A multi-modal data security sharing method based on information security

Abstract

This invention discloses a multimodal data security sharing method based on information security. Addressing the problems raised in previous technologies, such as data becoming ineffective when it leaves a controlled domain, and the inability of subsequent dynamic control attempts to be implemented due to the lack of a trusted, data-co-existing execution endpoint, and the inability of security policies to learn and adjust based on real-time feedback during data usage, this invention proposes the following solution: policy-driven multimodal data preprocessing and labeling. For the raw multimodal data to be shared, a sensitive information identification model corresponding to the modality is invoked for analysis. This invention solves the industry problem of data loss of control after leaving the domain, promotes real-time collaboration and evolution of security capabilities, drives the continuous evolution of policies and identification models, and constructs a unified framework and modality-adaptive cross-modal data security management solution. It transforms complex security operation and maintenance problems into simple policy definition problems, significantly reducing the technical threshold and operational costs of secure sharing.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a multimodal data security sharing method based on information security. Background Technology

[0002] The security of a data processing system is defined by the technologies and management practices employed to protect computer hardware, software, and data from accidental or malicious damage, alteration, and disclosure. Therefore, computer network security can be understood as ensuring the normal operation of the network system through various technical and management measures, thereby guaranteeing the availability, integrity, and confidentiality of network data. Data security primarily focuses on protecting the data itself, ensuring its integrity, confidentiality, and availability during storage, processing, and transmission. Its core objective is to prevent data theft, tampering, or loss, for example, through encryption technologies, data backup, and disaster recovery measures.

[0003] With the rapid development of big data and artificial intelligence technologies, the sharing and collaboration of multimodal data (such as images, text, audio, video, and combinations thereof) has become a key requirement in many fields (such as smart healthcare, fintech, and intelligent security). The deep-seated contradiction in existing data security sharing solutions lies in the inherent conflict between "data flow and fixed security policies." Data needs to flow across domains, systems, and users to realize its value, but security policies rely on fixed boundaries (such as firewalls), fixed servers, or fixed client environments. This centralized and boundary-based security architecture leads to: 1. Disconnect between strategy and data lifecycle: The strategy becomes ineffective when the data leaves the controlled domain. The data becomes a "runaway horse", and any subsequent dynamic control attempts cannot be realized due to the lack of a reliable execution endpoint that coexists with the data. 2. Isolation and rigidity of security capabilities: Security capabilities such as content recognition, access control, behavior monitoring, and source tracing auditing belong to different systems, and security policies cannot learn and adjust based on real-time feedback during data usage.

[0004] Therefore, the fundamental purpose of this invention is to transform this architecture by proposing a method that transforms security policies into executable code and encapsulates them in an integrated manner with the data itself, forming a new type of data object with inherent security capabilities and evolutionary potential. Summary of the Invention

[0005] This invention provides a multimodal data security sharing method based on information security, which solves the problem that the multimodal data sharing strategy in the prior art becomes invalid when the data leaves the controlled domain, and any subsequent dynamic control attempts cannot be realized due to the lack of a trusted execution endpoint that coexists with the data, and the security strategy cannot learn and adjust based on real-time feedback during the data usage process.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A method for secure sharing of multimodal data based on information security includes the following steps; Step S1, Strategy-driven multimodal data preprocessing and tagging: For the shared multimodal raw data, the sensitive information identification model corresponding to the modality is called for analysis, and a structured security tag set containing data sensitivity attributes is generated based on the analysis results and predefined rules. Step S2: Compilation of dynamic executable security policy: Receive dynamic security policy rules defined by the sender, which contain conditional logic based on content, environment, and behavior; merge and logically parse the dynamic security policy rules with the structured security tag set, and compile them to generate a lightweight, independently runnable policy execution agent program, wherein the structured security tag set is encoded as metadata that can be queried within the agent program; Step S3, Construction of the intrinsically secure data object: Encryption is performed on the original multimodal data, and the encrypted data, the policy execution agent, and the necessary decryption logic are encapsulated into a self-contained secure shared package; wherein, the policy execution agent is configured to be automatically activated when the secure shared package is accessed, becoming the only trusted entry point for data decryption and use; Step S4, Accompanying Policy Execution and Closed-Loop Information Collection: In the receiver environment, the policy execution agent program, during runtime, dynamically controls and makes decisions on data access, operation, and output behavior based on its internally encoded metadata and dynamic logic; at the same time, it continuously collects fine-grained operation context logs. Step S5, Leakage Source Tracing and Policy Adaptive Evolution: Based on the identification information extracted from the leaked data or the operation context log, locate the security event; and feed the event data and the corresponding operation log back to the sending system to drive iterative optimization of the sensitive information identification model and the generation logic of the dynamic security policy rules.

[0007] Preferably, the strategy execution agent is encapsulated using sandboxing technology, and its internal integration includes: A strategy rule interpretation and execution engine; A lightweight environmental perception and behavior monitoring module; A secure key management unit bound to the encrypted data within the secure shared packet; A dynamic digital watermark embedding module for data output; The agent is further configured to have a higher startup priority than any data access request from the receiving environment and to run as a protected process to resist external debugging and tampering.

[0008] Preferably, the "compile and generate" process in step S2 includes: Flattening of strategy logic: converting nested conditional statements into decision trees or state machines that can be efficiently executed by the agent program; Tag inlining: Key attributes (such as data ID and sensitivity level) in the structured security tag set are directly compiled into the code or configuration area of ​​the agent program as constants, reducing runtime query overhead and enhancing tamper resistance; Dependency minimization: Analyze the runtime libraries required for dynamic policy rules and include only the minimum necessary dependency packages in the agent to control its size.

[0009] Preferably, the operation context log includes the following elements: operation time, operation user ID, operation type, target data ID, access environment characteristics, policy decision result, and dynamic rule ID that triggered the decision.

[0010] Preferably, the "iterative optimization" in step S5 specifically includes: Feedback data packet construction: Combine and package the operation context logs related to a single shared event, the triggered dynamic policy rule records, and the leakage tracing results (if applicable) to form a policy effect evaluation sample; Dual-path optimization: Path 1 (Content Recognition Optimization): Use data segments marked as "false positives" or "false negatives" in the samples to incrementally train the corresponding sensitive information recognition model; Path Two (Strategy Logic Optimization): Utilizing the cases revealed in the samples where "overly strict policies hinder normal operations" or "overly lenient policies lead to risky operations," reinforcement learning algorithms are used to optimize the condition thresholds or actions in the dynamic security policy rules.

[0011] Preferably, the multimodal data includes images, text, audio, and video, and the sensitive information recognition model includes a face and object recognition model for images, a keyword and entity recognition model for text, and a voiceprint and speech content recognition model for audio.

[0012] Preferably, the initial security label includes attribute information such as data sensitivity level, allowed operation set, validity period, and allowed sharing environment requirements.

[0013] Preferably, the environment-based dynamic policy includes dynamic policy rules comprising environment-based dynamic policies, behavior-based dynamic policies, and content-based dynamic policies. The environment-based dynamic policy is used to control data decryption or operation permissions based on the receiver's device environment status; the behavior-based dynamic policy is used to dynamically adjust the receiver's subsequent permissions based on the receiver's data operation behavior; and the content-based dynamic policy is used to trigger predefined protection actions when an attempt to operate on specific sensitive content is detected.

[0014] Preferably, the selective encryption involves encrypting data blocks of different security levels using encryption algorithms of different strengths based on the differences in data sensitivity levels in the initial security label.

[0015] The beneficial effects of this invention are as follows: 1. It realizes the "digitalization" of security policies: security policies are no longer an external, static instruction manual, but are transformed into "digital genes" that coexist and perish with data. This makes data come with its own protective shield and monitors everywhere, completely solving the industry problem of data going out of control after leaving the domain. 2. It facilitates the "real-time collaboration and evolution" of security capabilities: Because capabilities such as content recognition, dynamic control, behavior auditing, and watermark tracing are integrated into the same lightweight agent and share a unified context, they can make nanosecond-level collaborative responses to a single operation. More importantly, the data generated in all links can provide closed-loop feedback, driving the strategy and recognition model to continuously evolve like a biological immune system, which is something that separate system combinations cannot achieve. 3. For different modal data such as images, text, audio, and video, it provides standardized interfaces for sensitive information identification and security tag generation, and centrally manages them through a unified policy description file. This simplifies the difficulty for enterprises or institutions to carry out integrated security governance of complex multimodal data assets, and builds a unified framework and modality-adaptive cross-modal data security management solution. 4. Greatly simplifies the complexity of security governance: For the data sender, only the "definition intent" (policy) needs to be focused on, without worrying about the specific configuration of the receiver's environment. The system automatically compiles its intent into a "data bodyguard" that can be executed in any environment, transforming complex security operation and maintenance issues into simple policy definition issues, which greatly reduces the technical threshold and operating costs of secure sharing.

[0016] In summary, this invention solves the industry problem of data going out of control after being taken off-site, promotes real-time collaboration and evolution of security capabilities, drives the continuous evolution of strategies and identification models, and constructs a unified framework and modality-adaptive cross-modal data security management solution. It transforms complex security operation and maintenance problems into simple policy definition problems, and significantly reduces the technical threshold and operating costs of security sharing. Attached Figure Description

[0017] Figure 1 This is an overall flowchart of a multimodal data security sharing method based on information security proposed in this invention. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] Example 1, referring to Figure 1 A method for secure multimodal data sharing based on information security includes the following steps: Step S1: Policy-driven multimodal data preprocessing and labeling: The sender prepares a multimodal dataset to be shared, and the system uses a dedicated sensitive information identification model to automatically analyze each type of data: Images: CT images are scanned using pre-trained face recognition and object detection models (such as YOLO, SSD) to identify whether they contain face regions or specific sensitive areas; Text: Use Natural Language Processing (NLP) tools for keyword matching and Named Entity Recognition (NER) to extract sensitive words from the text; Audio: Audio content is transcribed using an ASR (Automatic Speech Recognition) model, and speaker identity is analyzed using a voiceprint recognition model; After recognition is completed, the system automatically assigns a set of structured security labels to each recognized data unit (such as a face region bounding box in an image, a sensitive entity in text) or the entire data block according to a predefined security level matrix (e.g., mapping "face" to "high sensitivity" and "ordinary descriptive text" to "low sensitivity"). The label set adopts a structured data format (such as JSON) and includes the following attributes: data_id (data identifier), sensitivity_level (high / medium / low), allowed_operations (such as ["view", "comment"], prohibited ["copy", "print"]), validity_period (valid until YYYY-MM-DD), and environment_requirements (such as "only for PCs with a certain security client installed"). Step S2: Compiling a dynamically executable security policy: The sender uses a graphical policy editor to set dynamic security policy rules based on the intent of this sharing. These rules are described in a structured manner, for example: Environment-based policy: If the receiving device does not have the specified security plugin installed or the device is located within an untrusted geofence, then decryption of all highly sensitive data is prohibited. Behavior-based strategy: If a user attempts to take screenshots more than 5 times within 10 minutes, the sensitivity level of all data in the current session will be temporarily increased by one level, and an alarm will be triggered. Content-based strategy: If a user attempts to perform a "crop" or "zoom in" operation on a face region in an image marked as "highly sensitive," the operation is blocked and logged as a high-risk event. The system receives these dynamic policy rules and fuses and parses them with a structured security tag set. This compilation process includes: Strategy logic flattening: The nested conditional statements above are converted into an efficient state machine or decision tree data structure that can be directly executed by the agent program; Tag inlining: Key attributes (such as data_id and sensitivity_level) from the tag set are written directly as constants to the agent's configuration memory area, reducing runtime queries; Dependency minimization: Only core dependencies of the function libraries required for analysis policy rules (such as encryption libraries and environment detection APIs) are statically linked or packaged into the proxy program. Finally, a lightweight, stand-alone policy execution agent is compiled and generated. This agent integrates a policy rule interpretation and execution engine, an environment awareness and behavior monitoring module, a secure key management unit, and a dynamic digital watermark embedding module. The agent is encapsulated using sandboxing technology and is designed to run as a protected process at startup to resist debugging and tampering. Step S3, Construction of the intrinsically secure data object: The system selectively encrypts the raw data: based on the sensitivity_level in the structured security label set, "highly sensitive" data blocks are encrypted with AES-256, and "lowly sensitive" data blocks are encrypted with AES-128. Text and structured data can be directly encrypted, while images and videos can be encrypted using format-compatible encryption algorithms (such as DCT-based encryption) or in blocks. Then, the encrypted data, the policy execution agent generated in step S2, and the necessary decryption logic (such as the key negotiation protocol) are encapsulated into a self-contained secure shared package (e.g., a .sdp file). The agent is configured to be automatically activated when the secure shared package is accessed, becoming the only trusted entry point for data decryption and all subsequent operations. Step S4: Accompanying strategy execution and closed-loop information collection: The recipient obtains a secure shared package, and when the recipient first attempts to access the package (e.g., by double-clicking), the policy enforcement agent is automatically activated; Agent self-check and environment verification: The agent first verifies its own integrity, then checks the operating environment (device ID, IP, security software, network, etc.) and compares it with the inline environment_requirements; Access control and key acquisition: If the environment verification is successful, the proxy, as a trusted entry point, requests the decryption key from the sender's authorization server. The decryption process is controlled by policies, such as decrypting only medium and low sensitive data in the current environment. Operation monitoring and dynamic response: The agent acts as a hook between the data viewer and the operating system, monitoring user operations in real time. When a user attempts to "copy text", "take a screenshot", or "export a file", the agent immediately intercepts the request and queries the internally compiled decision logic to make a real-time decision. Auditing and watermark embedding: All operations (whether allowed or denied) are recorded in detail in the operation context log, including time, user, operation type, target data identifier, environmental characteristics, decision result and triggered rule ID. When "print" or "save as" is allowed, the agent instantly calls the internal watermark module to embed the recipient's identity and timestamp imperceptibly into the output data. Step S5, Leakage Source Tracing and Adaptive Evolution of Strategy: When the sender discovers suspected leaked data externally: Leakage tracing: Extract dynamic digital watermarks (user ID, timestamp) from the leaked data to accurately locate the specific sharing session and recipient in the audit logs; Feedback and optimization: Feedback data packet construction: The operation context logs related to the leak event, the triggered policy rule records, and the source tracing results are associated and packaged to form a policy effect evaluation sample; Dual-path optimization: Path 1 (Content Recognition Optimization): If the sample shows that a certain type of sensitive content (such as small lesions in CT images) is missed, then use these missed data fragments to incrementally train the corresponding image recognition model to reduce the future missed rate. Path 2 (Strategy Logic Optimization): Analyze the sample for sequences of behaviors such as "User_A exhibited rapid page turning and attempts to disable the proxy before being leaked". Use reinforcement learning algorithms to adjust the judgment threshold of "abnormal behavior sequences" in the dynamic policy, or automatically generate new preventative rules. The optimized model parameters and policy logic are applied to the subsequently generated secure shared packages through an update mechanism.

[0020] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0021] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0022] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A multimodal data security sharing method based on information security, characterized in that, Includes the following steps; Step S1, Strategy-driven multimodal data preprocessing and tagging: For the shared multimodal raw data, the sensitive information identification model corresponding to the modality is called for analysis, and a structured security tag set containing data sensitivity attributes is generated based on the analysis results and predefined rules. Step S2: Compilation of dynamic executable security policy: Receive dynamic security policy rules defined by the sender, which contain conditional logic based on content, environment, and behavior; merge and logically parse the dynamic security policy rules with the structured security tag set, and compile them to generate a lightweight, independently runnable policy execution agent program, wherein the structured security tag set is encoded as metadata that can be queried within the agent program; Step S3, Construction of the intrinsically secure data object: Encryption is performed on the original multimodal data, and the encrypted data, the policy execution agent, and the necessary decryption logic are encapsulated into a self-contained secure shared package; wherein, the policy execution agent is configured to be automatically activated when the secure shared package is accessed, becoming the only trusted entry point for data decryption and use; Step S4, Accompanying Policy Execution and Closed-Loop Information Collection: In the receiver environment, the policy execution agent program, during runtime, dynamically controls and makes decisions on data access, operation, and output behavior based on its internally encoded metadata and dynamic logic; at the same time, it continuously collects fine-grained operation context logs. Step S5, Leakage Source Tracing and Policy Adaptive Evolution: Based on the identification information extracted from the leaked data or the operation context log, locate the security event; and feed the event data and the corresponding operation log back to the sending system to drive iterative optimization of the sensitive information identification model and the generation logic of the dynamic security policy rules.

2. The method for secure multimodal data sharing based on information security according to claim 1, characterized in that, The policy execution agent is encapsulated using sandboxing technology, and its internal integration includes: A strategy rule interpretation and execution engine; A lightweight environmental perception and behavior monitoring module; A secure key management unit bound to the encrypted data within the secure shared packet; A dynamic digital watermark embedding module for data output; The agent is further configured to have a higher startup priority than any data access request from the receiving environment and to run as a protected process to resist external debugging and tampering.

3. The method for secure multimodal data sharing based on information security according to claim 1, characterized in that, The "compile and generate" process in step S2 includes: Flattening of strategy logic: converting nested conditional statements into decision trees or state machines that can be efficiently executed by the agent program; Tag inlining: Key attributes (such as data ID and sensitivity level) in the structured security tag set are directly compiled into the code or configuration area of ​​the agent program as constants, reducing runtime query overhead and enhancing tamper resistance; Dependency minimization: Analyze the runtime libraries required for dynamic policy rules and include only the minimum necessary dependency packages in the agent to control its size.

4. The method for secure multimodal data sharing based on information security according to claim 1, characterized in that, The operation context log includes the following elements: operation time, operation user ID, operation type, target data ID, access environment characteristics, policy decision result, and dynamic rule ID that triggered the decision.

5. A multimodal data security sharing method based on information security according to claim 1, characterized in that, The "iterative optimization" in step S5 specifically includes: Feedback data packet construction: Combine and package the operation context logs related to a single shared event, the triggered dynamic policy rule records, and the leakage tracing results (if applicable) to form a policy effect evaluation sample; Dual-path optimization: Path 1 (Content Recognition Optimization): Use data segments marked as "false positive" or "false negative" in the samples to incrementally train the corresponding sensitive information recognition model; Path Two (Strategy Logic Optimization): Utilizing the cases revealed in the samples where "overly strict policies hinder normal operations" or "overly lenient policies lead to risky operations," reinforcement learning algorithms are used to optimize the condition thresholds or actions in the dynamic security policy rules.

6. The method for secure multimodal data sharing based on information security according to claim 1, characterized in that, The multimodal data includes images, text, audio, and video, and the sensitive information recognition model includes a face and object recognition model for images, a keyword and entity recognition model for text, and a voiceprint and speech content recognition model for audio.

7. A multimodal data security sharing method based on information security according to claim 1, characterized in that, The initial security label contains attribute information including data sensitivity level, allowed operation set, validity period, and allowed sharing environment requirements.

8. A multimodal data security sharing method based on information security according to claim 1, characterized in that, The environment-based dynamic policy includes dynamic policy rules such as environment-based dynamic policy, behavior-based dynamic policy, and content-based dynamic policy. The environment-based dynamic policy is used to control data decryption or operation permissions according to the receiver's device environment status; the behavior-based dynamic policy is used to dynamically adjust the receiver's subsequent permissions according to the receiver's operation behavior on the data; and the content-based dynamic policy is used to trigger predefined protection actions when an attempt to operate on specific sensitive content is detected.

9. A multimodal data security sharing method based on information security according to claim 1, characterized in that, The selective encryption involves encrypting data blocks of different security levels using encryption algorithms of different strengths based on the differences in data sensitivity levels in the initial security label.

Images