjusted watermark image on the hidden watermark image, and perform position transformation and scaling processing to obtain the watermark protection image.

[0143] In the above embodiments, the image acquisition subunit sets the unstructured data of the picture type as the image to be protected, generates a watermark image according to the unique identifier through the watermark acquisition subunit, randomly selects a pixel point area in the image to be protected based on the hidden watermark adding subunit to embed the watermark image, and obtains the hidden watermark image, and superimposes the watermark image on the image to be protected based on the display watermark adding subunit, performs position transformation and scaling processing, and obtains the watermark protection image.

[0144] In the above embodiments, according to the actual protection requirements for unstructured data of picture type, a visible watermark adding subunit or a hidden watermark adding subunit may be selected to add a visible watermark or a hidden watermark to the image to be protected.

[0145] The beneficial effects of the above technology are: through the watermark acquisition subunit, the watermark image is acquired, and through the hidden watermark adding subunit and the display watermark adding subunit, the function of adding hidden watermarks and display watermarks to the protected image is realized, further realizing the protection of unstructured data of picture type, improving the security of unstructured data, protecting the copyright of unstructured data and tracking its usage, and improving the transparency and security of data management.

[0146] Embodiment 8:

[0147] An embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, a data protection unit, and further includes:

[0148] The speech preprocessing subunit is used to obtain unstructured data of speech type as audio data to be protected, and convert the audio data to be protected into the frequency domain for feature analysis to obtain audio feature information;

[0149] The speech feature extraction subunit is used to perform global correlation information analysis on the audio feature information through the attention mechanism network layer, obtain deep audio feature information, and construct a deep audio feature vector; perform convolution operation on the deep audio feature information through the convolutional neural network layer, extract hidden feature information in the deep audio feature information, and construct a hidden audio feature vector; the feedforward neural network layer maps the hidden feature information to a high-dimensional feature space for nonlinear activation to construct a high-dimensional feature vector; obtain audio representation information based on the deep audio feature vector, the hidden audio feature vector, and the high-dimensional feature vector;

[0150] The speech feature fusion subunit is used to convert the protection noise to be added into a protection noise feature vector of the same dimension as the audio representation information, perform feature fusion with the audio representation information, and obtain the added protection audio information;

[0151] The speech output subunit is used to convert the audio information with added protection into the time domain, and store it in the object storage server as unstructured data with added noise protection.

[0152] In the above embodiments, the speech preprocessing subunit converts the audio data into the frequency domain for feature analysis, the speech feature extraction subunit extracts feature information from the audio feature information to obtain audio characterization information, and the speech feature fusion subunit fuses the noise feature vector with the audio characterization information to obtain added protection audio information, and the speech output subunit converts the added protection audio information into the time domain and stores it in the object storage server as unstructured data with added noise protection.

[0153] In the above embodiments, the attention mechanism network layer in the speech feature extraction subunit performs global correlation information analysis on the audio feature information, obtains deep audio feature information, and constructs a deep audio feature vector; the convolutional neural network layer extracts hidden feature information from the deep audio feature information by performing convolution operations on the deep audio feature information, and constructs a hidden audio feature vector; the feedforward neural network layer maps the hidden feature information to a high-dimensional feature space for nonlinear activation to construct a high-dimensional feature vector.

[0154] In the above embodiments, the audio representation information includes a deep audio feature vector, a latent audio feature vector and a high-dimensional feature vector.

[0155] In the above embodiment, the speech feature fusion subunit converts the protection noise to be added into a protection noise feature vector with the same dimension as the audio representation information.

[0156] The beneficial effects of the above technology are: the speech preprocessing subunit converts the audio data into the frequency domain for analysis, and extracts the audio feature information through the speech feature extraction subunit, thereby realizing the acquisition of audio characterization information, and realizing the feature fusion of the protection noise to be added and the audio characterization information through the speech feature fusion subunit, and converts the unstructured data with added noise protection into the time domain and stores it in the object storage server through the speech output subunit, thereby realizing the addition of noise protection to the unstructured data of the speech type through the speech preprocessing subunit, the speech feature extraction subunit, the speech feature fusion subunit and the speech output subunit, thereby further improving the security of the unstructured data of the speech type in the object storage server.

[0157] Embodiment 9:

[0158] The embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, a voice preprocessing subunit, including:

[0159] Perform Fourier transform on the audio data to be protected and convert it into the frequency domain to obtain a frequency domain audio signal;

[0160] According to the frequency domain audio signal, the corresponding energy spectrum data is calculated, and the energy spectrum data is converted into Mel spectrum parameters through Mel filter to obtain Mel logarithm information;

[0161]

[0162] Among them, c i For S i (j) The corresponding Mel logarithm information, S i (j) is the spectrum value of the jth sampling point in the spectrum parameter of the i-th frame, G i (j) is the transfer function of the Mel filter, m is the number of sampling points in the spectrum parameter of the i-th frame;

[0163] Perform discrete cosine transform on the acquired Mel logarithm information to obtain audio feature information;

[0164]

[0165] Among them, T i is the audio feature information corresponding to the spectrum parameters of the i-th frame, is the Mel logarithmic information c i The r-th dimension feature, K is the audio feature information T i feature dimension.

[0166] In the above embodiments, the speech preprocessing subunit performs Fourier transform on the audio data to be protected and converts it into the frequency domain for analysis, and calculates the corresponding energy spectrum data based on the frequency domain audio signal; the energy spectrum data is converted into Mel spectrum parameters through a Mel filter, and the Mel logarithm information is obtained for discrete cosine transform to obtain audio feature information.

[0167] The beneficial effect of the above technology is that by converting the audio data to be protected into Mel-spectrogram parameters for analysis, the acquired audio feature information is independent of the original input signal features, retains the user's voice features, and has high noise resistance and reliability, which facilitates the subsequent steps of voice feature extraction.

[0168] Embodiment 10:

[0169] The embodiment of the present invention provides a sensitive data identification and protection system for an object storage server, the speech feature extraction subunit further comprising:

[0170] The attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are trained by using sample speech data, and the trained attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are used for feature extraction of audio feature information; optionally, including:

[0171] The attention mechanism network layer extracts sub-sample data from the sample speech data for processing, obtains the corresponding sample depth feature sub-information, calculates the similarity with the sample depth feature sub-information output by the attention mechanism network layer at the previous moment, and processes the attention weight of the sub-sample data through regularization, performs convolution operation on the attention weight through a preset convolution kernel, extracts the multi-channel features of the sub-sample data, and obtains the attention feature vector corresponding to the sub-sample data through an average pooling operation; by calculating the similarity between the attention feature vector and the standard attention feature vector corresponding to the sub-sample data, the preset convolution kernel size and number of channels of the attention mechanism network layer are adjusted;

[0172] The convolutional neural network layer is trained according to the sample speech data to optimize the control parameters of the input layer and hidden layer in the convolutional neural network layer; optional, including:

[0173] Initialize the original state value of the input layer;

[0174] Initialize the original state value of each node in the hidden layer according to the sample speech data;

[0175]

[0176] Among them, p(h i ) is the i-th node h in the hidden layer i The original state value, sigmoid is the activation function, b i is the hidden layer h i The bias value of the i-th node, o x is the xth sub-sample data in the sample speech data, and the sample speech data contains n sub-sample data in total; α ix is the subsample data o x The corresponding weight value;

[0177] According to the original state value of each node in the hidden layer, the activation state value of each node in the input layer is calculated to reconstruct the state of each node in the input layer;

[0178]

[0179] Among them, I y is the activation state value of the yth node in the input layer, N(,) indicates that it obeys Gaussian distribution, is the bias value of the yth node in the input layer, and l is the number of nodes in the hidden layer;

[0180] Reconstruct the activation state value of the hidden layer according to the activation state value of each node of the reconstructed input layer;

[0181] The weight value is updated according to the original state value of the input layer, the original state value of the hidden layer, the activation state value of the reconstructed input layer, and the activation state value of the hidden layer until the training of all the sample speech data is completed;

[0182] The feedforward neural network layer is trained according to the sample speech data, outputs the sample feature vector, analyzes the error between the sample feature vector and the standard feature vector corresponding to the sample speech data through the cost function, and optimizes the weight matrix and bias vector of the feedforward neural network layer.

[0183] In the above embodiments, an attention mechanism network layer, a convolutional neural network layer, and a feedforward neural network layer are respectively constructed to construct a speech feature extraction subunit, and training is performed through sample speech data to adjust the control parameters of the network layer.

[0184] In the above embodiments, for the training of the attention mechanism network layer, sub-sample data in the sample speech data is obtained and input into the attention mechanism network layer, and based on the output sample depth feature sub-information, the similarity with the sample depth feature sub-information output by the attention mechanism unit at the previous moment is calculated, and the attention weight of the sub-sample data is obtained through regularization processing, and a convolution operation is performed on the attention weight to extract the multi-channel features of the sub-sample data. Through the average pooling operation, the attention feature vector corresponding to the sub-sample data is obtained; by calculating the similarity between the attention feature vector and the standard attention feature vector corresponding to the sub-sample data, the preset convolution kernel size and number of channels of the attention mechanism network layer are adjusted.

[0185] In the above embodiments, for the training of the convolutional neural network layer, the original state value of the input layer is set, the activation state value of each node in the hidden layer is initialized according to the sample speech data, and the activation state value of each node in the input layer is reversely updated, and the weight value is updated to achieve the optimization of the control parameters of the input layer and the hidden layer in the convolutional neural network layer.

[0186] In the above embodiments, for the training of the feedforward neural network layer, the sample speech data is input into the feedforward neural network layer, and the corresponding sample feature vector is output; and the error between the sample feature vector and the standard feature vector corresponding to the sample speech data is analyzed through the cost function to optimize the weight matrix and bias vector of the feedforward neural network layer.

[0187] The beneficial effects of the above technology are: through sample speech data, the attention mechanism network layer, convolutional neural network layer, and feedforward neural network layer are trained, the control parameters of each network layer are optimized, and the feature extraction of audio feature information by the speech feature extraction subunit is realized.

[0188] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A sensitive data identification and protection system for an object storage server, characterized in that: include: A data storage module is used to store data information in a relational database and an object storage server through a business server; A data indexing module, configured to query the user-related data of a specific user identifier in the relational database based on the data security platform, obtain the storage address of the user-related data in the object storage server, and obtain the corresponding object storage data in the object storage server according to the storage address of the user-related data; A sensitive data identification module is used to call a corresponding sensitive data identification model according to the data type of the object storage data, identify whether the object storage data contains sensitive data, and extract unstructured data containing sensitive data when it is identified that the object storage data contains sensitive data; The sensitive data protection module is used to set corresponding access rights based on the access control list rules according to the unstructured data obtained by the sensitive data identification module, prohibit the public network server from accessing the unstructured data, limit the access rights of the designated servers in the intranet, and add protection measures to the unstructured data.

2. A sensitive data identification and protection system for an object storage server according to claim 1, characterized in that: The data storage module comprises: The server storage unit is used to obtain the corresponding data name, data type and data structure according to the data information, construct metadata, generate a unique identifier according to the data information, store the metadata, unique identifier and data information in a data container of the object storage database, and obtain a storage identifier of the data container in the object storage server as a data storage address; The database storage unit is used to extract the user identity in the data information, establish a corresponding relationship between the user identity, the data storage address and the data information according to the data storage address of the data information in the object storage server, and store the data information in the relational database.

3. A sensitive data identification and protection system for an object storage server according to claim 1, characterized in that: The sensitive data identification module includes: a data type identification unit, configured to identify the data type of the object storage data, and when identifying that the data type of the object storage data is a picture type, mark the object storage data as image storage data and transmit it to the image text recognition unit; when identifying that the data type of the object storage data is a sound type, mark the object storage data as sound storage data and transmit it to the voice recognition unit; An image text recognition unit, used to recognize text information in the image storage data, obtain the image text information, detect whether the image text information contains sensitive data, and extract the image storage data when it is detected that the image text information contains sensitive data; A voice recognition unit, configured to recognize user voice information in the voice storage data, and extract the voice storage data when recognizing that the voice storage data contains user voice information; The unstructured data includes image storage data containing sensitive data and sound storage data containing user voice information; The sensitive data includes user identity information, communication information, and work and residential address information.

4. A sensitive data identification and protection system for an object storage server according to claim 3, characterized in that: The image character recognition unit comprises: The model building subunit is used to build a pre-trained text recognition model through convolutional layers, pooling layers, and fully connected layers; A model optimization subunit is used to train the pre-trained text recognition model through a sample training set to obtain a text recognition model; optionally, it includes: Inputting a sample image containing text information in the sample training set into a pre-trained text recognition model, wherein the pre-trained text recognition model recognizes a sample text area in the sample image and outputs a sample text recognition result; Constructing a comprehensive loss function, optimizing the control parameters of the pre-trained text recognition model, and obtaining the text recognition model when the comprehensive loss function meets a threshold condition; Among them, L is the comprehensive loss function, X E The sample text area in the sample image obtained by the pre-trained text recognition model, X c is the standard text area corresponding to the sample image, r is the number of characters in the standard text recognition result corresponding to the sample image, is the sample recognition value of the i-th character in the sample text recognition result, is the standard recognition value of the i-th character in the standard character recognition result corresponding to the sample image; The model recognition unit is used to recognize the text information in the image storage data through the text recognition model to obtain the image text information.

5. A sensitive data identification and protection system for an object storage server according to claim 3, characterized in that: The speech recognition unit comprises: A user feature analysis subunit, configured to extract the voiceprint features of the user's voice information in the temporal and spatial dimensions based on a voiceprint extraction model, and obtain a user voiceprint feature vector; The storage data feature analysis subunit is used to extract the filter bank features of the sound storage data, perform feature enhancement processing, and obtain the storage data feature spectrum diagram; The feature matching analysis subunit is used to calculate the matching score according to the user voiceprint feature vector and the stored data feature spectrum diagram, and recognize the user voice information in the sound storage data.

6. A sensitive data identification and protection system for an object storage server according to claim 1, characterized in that: The sensitive data protection module comprises: An access permission unit, used to obtain the storage address of the unstructured data in the object storage server, and set the access permission to the unstructured data based on the access control list rule; optionally, including: Obtaining a designated intranet server that is allowed to access the unstructured data, and adding the server name, source server address, protocol type, and port number of the designated intranet server that is allowed to access to the unstructured data to an allowed access list; obtaining a designated intranet server that is denied access to the unstructured data, and adding the server name, source server address, protocol type, and port number of the designated intranet server that is denied access to the unstructured data to a denied access list; identifying a server that is not in the allowed access list and the denied access list as a public network server, and denying the public network server access to the unstructured data; A data protection unit is used to obtain the data type of the unstructured data, add a visible watermark and a hidden watermark to the unstructured data when the data type of the unstructured data is identified as a picture type, and add protective noise to the unstructured data when the data type of the unstructured data is identified as a voice type.

7. A sensitive data identification and protection system for an object storage server according to claim 6, characterized in that: The data protection unit comprises: An image acquisition subunit, used for setting unstructured data of a picture type as an image to be protected; A watermark acquisition subunit, used to acquire a unique identifier of the image to be protected in the relational database, add a solid color background, and generate a watermark image; A hidden watermark adding subunit is used to perform pixel-level analysis on the image to be protected, randomly select pixel point areas to embed the watermark image, and obtain a hidden watermark image; The display watermark adding subunit is used to adjust the transparency of the watermark image, superimpose the adjusted watermark image on the hidden watermark image, and perform position transformation and scaling processing to obtain a watermark protection image.

8. A sensitive data identification and protection system for an object storage server according to claim 7, characterized in that: The data protection unit further includes: A language preprocessing subunit, used to obtain unstructured data of speech type as audio data to be protected, and convert the audio data to be protected into a frequency domain for feature analysis to obtain audio feature information; The speech feature extraction subunit is used to perform global correlation information analysis on the audio feature information through the attention mechanism network layer, obtain deep audio feature information, and construct a deep audio feature vector; perform convolution operation on the deep audio feature information through the convolutional neural network layer, extract hidden feature information in the deep audio feature information, and construct a hidden audio feature vector; the feedforward neural network layer maps the hidden feature information to a high-dimensional feature space for nonlinear activation to construct a high-dimensional feature vector; obtain audio representation information according to the deep audio feature vector, the hidden audio feature vector, and the high-dimensional feature vector; A speech feature fusion subunit, used to convert the protection noise to be added into a protection noise feature vector of the same dimension as the audio representation information, perform feature fusion with the audio representation information, and obtain the added protection audio information; The speech output subunit is used to convert the added protection audio information into the time domain and store it in the object storage server as unstructured data with added noise protection.

9. A sensitive data identification and protection system for an object storage server according to claim 8, characterized in that: The language preprocessing subunit comprises: Performing Fourier transform on the audio data to be protected and converting it into frequency domain to obtain a frequency domain audio signal; According to the frequency domain audio signal, corresponding energy spectrum data is calculated, and the energy spectrum data is converted into Mel spectrum parameters through a Mel filter to obtain Mel logarithm information; Among them, c i For S i (j) The corresponding Mel logarithm information, S i (j) is the spectrum value of the jth sampling point in the spectrum parameter of the i-th frame, G i (j) is the transfer function of the Mel filter, m is the number of sampling points in the spectrum parameter of the i-th frame; Perform discrete cosine transform on the acquired Mel logarithm information to obtain audio feature information; Among them, T i is the audio feature information corresponding to the spectrum parameters of the i-th frame, is the Mel logarithmic information c i The r-th dimension feature, K is the audio feature information T i feature dimension.

10. A sensitive data identification and protection system for an object storage server according to claim 8, characterized in that: The speech feature extraction subunit further includes: The attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are trained by using sample speech data, and the trained attention mechanism network layer, the convolutional neural network layer and the feedforward neural network layer are used for feature extraction of the audio feature information; optionally, including: The attention mechanism network layer extracts sub-sample data from the sample speech data for processing, obtains corresponding sample depth feature sub-information, calculates the similarity with the sample depth feature sub-information output by the attention mechanism network layer at the previous moment, and obtains the attention weight of the sub-sample data through regularization processing, performs convolution operation on the attention weight through a preset convolution kernel, extracts multi-channel features of the sub-sample data, and obtains the attention feature vector corresponding to the sub-sample data through an average pooling operation; by calculating the similarity between the attention feature vector and the standard attention feature vector corresponding to the sub-sample data, adjusts the preset convolution kernel size and number of channels of the attention mechanism network layer; The convolutional neural network layer is trained according to the sample speech data to optimize the control parameters of the input layer and the hidden layer in the convolutional neural network layer; optionally, including: Initializing the original state value of the input layer; Initializing the original state value of each node of the hidden layer according to the sample speech data; Among them, p(h i ) is the i-th node h in the hidden layer i The original state value, sigmoid is the activation function, b i is the hidden layer h i The bias value of the i-th node, o x is the xth sub-sample data in the sample speech data, and the sample speech data contains n sub-sample data in total; α ix is the subsample data o x The corresponding weight value; According to the original state value of each node in the hidden layer, the activation state value of each node in the input layer is calculated to reconstruct the state of each node in the input layer; Among them, I y is the activation state value of the yth node in the input layer, N(,) indicates that it obeys Gaussian distribution, is the bias value of the yth node in the input layer, and l is the number of nodes in the hidden layer; Reconstructing the activation state value of the hidden layer according to the activation state value of each node of the reconstructed input layer; According to the original state value of the input layer, the original state value of the hidden layer, and the activation state value of the reconstructed input layer and the activation state value of the hidden layer, the weight value is updated until the training of all the sample speech data is completed; The feedforward neural network layer is trained according to the sample speech data, outputs a sample feature vector, analyzes the error between the sample feature vector and the standard feature vector corresponding to the sample speech data through a cost function, and optimizes the weight matrix and bias vector of the feedforward neural network layer.

Images