Dynamic data storage method, system and equipment based on risk level and medium

Abstract

The invention discloses a dynamic data storage method, system and equipment based on risk levels and a medium, and belongs to the field of electric power systems.The method comprises the steps that feature extraction is conducted on to-be-stored data to obtain an initial feature set, semantic analysis and context association analysis are conducted on the to-be-stored data to obtain a risk feature set, and the risk feature set is stored; combining to obtain a target feature; performing risk assessment according to the target feature to obtain a risk level, and determining an encryption level according to the risk level and a preset encryption mapping table; according to the method and the device, the to-be-stored data is automatically routed to the target storage node matched with the encryption grade, and the corresponding encryption storage operation is executed on the target storage node to complete dynamic data storage, so that the optimal balance of safety and efficiency in data storage can be realized by implementing the method and the device.

Description

Technical Field

[0001] This invention relates to the field of data storage, and in particular to a dynamic data storage method, system, device, and medium based on risk level. Background Technology

[0002] With the deepening of enterprise digital transformation and the popularization of cloud computing technology, the amount of data carried by large-scale facilities such as data centers and intelligent computing centers is growing exponentially, and the data format has evolved from single structured data to multimodal data including text, images, and time-series information. Against this backdrop, secure data storage has become a core challenge in protecting enterprise operations and citizens' privacy.

[0003] Traditional data storage security solutions generally employ static, fixed protection strategies. This means they either apply a uniform encryption and protection mechanism to all data in the storage system without differentiation, or implement differentiated storage strategies based solely on limited, pre-defined data classification labels (such as "public," "internal," and "secret"). Specifically, existing solutions often rely on predefined static rules or simple pattern matching based on regular expressions for data classification. For example, the word "transfer" in a technical document and the "transfer" operation in a real bank transaction record should have drastically different risk levels, but static rules struggle to make this distinction. This inadequate data classification capability directly leads to security vulnerabilities in data storage: the inability to implement differentiated storage protection strategies based on the true risk level of the data. High-risk data may not receive sufficient security protection, while low-risk data may be overprotected, resulting in a waste of storage resources. Furthermore, due to the lack of accurate risk assessment, data storage systems struggle to achieve optimal allocation of storage resources and security costs, impacting overall storage efficiency and cost-effectiveness. Summary of the Invention

[0004] This invention provides a dynamic data storage method, system, device, and medium based on risk level, which can solve the serious mismatch between the security strength of data storage and the actual security requirements of data, thus resulting in both security vulnerabilities and resource waste.

[0005] This invention provides a dynamic data storage method based on risk level, comprising:

[0006] The system acquires data to be stored in real time, extracts features from the data to be stored to obtain an initial feature set, performs semantic analysis and contextual analysis on the data to be stored to obtain a risk feature set, and combines the initial feature set and the risk feature set to obtain the target feature.

[0007] A risk assessment is performed based on the target characteristics to obtain a risk level, and an encryption level is determined based on the risk level and a preset encryption mapping table.

[0008] For a hierarchical storage architecture based on attribute encryption, the data to be stored is automatically routed to a target storage node that matches the encryption level, and the corresponding encrypted storage operation is performed on the target storage node to complete dynamic data storage.

[0009] This invention acquires data to be stored in real time, performs semantic and contextual analysis, and achieves deep perception and comprehensive assessment of data risks through multimodal analysis. Based on the risk level, data is automatically routed to a matching target storage node, enabling on-demand allocation of security resources and avoiding over- or under-protection. Overall, it achieves dynamic, precise, and automated data storage security strategies. By analyzing data content in real time and dynamically binding risk levels with storage protection strength, it fundamentally solves the core problem of "disconnect between security strategies and actual data risks" in traditional static storage solutions, achieving an optimal balance between security and efficiency.

[0010] Furthermore, the step of performing semantic analysis and contextual association analysis on the data to be stored to obtain a risk feature set, wherein the risk feature set includes semantic risk features and contextual risk features, specifically:

[0011] The data to be stored is input into a language processing model, and the semantic risk features are obtained by performing semantic analysis on the risk text information and grammatical patterns of the data to be stored.

[0012] The relationship graph corresponding to different data sources in the data to be stored is determined, and the contextual risk features are obtained by performing graph computation on the relationship graph.

[0013] This approach utilizes language processing models to analyze risk text information and grammatical patterns, achieving a deep understanding of the text content. By performing graph computation on the relationship graph, potential risks arising from complex relationships between data can be identified. A complete multimodal risk perception system has been constructed, organically combining text semantics and relational analysis, significantly improving the system's ability to identify risks in complex data.

[0014] Furthermore, the step of conducting a risk assessment based on the target characteristics to obtain a risk level specifically involves:

[0015] Obtain the sequence of historical risk events associated with the data to be stored, wherein each historical risk event includes a historical risk value and a timestamp corresponding to the event;

[0016] The historical risk event sequence is input into a time series analysis model, which determines the historical risk weight of each historical risk event based on the time difference between the current time and the timestamp of each historical risk event. The historical risk weight and the corresponding historical risk value are weighted and fused to obtain historical risk characteristics.

[0017] The weight parameters corresponding to the semantic risk features, the contextual risk features, and the historical risk features are determined, and a weighted fusion is performed based on each weight parameter to obtain the target risk value. Based on the target risk value and a preset risk mapping table, the risk level is determined.

[0018] This approach, using a time-series analysis model to determine historical risk weights based on time differences, achieves natural attenuation of risk impact and focuses more on recent threats. Weighted fusion of four risk characteristics enhances the accuracy of risk assessment through multi-dimensional comprehensive evaluation. A three-dimensional risk assessment model (semantic, contextual, and historical) is established, incorporating a risk attenuation mechanism through time-series analysis. This makes risk assessment more aligned with real-world scenarios and avoids the "permanent" impact of historical risks.

[0019] Furthermore, the risk-level-based dynamic data storage method also includes:

[0020] The corresponding decision weights are calculated based on the decision indicators of the language processing model and the time series analysis model, wherein the decision indicators include historical accuracy, real-time energy consumption coefficient and energy consumption adjustment factor.

[0021] The outputs of the language processing model and the time series analysis model are adjusted according to the decision weights to obtain the semantic risk features and the historical risk features.

[0022] This method calculates model decision weights based on decision indicators, enabling the system to automatically favor models that are "accurate, fast, and energy-efficient." The model output is adjusted according to these decision weights, thus optimizing the quality of the final risk assessment results. Overall, this achieves a multi-model collaborative optimization mechanism, intelligently balancing computational resource consumption and improving overall system energy efficiency while ensuring analytical accuracy.

[0023] Furthermore, the determination of the weight parameters corresponding to the semantic risk feature, the contextual risk feature, and the historical risk feature specifically involves:

[0024] Obtain the initial weight parameters, initial learning rate, learning rate decay factor, and loss function, wherein the loss function is determined based on the number of misclassification events and is used to quantify the classification error corresponding to the weight parameters;

[0025] Calculate the gradient of the loss function with respect to the initial weight parameters, determine the parameter optimization direction based on the gradient, monitor the consistency of the parameter optimization direction, and when the parameter optimization direction is consistent for a preset number of consecutive times, increase the step size of the learning rate decay factor update to obtain the target learning rate.

[0026] The initial weight parameters are iteratively updated based on the gradient and the target learning rate. When the preset maximum number of iterations is reached or the gradient value is less than the threshold, the iteration stops and the weight parameters are obtained.

[0027] By monitoring the consistency of parameter optimization directions and increasing the step size, the problem of slow model convergence is solved, accelerating the learning process in a stable optimization direction. A loss function is constructed based on misclassified events to ensure that technical optimization directly serves security goals. Overall, the system is endowed with the ability to continuously self-optimize, constantly adjusting its risk assessment strategy through online learning, enabling the system to adapt to the ever-changing threat environment and become increasingly accurate with use.

[0028] Furthermore, the execution of the corresponding encrypted storage operation on the target storage node specifically includes:

[0029] Based on the risk level, a corresponding multi-dimensional attribute combination scheme is determined, and an access control policy is determined based on the multi-dimensional attribute combination scheme.

[0030] The data to be stored is encrypted using attribute-based encryption technology based on the access control policy to obtain encrypted ciphertext. A threshold secret sharing mechanism is used to decompose the key into multiple key fragments. The key is used to decrypt the encrypted ciphertext. Each key fragment is a fragment that has been successfully verified by a preset bilinear equivalence condition.

[0031] The encrypted ciphertext is stored to the target storage node, and each of the keys is fragmented and stored to a preset secure storage node to achieve encrypted storage and access control of the data to be stored.

[0032] This approach employs attribute-based encryption technology with access control policies to achieve dynamic, attribute-based access control. A threshold secret sharing mechanism is used to decompose keys, and distributed storage reduces the threat of single points of failure. A secure storage solution combining fine-grained access control and distributed key management is constructed, ensuring key security while enabling flexible access control and significantly enhancing the overall system security.

[0033] Furthermore, the access control is implemented by analyzing the behavioral characteristics of the accessing user, specifically as follows:

[0034] Obtain the current behavioral feature values ​​of the accessing user on multiple preset behavioral features, and determine the mean and standard deviation of historical operation features based on the baseline of the accessing user's behavioral features.

[0035] The current behavior feature value is compared with the mean of the historical operation features and the standard deviation of the historical operation features to obtain the feature deviation value, and the feature deviation duration is determined based on the duration during which the feature deviation value is greater than a preset threshold.

[0036] The historical data distribution of each preset behavioral feature is calculated using the entropy weight method to obtain the feature weight corresponding to each preset behavioral feature;

[0037] The feature deviation value and the feature deviation duration are linearly combined according to the preset fusion coefficient, and then weighted and summed in combination with the weights of each feature to obtain the abnormality of the accessing user's behavior.

[0038] When the abnormality of the behavior is greater than a preset threshold, a random salt value is generated and sent to the accessing user, and a response value calculated based on the random salt value and the double hidden parameters is received. Multi-factor verification of the accessing user is then performed based on the response value.

[0039] This method calculates feature weights using entropy weighting, achieving objective and dynamic weight allocation. Multi-factor authentication is triggered based on behavioral anomaly, automatically increasing authentication strength during high-risk access. Random salt values ​​and double-hidden parameters ensure the security of authentication interactions. A dynamic authentication mechanism based on user behavior analysis has been established, upgrading access control from static permission checks to dynamic risk response, effectively defending against credential theft and internal threats.

[0040] Another embodiment of the present invention provides a dynamic data storage system based on risk level, including: a feature processing module, a risk assessment module, and an encrypted storage module;

[0041] The feature processing module is used to acquire data to be stored in real time, extract features from the data to be stored to obtain an initial feature set, perform semantic analysis and contextual analysis on the data to be stored to obtain a risk feature set, and combine the initial feature set and the risk feature set to obtain the target feature.

[0042] The risk assessment module is used to perform risk assessment based on the target characteristics, obtain a risk level, and determine an encryption level based on the risk level and a preset encryption mapping table.

[0043] The encrypted storage module is used to automatically route the data to be stored to a target storage node that matches the encryption level for a hierarchical storage architecture based on attribute encryption, and to perform corresponding encrypted storage operations on the target storage node to complete dynamic data storage.

[0044] This invention acquires data to be stored in real time, performs semantic and contextual analysis, and achieves deep perception and comprehensive assessment of data risks through multimodal analysis. Based on the risk level, data is automatically routed to a matching target storage node, enabling on-demand allocation of security resources and avoiding over- or under-protection. Overall, it achieves dynamic, precise, and automated data storage security strategies. By analyzing data content in real time and dynamically binding risk levels with storage protection strength, it fundamentally solves the core problem of "disconnect between security strategies and actual data risks" in traditional static storage solutions, achieving an optimal balance between security and efficiency.

[0045] Another embodiment of the present invention provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the risk-level-based dynamic data storage method of the present invention.

[0046] Another embodiment of the present invention provides a computer-readable storage medium item, including: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to perform steps of the risk-level-based dynamic data storage method of the present invention. Attached Figure Description

[0047] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating a dynamic data storage method based on risk level provided in an embodiment of the present invention;

[0049] Figure 2 This is a schematic diagram of the structure of a dynamic data storage system based on risk level provided in an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of the structure of a data security management system provided in an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0053] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0054] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0055] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0056] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0057] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0058] See Figure 1 To address the severe mismatch between the security strength of data storage and the actual security requirements of data in existing technologies, resulting in both security vulnerabilities and resource waste, an embodiment of the present invention provides a dynamic data storage method based on risk levels, comprising:

[0059] Step S101: Acquire the data to be stored in real time, extract features from the data to be stored to obtain an initial feature set, perform semantic analysis and contextual analysis on the data to be stored to obtain a risk feature set, and combine the initial feature set and the risk feature set to obtain the target feature.

[0060] In this embodiment, a packet capture engine deployed at the network layer captures data packets in real time and uses a metadata parser to extract basic features from the data packets, such as protocol type, port number, data packet size, and timestamp information, to obtain an initial feature set. Multi-dimensional analysis of the data content is performed, including identifying sensitive information patterns through text content scanning and analyzing contextual risks by constructing a data association network to obtain a risk feature set. The initial feature set and the risk feature set are concatenated to obtain a comprehensive feature vector, i.e., the target feature.

[0061] Step S102: Perform a risk assessment based on the target characteristics to obtain a risk level, and determine the encryption level based on the risk level and a preset encryption mapping table.

[0062] In this embodiment, a machine learning classifier is used to assess the risk of feature vectors, mapping the risk assessment results to discrete risk levels (high / medium / low). A predefined encryption policy table then converts these risk levels into specific data protection levels. For example, high-risk data is protected using fully homomorphic encryption (FHE) or zero-knowledge proof (ZKP); medium-risk data is protected using a combination of attribute-based encryption (ABE) and access control lists (ACLs); and low-risk data is stored efficiently using lightweight encryption (such as AES-256).

[0063] Step S103: For the attribute-based encryption-based hierarchical storage architecture, the data to be stored is automatically routed to the target storage node that matches the encryption level, and the corresponding encryption storage operation is performed on the target storage node to complete the dynamic data storage.

[0064] In this embodiment, the storage system includes multiple storage nodes with different security levels. Each node supports different encryption strengths and protection mechanisms. The corresponding target storage node is selected according to the data protection level, and the corresponding level of encrypted storage operation is performed on the target node.

[0065] As an example of an embodiment of the present invention, the step of performing semantic analysis and contextual association analysis on the data to be stored to obtain a risk feature set, wherein the risk feature set includes semantic risk features and contextual risk features, specifically: inputting the data to be stored into a language processing model, performing semantic analysis on the risk text information and grammatical patterns of the data to be stored to obtain the semantic risk features; determining the relationship graph corresponding to different data sources in the data to be stored, and performing graph computation on the relationship graph to obtain the contextual risk features.

[0066] In this embodiment, during semantic analysis, the data to be stored is input into a pre-trained language processing model. Deep semantic analysis is performed on the risky textual information (including sensitive entities, keywords, and specific semantic patterns) and grammatical patterns (such as abnormal sentence structures and potential malicious code features) within the data content. This extracts risk features at the text level and outputs quantified semantic risk feature values. Sensitive entity identification can be, for example, extracting sensitive information such as ID card numbers and bank card numbers based on regular expressions or NLP models (such as Spacy). Grammatical pattern analysis can be, for example, detecting abnormal grammatical structures in the data (such as the characteristic patterns of SQL injection attacks).

[0067] During the context association analysis process, the relationships between different data sources (including users, devices, application systems, etc.) in the data to be stored are determined, a cross-data source relationship graph is constructed, and the topological risk value is calculated. The relationship graph is constructed using the Neo4j graph database to store the user-device-data relationship (such as the path of user A accessing data C on device B). The topological risk value can be calculated by quantifying the association risk weight of nodes using the PageRank algorithm (such as automatically marking data associated with high-risk users as high-risk). The node connectivity in the relationship graph is calculated, the context risk of the data in the overall environment is analyzed, and the quantified context risk feature value is output.

[0068] In this embodiment, the image content data in the data to be stored can also be determined, the image content data can be input into the image recognition model, and the image risk features can be obtained by performing image analysis on the risk visual information in the image content data.

[0069] During image analysis, the image content data (including image files, video frames, etc.) included in the data to be stored is determined. The image content data is then input into a deep learning image recognition model (such as YOLO or ResNet models based on CNN). By intelligently recognizing and analyzing the risk visual information (including sensitive objects, text content, and specific scenes, etc.) in the image content, the risk features at the visual level are extracted, and quantified image risk feature values ​​are output.

[0070] As an example of an embodiment of the present invention, the step of risk assessment based on the target feature to obtain a risk level specifically involves: acquiring a sequence of historical risk events associated with the data to be stored, wherein each historical risk event includes a historical risk value and a timestamp corresponding to the event; inputting the sequence of historical risk events into a time series analysis model, thereby determining the historical risk weight corresponding to each historical risk event based on the time difference between the current time and the timestamp of each historical risk event; performing weighted fusion of each historical risk weight and the corresponding historical risk value to obtain historical risk features; determining the weight parameters corresponding to the semantic risk features, the contextual risk features, and the historical risk features, and performing weighted fusion based on each weight parameter to obtain a target risk value; and determining the risk level based on the target risk value and a preset risk mapping table.

[0071] In this embodiment, a sequence of historical risk events associated with the currently stored data is obtained, where each historical risk event contains a historical risk value (ranging from 0 to 1) and precise timestamp information. The historical risk event sequence is obtained by querying a risk event database, with filtering criteria including characteristics such as the same data source, similar data types, or the same user. The historical risk event sequence is input into a time series analysis model (such as a time series model based on LSTM or Transformer), and the historical risk characteristics are calculated through the following steps: calculating the time difference between the current time and the timestamps of each historical risk event; calculating the time difference and decay coefficient based on the exponential decay function to obtain the weight of each historical risk event; and then performing weighted fusion and normalization to obtain the historical risk characteristics. The formula for calculating the target risk value is as follows:

[0072]

[0073] Among them, R s The semantic risk feature has a value range of [0,1], Rc To define the context-dependent risk characteristics, a historical risk attenuation factor is used. Adjusting for the impact of timeliness; R h The sequence represents the historical risk events, where Δt is the time difference between data generation (in hours). The dynamic weight parameters satisfy α+β+δ=1 and are updated hourly through online learning. γ is the time decay coefficient, with a default value of 0.05 / h, which controls the rate at which historical risks decay over time. The larger the value, the faster the risk decreases over time; the smaller the value, the more persistent the impact of historical risks.

[0074] As an example of an embodiment of the present invention, the dynamic data storage method based on risk level further includes: calculating corresponding decision weights according to the decision indicators of the language processing model and the time series analysis model, wherein the decision indicators include historical accuracy, real-time energy consumption coefficient and energy consumption adjustment factor; adjusting the outputs of the language processing model and the time series analysis model according to each of the decision weights to obtain the semantic risk features and the historical risk features.

[0075] In this embodiment, a parallel natural language processing model (for semantic analysis of text data) and a time series analysis model (based on LSTM or Transformer models to analyze the time series features of data streams) are constructed. An image recognition model (using convolutional neural networks (CNNs) such as YOLO or ResNet for image content recognition) can also be included. Decision weights are calculated based on the historical accuracy and real-time energy consumption of each model, resulting in an exponential enhancement of the high-precision, low-energy-consumption model. The formula for calculating the decision weights is as follows: in, Let be the decision weights of model i in the t-th iteration. E represents the accuracy of model i in period t-1. i Let η be the real-time inference energy consumption coefficient of model i, η be the energy consumption adjustment factor (preset value 0.3±0.05), and n be the total number of models. The outputs of the language processing model, image recognition model, and time series analysis model are dynamically adjusted based on the calculated decision weights to obtain the semantic risk features, the historical risk features, and the image risk features.

[0076] As an example of an embodiment of the present invention, determining the weight parameters corresponding to the semantic risk feature, the contextual risk feature, and the historical risk feature specifically involves: obtaining initial weight parameters, an initial learning rate, a learning rate decay factor, and a loss function, wherein the loss function is determined based on the number of misclassified events and is used to quantify the classification error corresponding to the weight parameters; calculating the gradient of the loss function relative to the initial weight parameters, determining the parameter optimization direction based on the gradient, monitoring the consistency of the parameter optimization direction, and increasing the step size of the learning rate decay factor update when the parameter optimization direction is consistent for a consecutive preset number of times to obtain the target learning rate; iteratively updating the initial weight parameters based on the gradient and the target learning rate, and stopping the iteration and obtaining each of the weight parameters when the preset maximum number of iterations is reached or the gradient value is less than a threshold.

[0077] In this embodiment, a system is constructed that includes the number of misclassified events N. f Loss function L; calculate the gradient of the weight parameters Introducing a learning rate decay factor The parameter update formula is: Where ε is the learning rate adjustment coefficient with an initial value of 0.05, and the step size increases by 40% ± 10% when the gradient directions are consistent for three consecutive times.

[0078] As an example of an embodiment of the present invention, the step of performing the corresponding encrypted storage operation on the target storage node specifically includes: determining a corresponding multi-dimensional attribute combination scheme based on the risk level, and determining an access control policy based on the multi-dimensional attribute combination scheme; using attribute-based encryption technology, encrypting the data to be stored based on the access control policy to obtain encrypted ciphertext, and using a threshold secret sharing mechanism to decompose the key into multiple key fragments, wherein the key is used to decrypt the encrypted ciphertext, and each key fragment is a fragment that has been successfully verified by a preset bilinear equivalence condition; storing the encrypted ciphertext to the target storage node, and storing each key fragment to a preset secure storage node to achieve encrypted storage and access control of the data to be stored.

[0079] In this embodiment, based on the risk level determined by the risk assessment module, a corresponding multi-dimensional attribute (such as time, location, and position) combination scheme is generated: For high-risk data: a multi-dimensional attribute combination including department permissions, job level, time range, device authentication, and geographical location is constructed; For medium-risk data: an attribute combination including department permissions, access time, and device type is constructed; For low-risk data: basic department or role attributes are constructed, and based on the multi-dimensional attribute combination scheme, a formalized access control policy is generated, such as: "(Department: Finance Department AND Position: Manager) OR (Security Level ≥ 5)".

[0080] The data to be stored is encrypted using Attribute-Based Encryption (ABE) technology based on the generated access control policy. Specifically, the CP-ABE (Ciphertext-Based Attribute Encryption) scheme is used to embed the access control policy into the encryption process to generate encrypted ciphertext that can only be decrypted by access users who meet the policy.

[0081] A threshold secret sharing mechanism is used to securely protect the data encryption key. Specifically, the original key S is decomposed into t-of-n threshold fragments; the fragment generation formula is: Among them, V j For the j-th node, x m For threshold node identification, g is the elliptic curve base point, S is the master key, and r is the threshold node identifier. m The coefficients are random polynomials. At least K shards participate in the reconstruction during the verification phase, where K is greater than 2; each shard includes a hash binding based on node identity to ensure the shard's origin is verifiable; shard verification requires that a preset bilinear equivalence condition be met, the condition being... Where Y is the public key, H is the hash function, and e is the bilinear pairing operation.

[0082] The encrypted ciphertext is stored to the target storage node, and the verified key fragments are distributed and stored to different preset secure storage nodes, thus achieving physical separation of ciphertext and key fragments.

[0083] As an example of an embodiment of the present invention, the access control is implemented by analyzing the behavioral characteristics of the accessing user, specifically as follows: obtaining the current behavioral characteristic value of the accessing user on multiple preset behavioral characteristics; determining the historical operation characteristic mean and historical operation characteristic standard deviation based on the behavioral characteristic baseline of the accessing user; comparing the current behavioral characteristic value with the historical operation characteristic mean and the historical operation characteristic standard deviation respectively to obtain a feature deviation value, and determining the feature deviation duration based on the duration for which the feature deviation value is greater than a preset threshold; calculating the historical data distribution of each preset behavioral characteristic using the entropy weight method to obtain the feature weight corresponding to each preset behavioral characteristic; linearly combining the feature deviation value and the feature deviation duration according to a preset fusion coefficient, and performing a weighted summation based on each feature weight to obtain the behavioral anomaly degree of the accessing user; when the behavioral anomaly degree is greater than a preset confidence threshold, generating a random salt value and sending it to the accessing user, and receiving a response value calculated based on the random salt value and double hidden parameters, and performing multi-factor verification of the accessing user based on the response value.

[0084] In this embodiment, a set of key behavioral characteristics are defined for monitoring user access behavior. These characteristics may include: API call frequency (number of API requests per unit time), data access volume (number of data records or bytes accessed per unit time), access time period (time periods when the user is active, such as working hours or non-working hours), data type preference (ratio of accessing sensitive data to non-sensitive data), and access source (IP address, device identifier, etc.). User access logs are captured in real time by a data acquisition module, and the current behavioral characteristic values ​​of the above characteristics are extracted. Historical operation data of users over a period of time (e.g., 30 days) is collected, and the historical mean and standard deviation of each characteristic are calculated using sliding window statistics (window size set to 1 hour). Baseline update: The behavioral baseline modeling unit updates the historical mean and standard deviation periodically (e.g., hourly) to adapt to changes in user behavior. Statistical analysis of user historical operation characteristics is performed, recording users' historical access frequency, time periods, and data type preferences to establish a baseline of user behavior characteristics. The mean and standard deviation of historical operation characteristics are obtained. A comprehensive index of the current behavior's deviation from the baseline is calculated to obtain the characteristic deviation duration. Specifically, for each characteristic, when the characteristic deviation value first exceeds a threshold, a timer is started to record the duration Ti (in seconds). If the deviation value continues to exceed the threshold, Ti accumulates; otherwise, it is reset to 0. A time-sensitive factor λ (default value 0.1 / s) is introduced to adjust the contribution of duration to the anomaly score; the larger the λ value, the more significant the impact of duration. The behavior anomaly score is calculated using the following formula: Among them, f i μ represents the current behavioral characteristic value (such as API call frequency, data access volume, etc.). i τ is the historical operating characteristic mean. i T represents the standard deviation of historical operational characteristics (sliding window statistics, window size 1h). d λ is the duration of the characteristic deviation (in seconds), λ is the time sensitivity factor (default 0.1 / s, controlling the cumulative effect over time), and ω is the time sensitivity factor. i The feature weights are calculated dynamically using the entropy weighting method. When the abnormality of the behavior exceeds the confidence threshold, a multi-factor authentication process is triggered. This multi-factor authentication process specifically includes: introducing random salt binding during the challenge generation phase, where the server sends a random salt value s, and the user must prove that they possess s⊕the private key; constructing the response using double hidden parameters, where the user returns H(s⊕the private key), and the server verifies the hash value; and designing an interactive verification process resistant to man-in-the-middle attacks, establishing an encrypted channel through the TLS 1.3 protocol.

[0085] It should be noted that in this embodiment, the multi-factor authentication process can be an existing zero-knowledge proof protocol, which, combined with the design of the multi-factor authentication process described above, improves authentication efficiency and reliability.

[0086] As an example of an embodiment of the present invention, a data security management method based on the above data storage method is provided, including a data acquisition step, a dynamic classification step, a secure storage step, an access control step, and a collaborative optimization step.

[0087] The data acquisition steps include:

[0088] Use a dedicated packet capture engine to capture network traffic in real time;

[0089] The metadata parser extracts the structured features of data packets (such as protocol type, port number, and content digest) to generate a standardized data stream.

[0090] The dynamic classification steps include:

[0091] Semantic analysis: Utilizes a semantic analysis engine to parse sensitive entities and syntactic patterns (such as regular expression matching and NLP entity recognition) in data content;

[0092] Contextual Association: Construct a cross-data source association graph through the contextual association engine and calculate the topological risk value;

[0093] Risk assessment: The dynamic weighted results of semantic risk, contextual risk and historical risk are integrated to output the risk level (e.g., high / medium / low risk);

[0094] Online learning optimization: dynamically adjust classification weight parameters based on loss functions (such as mean squared error or cross-entropy loss) and gradient update algorithms;

[0095] The secure storage steps include:

[0096] Based on the risk level output from the dynamic classification process, it is automatically mapped to the corresponding encryption protection level:

[0097] High-risk data: Employ fully homomorphic encryption (FHE) or zero-knowledge proof (ZKP) technologies;

[0098] Medium-risk data: Implement a protection mechanism combining attribute-based encryption (ABE) and access control lists (ACLs);

[0099] Low-risk data: Use lightweight encryption (such as AES-256) for efficient storage;

[0100] The access control steps include:

[0101] Define dynamic policy rules (such as access thresholds based on risk levels) through smart contracts;

[0102] Verify the trusted digital identity (DID) and verifiable credentials (VC) of a user or device, and bind permission levels;

[0103] When abnormal access behavior is detected, an on-chain policy update is triggered (such as freezing permissions or blocking access paths);

[0104] The audit trail steps include:

[0105] A hash chain storage method is used, where each log entry is associated with the preceding log entry via a SHA-256 hash.

[0106] Bind the operation time using a trusted timestamp service;

[0107] Records all data operation events from collection, classification, storage to access, and supports cryptographic binding verification;

[0108] The collaborative optimization steps include:

[0109] The dynamic classification results drive the encryption strategy of the secure storage module and the permission rules of the access control module;

[0110] The audit trail module logs are fed back to the dynamic classification module in real time for model retraining and strategy adjustment.

[0111] like Figure 2 As shown, based on the above method embodiments, corresponding system embodiments are provided; one embodiment of the present invention provides a dynamic data storage system 200 based on risk level, including: a feature processing module 201, a risk assessment module 202, and an encrypted storage module 203;

[0112] The feature processing module 201 is used to acquire data to be stored in real time, extract features from the data to be stored to obtain an initial feature set, perform semantic analysis and contextual association analysis on the data to be stored to obtain a risk feature set, and combine the initial feature set and the risk feature set to obtain the target feature.

[0113] The risk assessment module 202 is used to perform risk assessment based on the target characteristics, obtain a risk level, and determine an encryption level based on the risk level and a preset encryption mapping table.

[0114] The encrypted storage module 203 is used to automatically route the data to be stored to a target storage node that matches the encryption level for a hierarchical storage architecture based on attribute encryption, and to perform corresponding encrypted storage operations on the target storage node to complete dynamic data storage.

[0115] like Figure 3 As shown, one embodiment of the present invention provides a data security management system, including:

[0116] The data acquisition module is configured with a packet capture engine and a metadata parser to capture network traffic in real time and extract structured features.

[0117] The dynamic classification module integrates a multi-level classification engine and uses an online learning mechanism to dynamically adjust the classification strategy. The multi-level classification engine includes a semantic analysis engine, a context association engine, and a risk assessment engine.

[0118] The secure storage module constructs a hierarchical storage architecture based on attribute encryption, and automatically maps classified data to storage protection levels;

[0119] The access control module is configured with a blockchain-enhanced fine-grained permission management mechanism, supporting dynamic policy adjustments and real-time risk response.

[0120] The audit trail module is configured with an operation log chain that has cryptographic binding characteristics to ensure the verifiability of data throughout its entire lifecycle.

[0121] The system achieves end-to-end secure management of network data streams from classification to storage through the coordinated operation of a multi-level classification engine, a secure storage module, an access control module, and an audit trail module.

[0122] In this embodiment, the secure storage module is equipped with an attribute encryption scheme, which includes:

[0123] Composite strategy builder, supporting logical combinations of multi-dimensional attributes (such as time, location, etc.);

[0124] The dynamic key generator uses a threshold secret sharing mechanism to decompose the master key;

[0125] The fragmentation verification unit verifies the legality of key fragmentation through bilinear pairing operations;

[0126] The storage routing controller automatically selects storage nodes with matching encryption strength based on the data classification level.

[0127] The access control module includes:

[0128] The behavioral baseline modeling unit statistically analyzes the user's historical operation characteristics, records the user's historical access frequency, time period, and data type preference, establishes the user behavior characteristic baseline, and obtains the mean and standard deviation of historical operation characteristics.

[0129] The real-time anomaly detector calculates a comprehensive index of the current behavior's deviation from the baseline, obtains the duration of the feature deviation, and calculates the degree of behavior anomaly.

[0130] The dynamic policy executor triggers a multi-factor authentication process when the abnormality of the behavior exceeds the confidence threshold.

[0131] The audit trail module includes:

[0132] The log entry generator generates data blocks by performing an XOR operation between the operation data and the precise timestamp. Specifically, it performs an XOR operation between the hash value of the log data and the binary representation of the timestamp to generate a unique data block.

[0133] The chained binding unit uses elliptic curve cryptography to double-sign consecutive log blocks. The double signature (using the ECDSA algorithm, signed by the audit node and the operating user respectively, to ensure that the log is tamper-proof)

[0134] Integrity verifiers ensure the log chain is immutable through signature verification.

[0135] The fast retrieval interface supports log location and query based on the Merkle tree structure (leaf nodes are log hash values, parent nodes are the concatenation of child node hashes, and the root node is stored in the blockchain).

[0136] The dynamic classification module includes:

[0137] Model group units are used to build parallel natural language processing models, image recognition models, and time series analysis models;

[0138] The dynamic weight allocator calculates decision weights based on the historical accuracy and real-time energy consumption of each model, resulting in an exponential enhancement of the high-precision, low-energy-consumption model.

[0139] It is understood that the above system item embodiments correspond to the method item embodiments of the present invention, and can implement the dynamic data storage method based on risk level provided by any of the above method item embodiments of the present invention.

[0140] It should be noted that the system embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0141] For ease of description and brevity, the system embodiments of the present invention include all the implementation methods described in the above-described embodiments of the dynamic data storage method based on risk level, and will not be repeated here.

[0142] Based on the above embodiments of the risk-level-based dynamic data storage method, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the risk-level-based dynamic data storage method of any embodiment of the present invention.

[0143] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0144] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0145] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0146] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the risk-level-based dynamic data storage method described in any of the above-described method embodiments of the present invention.

[0147] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0148] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A dynamic data storage method based on risk level, characterized in that, include: The system acquires data to be stored in real time, extracts features from the data to be stored to obtain an initial feature set, performs semantic analysis and contextual analysis on the data to be stored to obtain a risk feature set, and combines the initial feature set and the risk feature set to obtain the target feature. A risk assessment is performed based on the target characteristics to obtain a risk level, and an encryption level is determined based on the risk level and a preset encryption mapping table. For a hierarchical storage architecture based on attribute encryption, the data to be stored is automatically routed to a target storage node that matches the encryption level, and the corresponding encrypted storage operation is performed on the target storage node to complete dynamic data storage.

2. The dynamic data storage method based on risk level as described in claim 1, characterized in that, The risk feature set is obtained by performing semantic analysis and contextual association analysis on the data to be stored, wherein the risk feature set includes semantic risk features and contextual risk features, specifically: The data to be stored is input into a language processing model, and the semantic risk features are obtained by performing semantic analysis on the risk text information and grammatical patterns of the data to be stored. The relationship graph corresponding to different data sources in the data to be stored is determined, and the contextual risk features are obtained by performing graph computation on the relationship graph.

3. The dynamic data storage method based on risk level as described in claim 2, characterized in that, The risk assessment based on the target characteristics to obtain the risk level is specifically as follows: Obtain the sequence of historical risk events associated with the data to be stored, wherein each historical risk event includes a historical risk value and a timestamp corresponding to the event; The historical risk event sequence is input into a time series analysis model, which determines the historical risk weight of each historical risk event based on the time difference between the current time and the timestamp of each historical risk event. The historical risk weight and the corresponding historical risk value are weighted and fused to obtain historical risk characteristics. The weight parameters corresponding to the semantic risk features, the contextual risk features, and the historical risk features are determined, and a weighted fusion is performed based on each weight parameter to obtain the target risk value. Based on the target risk value and a preset risk mapping table, the risk level is determined.

4. The dynamic data storage method based on risk level as described in claim 3, characterized in that, The risk-level-based dynamic data storage method further includes: The corresponding decision weights are calculated based on the decision indicators of the language processing model and the time series analysis model, wherein the decision indicators include historical accuracy, real-time energy consumption coefficient and energy consumption adjustment factor. The outputs of the language processing model and the time series analysis model are adjusted according to the decision weights to obtain the semantic risk features and the historical risk features.

5. The dynamic data storage method based on risk level as described in claim 3 or 4, characterized in that, The determination of the weight parameters corresponding to the semantic risk feature, the contextual risk feature, and the historical risk feature is specifically as follows: Obtain the initial weight parameters, initial learning rate, learning rate decay factor, and loss function, wherein the loss function is determined based on the number of misclassification events and is used to quantify the classification error corresponding to the weight parameters; Calculate the gradient of the loss function with respect to the initial weight parameters, determine the parameter optimization direction based on the gradient, monitor the consistency of the parameter optimization direction, and when the parameter optimization direction is consistent for a preset number of consecutive times, increase the step size of the learning rate decay factor update to obtain the target learning rate. The initial weight parameters are iteratively updated based on the gradient and the target learning rate. When the preset maximum number of iterations is reached or the gradient value is less than the threshold, the iteration stops and the weight parameters are obtained.

6. The dynamic data storage method based on risk level as described in claim 1, characterized in that, The specific steps for performing the corresponding encrypted storage operation on the target storage node are as follows: Based on the risk level, a corresponding multi-dimensional attribute combination scheme is determined, and an access control policy is determined based on the multi-dimensional attribute combination scheme. The data to be stored is encrypted using attribute-based encryption technology based on the access control policy to obtain encrypted ciphertext. A threshold secret sharing mechanism is used to decompose the key into multiple key fragments. The key is used to decrypt the encrypted ciphertext. Each key fragment is a fragment that has been successfully verified by a preset bilinear equivalence condition. The encrypted ciphertext is stored to the target storage node, and each of the key fragments is stored to a preset secure storage node to achieve encrypted storage and access control of the data to be stored.

7. The dynamic data storage method based on risk level as described in claim 6, characterized in that, The access control is implemented by analyzing the behavioral characteristics of the accessing users, specifically: Obtain the current behavioral feature values ​​of the accessing user on multiple preset behavioral features, and determine the mean and standard deviation of historical operation features based on the baseline of the accessing user's behavioral features. The current behavior feature value is compared with the mean of the historical operation features and the standard deviation of the historical operation features to obtain the feature deviation value, and the feature deviation duration is determined based on the duration during which the feature deviation value is greater than a preset threshold. The historical data distribution of each preset behavioral feature is calculated using the entropy weight method to obtain the feature weight corresponding to each preset behavioral feature; The feature deviation value and the feature deviation duration are linearly combined according to the preset fusion coefficient, and then weighted and summed in combination with the weights of each feature to obtain the abnormality of the accessing user's behavior. When the abnormality of the behavior is greater than a preset threshold, a random salt value is generated and sent to the accessing user, and a response value calculated based on the random salt value and the double hidden parameters is received. Multi-factor verification of the accessing user is then performed based on the response value.

8. A dynamic data storage system based on risk level, characterized in that, include: Feature processing module, risk assessment module, and encrypted storage module; The feature processing module is used to acquire data to be stored in real time, extract features from the data to be stored to obtain an initial feature set, perform semantic analysis and contextual analysis on the data to be stored to obtain a risk feature set, and combine the initial feature set and the risk feature set to obtain the target feature. The risk assessment module is used to perform risk assessment based on the target characteristics, obtain a risk level, and determine an encryption level based on the risk level and a preset encryption mapping table. The encrypted storage module is used to automatically route the data to be stored to a target storage node that matches the encryption level for a hierarchical storage architecture based on attribute encryption, and to perform corresponding encrypted storage operations on the target storage node to complete dynamic data storage.

9. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the risk-level-based dynamic data storage method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the risk-level-based dynamic data storage method as described in any one of claims 1-7.

Images