Data security method and system fusing MIN and unified AI theory

Abstract

The invention provides a data security method and system fusing an MIN and a unified AI theory, and the method comprises the steps: S1, completing the multi-dimensional identification registration and synchronization of a data space in a multi-identification network MIN based on a data space identity identification DSID and an ontology semantic mapping frame; s2, acquiring a data acquisition record from a multi-identifier network MIN, and constructing an access control atlas in combination with a semantic vector of a data subject identifier DSID-Item; s3, analyzing the access request and verifying the authority, identifying the sensitivity level of the access request, and triggering a privacy enhancement mechanism when the sensitivity level is marked as medium-high-level privacy data; and S4, judging whether the data object reaches a value end point in the life cycle of the data object or not by taking a data space identity (DSID) registered in the multi-identifier network (MIN) as a retrieval anchor point, and if so, executing a verifiable multi-stage destruction operation. According to the invention, a full-life-cycle trusted data security technical scheme can be realized, and intelligent, explainable and efficient security management of data streams in a network space is realized.

Description

Technical Field

[0001] This invention relates to a data security method for cyberspace, more particularly to a data security method that integrates MIN and Unified AI theories, and further to a data security system employing this data security method that integrates MIN and Unified AI theories. Background Technology

[0002] With the rapid development of information technology, data flows and interacts more frequently in cyberspace, making data security and privacy protection crucial issues. However, existing data management and security control technologies have many shortcomings.

[0003] First, existing data identification systems are typically limited to local domain names or device IDs, lacking cross-domain synchronization and semantic mapping capabilities, resulting in fragmented data identities and making effective traceability and management difficult. Second, traditional data collection chains lack global semantic understanding, and policy configuration relies on manual experience, making it difficult to adapt to multi-source data and complex compliance requirements, impacting data quality and usability. Third, existing access control mechanisms largely rely on static permission matrices, lacking fine-grained semantic matching and access process verification, easily leading to over-authorization or privacy leaks. Fourth, traditional data destruction methods mostly remain at the level of logical deletion or physical erasure, lacking process verifiability and multi-domain review, posing potential compliance risks.

[0004] Therefore, current data flows in cyberspace still suffer from technical problems such as weak security controls, difficulty in establishing data ownership, limited privacy protection measures, and a lack of intelligent data management. These technical problems not only affect data security and privacy but also pose challenges to the compliant use and management of data. Summary of the Invention

[0005] The technical problem this invention aims to solve is to provide a data security method that integrates MIN and Unified AI theories. This method aims to achieve a trusted data security solution throughout the entire data lifecycle through a coordinated process of "identifier binding—governance modeling—access protection—verifiable destruction," enabling intelligent, interpretable, and efficient secure management of data flows in cyberspace and meeting the compliance and evolutionary governance requirements of complex cross-domain environments. Furthermore, this invention relates to a data security system that employs this data security method integrating MIN and Unified AI theories.

[0006] To address this, the present invention provides a data security method that integrates MIN and Unified AI theories, comprising the following steps: Step S1: First, based on the data space identity identifier DSID and ontology semantic mapping framework, generate the data subject identifier DSID-Item. Then, bind the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item to complete the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. Step S2: Obtain data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. Obtain collection pattern clusters through clustering algorithm. Combine the semantic vector of the data subject identifier DSID-Item to construct an access control graph. Step S3: Parse the access request and perform permission verification. Identify the sensitivity level of the access request. When the sensitivity level is marked as medium to high level privacy data, trigger the privacy enhancement mechanism. Step S4: Using the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, various data entries in the data space are periodically scheduled. Combined with access behavior logs, timestamp records and context information, it is determined whether the data object has reached the end of its value within its life cycle. If so, a verifiable multi-level destruction operation is performed, and the destruction process is completed by using the multi-identifier network MIN to confirm ownership, record and synchronize across domains.

[0007] A further improvement of the present invention is that step S1 includes the following sub-steps: Step S101: Generate a data space identity identifier DSID based on the multi-identifier architecture of the multi-identifier network MIN, and introduce an ontology semantic mapping framework to generate a data subject identifier DSID-Item. The ontology semantic mapping framework includes an ontology alignment stage, a semantic embedding stage, and a concept recognition stage. Step S102: During the access initialization phase, the collection node requests access permission through the access entry based on the multi-identifier network MIN, generates a unique trusted collection channel identifier SCP-ID, and binds the trusted collection channel identifier SCP-ID to the corresponding data subject identifier DSID-Item. Step S103: Construct a directed graph structure including data subject nodes, trusted acquisition channel nodes, and data acquisition event nodes. Use Neo4j graph database for logical modeling and generate unique behavioral digests for graph nodes based on SHA-256 hash algorithm to form an identification management link. Among them, the data subject node includes the data space identity identifier DSID, and the trusted acquisition channel node includes the trusted acquisition channel identifier SCP-ID. Step S104: Combine the identifier management link with the collected raw data to achieve hierarchical storage of data and construction of semantic indexes.

[0008] A further improvement of the present invention is that step S101 includes the following sub-steps: Step S1011: First, generate the main identifier DSID-root by combining the dynamic salt value with the user's basic identity information using the SHA-256 hash algorithm. Then, according to the structural domain characteristics of the data space, obtain the data space identity identifier DSID using the path-based identifier representation method, where DSID = DSID-root / physical region / data type - data source number / time segment. Step S1012 introduces an ontology semantic mapping framework to generate data subject identifiers DSID-Item. In the ontology alignment stage, the LogMap ontology alignment algorithm is used to automatically identify semantic equivalence or inclusion relationships between different ontologies. In the semantic embedding stage, the OWL2Vec* ontology embedding method is used to embed the ontology, representing ontology classes and attributes as embedding points in vector space. In the concept recognition stage, by integrating the BERT pre-trained language model and the CRF sequence labeling model, entity recognition and ontology mapping are performed on the original data labels or description fields, automatically labeling the semantic dimension information in the data space identity identifier DSID, and finally generating the data subject identifier DSID-Item. The semantic dimension information includes sensitivity level, data type, device label, and business domain attributes.

[0009] A further improvement of the present invention is that, in step S103, the digest formula is used. event =SHA256(serialize(EventAttributes)||Salt), where EventAttributes is a collection of event metadata; Salt is a random salt value; the serialize() function converts the structured attributes of the event into a string according to the predefined field order and format specifications.

[0010] A further improvement of the present invention is that step S2 includes the following sub-steps: Step S201: Obtain data collection records and use the Time2Vec time series embedding algorithm to vectorize and encode the timestamps in the data collection records; each data collection record includes an event timestamp, collection device identifier, data type, collection frequency, geographic location code, and statistical feature fields of the collection value range; Step S202: Combine the tags recorded in the semantic index, model the data using a Bi-LSTM deep learning network, and use the DBSCAN clustering algorithm to aggregate the output of the Bi-LSTM deep learning network to obtain multiple collection pattern clusters. Step S203: A semantic relationship extraction method based on graph attention network is adopted to construct a heterogeneous information graph with the data subject identifier DSID-Item as the central node. In the process of constructing the heterogeneous information graph, an independent embedding matrix is ​​configured for each type of node based on graph attention network, the features of all adjacent nodes are weighted and aggregated, and the attention weight is adaptively learned through multi-head attention mechanism to form the semantic vector h_DSID of the collection behavior. Step S204: Read the semantic vector of the data subject identifier DSID-Item. Based on the collection pattern in the pattern aggregation result, map the access subject and its corresponding role attributes, the data subject identifier DSID-Item of the target data, the allowed operation types, and context restrictions to the access control structure. The mapped access control structure is recorded in the form of key-value pairs to construct a preliminary access control graph I-ACG. During the construction process, each access subject is treated as a node in the access control graph I-ACG, and the node type is labeled with role attributes. Allowed access operations are represented as directed edges, which are used to indicate the direction from the subject node to the center node. The attributes of the directed edges include the operation type and context restrictions.

[0011] A further improvement of the present invention is that the heterogeneous information graph in step S203 includes data attribute nodes, context nodes, and compliance label nodes. Each type of node is vectorized using an independent embedding encoding function. Data attributes include modality type, acquisition frequency, and data value range; context includes geographical location, time window, and device status; and compliance labels include sensitivity level, scope of use, and authorization level. In constructing the heterogeneous information graph, the process is first performed using formulas... Construct a set of relations in the form of triples ,in, and These are graph nodes. Define the edge relation type, and then, through the formula Generate heterogeneous information graphs ,in, For a set of nodes, Let be the set of edges. and These are the node type set and the edge type set, respectively; In step S204, after constructing the preliminary access control graph I-ACG, the access control entries in JSON-LD format are written into its namespace through the data registration interface provided by the multi-identifier network MIN, and after successful writing, a unique named URI and version identifier are returned through the multi-identifier network MIN.

[0012] A further improvement of the present invention is that step S3 includes the following sub-steps: Step S301: Extract the request parameters of the access request. The request parameters include the visitor's identity ID, the data subject identifier DSID-Item of the request target, the operation type, the request timestamp, and the calling environment context. Search for its permission path in the access control graph I-ACG until a valid permission path is found. Then, proceed to step S302 to enter the zero-knowledge authorization verification stage. Step S302, first use the formula Generating zero-knowledge proofs Then through the formula The authorization verification process is as follows: upon successful authorization verification, a structured access token (AccessToken) is generated and digitally signed using the Elliptic Curve Digital Signature Algorithm (ECDSA). Represents a zero-knowledge proof function; Represents the verification function for zero-knowledge proofs; This indicates the initialization of the published public verification parameters; Indicates a private verification item; Indicates publicly available verification items; Step S303: Identify the sensitivity level of the access request. When the sensitivity level is marked as medium-high level privacy data, trigger the privacy enhancement mechanism. The path of the privacy enhancement mechanism includes a homomorphic encryption path and a secure multi-party computation path.

[0013] A further improvement of the present invention is that, in step S303, during the execution of the privacy enhancement mechanism, operation records, session environment information and result summaries are automatically generated, and these information are submitted as audit evidence to the log system of the multi-identifier network MIN, and the audit evidence is respectively bound to the data space identity identifier DSID and the access session ID.

[0014] A further improvement of the present invention is that step S4 includes the following sub-steps: Step S401, first use the formula A unified input vector for constructing a data lifecycle assessment model And the XGBoost gradient boosting algorithm is introduced to unify the input vector. Perform training and prediction, and output lifecycle score. ,in, Indicates access frequency. Indicates the last access time. Indicates business dependency tags, Indicate the sensitivity level; then, determine the lifecycle score. Whether the number of evaluation periods is less than the lifecycle end threshold within the preset number of evaluation periods. If so, the data object is determined to have reached the end of its value within its life cycle and is marked as a candidate for failure. Finally, the failure determination criteria and process records for each data object are recorded to form a list of data that have reached the end of their life cycle. Step S402: Perform multi-level shredding operations in stages. In the logical deletion stage, cut off the external access channel by canceling the mapping path of data in the index structure. In the overwrite stage, repeatedly write data blocks using the DoD 5220.22-M multiple overwrite algorithm to eliminate data residue. In the low-level erase stage, call the physical media control instruction ATASecure Erase to complete the low-level erase. Step S403: First, record the evidence items of the destruction process to construct the destruction evidence chain. Generate a digest value of the Merkle tree structure for all evidence items using the SHA-256 hash algorithm, and sign it to form a destruction digest block. Then, submit the destruction digest block to the network MIN with at most identifiers, and bind the corresponding data space identity identifier DSID and access session ID to form an audit record that maps one-to-one with the original data call history. The evidence items of the destruction evidence chain include the unique identifier of the data item, the execution method, the signature of the responsible node, and the destruction timestamp. The unique identifier of the data item includes the data space identity identifier DSID and the data item segment identifier Segment-ID. Step S404: The chain of evidence to be destroyed is simultaneously distributed to the regulatory node or governance domain to which the data object belongs.

[0015] This invention also provides a data security system that integrates MIN and unified AI theories, employing the data security method described above that integrates MIN and unified AI theories, and includes: The trusted identifier binding and data structuring module first generates a data subject identifier DSID-Item based on the data space identity identifier DSID and ontology semantic mapping framework. Then, it binds the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item, thus completing the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. The full lifecycle governance initialization module obtains data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. It obtains collection pattern clusters through clustering algorithms and constructs an access control graph by combining the semantic vector of the data subject identifier DSID-Item. The intelligent access and privacy protection module parses access requests and performs permission verification, identifies the sensitivity level of access requests, and triggers a privacy enhancement mechanism when the sensitivity level is marked as medium to high level privacy data. The lifecycle end and data deactivation processing module uses the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, periodically schedules various data entries in the data space, and combines access behavior logs, timestamp records and context information to determine whether the data object has reached the end of its value within its lifecycle. If so, it performs verifiable multi-level destruction operations and uses the multi-identifier network MIN to complete the ownership confirmation, recording and cross-domain synchronization of the destruction process.

[0016] Compared with existing technologies, the beneficial effects of this invention are as follows: First, based on the Data Space Identity (DSID) and ontology semantic mapping framework, a Data Subject Identifier (DSID-Item) is generated, completing multi-dimensional identifier space registration and synchronization, and realizing the trusted identifier binding and data structuring stages. Next, by constructing an access control graph, a full lifecycle governance initialization stage is achieved, performing initial modeling of the entire data lifecycle. Then, during data usage, an interpretable intelligent access scheduling and privacy enhancement protection mechanism is implemented, realizing a complete privacy protection chain. Finally, invalid data is identified and securely processed, verifiable multi-level destruction operations are executed, and the authorization, recording, and cross-domain synchronization of the destruction process are completed with the help of a multi-identifier network (MIN), achieving closed-loop governance throughout the entire lifecycle and preventing data residue and illegal reuse. Therefore, this invention can achieve a trusted data security technology solution throughout the entire lifecycle through four linked steps: "identifier binding—governance modeling—access protection—verifiable destruction," realizing intelligent, interpretable, and efficient secure management of data flows in cyberspace, and meeting the compliance and evolutionary governance requirements in complex cross-domain environments. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall process framework of one embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the implementation process of a zero-knowledge proof protocol; Figure 3 This is a schematic diagram illustrating the relationship between the data subject identifier DSID-Item and the data space identity identifier DSID in one embodiment of the present invention. Detailed Implementation

[0018] Before detailing the preferred embodiments of the present invention, the relevant technologies will be described and explained.

[0019] Regarding the definitions of abbreviations and key terms, DSID stands for Data Space Identity; HE stands for Homomorphic Encryption; zs-SNARKs stands for zero-knowledge succinct non-interactive argument of knowledge; ECDSA stands for Elliptic Curve Digital Signature Algorithm; SMC stands for Security Multi-Party Computation; and GAT stands for Graph Attention Network.

[0020] Regarding the future network MIN network architecture.

[0021] The existing internet architecture has gradually exposed problems such as a single governance model, a fragile security system, and a lagging evolution mechanism during the process of globalization. Especially in cross-sovereignty and multi-domain application scenarios, the existing network system centered on a single identifier (such as a domain name or IP address) is no longer sufficient to meet the complex needs of identity management, content addressing, and trusted interoperability. The traditional DNS management model is still dominated by centralized control, which has single-point bottlenecks and potential monopoly risks, and lacks inherent guarantees for data traceability and security protection. These problems directly restrict the further development of cyberspace in terms of security, governance, and sustainable evolution.

[0022] To address the aforementioned technological limitations, a Multi-Identifier Network (MIN) architecture is proposed. Its design integrates multi-identifier management mechanisms from future networks and existing IP networks, focusing on resolving the current shortcomings of the Internet in terms of identification systems, governance methods, and security capabilities. MIN constructs a network foundation that combines sovereign independence with interoperability by supporting multiple identifier types and distributed management. The MIN network primarily consists of a Multi-Identifier Management System (MIS) and Multi-Identifier Routers (MIRs). The MIN network's MIS is governed through a multilateral, co-managed consortium blockchain mechanism; the MIRs support various identifiers, including identity, content, service, and IP, enabling parallel coexistence at the network layer. MIN employs the HPT algorithm, combining hash tables and prefix trees, supporting multi-identifier translation and addressing for billions of entries.

[0023] The MIN network has the following outstanding advantages: (1) Multi-identifier support: MIN supports the parallel existence of multiple identifiers (such as identity, content, and IP), and can flexibly use different identifiers for addressing and routing according to application scenarios to meet the needs of traditional Internet and adapt to emerging fields such as Internet of Things, Industrial Internet, and Internet of Vehicles. (2) Decentralized governance: MIN adopts blockchain technology and consortium chain voting mechanism to ensure the fairness and transparency of network management and avoid the unilateral monopoly problem brought about by the current centralized DNS management. (3) High security and data traceability: The MIN network achieves data traceability by using asymmetric encryption technology, ensuring the security of data transmission and privacy protection. MIN's design gives it inherent security characteristics and can defend against various network attacks. MIN integrates a variety of security technologies, such as signature cryptography, authentication and behavior detection, and builds a dynamic security protection model to effectively resist various network attacks. (4) Scalability and flexibility: MIN's multi-identifier routing mechanism and consortium chain-based hierarchical management structure make it highly scalable. (5) Compatible with existing network architectures: MIN is compatible with existing network architectures such as IPv4 and IPv6, supporting gradual evolution and transition without completely replacing existing network equipment, thus reducing migration costs. (6) Identity-driven: With identity as the core identifier, it supports the registration and verification of users' real identities, enhancing network security and transparency. The binding of identity identifiers to devices ensures the traceability of network behavior.

[0024] Therefore, the MIN network architecture offers a new solution to existing internet problems, particularly in terms of multi-identifier management, decentralized governance, identity-driven mechanisms, and secure traceability. In the trusted data security method and system addressed in this invention, the multi-identifier, distributed governance, and inherent security characteristics of the MIN network provide the fundamental conditions for realizing trusted identification, dynamic governance, and security evolution in the data space, thus providing network environment support for the implementation of the technical solution of this invention.

[0025] On a unified AI theory.

[0026] While current artificial intelligence (AI) technology has made significant progress in computing power, algorithms, and applications, it still suffers from fundamental shortcomings in deep cognitive and generative mechanisms. Mainstream AI research relies excessively on symbolic formal operations or data-driven statistical patterns, essentially remaining at a superficial level of processing syntactic information. For semantic understanding and value judgment in complex environments, existing technologies often fail to establish effective internal connections, resulting in a lack of interpretability and adaptability in intelligent systems for security decision-making, complex governance, and dynamic evolution scenarios. Especially in high-risk areas such as code security and network defense, most systems can only identify surface-level syntactic features, such as abnormal byte distributions or function call anomalies, but cannot truly analyze potential attack logic or dynamically adjust response levels based on business value. This neglect of the deep structure of information causes intelligent systems to exhibit "black box" limitations in reasoning and decision-making when facing multi-source data and complex targets.

[0027] Faced with the aforementioned technological challenges, new theoretical explorations have proposed a reconstruction of the nature of information, with the theory of total information (TAI) serving as a crucial foundation for breaking through traditional paradigms. This theory posits that information is not a single-dimensional stack of symbols, but a dynamic whole composed of three types of information: syntactic, semantic, and pragmatic. Syntactic information corresponds to the formal structure of data and is the basis for machines to perceive the world, such as code structure and network message formats. Semantic information reveals the content and conceptual relationships behind the data, enabling systems to transcend literal symbols and establish an understanding of behavioral patterns. Pragmatic information further introduces the dimensions of value and goals, determining the significance of information for system decision-making and guiding agents to take actions that balance utility and safety in complex environments. By reconstructing the synergistic relationship among these three types of information, TAI provides intelligent systems with an interpretable, traceable, and value-oriented foundation, enabling them to achieve adaptive and transparent strategy generation in scenarios involving multi-layered defense, dynamic governance, and multi-dimensional data processing.

[0028] Building upon the theory of total information, mechanistic artificial intelligence further proposes a systematic intelligent generation path. Breaking away from the traditional "divide and conquer" model, it integrates the three-dimensional information ecosystem of syntax, semantics, and pragmatics into a unified intelligent evolution framework. Its core advantages are firstly reflected in interpretability: by semantically mapping and pragmatically constraining information at the perceptual layer, the decision-making process of the intelligent system can be traced from formal features to deep logic and target value. Secondly, it is reflected in universality: by constructing a closed-loop multi-type information conversion mechanism, the system can flexibly adapt to the needs of different domains and scenarios, generating dynamic, multi-path solutions from code review to network governance, thus breaking free from the constraints of fixed rules and static models.

[0029] Based on the above theoretical foundation, the Unified AI Theory further integrates the core ideas of the full information theory and mechanism-based artificial intelligence at the practical level, forming a holistic technical framework that is oriented towards complex environments and emphasizes security and interpretability. This framework can provide support for the technical solutions proposed in this application, enabling intelligent systems to achieve higher levels of security control, strategy optimization, and evolutionary adaptation when facing multi-identifier networks and trusted governance requirements.

[0030] Regarding zero-knowledge proof technology.

[0031] In the field of modern cryptography and privacy computing, Zero-Knowledge Proof (ZKP) is a landmark technology that aims to solve the problem of "how to prove the authenticity of secret information without revealing the secret information itself." A complete Zero-Knowledge Proof must simultaneously satisfy three properties: Completeness, Soundness, and Zero-Knowledge. Zero-Knowledge requires that the verification process does not reveal any information other than the proposition being true. With the increasing complexity of the Internet and information systems, Zero-Knowledge Proof has gradually moved from theory to practice, playing a particularly important role in scenarios involving sensitive data and privacy protection.

[0032] Currently, zero-knowledge proofs have several implementation paths, each representing a different technical approach and ultimately exhibiting differences in performance and security characteristics. Among them, the STARKs protocol offers the highest security. It does not rely on specific mathematical problem assumptions, possesses resistance to quantum attacks, and implements transparent, universal strings that require no trusted initialization. The STARKs protocol refers to the Scalable Transparent Arguments of Knowledge protocol, a protocol belonging to cryptographic proof systems.

[0033] Among the many specific implementation schemes of zero-knowledge proofs, zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) are a widely used and mature class, and the zk-SNARK protocol is one of these protocols. This application... Figure 2 The technical implementation process of zk-SNARK is demonstrated. Starting from the initial computational problem, it is first transformed into an algebraic circuit, then represented by R1CS (rank-one constraint system), further mapped to QAP (polynomial evaluation representation), and then processed by linear PCP and linear interactive proof to finally generate a zk-SNARK proof.

[0034] Compared to traditional zero-knowledge proofs, zk-SNARKs introduce two major advantages: simplicity and non-interaction. Proofs are small in size, verification is fast, and multiple rounds of interaction between the prover and verifier are unnecessary; generation and verification can be completed in a single step. With these characteristics, zk-SNARKs have been widely applied in areas such as blockchain privacy transactions, zero-knowledge aggregation, decentralized identity authentication, and confidential smart contracts, providing efficient and robust privacy protection and security guarantees for various complex systems.

[0035] Regarding multimodal data processing and semantic indexing.

[0036] Against the backdrop of rapid development in artificial intelligence and big data, multimodal data processing and semantic indexing technologies have evolved from single-modal feature analysis to a complex system that comprehensively processes multi-source information. Traditional data processing techniques are limited to single-modal data, rely on inverted indexes and keyword matching, and lack deep semantic understanding. Especially when processing unstructured data such as images, videos, and audio, the data value is difficult to fully extract.

[0037] With the widespread adoption of the internet and sensing devices, the sources and types of data have exploded, making the correlation of cross-modal information a rigid requirement. The second phase of multimodal data processing technologies has gradually taken shape, driven by deep learning and feature representation learning. Convolutional Neural Networks (CNNs) excel in visual feature extraction, while Recurrent Neural Networks (RNNs) and the subsequent Transformer architecture have achieved breakthroughs in natural language modeling, making feature extraction from different modalities such as images, text, and speech possible. Multimodal feature alignment techniques map data to a shared vector space, forming a unified semantic representation through feature concatenation, attention mechanisms, or cross-modal contrastive learning. For example, the visual-language joint embedding model supports cross-modal retrieval of images and text.

[0038] At this stage, semantic indexing technology began to be applied to multimodal data processing. Traditional keyword-based indexing methods cannot directly handle high-dimensional feature vectors. Vector-based semantic indexing constructs a high-dimensional feature vector space, transforming data items into dense vectors, and utilizes the Approximate Nearest Neighbor (ANN) algorithm to achieve efficient retrieval, thus overcoming the limitations of keyword matching. For example, in image retrieval tasks, the system no longer relies on manual labels but directly achieves "image search" through visual feature embedding. In natural language query tasks, embedded vectors can capture the contextual relationships and semantic similarities of words, making the query results more consistent with the user's intent.

[0039] In the third stage, pre-trained models and knowledge-driven technologies significantly promoted the deep integration of multimodal data processing and semantic indexing. Language pre-trained models, such as BERT and RoBERTa, acquired rich contextual semantic capabilities through training on large-scale corpora, providing a powerful representational foundation for text modalities. The core feature of this stage is the upgrade from simple feature alignment to deep semantic modeling. The system can understand more complex conceptual relationships and capture contextual associations, thereby supporting more accurate semantic indexing and reasoning.

[0040] In recent years, hybrid approaches based on knowledge graphs and deep learning have emerged in semantic indexing mechanisms. Knowledge graphs provide structured entity relationships and hierarchical semantic networks, while deep learning models offer powerful feature representation capabilities. The combination of these two technologies enables retrieval systems to perform deeper semantic associations across multimodal data. For example, by mapping detected object entities in an image to a knowledge graph, the system can not only identify the presence of "car" in the image but also deduce higher-order semantics such as brand, purpose, and scene attributes. During natural language queries, semantic indexing systems can leverage the hierarchical relationships and associative attributes of knowledge graphs to precisely target fuzzy queries to the desired content, significantly improving the interpretability and accuracy of retrieval. Therefore, the application scenarios for multimodal data processing and semantic indexing technologies are already quite extensive.

[0041] In this evolutionary process, multimodal data processing technology has continuously faced challenges and breakthroughs. First, there is the alignment challenge brought about by data heterogeneity; different modalities have significantly different data distributions and structures, requiring the design of efficient feature fusion and mapping mechanisms. Second, there is the high-dimensional complexity of semantic indexing; as the amount of data and the number of modalities increase, the computational cost of constructing and retrieving high-dimensional vector indexes rises significantly, requiring support from approximation algorithms, sparse representations, and hardware acceleration technologies. Furthermore, the interpretability and robustness of semantic indexes are also key research areas; how to enable the system not only to provide search results but also to explain the semantic relationships behind the results has become a direction for further optimization.

[0042] One existing technology related to this application is a technical solution based on the IP protocol.

[0043] The underlying architecture of the Internet is primarily built upon the Internet Protocol (IP). As the core network layer protocol in the TCP / IP protocol suite, IP is responsible for packetizing data and transmitting it across different physical networks, achieving global interconnection through routing functions. Its basic task is to deliver data from a source host to a destination host based on the source and destination addresses in the packet header. The IP protocol defines standard packet structures and addressing methods, and when encapsulating data, it transmits control information along with the payload to the underlying network layer.

[0044] The drawbacks of this existing IP technology solution are as follows: while it has long supported the operation and development of the modern internet, it has revealed numerous shortcomings in practical applications and network governance. The existing IP address system has significant limitations in its identification capabilities. Traditional IP addresses can only identify network locations, lacking the flexible capacity to carry multi-dimensional attributes such as identity, content, and geographic location. In emerging scenarios such as the Internet of Things (IoT), the Internet of Vehicles (IoV), and the Industrial Internet, the identification needs of terminals and services are becoming increasingly diverse and dynamic, requiring the ability to flexibly switch identification types according to different application scenarios. However, a single IP address cannot achieve multiple identifiers in parallel, severely limiting network-level scalability.

[0045] Existing IP technologies also face significant challenges in terms of address space and evolution. IPv4 uses a 32-bit address space, and global address resources are already nearing depletion. Although IPv6 expands the address space to 128 bits, theoretically it can meet the growing needs of network terminals in the long term. However, its deployment and promotion require large-scale updates and replacements of routing modules, applications, and terminal devices, affecting the entire network ecosystem. This results in high migration costs and slow progress, leading to a complex situation where IPv4 and IPv6 coexist for a long time.

[0046] Secondly, the highly centralized governance structure of IP networks makes them highly susceptible to amplified security risks. Critical infrastructure such as the Domain Name System (DNS), root servers, and routing tables are controlled by a few central nodes. If any of these critical nodes fails or is attacked, it can trigger widespread network outages and service unavailability. From a security perspective, public facilities like routers and DNS servers are easy targets for attackers; from an information security perspective, the exposure of IP addresses during communication exposes transmission paths to the risk of eavesdropping, tampering, and tracking.

[0047] More seriously, existing IP protocols are clearly inadequate in terms of information security and traceability. Their network governance often relies on static rules, such as blacklists and access control lists, forming a passive defense model that lacks the ability to dynamically respond to complex attacks and cannot achieve semantic tracing of security incidents.

[0048] In conclusion, while the IP protocol and its centralized architecture played an irreplaceable and fundamental role in the early development of the Internet, with the continuous evolution of network environments and application scenarios, traditional IP technologies can no longer meet current and future needs in terms of identification flexibility, decentralized governance, security traceability, and ease of operation and maintenance. These shortcomings have become an important area that subsequent technical solutions urgently need to address and optimize.

[0049] One existing technology related to this application is blockchain technology.

[0050] With the increasing demand for data assetization and cross-domain collaboration, some existing solutions are attempting to introduce blockchain technology to build distributed data management platforms to enhance data security, traceability, and multi-party governance capabilities. These systems are typically based on consortium blockchains or private blockchains, using smart contracts to record data operations on the blockchain and control access, thereby providing a verifiable traceability mechanism throughout the data lifecycle of collection, sharing, use, and destruction.

[0051] While blockchain-based distributed data management platforms have made progress in improving data traceability and multi-party collaborative governance, they still face many limitations in practical applications. The identification system of blockchain-based data management platforms remains inflexible. Existing solutions typically generate only a single hash identifier on-chain to represent the data object itself, lacking the ability to collaboratively manage multi-dimensional identifiers such as identity, content, and geography, and failing to adapt to the data flow and multi-identifier mapping needs in complex scenarios. Although on-chain governance is decentralized, its granularity is coarse. While consortium blockchains possess multi-party voting and consensus mechanisms, their governance rules are mostly statically preset and cannot be dynamically adjusted according to real-time business semantics or security posture, resulting in lifecycle management remaining in a state of fixed strategies and lagging updates.

[0052] Secondly, the performance and scalability of such data management platforms are easily limited. The consensus mechanism and redundant data storage of blockchain restrict transaction throughput and response speed, making it difficult to meet the requirements of high-frequency data access and real-time management in scenarios requiring large-scale, low-latency processing. Furthermore, there is a lack of intelligence. Although on-chain records provide an immutable historical trajectory, the lack of deep integration with upper-layer intelligent analysis and reasoning systems prevents semantic understanding of data behavior and automated decision support. This results in data lifecycle management remaining primarily at the recording level rather than the optimization level.

[0053] This application addresses the problems existing in the current data circulation process in cyberspace, such as weak security controls, difficulty in confirming data subject rights, limited privacy protection measures, and lack of intelligent data management. It proposes a trusted data security method and system that integrates multi-identifier networks (MIN) and unified AI theory. This data security method aims to construct a data space with trusted governance capabilities throughout its entire lifecycle, achieving intelligent, explainable, and efficient secure management in data collection, storage, use, access control, privacy protection, and destruction, meeting the compliance and evolutionary governance requirements of complex cross-domain environments.

[0054] The preferred embodiments of the present invention will now be described in further detail with reference to the accompanying drawings.

[0055] like Figure 1As shown, this embodiment constructs a trusted identification, intelligent governance, and evolutionary closed loop in the data space through the interactive steps S1 to S4, based on the Multi-Identifier Network (MIN) and Unified AI theory.

[0056] This embodiment provides a data security method that integrates MIN and unified AI theories, including the following steps: Step S1: First, based on the data space identity identifier DSID and ontology semantic mapping framework, generate the data subject identifier DSID-Item. Then, bind the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item to complete the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. Step S2: Obtain data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. Obtain collection pattern clusters through clustering algorithm. Combine the semantic vector of the data subject identifier DSID-Item to construct an access control graph. Step S3: Parse the access request and perform permission verification. Identify the sensitivity level of the access request. When the sensitivity level is marked as medium to high level privacy data, trigger the privacy enhancement mechanism. Step S4: Using the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, various data entries in the data space are periodically scheduled. Combined with access behavior logs, timestamp records and context information, it is determined whether the data object has reached the end of its value within its life cycle. If so, a verifiable multi-level destruction operation is performed, and the destruction process is completed by using the multi-identifier network MIN to confirm ownership, record and synchronize across domains.

[0057] Step S1 in this embodiment is used to implement the trusted identifier binding and data structuring stage. This stage establishes an identity anchoring mechanism for the trusted data space, which is a prerequisite for subsequent intelligent governance.

[0058] Step S1 in this embodiment includes the following sub-steps: Step S101: Generate a data space identity identifier DSID based on the multi-identifier architecture of the multi-identifier network MIN, and introduce an ontology semantic mapping framework to generate a data subject identifier DSID-Item. The ontology semantic mapping framework includes an ontology alignment stage, a semantic embedding stage, and a concept recognition stage. Step S102: During the access initialization phase, the collection node requests access permission through the access entry based on the multi-identifier network MIN, generates a unique trusted collection channel identifier SCP-ID, and binds the trusted collection channel identifier SCP-ID to the corresponding data subject identifier DSID-Item. Step S103: Construct a directed graph structure including data subject nodes, trusted acquisition channel nodes, and data acquisition event nodes. Use Neo4j graph database for logical modeling and generate unique behavioral digests for graph nodes based on SHA-256 hash algorithm to form an identification management link. Among them, the data subject node includes the data space identity identifier DSID, and the trusted acquisition channel node includes the trusted acquisition channel identifier SCP-ID. Step S104: Combine the identifier management link with the collected raw data to achieve hierarchical storage of data and construction of semantic indexes.

[0059] Step S1101 in this embodiment is used to generate the data subject identifier.

[0060] This step aims to achieve unique anchoring of data subjects throughout their entire lifecycle. It is the first step in building a trusted data space and a core prerequisite for supporting subsequent intelligent governance operations. Based on the multi-identifier architecture provided by the Multi-Identifier Network (MIN), this embodiment proposes a data subject identification mechanism for extended design of trusted data space management, namely the Data Space Identity (DSID). The DSID is based on the native identity identifier of the user or organization, such as the UID (User Identification) or OrganID (Organization ID) in the MIN, combined with structural encoding and encryption strategies to generate a unique hierarchical identifier for the data space, possessing resolution and cross-domain mapping capabilities.

[0061] The data space identity identifier (DSID) generation process described in this embodiment includes two stages: primary identifier construction and structural domain hierarchy derivation. Specifically, step S101 in this embodiment preferably includes the following sub-steps: Step S1011: First, the primary identifier DSID-root is generated by combining the SHA-256 hash algorithm with the dynamic salt value and the user's basic identity information. The generation process is expressed by the formula: DSID-root = HASH_SHA-256 (user basic identity information + dynamic salt value); this primary identifier possesses collision resistance and forgery prevention capabilities, and can uniquely identify the spatial root anchor point of a data subject globally. Then, based on the structural domain characteristics of the data space, such as physical location region, data type, data source number, time segment, business purpose, etc., a path-based identifier representation is used to obtain the data space identity identifier DSID, where DSID = DSID - root / physical location region / data type - data source number / time segment; for example: the physical location region can be represented as region-cn; the data type - data source number can be represented as sensor-cam02; the time segment can be represented as segment-20250625; the data space identity identifier DSID preferably adopts a hash chain and hierarchical HMAC binding method to ensure that the entire identifier path is structurally traceable and tamper-proof; each layer of sub-identifiers is logically derived from the previous layer and bound to the previous level through HMAC encryption, thereby realizing a unique mapping of the data space and path-based traceability under distributed identifier registration; In step S1012, at the parsing and usage level, the Data Space Identity DSID encoding adopts the Z85 structured expression format to meet the requirements of network transmission and identifier openness. Simultaneously, an ontology semantic mapping framework is introduced to generate the Data Subject Identifier DSID-Item, achieving automatic mapping and intelligent recognition from the identifier to the data semantic space. The ontology semantic mapping framework preferably consists of three parts: an ontology alignment stage, a semantic embedding stage, and a concept recognition stage. In the ontology alignment stage, the LogMap ontology alignment algorithm is used to automatically identify semantic equivalence or inclusion relationships between different ontologies. In the semantic embedding stage, the OWL2Vec* ontology embedding method is used to embed the ontologies, representing ontology classes and attributes as embedding points in a vector space. In the concept recognition stage, by integrating the BERT pre-trained language model and the CRF sequence labeling model, entity recognition and ontology mapping are performed on the original data labels or description fields, automatically labeling the semantic dimension information in the Data Space Identity DSID, and finally generating the Data Subject Identifier DSID-Item. Therefore, the Data Subject Identifier DSID-Item possesses uniqueness, structural integrity, and semantic mapping capabilities. The semantic dimension information includes sensitivity level, data type, device label, and business domain attributes.

[0062] In the above-mentioned data subject identifier DSID-Item generation process, this embodiment further distinguishes the concepts of data spatial identity identifier DSID and data subject identifier DSID-Item, such as... Figure 3As shown. Among them, the Data Space Identity (DSID) serves as a structured identity anchor for the data space, used to achieve unique identification and path tracing within the multi-identifier network (MIN). It belongs to the basic layer of identifier management and is also a component of the Data Subject Identifier (DSID-Item). The Data Subject Identifier (DSID-Item) is formed on the basis of the Data Space Identity (DSID) through semantic alignment, embedding, and concept recognition via an ontology semantic mapping framework. It not only possesses the uniqueness and hierarchical structure characteristics of the Data Space Identity (DSID) but also carries semantic dimension information related to the data subject, such as sensitivity level, data type / purpose, and business domain attributes.

[0063] Therefore, the data subject identifier DSID-Item can not only serve as a unique identity reference for the data space identity identifier DSID in subsequent registration, access and destruction processes, but also provide higher-level semantic expression and refined management capabilities in semantic indexing, access control and compliance judgment.

[0064] Step S102 in this embodiment is used to implement data object binding and identifier resolution. This step is used to establish a highly secure and reliable data acquisition link to achieve dynamic access and reliable recording of the process of sensing devices, edge nodes and data acquisition behavior.

[0065] During the access initialization phase, the data acquisition node requests access permission through the access entry point based on the multi-identifier network (MIN). The system employs an identity authentication mechanism based on the mTLS protocol, coupled with secure hardware fingerprint verification, to ensure that only pre-registered devices can access the data space. After successful registration, the system generates a unique trusted acquisition channel identifier (SCP-ID) for the node and binds it to the corresponding data subject identifier (DSID-Item).

[0066] To ensure the verifiability of the data collection process, step S102 introduces a Merkle Tree-based data collection signature mechanism. Raw data fragments and metadata within each data collection cycle are packaged, including timestamps, collection frequency, geographical location, and channel status, and signed with the device's private key. This signature information is uploaded to the log system of the multi-identifier network (MIN) for subsequent monitoring or AI model verification of the legality of the action.

[0067] Through this step, all raw data streams are identified, registered, and controlled under the "DSID-Item+SCP-ID" structure, ensuring that the source of the collection path is trustworthy, the behavior is traceable, and the channel is secure, providing a highly complete and reliable data foundation for the intelligent governance of the data space.

[0068] Step S103 in this embodiment is used to realize the registration and synchronization of the multidimensional identifier space.

[0069] This step, based on the previously generated data subject identifier DSID-Item and trusted acquisition channel identifier SCP-ID, completes the multi-dimensional identifier registration of the data space in the multi-identifier network MIN, realizing cross-domain synchronization and globally resolvable registration of identifiers in different regions and different protocol domains. This process is the core foundation for realizing the traceability of trusted data space identifiers throughout the entire lifecycle.

[0070] The identifier registration adopts a structured mapping method based on graph databases. First, a directed graph structure is constructed, consisting of data subjects (including data space identity identifiers DSID), acquisition channels (including trusted acquisition channel identifiers SCP-ID), and data events (including data acquisition event identifiers Event-ID), using the Neo4j graph database for logical modeling. Specifically, the system uses the Neo4j graph database to construct the following three types of core nodes: data subject nodes (including data space identity identifiers DSID), trusted acquisition channel nodes (including trusted acquisition channel identifiers SCP-ID), and data acquisition event nodes (including data acquisition event identifiers Event-ID), defining the directed relationships between them, including semantic edge types such as OWNED_BY (DSID data space identity identifier owns a certain acquisition channel), GENERATES (acquisition channel generates acquisition events), and RELATED_EVENT (data subject associated with an event). The above directed graph structure is organized using triples and supports declarative operations using the Cypher language.

[0071] At the node identification level, to ensure that all graph nodes possess global uniqueness and non-repudiation of behavior, the system injects a unique behavior digest (Behavior Digest) generated based on the SHA-256 hash algorithm into each node. The digest generation process adopts a dynamic hash binding strategy: based on the node's structural attributes, including ID, type, timestamp, and sensitivity level, etc., a standardized structural encoding is performed in conjunction with a random salt value, and an irreversible behavior digest is generated by calling a hash function, which is then written into the graph database as a node attribute.

[0072] Specifically, in step S103 of this embodiment, the formula digest event = SHA256(serialize(EventAttributes)||Salt) is used, where EventAttributes is a collection of event metadata; Salt is a random salt value to ensure that the digest is unpredictable and collision-free; the serialize() function converts the structured attributes of the event into a string form according to the predefined field order and format specifications, so as to serve as the input of the hash function.

[0073] To further record the evolution history of identifier versions within the data space, step S103 introduces a Merkle Tree structure to construct a version tree for the identifier registration chain. The system arranges the digest values ​​generated by all historical registration operations in chronological order and sequentially nests them to generate a Merkle root hash, which serves as the anchor value for the identifier evolution tree and is bound to the current DSID node. Through this structure, the system can perform consistency verification and historical tracing of the identifier status for any version.

[0074] For cross-domain synchronization, to achieve registration, propagation, and state synchronization of data spatial identifiers (such as DSID-Item and SCP-ID) across multiple heterogeneous domains, this embodiment preferably designs a multi-domain registration protocol based on the gRPC framework and the ProtoBuf communication protocol. This protocol defines standardized message interfaces for registration requests, state synchronization, signature verification, and exception handling, supporting trusted communication between different organizational domains, data platforms, or governance boundaries. At the protocol design level, the system uses ProtoBuf to define a set of structured message templates, covering instruction fields such as Register, Resolve, Revoke, and CheckVersion, and including core fields such as the registration object (such as DSID-Item, SCP-ID, and Event-ID), initiator identity, timestamp, version number, and signature digest. Each field has a precise data type and structure format defined in ProtoBuf, ensuring cross-platform compatibility and communication efficiency.

[0075] During the registration process, the system maintains a long-lived connection with the remote governance node via a gRPC bidirectional streaming channel, enabling continuous synchronization of asynchronous calls and message streams. When initiating cross-domain registration, the caller first structures and packages the complete request message, generating a signature digest. The signing process is based on the ECDSA elliptic curve digital signature algorithm; the caller uses its local private key to digitally sign the ProtoBuf-encoded message, and the signature result is sent along with the original message. Upon receiving the registration request, the receiver first verifies the signature's validity based on the shared public key, then parses the registration content and performs local mapping. If verification fails or the message structure is invalid, the system automatically triggers an error response mechanism and records the failure event in the local log and the MIN's auditing system. All registration interaction events are protected via a TLS encrypted channel before transmission, ensuring the security of data content and metadata transmission.

[0076] For state synchronization, the system introduces a version control mechanism. Each registration record is accompanied by a version number (VersionID) and a modification timestamp (LastModified). The receiving end compares the version information to determine whether the registration mapping needs to be updated, avoiding redundant synchronization operations. When multiple registration centers are making concurrent modifications, the system automatically handles conflicting registration requests according to a preset conflict resolution strategy.

[0077] Ultimately, the various core identifiers in the trusted data space are uniformly registered and resolved within MIN, forming a complete identifier management chain.

[0078] Step S104 in this embodiment is used to implement data structuring and semantic index construction.

[0079] In this embodiment, step S104 effectively combines the identifier management link completed in the previous steps with the collected raw data to achieve hierarchical data storage and semantic index construction, thereby providing standardized and efficient data support for subsequent syntax verification and intelligent management. Specifically, this step takes the identifier management link output in step S103 and the raw data collected by sensors, edge devices, etc. in step S102 as input, and transforms the raw heterogeneous data into a structured and tagged semantic data set by constructing a hierarchical storage architecture and semantic index system.

[0080] In the data processing stage, the data is first divided into a raw layer and a semantic processing layer based on its source, modality, and security sensitivity level, and then stored separately. The raw layer is responsible for storing the unprocessed raw data and data acquisition logs to ensure data integrity. The semantic processing layer uses multimodal coding methods: the DeBERTa-v3 model is used for deep semantic coding of text data, the Vision Transformer (ViT) is used to extract multidimensional features from image data, and the GraphSAGE graph neural network is used to perform neighborhood sampling and feature aggregation on database table structure information. Through these multiple processing methods, the heterogeneous raw data is transformed into high-dimensional vector representations.

[0081] Then, based on the transformed vectors, multi-level tags are further concatenated, including modality type, timestamp, data purpose, sensitivity level, and the data subject identifier DSID-Item, to construct a detailed and parsable semantic index tag system. This system uses the high-performance vector retrieval tool FAISS to build the semantic index and provides an open access interface to meet the subsequent needs for rapid semantic-based retrieval and permission verification. Simultaneously, to ensure data security and privacy protection, attribute-based encryption (ABE) and other encryption algorithms are applied to data with different sensitivity levels to achieve fine-grained binding of encrypted storage and access control. The output of step S104 includes a hierarchically stored data warehouse, a semantic index of associated data space identifiers, and an open index access interface.

[0082] Step S2 in this embodiment is used to realize the initialization stage of full life cycle governance. By establishing a unified AI theoretical model, the initial modeling of the data life cycle is carried out to support subsequent behavior perception and strategy execution.

[0083] In this embodiment, step S2 is based on the hierarchical storage data warehouse and semantic index generated in step S1, and uses a unified AI theoretical model to intelligently model and dynamically optimize the data space collection strategy. The purpose is to enhance the compliance of data collection behavior, improve resource utilization efficiency, and proactively avoid collection risks while ensuring data integrity and availability.

[0084] Specifically, step S2 in this embodiment preferably includes the following sub-steps: Step S201: Obtain data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted acquisition channel identifier SCP-ID. Then, introduce the Time2Vec time series embedding algorithm to vectorize and encode the timestamps of the data collection records to effectively model the periodicity and trend characteristics of the time dimension. Each data collection record includes fields such as event timestamp, acquisition device identifier, data type, acquisition frequency, geographic location code, and statistical characteristics of the acquisition value range, which serve as input features. Step S202: Combine the tags recorded in the semantic index, model the data using a Bi-LSTM deep learning network, and use the DBSCAN clustering algorithm to aggregate the output of the Bi-LSTM deep learning network to obtain multiple collection pattern clusters. Step S203: After obtaining the clustering results, a semantic relationship extraction method based on graph attention network is used to model the implicit semantic structure in various collection behaviors. Specifically, a heterogeneous information graph is constructed with the data subject identifier DSID-Item as the central node. In the process of constructing the heterogeneous information graph, an independent embedding matrix is ​​configured for each type of node based on graph attention network, the features of all neighboring nodes are weighted and aggregated, and the attention weights are adaptively learned through a multi-head attention mechanism to form the semantic vector h_DSID of the collection behavior. Step S204: Based on the semantic representation, semantic index labels, and typical collection pattern clusters generated by clustering, the initial access control graph is constructed to achieve pre-configuration of access permissions for the trusted data space in the early stages of its lifecycle. Specifically, the semantic vector corresponding to the data subject identifier DSID-Item is read first. This semantic vector incorporates feature information such as sensitivity level, scope of use, authorization level, and collection pattern through field mapping. Then, according to the collection pattern in the pattern aggregation result, the access subject and its corresponding role attributes, the target data's data subject identifier DSID-Item, allowed operation types, and context restrictions are mapped to the access control structure. The mapped access control structure is recorded in key-value pairs, with each entry including {subject ID, role attribute, target DSID-Item, operation type, ...} Context restrictions}, construct a preliminary access control graph I-ACG; during the construction process, each access subject is treated as a node in the access control graph I-ACG, and the node type is labeled with role attributes; allowed access operations are represented as directed edges, which are used to indicate the direction from the subject node to the central node (i.e., the data subject identifier DSID-Item, also known as the data resource node), and the attributes of the directed edges include operation type and context restrictions.

[0085] In step S202 of this embodiment, after vectorization encoding, it is preferable to combine the data usage labels and sensitivity level labels recorded in the semantic index to incorporate the task objectives and compliance levels of each type of collected data into the modeling process. For example, if a certain type of data is labeled as "high-frequency sensor monitoring + medium-level sensitive information," then its collection strategy should meet the requirements of high-frequency coverage and have necessary desensitization strategies. This strategy learning task is modeled using a Bi-LSTM deep learning network. Based on the input time-series vector sequence, an Attention mechanism is introduced to assign high weights to key behavioral segments, outputting a context-aware representation vector of the collection behavior. Subsequently, in order to identify the collection preferences and strategy differences of data subjects in specific scenarios, the system uses the DBSCAN clustering algorithm to perform pattern aggregation on the output representation of the Bi-LSTM network, automatically summarizing multiple typical collection pattern clusters, such as: timed stable collection mode, scene-triggered collection mode, and non-periodic bursty collection mode, etc.

[0086] In step S203 of this embodiment, when constructing the structure of the heterogeneous information graph, it is preferable to first include data attribute nodes, context nodes, and compliance label nodes, with each type of node being vectorized using an independent embedding encoding function. Then, edge types in the heterogeneous information graph are defined to describe the semantic relationships between nodes, such as "has_attribute", "captured_in", and "restricted_by", and these edge types are injected into the structural metadata of the heterogeneous information graph. Data attributes include modality type, acquisition frequency, and data value range; context includes geographical location, time window, and device status; and compliance labels include sensitivity level, scope of use, and authorization level.

[0087] During the construction of the heterogeneous information graph, based on the data collection behavior logs recorded in the original layer of the data warehouse, the data attributes, context, and other information associated with each data subject identifier (DSID-Item) during its lifecycle are automatically extracted. Specifically, this is first done using formulas. Construct a set of relations in the form of triples ,in, and These are graph nodes. Define the edge relation type, and then, through the formula Generate heterogeneous information graphs That is, using a structural template to automatically set the relation set of the triple. Injected into the graph database, generating a structurally complete heterogeneous graph topology. ,in, For a set of nodes, Let be the set of edges. and These are the node type set and the edge type set, respectively. To achieve automatic aggregation of semantic contributions among different nodes, the system runs a graph attention network (GAT) on the heterogeneous graph. In this process, the GAT configures an independent embedding matrix for each type of node, weights and aggregates the features of all neighboring nodes, and the attention weights are adaptively learned by a multi-head attention mechanism. Finally, using the data subject identifier (DSID-Item) as the central node, neighboring nodes are aggregated to form a high-dimensional embedding vector h_DSID that is structurally rich and semantically interpretable. This vector serves as the semantic representation of the data collection behavior and participates in subsequent access policy generation and compliance assessment tasks.

[0088] In step S204 of this embodiment, which maps the access subject and its corresponding role attributes, the data subject identifier DSID-Item of the target data, the allowed operation types, and context restrictions to the access control structure, the above elements are filled into the triplet template of the access control structure with "access subject - target data - access conditions" as the core relationship. The access subject is the subject node in the control structure, with its role attribute field attached; the target data refers to the data subject identifier DSID-Item, which is the resource node being accessed; the access conditions use operation types and context restrictions as edge attributes to form an access relationship of "subject → resource".

[0089] In the mapped access control structure, if a subject has access permissions to multiple subsets of data, this is expressed through multiple edges. The edge weights are set according to the strength of the policy restrictions; for example, highly sensitive data is accompanied by a zero-knowledge verification flag. After the graph is constructed, the system writes the JSON-LD formatted access control entries into its namespace through the data registration interface provided by the multi-identifier network (MIN). Upon successful writing, the multi-identifier network (MIN) returns a unique named URI and version identifier, enabling persistent embedding and searchable management of the access control structure within the multi-identifier network (MIN). Through the initialization policy configuration in this step, the system implements an early access protection framework for the data space, ensuring least privilege control capabilities before data is formally accessed, and providing a basic policy anchor for intelligent scheduling and privacy protection mechanisms in subsequent access phases.

[0090] Step S3 in this embodiment is used to implement the intelligent access and privacy protection stage. It focuses on implementing interpretable intelligent access scheduling and privacy enhancement mechanisms during data usage, ensuring that data meets business needs while also respecting usage boundaries and privacy compliance. Step S3 in this embodiment preferably includes steps S301 to S303.

[0091] Steps S301 and S302 in this embodiment are used to implement access request parsing and dynamic authorization. They are used to perform semantic parsing and permission verification on external access requests during the data retrieval phase, establishing a "usable but invisible" guarantee mechanism for access behavior in the trusted data space. The system uses the initial access control graph (I-ACG) constructed in step B2 as the policy basis, combined with the access subject identity identifier and data space identifier (DSID-Item) registered by MIN, to perform fine-grained parsing and permission matching of the target scope, operation type, and retrieval environment of the access request.

[0092] In step S301 of this embodiment, after the access request arrives, the request parameters of the access request are first extracted by the parsing module. The request parameters include the visitor's identity ID (UserID), the data subject identifier DSID-Item of the request target, the operation type (OpType), the request timestamp (T), and the calling environment context (Context), etc. Then, the data sensitive label and compliance policy corresponding to the DSID are retrieved, and its permission path is searched in the access control graph I-ACG until a legal permission path is found. Then, the process jumps to step S302 to enter the zero-knowledge authorization verification stage to ensure that the request completes the permission confirmation under privacy protection.

[0093] Accordingly, this embodiment introduces a non-interactive permission verification protocol based on zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge). Specifically, this embodiment designs a permission verification function. This is used to constrain the following access legitimacy conditions: Condition 1, Visitor identity Having a legitimate access role Condition 2: Current access operation Authorized; Condition 3, Data subject identifier The corresponding sensitivity level The visitor's authorization level has not been exceeded; Condition 4: Current access context The environmental constraints in the behavior policy graph are satisfied; Condition 5: all inputs match the minimum access boundary registered in the access control graph.

[0094] The visitor needs to generate a zero-knowledge proof that satisfies the following relation. Submit to the verification module.

[0095] More specifically, in step S302 of this embodiment, the formula is first used to... Generating zero-knowledge proofs Then through the formula The access control verification process determines whether a user has the right to access the target data without disclosing their identity, role, or access path. Upon successful access verification, a structured access token (AccessToken) is generated. This AccessToken encapsulates the access scope, operation permissions, access window, and identity digest, and is digitally signed using the Elliptic Curve Digital Signature Algorithm (ECDSA) to ensure the integrity and traceability of the access session. All access events and zero-knowledge proof digests are simultaneously written to the MIN audit chain for compliance checks and subsequent accountability.

[0096] in, Represents a zero-knowledge proof function; Represents the verification function for zero-knowledge proofs; This indicates the initialization of the published public verification parameters; This indicates a private authentication item, containing the visitor's key. Access Role Current context and access graph path , represented as Access graph path The system automatically traces back the generated access path from the Access Control Graph (I-ACG) to prove that the visitor is indeed within the legal boundaries; This indicates that the publicly verified item is the data subject identifier DSID-Item and the operation type. With sensitivity level Through commitment function The encrypted verification target is represented as .

[0097] Step S303 in this embodiment is used to implement privacy-enhanced execution and minimum exposure guarantee. This step targets the authorized use phase of highly sensitive data, further implementing the core principle of "usable but not visible" data, ensuring that sensitive information is avoided during the actual data execution process. The system uses the AccessToken generated and issued in step S302 as the entry point, and combines it with the semantic index tag system registered in the multi-identifier network MIN to determine the sensitivity level of the accessed data. Automatic identification is performed. If the accessed data is marked as medium to high-level privacy data, the system will trigger a privacy enhancement mechanism to encrypt and minimize the exposure of the data during the data processing.

[0098] In step S303 of this embodiment, the sensitivity level of the access request is identified. When the sensitivity level is marked as medium-high level privacy data, a privacy enhancement mechanism is triggered. The privacy enhancement mechanism includes a homomorphic encryption (HE) path and a secure multi-party computation (SMC) path. The homomorphic encryption (HE) path is suitable for unilateral sensitive data processing tasks. The system encrypts the target data and transmits it to the accessing entity, allowing it to complete the authorization operation in encrypted form. The secure multi-party computation (SMC) path is suitable for multi-source joint computation scenarios. The system calls the Secure Multi-Party Computation Protocol (SPDZ) to coordinate execution across multiple data spaces, completing the joint analysis task without requiring each party to decrypt the data.

[0099] To ensure the verifiability and traceability of the entire process, step S303 of this embodiment automatically generates operation records, session environment information, and result summaries during the execution of the privacy enhancement mechanism. These information are then submitted as audit evidence to the log system of the multi-identifier network (MIN). This audit evidence is bound to both the Data Space Identity (DSID) and the Access Session ID for subsequent access tracking and compliance verification. Through this step, this embodiment further strengthens the security control of highly sensitive data during authorized use, achieving a complete privacy protection chain from "accessibility" to "usage," providing a "minimum visibility and maximum availability" privacy guarantee capability for the trusted data space. The Access Session ID refers to a unique identifier automatically generated by the system when a user or application initiates a specific data access request using the Data Space Identity (DSID).

[0100] In this embodiment, step S4 is used to realize the lifecycle end and data deactivation stage. Preferably, it includes steps S401 to S404, wherein step S401 is used to perform data failure detection and lifecycle determination; steps S402 to S404 are used to perform data shredding and verifiable destruction.

[0101] First, determining whether a data object has reached its value endpoint within its lifecycle is crucial for supporting subsequent data deactivation and secure destruction operations, and is a key step in realizing a "controllable destruction" mechanism for the data space. This embodiment uses the Data Space Identity (DSID) registered in the Multi-Network Identifier (MIN) as the retrieval anchor point, periodically scheduling various data entries in the data space, and comprehensively evaluating their current activity, value status, and retention necessity by combining access behavior logs, timestamp records, and business context information.

[0102] Specifically, in step S401, firstly through the formula A unified input vector for constructing a data lifecycle assessment model And the XGBoost gradient boosting algorithm is introduced to unify the input vector. Perform training and prediction, and output lifecycle score. ,in, Indicates access frequency. Indicates the last access time. Indicates business dependency tags, Sensitivity levels are indicated; the constructed data lifecycle assessment model uses access frequency, last access time, business dependency tag, and sensitivity level as indicators. The core feature is...

[0103] Then, determine the lifecycle score. Whether the number of evaluation periods is less than the lifecycle end threshold within the preset number of evaluation periods. If so, the data object is determined to have reached the end of its value within its lifecycle and is marked as a candidate for failure; lifecycle score. The lower the value, the weaker the activity, the lower the value, and the closer it is to the end-of-life threshold. The lifecycle end threshold described in this embodiment... This refers to a pre-set threshold used to determine whether a data object has reached its end-of-life value. This threshold can be adjusted according to actual circumstances and needs. The default lifecycle end threshold is set to [value missing]. The preset number can also be customized and adjusted, such as when a data object's lifecycle score is set. Furthermore, if no valid access occurs within three consecutive evaluation periods, the system marks it as a candidate for failure.

[0104] Furthermore, to address the discrepancy between short-term inactive and long-term cold data in business scenarios, the system can dynamically adjust lifecycle assessment results based on business strategies, regulatory requirements, and user-defined strategies. For example, compliant data related to the financial or medical fields, even with low activity, will be delayed in being classified as invalid. Finally, the invalidation criteria and process records for each data object are recorded to form a lifecycle-end data list. Each data item is accompanied by complete invalidation criteria and process records, and is pushed to the next stage of the data deactivation processing module. This ensures that the data space has the evolutionary capability of "retreating on demand and proactively cleaning up," supporting a complete lifecycle closed loop for the trusted data space.

[0105] Step S402 targets data objects whose lifecycles have ended, performing verifiable multi-level destruction operations, and using MIN to complete the ownership confirmation, recording, and cross-domain synchronization of the destruction process. First, data items identified as candidate invalid data are triggered to execute a shredding process. Based on the data's sensitivity level and the type of storage medium, an applicable destruction strategy is automatically matched and scheduled through a unified task scheduling module. During execution, multi-level shredding operations are performed in stages. In the logical deletion stage, the mapping path of the data in the index structure is cancelled, cutting off external access channels. In the overwrite stage, the DoD5220.22-M multiple overwrite algorithm is used to repeatedly write data blocks to eliminate data residue. In the low-level erase stage, the physical media control command ATA Secure Erase is invoked to complete the low-level erase, ensuring that the data is unrecoverable.

[0106] Step S403: After the shredding operation is completed, the evidence items of the destruction process are first recorded to construct the destruction evidence chain. A Merkle tree digest value is generated for all evidence items using the SHA-256 hash algorithm, and a Destruction Proof Block is formed by signing it. Then, the Destruction Proof Block is submitted to the At most one identifier network (MIN) and bound to the corresponding Data Space Identity (DSID) and Access Session ID, forming an audit record that maps one-to-one with the original data call history, enabling cross-domain verification of the destruction behavior at the regulatory level. The evidence items in the destruction evidence chain include the unique identifier of the data item, the execution method, the signature of the responsible node, and the destruction timestamp. The unique identifier of the data item includes the Data Space Identity (DSID) and the Data Item Segment Identifier (Segment-ID). The Segment-ID value is the storage segment identifier under the Data Space Identity (DSID), used to distinguish different storage segments under the unified Data Space Identity (DSID), ensuring that the audit record can accurately correspond to the specific part of the data object.

[0107] To enhance regulatory usability, the Multi-Identifier Network (MIN) provides cross-domain trust services during this process. Based on the semantic mapping capabilities of the Data Space Identity (DSID), this embodiment synchronously distributes the destruction evidence chain to the regulatory node or governance domain to which the data object belongs in step S404, also known as cross-domain synchronous filing of the evidence chain. This mechanism ensures that the same destruction behavior can be reviewed and held accountable in different organizations or jurisdictions, supporting multi-party trust and regulatory response for sensitive data in scenarios such as digital sovereignty and cross-border circulation. Ultimately, through this step, the system constructs a trusted destruction closed loop of "data destruction behavior - ownership confirmation evidence chain - cross-domain synchronous filing," realizing a highly reliable, highly transparent, and highly compliant data exit mechanism for the trusted data space at the end of its lifecycle.

[0108] This embodiment also provides a data security system that integrates MIN and unified AI theories, employing the data security scheme described above that integrates MIN and unified AI theories, and includes: The trusted identifier binding and data structuring module first generates a data subject identifier DSID-Item based on the data space identity identifier DSID and ontology semantic mapping framework. Then, it binds the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item, thus completing the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. The full lifecycle governance initialization module obtains data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. It obtains collection pattern clusters through clustering algorithms and constructs an access control graph by combining the semantic vector of the data subject identifier DSID-Item. The intelligent access and privacy protection module parses access requests and performs permission verification, identifies the sensitivity level of access requests, and triggers a privacy enhancement mechanism when the sensitivity level is marked as medium to high level privacy data. The lifecycle end and data deactivation processing module uses the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, periodically schedules various data entries in the data space, and combines access behavior logs, timestamp records and context information to determine whether the data object has reached the end of its value within its lifecycle. If so, it performs verifiable multi-level destruction operations and uses the multi-identifier network MIN to complete the ownership confirmation, recording and cross-domain synchronization of the destruction process.

[0109] In summary, this embodiment integrates MIN and Unified AI theories to propose a trusted data security method and system for the entire lifecycle of data space. By constructing a four-stage linkage mechanism of "identifier binding—governance modeling—access protection—verifiable destruction," it achieves controllable, traceable, and evolvable governance of data throughout the entire process from registration, collection, use to destruction. Compared with the technical problems of fragmented identification, rigid permissions, and unverifiable destruction in existing data management methods, this embodiment transforms the "data governance logic" from external static configuration to system-endogenous intelligence, constructing an interpretable and verifiable closed loop throughout the identification management, access control, and data disposal processes, and possessing the following beneficial effects.

[0110] First, a systematic improvement in the uniqueness of identifiers and cross-domain resolvability.

[0111] Existing data identification systems often only reach the level of local domain names or device IDs, making it difficult to achieve cross-domain synchronization and semantic mapping, resulting in fragmented data identities and difficulties in traceability. This embodiment constructs a Data Space Identity (DSID) and a Trusted Acquisition Channel Identity (SCP-ID) to form a three-layer association graph of "subject-channel-event". The identification link is preferably modeled using the Neo4j graph database and maintained with a Merkle Tree to ensure the verifiability of cross-domain registration and resolution. Based on the Data Space Identity (DSID) and ontology semantic mapping framework, a Data Subject Identity (DSID-Item) is generated to complete multi-dimensional identification space registration and synchronization, realizing the trusted identification binding and data structuring stages. This embodiment relies on the naming-resolution-mapping service of the multi-identifier network (MIN). The DSID and its derived identifiers can be globally uniquely resolved and cross-domain mapped in a multi-domain environment, ensuring consistency and traceability of data throughout the entire process from registration to collection, and significantly improving the integrity of data space identification management, providing a solid foundation of trust for subsequent governance and access.

[0112] Second, the optimization of data collection strategies and the significant enhancement of the intelligence level of governance decisions.

[0113] Traditional data acquisition processes lack global semantic understanding, and policy configuration relies on manual experience, making them ill-suited for multi-source data and complex compliance requirements. This embodiment, based on unified AI theory, embeds multi-source data attributes, acquisition context, and compliance tags into a heterogeneous information graph. Using the Data Space Identity (DSID) as the central node, it generates acquisition patterns and access policies through temporal modeling, cluster analysis, and graph neural network inference, transforming the data acquisition process from a fixed template to intelligent scheduling. It can automatically select the optimal acquisition frequency, channel, and security policy in different scenarios, forming interpretable and evolvable intelligent modeling, thereby improving resource utilization and compliance.

[0114] Third, the interpretability of access control and the ability to protect privacy have been comprehensively strengthened.

[0115] Existing access controls largely rely on static permission matrices, lacking fine-grained semantic matching and access process verification, which can easily lead to over-authorization or privacy leaks. This embodiment introduces an Initial Access Control Graph (I-ACG) and a zero-knowledge proof mechanism during the access phase, enabling users to complete permission verification without exposing sensitive information. During access, it combines semantic index tags to trigger homomorphic encryption (HE) and secure multi-party computation (SMC / SPDZ) and other privacy enhancement technologies, achieving interpretable intelligent access scheduling and privacy enhancement protection mechanisms during data usage, realizing a complete privacy protection chain that is "usable but not visible." Furthermore, access tokens and verification results are written to the MIN audit chain throughout the process, enabling traceability and compliance verification of access events, significantly improving security transparency during the access phase.

[0116] Fourth, the verifiability and cross-domain compliance of data destruction activities have been significantly improved.

[0117] Traditional data destruction often involves logical deletion or physical erasure, lacking process verifiability and multi-domain review, thus posing potential compliance risks. This embodiment executes a multi-level shredding mechanism (logical deletion, overwrite, and low-level erasure) after data becomes invalid, generating an evidence chain containing data identifiers, destruction methods, and responsible signatures. This evidence chain is written into a multi-identifier network (MIN) via a Merkle Tree digest structure, enabling simultaneous filing and regulatory review of the destruction process across multiple domains, ensuring the non-repudiation and verifiability of the data exit process.

[0118] Fifth, the technical solution is highly versatile and supports the construction of a trusted data space ecosystem.

[0119] This embodiment does not rely on a specific data modality or a single protocol system, and is applicable to various high-security scenarios such as industrial IoT data management and cross-border data flow compliance. By modeling the entire chain of identification, access, governance, and destruction, it achieves a closed loop of data space governance: "trustworthy upon registration, auditable in use, and destroyable upon expiration." The policies, evidence, and audit information output by this embodiment are all interpretable and scalable, achieving interpretability and evolvability throughout the entire lifecycle, and providing a technical foundation for building a trusted data ecosystem with multi-party collaboration.

[0120] Therefore, this embodiment, through the deep integration of MIN and the unified AI theory, can realize the transformation of data space governance from static configuration to intelligent evolution and from single-domain management to cross-domain trust, and achieve intelligent, explainable and efficient security management of data flow in cyberspace, meeting the governance requirements of compliance and evolution in complex cross-domain environments.

[0121] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A data security method integrating MIN and Unified AI theories, characterized in that, Includes the following steps: Step S1: First, based on the data space identity identifier DSID and ontology semantic mapping framework, generate the data subject identifier DSID-Item. Then, bind the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item to complete the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. Step S2: Obtain data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. Obtain collection pattern clusters through clustering algorithm. Combine the semantic vector of the data subject identifier DSID-Item to construct an access control graph. Step S3: Parse the access request and perform permission verification. Identify the sensitivity level of the access request. When the sensitivity level is marked as medium to high level privacy data, trigger the privacy enhancement mechanism. Step S4: Using the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, various data entries in the data space are periodically scheduled. Combined with access behavior logs, timestamp records and context information, it is determined whether the data object has reached the end of its value within its life cycle. If so, a verifiable multi-level destruction operation is performed, and the destruction process is completed by using the multi-identifier network MIN to confirm ownership, record and synchronize across domains.

2. The data security method integrating MIN and unified AI theories according to claim 1, characterized in that, Step S1 includes the following sub-steps: Step S101: Generate a data space identity identifier DSID based on the multi-identifier architecture of the multi-identifier network MIN, and introduce an ontology semantic mapping framework to generate a data subject identifier DSID-Item. The ontology semantic mapping framework includes an ontology alignment stage, a semantic embedding stage, and a concept recognition stage. Step S102: During the access initialization phase, the collection node requests access permission through the access entry based on the multi-identifier network MIN, generates a unique trusted collection channel identifier SCP-ID, and binds the trusted collection channel identifier SCP-ID to the corresponding data subject identifier DSID-Item. Step S103: Construct a directed graph structure including data subject nodes, trusted acquisition channel nodes, and data acquisition event nodes. Use Neo4j graph database for logical modeling and generate unique behavioral digests for graph nodes based on SHA-256 hash algorithm to form an identification management link. Among them, the data subject node includes the data space identity identifier DSID, and the trusted acquisition channel node includes the trusted acquisition channel identifier SCP-ID. Step S104: Combine the identifier management link with the collected raw data to achieve hierarchical storage of data and construction of semantic indexes.

3. The data security method integrating MIN and unified AI theories according to claim 2, characterized in that, Step S101 includes the following sub-steps: Step S1011: First, generate the main identifier DSID-root by combining the dynamic salt value with the user's basic identity information using the SHA-256 hash algorithm. Then, according to the structural domain characteristics of the data space, obtain the data space identity identifier DSID using the path-based identifier representation method, where DSID = DSID-root / physical region / data type - data source number / time segment. Step S1012 introduces an ontology semantic mapping framework to generate a data subject identifier DSID-Item. In the ontology alignment stage, the LogMap ontology alignment algorithm is used to automatically identify semantic equivalence or inclusion relationships between different ontologies. In the semantic embedding stage, the OWL2Vec* ontology embedding method is used to embed the ontology, representing ontology classes and attributes as embedding points in a vector space. In the concept recognition stage, by integrating the BERT pre-trained language model and the CRF sequence labeling model, entity recognition and ontology mapping are performed on the original data labels or description fields, automatically labeling the semantic dimension information in the data space identifier DSID, and finally generating the data subject identifier DSID-Item. The semantic dimension information includes sensitivity level, data type, device label, and business domain attributes.

4. The data security method integrating MIN and unified AI theories according to claim 2, characterized in that, In step S103, the formula digest is used. event =SHA256(serialize(EventAttributes)||Salt), where EventAttributes is a collection of event metadata; Salt is a random salt value; the serialize() function converts the structured attributes of the event into a string according to the predefined field order and format specifications.

5. The data security method integrating MIN and unified AI theories according to any one of claims 1 to 4, characterized in that, Step S2 includes the following sub-steps: Step S201: Obtain data collection records and use the Time2Vec time series embedding algorithm to vectorize and encode the timestamps in the data collection records; each data collection record includes an event timestamp, collection device identifier, data type, collection frequency, geographic location code, and statistical feature fields of the collection value range; Step S202: Combine the tags recorded in the semantic index, model the data using a Bi-LSTM deep learning network, and use the DBSCAN clustering algorithm to aggregate the output of the Bi-LSTM deep learning network to obtain multiple collection pattern clusters. Step S203: A semantic relationship extraction method based on graph attention network is adopted to construct a heterogeneous information graph with the data subject identifier DSID-Item as the central node. In the process of constructing the heterogeneous information graph, an independent embedding matrix is ​​configured for each type of node based on graph attention network, the features of all adjacent nodes are weighted and aggregated, and the attention weight is adaptively learned through multi-head attention mechanism to form the semantic vector h_DSID of the collection behavior. Step S204: Read the semantic vector of the data subject identifier DSID-Item. Based on the collection mode in the pattern aggregation result, map the access subject and its corresponding role attributes, the data subject identifier DSID-Item of the target data, the allowed operation types and context restrictions to the access control structure. The mapped access control structure is recorded in the form of key-value pairs to construct a preliminary access control graph I-ACG. During the construction process, each access subject is treated as a node in the Access Control Graph (I-ACG), and the node type is labeled with the role attribute. Allowed access operations are represented as directed edges, which indicate a path from the main node to the center node. The attributes of a directed edge include the operation type and context restrictions.

6. The data security method integrating MIN and unified AI theories according to claim 5, characterized in that, The heterogeneous information graph in step S203 includes data attribute nodes, context nodes, and compliance label nodes. Each type of node is vectorized using an independent embedding encoding function. Data attributes include modality type, acquisition frequency, and data value range; context includes geographical location, time window, and device status; and compliance labels include sensitivity level, scope of use, and authorization level. In constructing the heterogeneous information graph, the process is first performed using formulas... Construct a set of relations in the form of triples ,in, and These are graph nodes. Define the edge relation type, and then, through the formula Generate heterogeneous information graphs ,in, For a set of nodes, Let be the set of edges. and These are the node type set and the edge type set, respectively; In step S204, after constructing the preliminary access control graph I-ACG, the access control entries in JSON-LD format are written into its namespace through the data registration interface provided by the multi-identifier network MIN, and after successful writing, a unique named URI and version identifier are returned through the multi-identifier network MIN.

7. The data security method integrating MIN and unified AI theories according to any one of claims 1 to 4, characterized in that, Step S3 includes the following sub-steps: Step S301: Extract the request parameters of the access request. The request parameters include the visitor's identity ID, the data subject identifier DSID-Item of the request target, the operation type, the request timestamp, and the calling environment context. Search for its permission path in the access control graph I-ACG until a valid permission path is found. Then, proceed to step S302 to enter the zero-knowledge authorization verification stage. Step S302, first use the formula Generating zero-knowledge proofs Then through the formula The authorization verification process is as follows: upon successful authorization verification, a structured access token (AccessToken) is generated and digitally signed using the Elliptic Curve Digital Signature Algorithm (ECDSA). Represents a zero-knowledge proof function; Represents the verification function for zero-knowledge proofs; This indicates the initialization of the published public verification parameters; Indicates a private verification item; Indicates publicly available verification items; Step S303: Identify the sensitivity level of the access request. When the sensitivity level is marked as medium-high level privacy data, trigger the privacy enhancement mechanism. The path of the privacy enhancement mechanism includes a homomorphic encryption path and a secure multi-party computation path.

8. The data security method integrating MIN and unified AI theories according to claim 7, characterized in that, In step S303, during the execution of the privacy enhancement mechanism, operation records, session environment information, and result summaries are automatically generated, and these information are submitted as audit evidence to the log system of the multi-identifier network MIN. The audit evidence is bound to the data space identity identifier DSID and the access session ID, respectively.

9. The data security method integrating MIN and unified AI theories according to any one of claims 1 to 4, characterized in that, Step S4 includes the following sub-steps: Step S401, first use the formula A unified input vector for constructing a data lifecycle assessment model And the XGBoost gradient boosting algorithm is introduced to unify the input vector. Perform training and prediction, and output lifecycle score. ,in, Indicates access frequency. Indicates the last access time. Indicates business dependency tags, Indicate the sensitivity level; then, determine the lifecycle score. Whether the number of evaluation periods is less than the lifecycle end threshold within the preset number of evaluation periods. If so, the data object is determined to have reached the end of its value within its life cycle and is marked as a candidate for failure. Finally, the failure determination criteria and process records for each data object are recorded to form a list of data that have reached the end of their life cycle. Step S402: Perform multi-level shredding operations in stages. In the logical deletion stage, cut off the external access channel by canceling the mapping path of data in the index structure. In the overwrite stage, repeatedly write data blocks using the DoD 5220.22-M multiple overwrite algorithm to eliminate data residue. In the low-level erasure stage, call the physical media control command ATA SecureErase to complete the low-level erasure. Step S403: First, record the evidence items of the destruction process to construct the destruction evidence chain. Generate a digest value of the Merkle tree structure for all evidence items using the SHA-256 hash algorithm, and sign it to form a destruction digest block. Then, submit the destruction digest block to the network MIN with at most identifiers, and bind the corresponding data space identity identifier DSID and access session ID to form an audit record that maps one-to-one with the original data call history. The evidence items of the destruction evidence chain include the unique identifier of the data item, the execution method, the signature of the responsible node, and the destruction timestamp. The unique identifier of the data item includes the data space identity identifier DSID and the data item segment identifier Segment-ID. Step S404: The chain of evidence to be destroyed is simultaneously distributed to the regulatory node or governance domain to which the data object belongs.

10. A data security system integrating MIN and unified AI theories, characterized in that, The data security method employing the fusion of MIN and unified AI theories as described in any one of claims 1 to 9, and includes: The trusted identifier binding and data structuring module first generates a data subject identifier DSID-Item based on the data space identity identifier DSID and ontology semantic mapping framework. Then, it binds the trusted acquisition channel identifier SCP-ID to the corresponding data subject identifier DSID-Item, thus completing the multi-dimensional identifier registration and synchronization of the data space in the multi-identifier network MIN. The full lifecycle governance initialization module obtains data collection records from the multi-identifier network MIN based on the data subject identifier DSID-Item and the trusted collection channel identifier SCP-ID. It obtains collection pattern clusters through clustering algorithms and constructs an access control graph by combining the semantic vector of the data subject identifier DSID-Item. The intelligent access and privacy protection module parses access requests and performs permission verification, identifies the sensitivity level of access requests, and triggers a privacy enhancement mechanism when the sensitivity level is marked as medium to high level privacy data. The lifecycle end and data deactivation processing module uses the data space identity identifier DSID registered in the multi-identifier network MIN as the retrieval anchor point, periodically schedules various data entries in the data space, and combines access behavior logs, timestamp records and context information to determine whether the data object has reached the end of its value within its lifecycle. If so, it performs verifiable multi-level destruction operations and uses the multi-identifier network MIN to complete the ownership confirmation, recording and cross-domain synchronization of the destruction process.

Images