Data security and privacy protection method and system

Abstract

The invention belongs to the technical field of data processing. The data security and privacy protection method comprises the following steps: determining an encryption algorithm of data according to the sensitivity and access frequency of the data; determining the authority of the user by using the behavior prediction model; determining an optimal desensitization method by using a context-aware desensitization technology; analyzing security threats and abnormal behaviors of the current data operation by using a predictive security audit model to obtain a precautionary measure method; obtaining backup time and frequency of the data by utilizing the sensitivity and the change frequency of the data; and processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the precautionary measure method and the backup time and frequency of the data to obtain a data security and privacy protection method. By utilizing the method, the effects of encrypting the data in multiple aspects, dynamically adjusting the user permission and thoroughly desensitizing are achieved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a data security and privacy protection method and system. Background Art

[0002] In modern data processing and analysis, data security and privacy protection are crucial links. As the amount of data continues to increase, the complexity of data transmission, storage and processing is also increasing, and ensuring data security and privacy has become increasingly important. The use of advanced encryption technology, strict permission control, data desensitization and security auditing can effectively protect the security and privacy of data throughout its life cycle.

[0003] Although the above method can achieve data protection, it also has the following shortcomings:

[0004] 1. Incomplete encryption measures: Existing solutions usually only use encryption measures during data transmission, but do not perform sufficient encryption processing during storage, which makes data easy to be cracked and leaked in a static storage state.

[0005] 2. Inadequate permission control: Existing solutions are not detailed enough in permission management. Usually, only simple role-based access control (RBAC) is used, which makes it difficult to cope with complex data access requirements, resulting in unauthorized users gaining improper access rights.

[0006] 3. Incomplete data desensitization: During data processing and analysis, existing solutions do not fully desensitize sensitive information. They only perform simple desensitization on some fields and cannot effectively prevent the leakage of sensitive information.

[0007] 4. Imperfect security audit mechanism: The existing solution does not record security audits in detail and cannot monitor and warn abnormal operations in real time, resulting in insufficient traceability of data operations and insufficient emergency response capabilities.

[0008] 5. Imperfect data backup and recovery mechanism: The existing solution has a low backup frequency and slow data recovery speed. It is impossible to quickly restore data in emergencies, affecting business continuity. Summary of the invention

[0009] Based on this, it is necessary to provide a data security and privacy protection method to address the above technical issues.

[0010] In a first aspect, the present application provides a method for data security and privacy protection, the method comprising:

[0011] Determine the encryption algorithm for the data based on the sensitivity of the data and the access frequency;

[0012] Use behavioral prediction models to determine user permissions;

[0013] Use context-aware desensitization technology to determine the optimal desensitization method;

[0014] Use predictive security audit models to analyze security threats and abnormal behaviors of current data operations and obtain preventive measures;

[0015] Using the sensitivity and change frequency of the data, the backup time and frequency of the data are obtained;

[0016] The data is processed according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

[0017] In some practicable manners, the step of determining the encryption algorithm of the data according to the sensitivity of the data and the access frequency includes:

[0018] Acquire relevant information of the data, wherein the relevant information includes at least one of a data type, a data structure, and a content;

[0019] Obtaining the sensitivity of the data according to the relevant information of the data, wherein the sensitivity represents the classification of the sensitivity of the data according to a preset sensitivity classification standard;

[0020] According to the log records, the number of accesses and access patterns of the data are collected to obtain the access frequency;

[0021] Obtaining selection information of the encryption algorithm according to the sensitivity of the data and the access frequency;

[0022] The encryption algorithm selection information is matched with the preset encryption algorithm rules to determine the encryption algorithm for the data.

[0023] In some practicable ways, the step of using the behavior prediction model to determine the user's authority includes:

[0024] Obtaining the user's behavior data and analyzing it to obtain the user's behavior characteristics;

[0025] Using the user's behavior characteristics, training an initial behavior prediction model to obtain a behavior prediction model;

[0026] Obtaining initial permissions of the user according to the behavior prediction model;

[0027] Acquire the current environment and context information of the user to obtain first permission adjustment information of the user;

[0028] The authority of the user is determined according to the first authority adjustment information of the user and the initial authority of the user.

[0029] In some practicable embodiments, the step of determining the optimal desensitization method using context-aware desensitization technology includes:

[0030] Get context information of current data;

[0031] According to the context information, a desensitization strategy library is matched to obtain an optimal desensitization method, wherein the desensitization strategy library pre-stores several desensitization methods.

[0032] In some practicable methods, the step of using a predictive security audit model to analyze security threats and abnormal behaviors of current data operations and obtain preventive measures includes:

[0033] Build an initial predictive security audit model and obtain historical data operation behavior;

[0034] Using historical data operation behaviors, the initial predictive security audit model is trained to obtain a predictive security audit model;

[0035] By using the predictive security audit model, the security threats and abnormal behaviors of current data operations will be analyzed to obtain countermeasures.

[0036] In some practicable manners, the step of obtaining the backup time and frequency of the data by using the sensitivity and change frequency of the data includes:

[0037] Priority marking is performed according to the sensitivity of the data to obtain data with the priority mark;

[0038] Determine the idle window period based on the time when the frequency of changes occurs;

[0039] The backup time and frequency of the data are obtained according to the priority of the data with the priority mark and the idle window period.

[0040] In some practicable manners, the step of processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection includes:

[0041] Record all data access and log records in the blockchain to obtain an unalterable log chain;

[0042] The management and access rights control of the data are distributed in a grid-like manner through blockchain to obtain distributed data management and verification;

[0043] Data protection is achieved by utilizing the tamper-proof log chain and the distributed data management and verification;

[0044] The data protection, the encryption algorithm of the data, the user's authority, the optimal desensitization method, the preventive measures, the backup time and frequency of the data are processed to obtain a method for data security and privacy protection.

[0045] In some practicable manners, the step of processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection includes:

[0046] Determine the user's risk level based on the user's historical data operation behavior;

[0047] According to the risk level of the user, second permission adjustment information and encryption strategy of the user are obtained.

[0048] The initial permissions of the user are adjusted according to the second permission adjustment information of the user.

[0049] In a second aspect, the present application provides a data security and privacy protection system, which is applied to the aforementioned data security and privacy protection method, and the system includes:

[0050] An encryption unit, used to determine an encryption algorithm for the data according to the sensitivity of the data and the access frequency;

[0051] A permission unit, used to determine the user's permissions using a behavior prediction model;

[0052] A desensitization unit, used to determine the optimal desensitization method using context-aware desensitization technology;

[0053] The model unit is used to analyze the security threats and abnormal behaviors of current data operations by using the predictive security audit model, and obtain preventive measures;

[0054] A backup unit, used to obtain the backup time and frequency of the data by using the sensitivity and change frequency of the data;

[0055] The integration unit is used to process the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

[0056] In a third aspect, the present application provides a computer program, which, when executed by a processor, implements the steps of the aforementioned data security and privacy protection method.

[0057] Beneficial Effects

[0058] The present application provides a data security and privacy protection method, which determines the encryption algorithm of the data according to the sensitivity of the data and the access frequency; determines the user's authority by using a behavior prediction model; determines the optimal desensitization method by using context-aware desensitization technology; uses a predictive security audit model to analyze the security threats and abnormal behaviors of current data operations and obtains a preventive measure method; uses the sensitivity of the data and the frequency of changes to obtain the backup time and frequency of the data; processes the data according to the encryption algorithm of the data, the user's authority, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection. The above method has the effect of encrypting multiple aspects of the data, dynamically adjusting user authority, and thoroughly desensitizing. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the conventional technology, the drawings required for use in the embodiments or the conventional technology descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0060] Figure 1 The present invention is a flowchart of a data security and privacy protection method in one embodiment. DETAILED DESCRIPTION

[0061] In order to facilitate understanding of the present application, the present application will be described more fully below with reference to the relevant drawings. Embodiments of the present application are provided in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used herein includes any and all couplings of one or more related listed items.

[0063] It can be understood that the terms "first", "second", etc. used in the present application can be used in this article to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element.

[0064] Some terms involved in this application are explained below to facilitate understanding of this application:

[0065] Contextual information refers to various information related to an event, behavior or data in a specific situation or environment. This information helps to understand the current scenario, user needs and data sensitivity, so as to make more accurate decisions.

[0066] like Figure 1 As shown, in a first aspect of the present application, a data security domain privacy protection method is provided, the method comprising:

[0067] S100, determining an encryption algorithm for the data according to the sensitivity and access frequency of the data.

[0068] Determining the encryption algorithm for data includes the following steps:

[0069] S101, obtaining relevant information of the data;

[0070] The relevant information includes at least one of a data type, a data structure and a data content.

[0071] Exemplarily, relevant information of the data to be encrypted is collected, including data type (such as personal information, financial data, medical records, etc.), data structure and content. The relevant information content includes information of different importance levels.

[0072] S102: Obtain the sensitivity of the data according to the relevant information of the data.

[0073] The sensitivity indicates that the data is classified according to a preset sensitivity classification standard.

[0074] Exemplarily, the relevant information of the data is classified into sensitivity levels, and this classification level can be preset manually, such as classifying the data according to regulatory requirements, company policies, etc., and then determining the sensitivity level of the data (for example, low, medium, or high sensitivity) based on the classification.

[0075] S103, collecting the number of accesses and access patterns of the data according to the log records to obtain the access frequency.

[0076] Among them, log records can monitor the access to data. According to the content of log records, the number of accesses and access patterns of data are obtained. Specifically, the number of accesses indicates the frequency of access, and the access pattern indicates the information of the visitor, the time of access, and the method of access. Furthermore, the number of accesses is divided according to the preset number, that is, the access to data is divided into high frequency, low frequency, and occasional, so as to determine the access frequency.

[0077] S104: Obtain selection information of the encryption algorithm according to the sensitivity of the data and the access frequency.

[0078] S105, matching the encryption algorithm selection information with the preset encryption algorithm rules to determine the encryption algorithm for the data

[0079] It should be noted that after obtaining the data sensitivity and access frequency, the selection information of the encryption algorithm can be obtained. Each encryption algorithm has corresponding selection information. In this way, after obtaining the selection information, this selection information is matched with the corresponding selection information corresponding to the encryption algorithm to determine which encryption algorithm should be selected. In other words, according to the selection information of the encryption algorithm, it is matched with the encryption algorithm rules to determine the encryption algorithm of the data.

[0080] Exemplarily, for highly sensitive data, a high-strength encryption algorithm (such as AES-256) is selected. For data with low sensitivity and high access frequency, a lightweight encryption algorithm (such as AES-128 or a scheme based on symmetric encryption) is selected. For data with low frequency but high sensitivity, a stronger encryption scheme is selected. This can be used as a matching criterion for selecting an encryption algorithm. Next, the encryption algorithm can be matched with the selection information, for example, high sensitivity + high frequency: select an encryption algorithm of moderate strength (such as AES-128) to ensure a balance between performance and security. High sensitivity + low frequency: Select a high-strength encryption algorithm (such as AES-256) to maximize the protection of sensitive data. Low sensitivity + high frequency: Select a lightweight encryption algorithm to improve efficiency.

[0081] It should also be noted that AI algorithms can be used to dynamically adjust encryption strength and encryption algorithms based on the sensitivity and access frequency of the data. For example, for data with high access frequency and low sensitivity, a lighter encryption algorithm is used to improve efficiency; while for data with low access frequency but high sensitivity, a high-strength encryption algorithm is used.

[0082] Through the above steps, the appropriate encryption algorithm can be effectively determined based on the sensitivity and access frequency of the data. This process not only helps to ensure the security of the data, but also improves the performance of the system and the user experience.

[0083] S200, using the behavior prediction model to determine the user's authority.

[0084] Determining the user's permissions includes the following steps:

[0085] S201, obtaining the user's behavior data, and analyzing it to obtain the user's behavior characteristics.

[0086] Specifically, first collect the user's historical behavior data, including the user's login time, the type and frequency of access data, the device used, the geographic location, etc. These data provide a complete record of the user's interaction in the system. Next, by analyzing these data, extract the user's behavioral characteristics. Behavioral characteristics may include time access patterns (such as users have a higher access frequency in the morning), device usage preferences (such as the type of device commonly used by users), and access preferences for specific resources. The method for extracting behavioral characteristics is a conventional method, and this application does not limit this.

[0087] S202, using the behavior characteristics of the user to train an initial behavior prediction model to obtain a behavior prediction model.

[0088] The extracted user behavior features are used as input data and input into the initial behavior prediction model (machine learning algorithm, the architecture is a conventional model architecture) to train the initial behavior training model, which aims to predict the user's future behavior patterns based on the user's historical behavior features. For example, if a user usually accesses a resource in a specific time period, the model will capture and predict this behavior pattern. After the training is completed, the generated behavior prediction model can be used to predict the user's possible behavior in the future, including when and how to access which data.

[0089] S203: Obtaining the initial authority of the user according to the behavior prediction model.

[0090] Among them, initial permissions are assigned to users based on the behavior prediction model. The initial permissions are generated based on the user's historical behavior and the future behavior predicted by the behavior prediction model, ensuring that users can seamlessly access their commonly used data resources under normal circumstances. The initial permissions for users are preliminary settings based on the predictions of the behavior prediction model, but may be further adjusted as the environment changes and real-time behavior monitoring is carried out.

[0091] S204: Acquire the current environment and context information of the user to obtain first permission adjustment information of the user.

[0092] Among them, the system monitors the user's current environment and context information in real time, such as the user's physical location, the network used, the device currently used, etc. This information helps the system identify whether the user's current operating environment is consistent with the normal environment. Specifically, the current environment can refer to the immediate external conditions and environmental factors in which the user is performing a certain operation, which may include: device type (such as whether the user is currently using a mobile phone or a computer), network status (such as whether the user is currently connected to the company's intranet or public Wi-Fi), geographic location (such as the user's current actual physical location), etc. Context information is a broader concept, which includes not only all factors in the current environment, but also historical information and background information related to user behavior. For example: time information (such as user operations in a specific time period), user behavior patterns (such as resources that users usually access on weekdays), application and service information (such as the application currently used by the user and its security), etc.

[0093] It should be noted that the current environment can be regarded as part of the context information, which is an instant expression of the user's current state. Context information is a more comprehensive concept, including current environment information and other background information related to user behavior and historical patterns. For example, when the system detects that a user logs in from a new geographic location (current environment), it compares this information with the user's historical behavior pattern (context information) to determine whether permissions need to be adjusted. If a user usually accesses data using the company intranet during office hours (context information), but now tries to access the same data late at night through public Wi-Fi (current environment), the system may consider this an abnormal situation and trigger permission adjustment. The current environment describes the immediate conditions of the user's operation, while the context information covers these conditions as well as the user's behavior patterns and other background information. The two complement each other in the permission management system, providing comprehensive information to support the system in making dynamic permission adjustment decisions.

[0094] It should also be noted that after obtaining the current environment and context information of the user, the user's permissions are adjusted to obtain the user's first permission adjustment information.

[0095] S205: Determine the authority of the user according to the first authority adjustment information of the user and the initial authority of the user.

[0096] The user's initial permissions are combined with the permission adjustment information to determine the final user permissions. If the current environment and context information are consistent with the prediction of the behavior prediction model, the initial permissions are maintained; if there are differences, the user permissions are dynamically modified according to the adjustment information. For example, access to sensitive resources is restricted on an insecure network. The final permissions will be applied to the user's current operations to ensure that the permission settings can both meet the user's needs and ensure the security of the system.

[0097] It should be noted that after step S205, step S206 is also included.

[0098] S206, based on the user's permissions, the user's actual behavior is used as training data for the behavior prediction model, and the behavior prediction model is trained again to achieve re-optimization of the behavior prediction model, so that the behavior prediction model can better match the user's actual needs and behavior patterns during the continuous optimization process, thereby improving the system's security and user experience.

[0099] In summary, AI-driven permission management can learn user behavior patterns and predict their data access needs. It can dynamically adjust permissions based on user behavior and environmental context to achieve more refined access control.

[0100] S300, using context-aware desensitization technology to determine the optimal desensitization method.

[0101] Among them, determining the optimal desensitization method includes the following steps:

[0102] S301, obtaining context information of current data.

[0103] Specifically, identify the usage scenarios of the current data, for example, whether the current data is used for internal analysis, external sharing, compliance checking, or report generation. Each scenario has different requirements for data security. Determine the role (such as ordinary user, administrator, third-party partner) and permission level of the current data accessor. Different roles have different access requirements and permissions to data, which affects the choice of desensitization strategy. Collect information related to the current operating environment, such as access time, device type, network security (such as whether it is an encrypted connection), geographic location, etc. These factors will affect the assessment of data sensitivity. Refer to past historical access records and contexts, especially access behaviors similar to the current scenario, to help the system understand the current context more accurately.

[0104] S302: According to the context information, a desensitization strategy library is matched to obtain an optimal desensitization method.

[0105] Among them, several desensitization methods are pre-stored in the desensitization strategy library.

[0106] Specifically, the context information is matched with the desensitization strategy library in advance to form a matching relationship. In this way, after the current context information is obtained, the matching result between the context information and the desensitization strategy library is used as the optimal desensitization method.

[0107] It should be noted that desensitization methods may include data masking, pseudonymization, data perturbation, generalization, etc. The optimal desensitization method is automatically selected based on the sensitivity of the data. For example, highly sensitive data may require pseudonymization or high generalization, while low-sensitivity data may only require simple masking.

[0108] It should also be noted that if the corresponding sensitivity in the context information is different, a more complex desensitization strategy is used, including the following steps:

[0109] Rating the desensitization methods in the desensitization strategy library to correspond to different sensitivities;

[0110] When the above information corresponds to high sensitivity, the desensitization method with high sensitivity rating is selected according to the desensitization method rating;

[0111] When the following information corresponds to low sensitivity, the desensitization method with low sensitivity rating is selected according to the desensitization method rating;

[0112] Combined with the context information, the desensitization method with high sensitivity rating and the desensitization method with low sensitivity rating are combined to form a comprehensive desensitization method; wherein, the output of one desensitization method is used as the input of another desensitization method to form a comprehensive desensitization method, so that this comprehensive desensitization method can be used as the optimal desensitization method. In this way, it is not only convenient for the system to judge the desensitization method, but also can ensure the sensitivity of the data, avoiding the problem that the above information is highly sensitive and the following information is low sensitive, which leads to the selected desensitization method having a low rating and poor privacy protection of high-sensitivity data. The above information is of low sensitivity and the following information is of high sensitivity. The above method is used in the same way, and will not be repeated here.

[0113] In summary, the above method can select the best desensitization method in different scenarios. Combined with context information and data sensitivity, the best desensitization method can be intelligently selected and applied. This method ensures a balance between data privacy protection and actual usage needs, and helps to achieve more flexible and efficient privacy protection in the process of sensitive data processing.

[0114] S400, using the predictive security audit model to analyze the historical data operation behavior, the security threats and abnormal behaviors of the current operation, and obtain preventive measures.

[0115] Wherein, the method for obtaining the countermeasure comprises the following steps:

[0116] S401, build an initial predictive security audit model and obtain historical data operation behavior.

[0117] Specifically, the initial predictive security audit model can be a conventional decision tree, random forest, support vector machine (SVM), neural network, etc. Historical data operation behaviors are extracted from the log records, which may include user login records, data access patterns, data modification records, file transfer records, etc. Feature extraction is performed on the extracted historical data, and feature extraction is a conventional method and is not limited in this application. Before feature extraction, data cleaning is also required for the data collected through log records.

[0118] S402, using historical data operation behaviors to train the initial predictive security audit model to obtain a predictive security audit model.

[0119] Specifically, the historical data operation behaviors are divided into a training set and a test set. The training set is used to train the initial predictive security audit model, and the test set is used to evaluate the accuracy and generalization ability of the initial predictive security audit model. The initial predictive security audit model is trained using the training set so that the initial predictive security audit model can learn the normal and abnormal patterns of data operation behaviors. The initial predictive security audit model optimizes the prediction accuracy by continuously adjusting parameters. Finally, the trained predictive security audit model is verified using the test set to evaluate its performance in different scenarios. If the accuracy of the predictive security audit model is insufficient, it can be further optimized by adjusting parameters, increasing the amount of data, or changing the algorithm.

[0120] S403: Utilizing the predictive security audit model, the security threats and abnormal behaviors of current data operations are analyzed to obtain countermeasures.

[0121] Specifically, the current data operation is monitored in real time, that is, every data operation behavior occurring in the system is monitored in real time, and these behaviors are input into the trained predictive security audit model. The predictive security audit model is used to analyze the security threats and abnormal behaviors of the current data operation to determine whether there are potential security threats or abnormal behaviors. For example, the predictive security audit model can detect abnormal access frequencies, unauthorized users attempting to access sensitive data, operations that do not conform to the user's historical behavior patterns, etc., and output the results. Based on the analysis results of the predictive security audit model, corresponding preventive measures are automatically generated. These measures may include immediately notifying the security team, temporarily locking the user account, strengthening the security monitoring of the current session, or adjusting the user permissions.

[0122] Use machine learning models to analyze historical data operation behaviors and predict potential security threats and abnormal behaviors. Through predictive analysis, take measures in advance to prevent unauthorized access or data leakage. In other words, through the above steps, the system can learn and train the predictive security audit model from historical data operation behaviors, so that it can quickly identify potential security threats and abnormal behaviors when facing current operations. Based on the analysis results of the predictive security audit model, the system can take preventive measures in time to improve the overall security and data protection capabilities. This approach ensures that the system can dynamically respond to different security challenges and effectively prevent security incidents such as unauthorized access and data leakage.

[0123] S500, using the sensitivity and change frequency of the data, obtain the backup time and frequency of the data.

[0124] Wherein, obtaining the backup time and frequency of the data comprises the following steps:

[0125] S501, performing priority marking according to the sensitivity of the data to obtain data with the priority mark.

[0126] Specifically, if the sensitivity of the data has been determined in the previous step, the data is marked with a priority based on the sensitivity of the data. Data with high sensitivity is marked as "high priority" and requires the highest priority backup arrangement; data with low sensitivity is marked as "low priority" and the backup frequency can be relatively low. In this way, the system marks all data with different priorities, so that these marks can be used to calculate the backup time and frequency in subsequent steps.

[0127] S502: Determine an idle window period according to the time when the frequency change occurs.

[0128] Specifically, analyze the frequency of data changes and determine the time patterns of data updates and modifications. For example, some data may change frequently during peak business hours during the day, but be relatively stable at night or on weekends. Next, based on the frequency of data changes, identify idle windows of system resources. These windows are usually during periods when data changes less and system load is lower, such as late at night or on weekends. Finally, set these idle windows in the system so that backup tasks can be scheduled during these periods to minimize the impact on system performance.

[0129] S503: Obtain the backup time and frequency of the data according to the priority of the data with the priority mark and the idle window period.

[0130] Specifically, the priority-marked data is matched with the determined idle window period. High-priority data is preferentially scheduled for backup during the idle window period to ensure that the backup task is completed when the system load is low, while meeting the backup requirements of highly sensitive data. Next, high-priority data is scheduled for backup during multiple idle windows according to the priority level. For example, a full or incremental backup of high-priority data is performed late at night every day. Low-priority data is scheduled for backup during the window period with the lowest system load, and the frequency can be relatively low, such as once a week or once a month. Finally, the backup frequency is set according to the sensitivity and frequency of data changes. High-priority data with high frequency changes may require daily or real-time backup; while low-priority data with low frequency changes can be set to be backed up once a week or once a month.

[0131] This application can determine the timing and frequency of backup based on the importance and frequency of change of the data. When data is lost or damaged, the affected data can be quickly identified and the key data can be restored first (the order of priority is determined by the level of priority). Through the above steps, the backup time and frequency of each type of data can be reasonably determined based on the sensitivity and frequency of change of the data. This method ensures that while meeting data security requirements, the utilization of system resources is optimized and the situation where backup tasks affect system performance is avoided.

[0132] S600, processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

[0133] The method for obtaining data security and privacy protection includes the following steps:

[0134] S601, record all the data access and log records in the blockchain to obtain an unalterable log chain.

[0135] Specifically, all data access and operation logs are recorded in the blockchain. Each record is packaged into a block and added to the blockchain to form an unalterable log chain. This process ensures the transparency and traceability of all operations, and can prevent malicious tampering and data leakage. The unalterable log chain provides a reliable foundation for subsequent auditing and tracking. Any access or operation to the data can be traced back to a specific user and time, which helps to identify abnormal behavior.

[0136] S602, the management and access rights control of the data are distributed in a grid format through the blockchain to obtain distributed data management and verification.

[0137] Specifically, data management and access control are carried out through the grid distribution of blockchain. Each node in the blockchain network participates in the storage and verification of data. The legitimacy of data access and management operations is ensured through the consensus mechanism. Distributed management reduces the risk of single point failure and ensures high availability of the system. At the same time, access control can prevent unauthorized access and data tampering, further enhancing data security.

[0138] S603, using the tamper-proof log chain, and the distributed data management and verification, to obtain data protection.

[0139] Specifically, a data assurance solution is generated using the previously generated unalterable log chain and distributed data management and verification mechanism. This data assurance solution is based on the audit of historical operations and the verification of current access requests, and can effectively identify potential security threats and abnormal behaviors. By combining these mechanisms, security incidents can be discovered and responded to in a timely manner, ensuring the security of data during use.

[0140] S604, the data protection, the encryption algorithm of the data, the user's authority, the optimal desensitization method, the preventive measures, the backup time and frequency of the data are processed to obtain a method for data security and privacy protection.

[0141] Specifically, the data protection plan, data encryption algorithm, user permissions, optimal desensitization method, preventive measures, and data backup time and frequency are integrated to perform comprehensive data processing.

[0142] It should be noted that data security domain privacy protection specifically includes:

[0143] Encryption processing: Select an appropriate encryption algorithm to encrypt data based on the sensitivity and access frequency of the data.

[0144] Permission control: Set corresponding data access control based on user permissions to ensure that only authorized users can access sensitive data.

[0145] Desensitization: Apply the best desensitization methods to protect data privacy while allowing data analysis within the scope of compliance.

[0146] Backup management: Arrange data backup tasks according to backup time and frequency to ensure data recoverability.

[0147] Through this series of comprehensive processing, a complete data security and privacy protection solution is formed to ensure the security of data during storage, transmission and processing, and meet various compliance requirements.

[0148] In one embodiment, a data security and privacy protection method further includes the following steps:

[0149] S701, determining the risk level of the user based on the user's historical data operation behavior.

[0150] Specifically, historical operation behavior data, including login time, resources accessed, data modification records, abnormal behavior (such as failed login attempts, access to uncommon functions, etc.). Monitoring tools and logging can be used to implement this process. Preprocess the collected data to extract features that are helpful for risk assessment. These features can include access frequency, data sensitivity, historical abnormal behavior, etc. By analyzing these features, the user's normal behavior patterns and potential risk factors can be identified. The extracted features are input into a trained AI model (such as a classifier or regression model). The AI ​​model should have been trained based on historical data and be able to identify the behavior patterns of different users and assess the risk level. The AI ​​model output divides the risk level into multiple levels (such as low risk, medium risk, high risk) for subsequent decision-making.

[0151] S702: Obtain second permission adjustment information and encryption strategy of the user according to the risk level of the user.

[0152] Specifically, formulate corresponding permission adjustment strategies based on the risk level of the user. For high-risk users, the system may recommend reducing their permissions to access sensitive data; for low-risk users, permissions can be moderately relaxed. The permission adjustment information will specify how to modify the user's access rights.

[0153] Generate the corresponding encryption strategy based on the user's risk level. For example, for high-risk users, it is recommended to use a stronger encryption algorithm and a more frequent data encryption strategy; for low-risk users, lighter encryption measures can be used to improve system performance and user experience. It should be noted that the encryption algorithm here comes from the same encryption algorithm library as the aforementioned data encryption algorithm, and can be selected according to different encryption needs.

[0154] S703: Adjust the initial permissions of the user according to the second permission adjustment information of the user.

[0155] Specifically, the generated permission adjustment information and encryption policy are implemented into the user's account, and the user's access rights and data encryption method are updated in real time. At the same time, the user's behavior is continuously monitored and feedback is collected to dynamically adjust permissions and policies based on new behaviors to ensure the security and flexibility of the system.

[0156] It should be noted that the initial permissions of the user in this step refer to the same permissions as the initial permissions in the previous step of "obtaining the initial permissions of the user according to the behavior prediction model", that is, the initial permissions are adjusted twice using the first permission adjustment information and the second permission adjustment information.

[0157] By collecting and analyzing user behavior data, AI models are used to assess the risk level of user behavior, and data access permissions and encryption policies are adjusted accordingly. Through the above steps, the risk level of users can be effectively assessed based on their historical data operation behaviors, and the user's permissions and encryption policies can be flexibly adjusted accordingly. This dynamic adjustment mechanism can enhance data security, ensure that sensitive data is accessed only at the appropriate security level, and minimize potential security risks.

[0158] In a second aspect, the present application provides a data security and privacy protection system, which is applied to the aforementioned data security and privacy protection method, and the system includes:

[0159] An encryption unit, used to determine an encryption algorithm for the data according to the sensitivity of the data and the access frequency;

[0160] A permission unit, used to determine the user's permissions using a behavior prediction model;

[0161] A desensitization unit, used to determine the optimal desensitization method using context-aware desensitization technology;

[0162] The model unit is used to analyze the security threats and abnormal behaviors of current data operations by using the predictive security audit model, and obtain preventive measures;

[0163] A backup unit, used to obtain the backup time and frequency of the data by using the sensitivity and change frequency of the data;

[0164] The integration unit is used to process the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

[0165] In a third aspect, the present application provides a computer program, which, when executed by a processor, implements the steps of the aforementioned data security and privacy protection method.

[0166] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0167] The various embodiments in the present disclosure are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0168] The protection scope of the present disclosure is not limited to the above-mentioned embodiments. Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the scope and spirit of the present disclosure. If these changes and modifications fall within the scope of the claims of the present disclosure and their equivalents, the intention of the present disclosure also includes these changes and modifications.

Claims

1. A data security and privacy protection method, characterized in that: The method comprises: Determine the encryption algorithm for the data based on the sensitivity of the data and the access frequency; Use behavioral prediction models to determine user permissions; Use context-aware desensitization technology to determine the optimal desensitization method; Use predictive security audit models to analyze security threats and abnormal behaviors of current data operations and obtain preventive measures; Using the sensitivity and change frequency of the data, the backup time and frequency of the data are obtained; The data is processed according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

2. The data security and privacy protection method according to claim 1, characterized in that: The step of determining the encryption algorithm of the data according to the sensitivity and access frequency of the data includes: Acquire relevant information of the data, wherein the relevant information includes at least one of a data type, a data structure, and a content; Obtaining the sensitivity of the data according to the relevant information of the data, wherein the sensitivity represents the classification of the sensitivity of the data according to a preset sensitivity classification standard; According to the log records, the number of accesses and access patterns of the data are collected to obtain the access frequency; Obtaining selection information of the encryption algorithm according to the sensitivity of the data and the access frequency; The encryption algorithm selection information is matched with the preset encryption algorithm rules to determine the encryption algorithm for the data.

3. The data security and privacy protection method according to claim 1, characterized in that: The step of using the behavior prediction model to determine the user's authority includes: Obtaining the user's behavior data and analyzing it to obtain the user's behavior characteristics; Using the user's behavior characteristics, training an initial behavior prediction model to obtain a behavior prediction model; Obtaining initial permissions of the user according to the behavior prediction model; Acquire the current environment and context information of the user to obtain first permission adjustment information of the user; The authority of the user is determined according to the first authority adjustment information of the user and the initial authority of the user.

4. The data security and privacy protection method according to claim 1, characterized in that: The step of determining the optimal desensitization method by using context-aware desensitization technology includes: Get context information of current data; According to the context information, a desensitization strategy library is matched to obtain an optimal desensitization method, wherein the desensitization strategy library pre-stores several desensitization methods.

5. The data security and privacy protection method according to claim 1, characterized in that: The step of using the predictive security audit model to analyze the security threats and abnormal behaviors of current data operations and obtain preventive measures includes: Build an initial predictive security audit model and obtain historical data operation behavior; Using historical data operation behaviors, the initial predictive security audit model is trained to obtain a predictive security audit model; By using the predictive security audit model, the security threats and abnormal behaviors of current data operations will be analyzed to obtain countermeasures.

6. The data security and privacy protection method according to claim 1, characterized in that: The step of obtaining the backup time and frequency of the data by using the sensitivity and change frequency of the data includes: Priority marking is performed according to the sensitivity of the data to obtain data with the priority mark; Determine the idle window period based on the time when the frequency of changes occurs; The backup time and frequency of the data are obtained according to the priority of the data with the priority mark and the idle window period.

7. The data security and privacy protection method according to claim 1, characterized in that: The step of processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection includes: Record all data access and log records in the blockchain to obtain an unalterable log chain; The management and access rights control of the data are distributed in a grid-like manner through blockchain to obtain distributed data management and verification; Data protection is achieved by utilizing the tamper-proof log chain and the distributed data management and verification; The data protection, the encryption algorithm of the data, the user's authority, the optimal desensitization method, the preventive measures, the backup time and frequency of the data are processed to obtain a method for data security and privacy protection.

8. The data security and privacy protection method according to claim 1, characterized in that: The step of processing the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection includes: Determine the user's risk level based on the user's historical data operation behavior; According to the risk level of the user, second permission adjustment information and encryption strategy of the user are obtained. The initial permissions of the user are adjusted according to the second permission adjustment information of the user.

9. A data security and privacy protection system, characterized in that: The data security and privacy protection method applied to any one of claims 1 to 8, wherein the system comprises: An encryption unit, used to determine an encryption algorithm for the data according to the sensitivity of the data and the access frequency; A permission unit, used to determine the user's permissions using a behavior prediction model; A desensitization unit, used to determine the optimal desensitization method using context-aware desensitization technology; The model unit is used to analyze the security threats and abnormal behaviors of current data operations by using the predictive security audit model, and obtain preventive measures; A backup unit, used to obtain the backup time and frequency of the data by using the sensitivity and change frequency of the data; The integration unit is used to process the data according to the encryption algorithm of the data, the authority of the user, the optimal desensitization method, the preventive measure method, and the backup time and frequency of the data to obtain a method for data security and privacy protection.

10. A computer program, characterized in that When the computer program is executed by a processor, the steps of the data security and privacy protection method described in any one of claims 1 to 8 are implemented.

Images