Enterprise data asset management method, system and device based on cloud data and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to an enterprise data asset management method, system and device based on cloud data and a storage medium, an activity sensing engine is deployed to collect indexes such as data access frequency, business key weight and cross-department calling popularity, and the indexes are processed into multi-dimensional activity factors through a rule engine; and dividing hot, warm and cold grades after calculating scores. Hot data is controlled by a trusted domain and stored in a high-IOPS cloud disk, warm data generates role self-adaptive desensitization view retention standard cloud disk, and cold data starts full mask and manual approval transfer object storage. And if the cold data is overdue, starting compliance review and physically erasing the cold data. According to the method, dynamic collaboration of data value evaluation, security policy and storage scheduling is realized, traditional static management contradictions are solved, full-life-cycle intelligent management of data is achieved, the value utilization rate is improved, the resource cost is optimized, and compliance risks are reduced.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a cloud data-based enterprise data asset management method, system, device and storage medium. Background Art

[0002] Data assets refer to digital resources owned or controlled by businesses or individuals that can generate future economic benefits. These resources include customer information, transaction records, market reports, and other information, existing in physical or electronic form. The core contradiction facing cloud data asset management in enterprises today is the conflict between the dynamic value of data and the static nature of traditional management methods. This is manifested in three key technical flaws: First, there's a lack of a data value assessment mechanism: Existing technologies rely on a single dimension (such as access frequency) or fixed thresholds to categorize data. This fails to quantify the real-time value of data across multiple dimensions, such as business criticality and cross-departmental collaboration. As a result, high-value but infrequently accessed data (such as compliance reports) is downgraded, reducing decision-making efficiency. Meanwhile, low-value, high-frequency data (such as temporary logs) occupies high-performance resources, resulting in over 30% storage waste. Second, security policies and resource scheduling are disconnected: Traditional solutions separate data security (such as masking) from storage scheduling, resulting in a static RBAC (role-based access control) security policy model that makes it impossible to dynamically adjust masking intensity based on data value. Furthermore, storage migration relies on manual policy configuration, resulting in response delays that prevent high IOPS resources from being allocated to hot data in a timely manner. This leads to a dual imbalance between security management and resource utilization. Full masking of frequently accessed business data reduces availability, while cold data, stored without downgrading, increases costs. Third, the dilemma of cold data governance: Cold data is retained for a long time and occupies storage, and there is a lack of automated cleanup mechanisms. Usually, logical deletion is the main method, which cannot meet the physical erasure requirements of regulations such as GDPR. Cleanup decisions rely on manual review, and the lack of response from responsible persons leads to process blockage, increased compliance risks (for example, Meta was fined US$1.3 billion for data retention), and continued expansion of storage costs.

[0003] In view of this, a cloud data-based enterprise data asset management method, system, device and storage medium are proposed. Summary of the Invention

[0004] The purpose of the present invention is to provide a cloud data-based enterprise data asset management method, system, device and storage medium to solve the problems of "lack of data value assessment mechanism, separation of security policy and resource scheduling, and dilemma of cold data governance".

[0005] To solve the above technical problems, the present invention provides a cloud data-based enterprise data asset management method, comprising: S1. Real-time collection of raw data indicators through an activity perception engine deployed on the cloud platform; the activity perception engine is a data collection module connected to the cloud platform log bus; the raw data indicators include data access frequency, pre-configured business criticality weight value, and cross-department call popularity; S2. Input the raw data indicators into a rule engine, and output a standardized multi-dimensional activity factor; the rule engine is a logic processing module that executes preset calculation rules; the multi-dimensional activity factor is a set of numerical values ​​that characterize the real-time value of the data; S3. Calculate activity scores based on multidimensional activity factors, and classify the original data into three activity levels: hot level, warm level, and cold level according to the activity score ranking results; S4. Dynamic security policies are implemented on raw data based on activity levels. For hot-level raw data, full trusted domain access control is implemented. For warm-level raw data, role-adaptive desensitization views are generated and key fields are dynamically masked. For cold-level raw data, full masking and manual approval mechanisms are enabled. At the same time, storage resources are scheduled based on activity levels. Hot data is migrated to high-IOPS cloud disks; warm data is retained on standard cloud disks; and cold data is transferred to object storage. S5. When cold-level data continues to exist for longer than the preset period, the compliance review process is initiated and secure erasure is performed.

[0006] As a further improvement of the present technical solution, in S2, the rule engine processes the original data indicators through a rule counting method; the rule counting method refers to accumulating the access frequency by time window, amplifying the business criticality weight by a preset coefficient, and weighted summing the call heat by department weight.

[0007] As a further improvement of the present technical solution, in S3, the activity score is calculated by linearly weighting and summing the values ​​of the multidimensional activity factors; The activity grade classification rule is as follows: raw data with N ≤ the top 30% is defined as hot grade; raw data with N ≤ the top 70% is defined as warm grade; raw data with N > the top 70% is defined as cold grade, where N is the activity score ranking of the raw data corresponding to the multidimensional activity factor.

[0008] As a further improvement of the present technical solution, in S4, the generation of the role-adaptive desensitization view includes: Predefined field mask rule templates to specify key field mask rules for different data types; Dynamically load matching mask templates based on user role permissions; An in-memory computing isolation zone is built between the database query engine and the user end, and dynamic mask operations are performed in the in-memory computing isolation zone before the database query results are returned.

[0009] As a further improvement of this technical solution, in S5, the compliance review process includes: Compliance verification using a linked data lineage map, a metadata repository that records data sources and flow paths; Sending erasure confirmation request to predefined data controllers; If no response is received within the scheduled time, the case will be referred to the Compliance Committee for arbitration; After obtaining confirmation or passing arbitration, the underlying overwrite interface of the storage medium is called to perform physical sector erasure to ensure that the data cannot be recovered.

[0010] A cloud-based enterprise data asset management system, used to implement the above-mentioned cloud-based enterprise data asset management method, comprises: The activity factor generation module is used to connect to the cloud platform log bus to collect raw data indicators and output multi-dimensional activity factors through the rule engine; Activity level calculation module, which calculates activity scores and divides them into levels based on multi-dimensional activity factors; The policy execution matrix receives the output of the activity level calculation module and synchronously triggers dynamic security policies and storage resource scheduling; The cold data governance module monitors the unaccessed period of cold-level data and triggers the compliance review process.

[0011] As a further improvement of the present technical solution, the activity factor generation module has a built-in rule counter; the rule counter performs the following operations: Perform sliding window accumulation on access frequency; Apply a multiplication factor to the business criticality weight.

[0012] A computer device comprises: at least one processor and a memory, wherein the memory stores a computer program that can be run on the processor. When the processor executes the computer program, the steps of the above-mentioned cloud data-based enterprise data asset management method are performed.

[0013] A computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned cloud data-based enterprise data asset management method are executed.

[0014] Compared with the prior art, the present invention has the following beneficial effects: This cloud-based enterprise data asset management method, system, equipment and storage medium uses an active-aware dynamic hierarchical management mechanism to deeply coordinate data value assessment, security policy and storage scheduling, resolving the core contradiction between traditional static management methods and the dynamic changes in data value, and realizing intelligent and refined governance of the entire data life cycle, ultimately achieving the comprehensive goals of maximizing data value, optimizing resource costs and controlling compliance risks.

[0015] This cloud-based enterprise data asset management method, system, equipment, and storage medium replaces the traditional single-dimensional or fixed-threshold grading method by integrating multi-dimensional activity factor dynamic evaluation technology that integrates access frequency, business criticality, and cross-departmental call popularity, thereby achieving real-time quantification of data value.

[0016] This cloud-based enterprise data asset management method, system, device, and storage medium deeply binds activity levels with dynamic security policies and storage resource scheduling through policy execution matrix integrated scheduling technology, replacing the traditional static management model that separates security and storage.

[0017] This cloud-based enterprise data asset management method, system, equipment and storage medium uses cold data intelligent governance technology that combines data lineage verification + multi-level approval + physical sector erasure to replace the traditional inefficient model based on manual review and logical deletion.

[0018] This cloud data-based enterprise data asset management method, system, equipment and storage medium, through the decoupling and coordination of the four major modules of active factor generation, level calculation, policy execution, and cold data governance, supports enterprises to flexibly adjust rule engine parameters, security policy templates and storage scheduling strategies according to business needs, adapt to the differentiated data management needs of different industries, reduce the cost of system secondary development, and enhance the rapid response capability and business agility of enterprises in the cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of the method flow of the present invention; Figure 2 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0020] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0021] In recent years, the core contradiction faced by enterprise cloud data asset management is the conflict between the dynamic changes in data value and the static and solidified traditional management methods. Specifically, it manifests itself in the three major technical defects of "lack of data value assessment mechanism, separation of security strategy and resource scheduling, and dilemma of cold data governance."

[0022] For this reason, see Figure 1 As shown, one of the purposes of the present invention is to provide an enterprise data asset management method based on cloud data, the enterprise data asset management method based on cloud data comprising the following steps: S1. Real-time collection of raw data indicators through an activity perception engine deployed on the cloud platform; the activity perception engine is a data collection module connected to the cloud platform log bus; the raw data indicators include data access frequency, pre-configured business criticality weight value, and cross-department call popularity; In traditional data management, data value assessment relies on manually preset rules or fixed-period sampling (such as monthly visit statistics). This leads to two core problems: First, the lack of real-time performance: It cannot capture sudden business scenarios (such as a promotion that causes a surge in data access) or the value fluctuations of long-term, low-frequency but high-value data (such as annual compliance reports). Second, the single dimension is used to judge data activity solely by "access frequency," ignoring business importance (such as the weight difference between financial data and temporary logs) and the value of cross-departmental collaboration (such as the popularity of shared data). This leads to resource misallocation (high-value, low-frequency data is downgraded to storage, while low-value, high-frequency data occupies high-performance resources). To solve the above problems, step S1 uses an activity perception engine to achieve dynamic, multi-dimensional data indicator collection. The core technologies include: Cloud-native architecture deployment technology: The liveness perception engine uses lightweight container deployment (such as Docker + Kubernetes). It connects to cloud platform log buses (such as Alibaba Cloud SLS and AWS CloudWatchLogs) through tools such as Flume / Logstash, allowing for real-time subscription to full data access logs, thus avoiding the performance loss of traditional agent-based collection. Multi-dimensional indicator collaborative collection technology collects data including at least data access frequency, business criticality weight, and cross-department call popularity. Data access frequency is the number of times the data is queried / called based on a 5-minute sliding window (configurable), and raw logs are extracted in real time through interface parameters. Business criticality weight is pre-configured using the "classification and grading module" of the data asset management application layer (1-10 points, such as financial data = 10, marketing data = 5), stored in the metadata database table, and regularly updated by the engine. Cross-department call popularity is the number of times the data is called by APIs from different departments (such as operations, risk control, and finance), weighted by department importance (e.g., calls from the risk control department × 2, calls from the operations department × 1). The formula is: weighted popularity = Σ(number of department calls × department weight coefficient). Real-time stream processing technology: The Flink stream processing framework is used to clean raw indicators in real time (deduplication and outlier filtering). High-concurrency data is cached through the Kafka message queue to ensure that the collection delay of 100,000 logs per second is less than 1 second.

[0023] Through the real-time collection of multi-dimensional indicators (frequency + weight + heat), the limitations of traditional single dimensions are broken through, and comprehensive and real-time data input is provided for the subsequent "activity factor calculation" (S2) and "level classification" (S3), so that data value assessment is upgraded from "static snapshot" to "dynamic portrait", thereby providing basic support for the dynamic quantification of data value. In addition, it prevents high-business-critical data (such as payment records) from being misjudged as "cold data" due to low short-term access volume, reduces the occupation of high-performance storage by low-value data (such as temporary debugging logs), and provides "dynamic scheduling of storage resources" in step S4 (hot data → high IOPS cloud disk, cold data → object storage). At the same time, the introduction of cross-departmental call heat indicators can identify "shared core data" (such as customer basic information) relied on by multiple departments, give priority to its storage and computing resources, improve the efficiency of enterprise data collaboration, avoid the underestimated value of data due to departmental barriers, and optimize the efficiency of cross-departmental collaboration; and the indicators collected in real time can be used as the basis for data "health" monitoring. For example, when a certain cold data suddenly has an abnormal access frequency, it can trigger the audit alarm of the security software layer (such as the "Security Software Layer-Attack Detection Module" in the attachment) to identify the risk of data leakage in advance, thereby realizing the pre-emptive prevention and control of compliance risks.

[0024] S2. Input the raw data indicators into the rule engine and output a standardized multi-dimensional activity factor; the rule engine is a logic processing module that executes preset calculation rules; the multi-dimensional activity factor is a set of numerical values ​​that characterize the real-time value of data; the rule engine processes the raw data indicators through a rule counting method; the rule counting method refers to accumulating the access frequency by time window, amplifying the business criticality weight by a preset coefficient, and weighted summing the call popularity by department weight.

[0025] Raw data indicators (access frequency, business criticality, and cross-departmental call frequency) have three core issues and cannot be directly used as the basis for data value assessment: First, the metrics are confusing: access frequency is measured in "times / minute," business criticality is weighted on a scale of 1 to 10, and call popularity is measured in "times / day." These dimensional differences prevent direct comparison or integration of metrics (for example, "100 calls per day" and "8 points weight" cannot be directly added together). Second, dynamic fluctuations are not smoothed: Access frequency may experience instantaneous peaks due to sudden business events (such as promotions). Directly using the original value can lead to value misjudgment (for example, temporarily high-frequency but low-value log data is overestimated). Third, business semantics are not integrated: a single indicator cannot reflect the comprehensive value of data (for example, financial data with high weight but low call volume and marketing data with low weight but high call volume require semantic integration through rules); To solve the above problems, step S2 uses a rule engine to execute preset calculation rules. The core technologies include: Rule engine modular architecture technology: Using the Drools rule engine, the processing logic is broken down into "indicator access module - rule parsing module - standardized calculation module - factor output module." This technology supports visual rule configuration (such as adjusting weight coefficients through the web interface), allowing calculation logic to be updated without modifying the code. Multi-dimensional indicator standardization processing technology, including access frequency, business criticality weight, and cross-department call popularity processing, specifically: Access frequency: Time window accumulation + normalization processing. For example, the original number of visits is accumulated by a sliding time window (such as 7 days) to eliminate the impact of instantaneous fluctuations. The formula is: Normalized frequency = (actual number of visits within 7 days / historical maximum number of visits) × 100 (for example, if a data is accessed 500 times in 7 days and the historical peak is 1000 times, the normalized frequency = 50); Business criticality weight: Preset coefficient amplification. Configure the amplification coefficient based on the business domain to which the data belongs (such as finance, marketing, and operations and maintenance) (Finance × 1.5, Marketing × 1.2, Operations and Maintenance × 1.0). The formula is: Weighted business criticality = original weight value × business domain coefficient (for example, the original weight of financial data is 10 points, and after weighting, it = 10 × 1.5 = 15 points). Cross-department call activity: weighted sum of department weights, with preset weights based on department importance (Risk Control Department = 2, Operations Department = 1.5, Other Departments = 1). Formula: Weighted call activity = Σ(number of department calls × department weight), then normalized to [0, 100] (e.g., if the Risk Control Department calls 300 times and the Operations Department calls 200 times, weighted activity = 300 × 2 + 200 × 1.5 = 900, normalized = 90). Real-time stream computing and dynamic rule update technology: Based on the Flink stream computing framework, raw metrics are processed and connected to the rule engine via the Kafka message queue, achieving real-time standardization of 100,000 data points per second. The rule engine supports hot updates (without restarting the service) and dynamically adjusts parameters such as window size and coefficient weighting through the API interface (for example, when business changes, the amplification coefficient of financial data can be updated within 5 minutes). The standardized multi-dimensional activity factor (such as [frequency = 50, business criticality = 15, call heat = 90]) eliminates dimensional differences and can directly calculate the activity score through weighted summation, upgrading the data value assessment from "qualitative description" to "quantitative calculation". Compared with traditional manual grading, it improves the accuracy and realizes the dynamic and precise quantification of data value; through preset coefficients and department weights, business rules (such as "financial data is more important" and "risk control call priority is high") are embedded in the technical calculation process to avoid the disconnection between technical indicators and business goals, so that the activity factor can reflect both the objective access characteristics of the data and the subjective business priorities of the enterprise; and the modular design of the rule engine supports new Indicators can be added (such as "data update frequency" and "compliance risk level" in the future) and calculation rules can be adjusted without refactoring the underlying code; the dynamic update capability enables enterprises to quickly respond to business changes (such as temporarily increasing the weight coefficient of marketing data during promotions) and adapt to agile management needs; at the same time, the standardized activity factor provides a unified and comparable input for the "hot / warm / cold level classification" in step S3 and the "dynamic security policy + storage scheduling" in step S4, ensuring the precise execution of subsequent resource allocation (such as high IOPS cloud disks for hot data) and security measures (such as desensitization policies), and avoiding policy misjudgments due to indicator confusion (such as mistakenly transferring high-value cold data to low-cost storage).

[0026] S3. Calculate activity scores based on multidimensional activity factors, and classify the original data into three activity levels: hot level, warm level, and cold level according to the activity score ranking results; The traditional data classification method has two core flaws and is difficult to meet the needs of dynamic data asset management: First, it is highly subjective and has inconsistent standards. Data levels are manually labeled based on experience (e.g., "important," "normal," or "unimportant"). Different business departments may have different judgments on the same data (e.g., the finance department considers "transaction records" to be the most important, while the operations department considers "system logs" to be more urgent). This leads to confusion in data classification and conflicts in resource allocation. Second, static thresholds are rigid and cannot adapt to value fluctuations: Using fixed thresholds (e.g., "monthly visits > 1,000 times is considered hot data") ignores dynamic changes in data value (e.g., visits to a promotional event surge during the event and plummet afterward). This results in "outdated hot data" continuously occupying high resources, and "temporary hot data" being mistakenly classified as cold data because it does not meet the threshold. To solve the above problems, the S3 step implements standardized grading through quantitative calculation and dynamic sorting. The core technologies include: Linear weighted summation activity scoring algorithm: The multi-dimensional activity factors (normalized frequency F, weighted business criticality B, and normalized call popularity H) output by S2 are linearly summed according to preset weights. The formula is: Activity Score = 0.4F + 0.3B + 0.3H. (Weights are distributed based on business priority: frequency reflects real-time value, accounting for the highest 40%; business criticality and call popularity reflect static importance and cross-departmental value, respectively, accounting for 30% each.) For example, if the multi-dimensional factors of a transaction data are F = 90, B = 15, and H = 85, the activity score is 0.4 × 90 + 0.3 × 15 + 0.3 × 85 = 36 + 4.5 + 25.5 = 66. Dynamic partitioning rules based on sorting percentages: All data is sorted in descending order by activity score. The top 30% is defined as the hot level (high value, high frequency access, requiring priority resource allocation); data in the 30% to 70% range is defined as the warm level (medium value and access frequency, balancing resources and costs); and data above the 70% range is defined as the cold level (low value, low frequency access, suitable for downgraded storage or compliance cleanup). This is achieved by using the Spark SQL window number ROW_NUMBER() to sort by score and combining it with PERCENT_RANK() to calculate the percentage range, automatically assigning levels, and labeling them (e.g., level = hot / warm / cold). Automated grading and dynamic update technology: Scoring and ranking are re-executed based on scheduled tasks (such as every morning) or triggered calculations (when the access volume of a certain type of data fluctuates by more than 20%), avoiding the lag of static thresholds. For example, during a promotion, if the ranking score of marketing data jumps from 50% (warm) to 20% (hot), the system will automatically upgrade it to hot data and allocate high-performance storage. Through quantitative scoring (rather than manual qualitative judgment) and fixed percentage rules (rather than subjective thresholds), differences in data grading between departments are eliminated, and the data grading standards across the enterprise are unified (for example, "hot grade" refers to the top 30% of high-scoring data in any business line). This provides a consensus basis for cross-departmental data collaborative management, thereby improving the objectivity and standardization of data grading. Hot-grade data (such as real-time transaction records) is automatically allocated to high-performance storage (such as ESSD cloud disk, IOPS = 100,000), cold-grade data (such as logs from one year ago) is migrated to low-cost object storage (such as OSS, with costs reduced to 1 / 5), and warm-grade data (such as orders within three months) adopts a hybrid storage strategy to achieve precise "value-resource" matching. Compared with traditional static division, it reduces storage costs and hot data access latency; and clear level labels provide a direct basis for the "dynamic security strategy" in step S4 and the "cold data governance" in step S5. At the same time, the dynamic update mechanism ensures that the data level is adjusted in real time with business fluctuations (for example, if a sudden public opinion causes a surge in access to a user portrait data, it will be upgraded from warm level to hot level within 24 hours), avoiding the "value mismatch" problem of traditional static division and supporting agile enterprise decision-making (such as real-time adjustment of marketing resources to high-activity user data).

[0027] S4. Dynamic security policies are implemented on raw data based on activity levels. For hot-level raw data, full trusted domain access control is implemented. For warm-level raw data, role-adaptive desensitization views are generated and key fields are dynamically masked. The generation of role-adaptive desensitization views includes: pre-defining field masking rule templates to specify key field masking rules for different data types; dynamically loading matching masking templates based on user role permissions; building an in-memory computing isolation zone between the database query engine and the user end, and performing dynamic masking operations in the in-memory computing isolation zone before returning database query results; and enabling full masking and manual approval mechanisms for cold-level raw data. At the same time, storage resources are scheduled based on activity levels. Hot data is migrated to high-IOPS cloud disks; warm data is retained on standard cloud disks; and cold data is transferred to object storage. Traditional data security and storage management models have three core contradictions, making it difficult to adapt to the dynamic changes in data value: First, a one-size-fits-all security strategy lacks precision: Applying the same security measures to all data (such as full encryption or uniform desensitization) can lead to the leakage of high-value hot data (such as transaction passwords) due to lax permissions, while over-encrypting low-value cold data (such as historical logs) affects access efficiency and wastes key management resources. Second, static binding of storage resources leads to an imbalance in cost and efficiency: fixed data storage types (e.g., using only high-performance cloud disks) fail to account for differences in activity. Hot data (e.g., real-time orders) suffers access delays due to insufficient storage performance, while cold data (e.g., backups from one year ago) occupies high-cost storage for extended periods, resulting in over 30% wasted resources. Third, the "fixed and rigid" redaction rules conflict with business usability: using static redaction templates (e.g., mobile phone numbers always display the first three and last four digits), without differentiating user role permissions (e.g., administrators need to view full mobile phone numbers, while ordinary employees need to redact them), leading to conflicts between "security compliance and business usability" (e.g., customer service cannot verify user information due to redaction); To address these issues, step S4 implements dynamic adaptation through a linkage mechanism of "activity level - security policy - storage type". The core technologies include: Dynamic security policy technology based on activity level, specifically: Heat-grade data: Complete access control in the trusted domain. Kubernetes NetworkPolicy is used to configure network access rules, allowing only trusted IP addresses in the enterprise intranet (such as 192.168.0.0 / 24) to access the heat data storage area. TLS 1.3 is used to encrypt the communication channel. Certificates are generated and stored by a hardware password card (such as "Password Card 161"). The key is obtained by calling the get_key("tls_heat_data") interface. A fine-grained RBAC permission model is integrated (for example, only the CFO can access payment details in the heat data; ordinary employees have no permission). Warm-level data: Role-adaptive desensitization view. First, pre-defined field masking rule templates are configured by data type (mobile phone number, ID card, bank card). For example, for a mobile phone number, the first three and last four digits are plain text, and the middle four digits are masked (138****5678). These are stored in the "Security Management Module" of the security software layer. Second, dynamic template loading is implemented: masking rules are matched based on user roles (such as "Customer Service / Administrator / Auditor"). For example, customer service users load the "Mobile Phone Number + Name Desensitization" template, while administrators load the "Full Plain Text" template. Finally, dynamic masking in the in-memory computing isolation zone is implemented: Based on the ProxySQL middleware, an in-memory isolation zone is built between the database query engine and the user end. After intercepting SQL query results, real-time masking is performed (for example, calling the mask_phone(phone, role) function) to prevent plaintext data from being stored on disk. Cold-level data: Full masking and manual approval mechanism. For cold data, all fields are masked by default (for example, ID card numbers are displayed as ************), retaining only non-sensitive information such as data IDs. The approval process is configured through a workflow engine (such as Activiti). Users need to submit an application (including the reason for access and time limit). After dual approval by the department head and security administrator, some fields are temporarily unlocked (for example, only the first 6 digits of the ID card are displayed). After approval, a temporary access token (valid for 2 hours) is automatically generated. Storage resource scheduling technology based on activity level, specifically: Hot Level → High IOPS Cloud Disk: Use the cloud platform API (such as Alibaba Cloud Ecs.ModifyDiskAttribute) to migrate hot data to ESSD cloud disks (IOPS ≥ 100,000, latency ≤ 1ms) to meet high-frequency access requirements. Temperature level → Standard cloud disk: retains ordinary SSD cloud disk (IOPS = 10,000-50,000), balancing performance and cost; Cold level → Object storage: Automatically transfer cold data to object storage (such as AWS S3 and Alibaba Cloud OSS) through lifecycle management policies (such as AWS S3 Lifecycle), reducing storage costs to 1 / 5 of the original cost, and enabling data compression (such as the GZIP algorithm) to further save space. Dynamic migration trigger: When the data activity level changes for three consecutive days (e.g., from hot to warm), the scheduling engine (based on Kubernetes CronJob) executes storage migration. The migration process is implemented through snapshots and incremental synchronization, minimizing business interruption. Hot data is triple-protected with "trusted domain + encryption + RBAC". Compared with traditional extensive permissions, the incidence of security incidents is reduced. Role-adaptive desensitization avoids "over-desensitization affecting business" (for example, customer service can view the first letter of the user's name + the last 4 digits of the mobile phone number, which is both compliant and can verify identity), thereby improving user satisfaction. Cold data is fully masked + manual approval eliminates low-frequency high-risk access (such as historical customer data being maliciously downloaded), meets GDPR and other compliance requirements (data minimization principle), thereby achieving precise security protection and reducing compliance risks. At the same time, storage tiered scheduling reduces overall storage costs (cold data accounts for 70%, and the cost per GB after transfer to object storage is reduced from 0.5 yuan / month to 0.1 yuan / month). Hot data focuses on high IOPS resources, reducing access latency. It supports real-time business (such as flash sale order inquiries), prevents cold data from long-term occupation of high-performance storage, and frees up cloud disk resources for business expansion, thereby optimizing resource costs and improving ROI. Furthermore, the entire process of security policy and storage scheduling is automated (no manual level judgment, desensitization rule configuration, or data migration is required), reducing the O&M workload. The dynamic migration process is business-unaware (snapshot + incremental synchronization), avoiding business interruptions caused by traditional downtime migration (such as automatic nighttime migration without affecting daytime transactions). Furthermore, when the data activity level changes (such as marketing data going from warm to hot during a promotion), the system automatically upgrades the security policy (such as opening trusted domain access) and migrates to high-performance storage within 24 hours, supporting sudden business needs and avoiding the lag of manual adjustments (traditional processes take 3-5 days).

[0028] S5. When cold-level data persists for a period exceeding a preset period, a compliance review process is initiated and secure erasure is performed. The compliance review process includes: verifying compliance by associating with the data lineage map, which is a metadata database that records the source and flow path of data; sending an erasure confirmation request to a predefined data owner; if no response is received within a predetermined time, the request is forwarded to the Compliance Committee for arbitration; and after confirmation or arbitration is passed, the underlying overwrite interface of the storage medium is invoked to perform a physical sector erase to ensure that the data cannot be recovered. If cold data (the 70% of low-activity data after sorting) is left unprocessed for a long time, it will cause three core problems: First, compliance risks accumulate: Some cold data may involve user privacy (such as historical transaction records) or industry regulatory requirements (such as the five-year retention requirement for financial data). If it is deleted without verifying compliance, it may violate the GDPR's "data minimization" or the "storage period" clause of the Data Security Law. If it is retained excessively, it will face the risk of "right to be forgotten" litigation (if the user requests the deletion of personal information). Second, long-term storage resource usage: Cold data typically accounts for more than 60% of all data. Even if it is transferred to object storage, the "indefinite retention" will still cause storage costs to increase linearly. For example, one enterprise accumulated 100TB of cold data over three years, with annual storage costs exceeding 500,000 yuan. Third, data residue and leakage risks: Traditional deletion (such as the "DELETE" command) only removes file indexes, while the actual data is still stored in the physical sectors and can be restored through data recovery tools. This poses the risk of "leakage after deletion" (such as illegal data recovery from discarded hard drives); To address these issues, step S5 uses a closed-loop technology encompassing "compliance review - approval confirmation - physical erasure" to ensure the safe and compliant destruction of cold data. Core technologies include: Data lineage graph compliance verification technology: Based on the Apache Atlas data lineage engine, a metadata database is constructed to record the entire data lifecycle path: data source (such as business system A) → processing process (such as ETL task B) → flow destination (such as reporting system C) → related data (such as sub-table D, backup file E). At the same time, before erasure, the SQL query is automatically executed: SELECT * FROM data_lineage WHERE target_id='cold data ID' AND retention_period>CURRENT_DATE, to verify whether compliance conditions such as "storage period has expired" and "unrelated and unarchived data" are met (for example, financial data must be retained for 5 years, but if cold data is only stored for 3 years, the erasure request will be rejected). Multi-level approval and arbitration mechanism technology: First, confirmation by the responsible person: Through the API of the enterprise IM system (such as DingTalk / WeChat Enterprise), an erasure confirmation request is sent to the "data responsible person" predefined in the metadata database (such as the head of the business department). The request includes information such as the data ID, storage period, and compliance verification results, and a 48-hour response time limit is set. Second, arbitration by the compliance committee: If the responsible person does not respond or rejects the request, the arbitration process is automatically triggered, and the request is forwarded to the compliance committee (composed of representatives from the legal, security, and IT departments). An online vote is initiated through a workflow engine (such as Flowable). If more than 2 / 3 of the votes agree, the request is approved. Finally, approval records are left: All approval records (including the opinions of the responsible person and the arbitration vote results) are encrypted and stored on a blockchain (such as Hyperledger Fabric) to ensure that they cannot be tampered with and meet audit traceability requirements. Bottom-level physical sector erasure technology: includes storage media adaptation and irreversible verification. Storage media adaptation calls different erasure interfaces based on the storage type. For cloud disks / local hard disks, the ATA Secure Erase command is sent through the hdparm tool to overwrite sectors at the bottom level (write random binary data three times, in compliance with DoD 5220.22-M standards). Object storage (such as S3) calls the cloud vendor API (such as DeleteObject+S3 Glacier Deep Archive for permanent deletion) and triggers physical erasure of the storage node. Reversible verification involves scanning sectors through third-party tools (such as DBAN) after erasure to confirm that the data recovery rate is less than 0.001%. A "Data Destruction Report" is generated and uploaded to the compliance system.

[0029] Data lineage verification ensures that erasure does not violate storage period regulations (e.g. medical data is retained for 10 years, and erasure cannot be triggered for data that has not expired), avoiding fines of millions of yuan due to "illegal deletion" (e.g. GDPR fines up to 4% of global revenue). Blockchain evidence approval records can be directly used for regulatory audits (e.g. the "Data Lifecycle Management" inspection by the State Administration of Financial Supervision), improving the audit pass rate, thereby achieving zero residual compliance risk and meeting regulatory requirements; in addition, cold data is automatically erased after expiration, reducing object storage costs each year (e.g. a company erases 50TB of cold data annually, saving 250,000 yuan), avoiding the need for storage expansion caused by the unlimited accumulation of "zombie data", reducing the cloud resource procurement budget, and thus optimizing storage costs to the extreme. At the same time, the underlying sector overwrite technology makes the probability of data recovery close to zero. Compared with traditional logical deletion (such as emptying the Recycle Bin), the risk of data leakage is reduced, which is suitable for highly sensitive scenarios (such as user ID cards and biometric information). It meets the requirement of "deletion means complete irrecoverability" in the "Personal Information Protection Law", so that data security is completely guaranteed and residual leakage is eliminated; moreover, the entire process from compliance verification to erasure execution is automated (human beings only participate in the approval link), which improves processing efficiency (the traditional manual process takes 7 days, but only 2 days after automation); the bloodline map + blockchain approval record + destruction report form a complete audit chain, which can trace the entire path of each data "from generation to destruction", meeting the compliance needs of highly regulated industries such as finance and medical care.

[0030] See also Figure 2 As shown, the second object of the present invention is to provide an enterprise data asset management system based on cloud data, which is used to implement the above-mentioned enterprise data asset management method based on cloud data, including: The activity factor generation module is used to connect to the cloud platform log bus to collect raw data indicators and output multi-dimensional activity factors through the rule engine. The activity factor generation module has a built-in rule counter. This rule counter performs the following operations: accumulates access frequency in a sliding window; applies a magnification factor to the business criticality weight; Activity level calculation module, which calculates activity scores and divides them into levels based on multi-dimensional activity factors; The policy execution matrix receives the output of the activity level calculation module and synchronously triggers dynamic security policies and storage resource scheduling; The cold data governance module monitors the unaccessed period of cold-level data and triggers the compliance review process.

[0031] A third object of the present invention is to provide a network device, wherein the computer device comprises: at least one processor and a memory, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the steps of the above-mentioned cloud data-based enterprise data asset management method are performed; The memory includes storage media, which include various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical disks.

[0032] A fourth object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-mentioned cloud-based enterprise data asset management method; Specifically, there is no limitation on the material and structure of the storage medium, as long as it can realize the corresponding storage function.

[0033] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely preferred examples of the present invention and are not intended to limit the present invention. Various changes and improvements may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and improvements fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A cloud data-based enterprise data asset management method, characterized in that: include: S1. Real-time collection of raw data indicators through the activity perception engine deployed on the cloud platform; The activity perception engine is a data acquisition module connected to the cloud platform log bus; The raw data indicators include data access frequency, pre-configured business criticality weight value, and cross-department call popularity; S2. Input the raw data indicators into the rule engine and output standardized multi-dimensional activity factors; The rule engine is a logic processing module that executes preset calculation rules; The multidimensional activity factor is a set of numerical values ​​that characterize the real-time value of data; S3. Calculate activity scores based on multidimensional activity factors, and classify the original data into three activity levels: hot level, warm level, and cold level according to the activity score ranking results; S4. Dynamic security policies are implemented on raw data based on activity levels. For hot-level raw data, full trusted domain access control is implemented. For warm-level raw data, role-adaptive desensitization views are generated and key fields are dynamically masked. For cold-level raw data, full masking and manual approval mechanisms are enabled. At the same time, storage resources are scheduled based on activity levels. Hot data is migrated to high-IOPS cloud disks; warm data is retained on standard cloud disks; and cold data is transferred to object storage. S5. When cold-level data continues to exist for longer than the preset period, the compliance review process is initiated and secure erasure is performed.

2. The enterprise data asset management method based on cloud data according to claim 1, characterized in that: In S2, the rule engine processes the original data indicators through a rule counting method; the rule counting method refers to accumulating the access frequency by time window, amplifying the business criticality weight by a preset coefficient, and weighted summing the call heat by department weight.

3. The enterprise data asset management method based on cloud data according to claim 1, characterized in that: In said S3, the activity score is calculated by linearly weighting and summing the values ​​of the multidimensional activity factors; The activity grade classification rule is as follows: raw data with N ≤ the top 30% is defined as hot grade; raw data with N ≤ the top 70% is defined as warm grade; raw data with N > the top 70% is defined as cold grade, where N is the activity score ranking of the raw data corresponding to the multidimensional activity factor.

4. The enterprise data asset management method based on cloud data according to claim 1, characterized in that: In S4, the generation of the role-adaptive desensitization view includes: Predefined field mask rule templates to specify key field mask rules for different data types; Dynamically load matching mask templates based on user role permissions; An in-memory computing isolation zone is built between the database query engine and the user end, and dynamic mask operations are performed in the in-memory computing isolation zone before the database query results are returned.

5. The enterprise data asset management method based on cloud data according to claim 1, characterized in that: In S5, the compliance review process includes: Compliance verification using a linked data lineage map, a metadata repository that records data sources and flow paths; Sending erasure confirmation request to predefined data controllers; If no response is received within the scheduled time, the case will be referred to the Compliance Committee for arbitration; After obtaining confirmation or passing arbitration, the underlying overwrite interface of the storage medium is called to perform physical sector erasure to ensure that the data cannot be recovered.

6. A cloud-based enterprise data asset management system, used to implement the cloud-based enterprise data asset management method according to any one of claims 1 to 5, characterized in that: include: The activity factor generation module is used to connect to the cloud platform log bus to collect raw data indicators and output multi-dimensional activity factors through the rule engine; Activity level calculation module, which calculates activity scores and divides them into levels based on multi-dimensional activity factors; The policy execution matrix receives the output of the activity level calculation module and synchronously triggers dynamic security policies and storage resource scheduling; The cold data governance module monitors the unaccessed period of cold-level data and triggers the compliance review process.

7. The cloud-based enterprise data asset management system according to claim 6, characterized in that: The activity factor generation module has a built-in rule counter; the rule counter performs the following operations: Perform sliding window accumulation on access frequency; Apply a multiplication factor to the business criticality weight.

8. A computer device, comprising: At least one processor and a memory, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are performed.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are performed.

Images