A data security processing method, system, device and storage medium

Abstract

This invention discloses a data security processing method, system, device, and storage medium, relating to the field of information security technology. The method includes: performing semantic analysis on the data to be processed to extract feature information characterizing data attributes; calculating a risk quantification result of the data to be processed based on the feature information and preset risk assessment parameters; generating corresponding security control instructions based on the risk quantification result; and performing risk-matching security processing on the data to be processed before persistent storage according to the security control instructions, to obtain securely processed data. By performing risk assessment, security marking, and encryption decisions at multiple stages during data persistence, this invention ensures that the data is always protected on the storage medium; and systematically solves the shortcomings of existing technologies in terms of protection accuracy, real-time processing security, and dynamic policy adaptability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a data security processing method, system, device, and storage medium. Background Technology

[0002] In the field of data security, common techniques for identifying and protecting sensitive data typically rely on pattern matching based on predefined rules or manual intervention. The strategies throughout the processing flow are usually set during system deployment and remain fixed during operation.

[0003] However, these existing technical solutions are gradually revealing their limitations in practical applications, especially when dealing with high-value, high-compliance data. First, their identification effectiveness heavily relies on the completeness and accuracy of pre-defined rules. For data exceeding the scope of these rules or with complex contextual relationships, the reliability and consistency of the identification results are difficult to guarantee, failing to achieve precise protection. Second, the serial processing flow prevents seamless integration of security operations, potentially introducing unnecessary security exposure risks at critical stages of the data lifecycle. In the complex path of data transfer from the application layer to the encryption module and then to the storage driver, any caching, queuing, or asynchronous operation at any stage can cause data to briefly remain in plaintext form within a buffer. This time window may be very short, but for high-value data and sophisticated attackers, it constitutes a real security vulnerability, failing to meet the highest level of security compliance requirements. Furthermore, fixed processing strategies struggle to cope with constantly changing business needs and external security threat environments, failing to achieve a dynamic and adaptive balance between security and processing efficiency. Summary of the Invention

[0004] To address the shortcomings of existing technologies in terms of data protection accuracy, real-time processing, and policy adaptability, this invention provides a data security processing method, system, device, and storage medium, achieving comprehensive optimization through multi-mechanism collaborative design. First, it employs semantic understanding-based data analysis to replace the traditional mechanical rule matching mode, fundamentally improving the accuracy of sensitive information identification while enhancing adaptability to complex semantics in different business scenarios, avoiding the limitations of traditional rules in complex scenarios. Second, it implements integrated security processing before data is written to the storage device, ensuring real-time data security. Specifically, the system intercepts the data write stream at the operating system kernel level and simultaneously completes risk assessment, security marking, and encryption decision-making in memory through atomic operations, eliminating the need for step-by-step execution. The processed secure data is directly written to the storage medium, ensuring that the data remains protected throughout its lifecycle and that no plaintext resides within it, completely eliminating the "plaintext time window" from both a technical principle and implementation perspective. Furthermore, it incorporates risk assessment parameters that can be dynamically adjusted according to external threats, allowing encryption strategies to adaptively optimize based on real-time threat intelligence, achieving dynamic and accurate matching between security protection levels and actual threats. Through the coordinated operation of the above mechanisms, this solution balances protection accuracy, processing real-time performance, and policy adaptability, providing a complete and reliable security protection solution for the data environment.

[0005] To achieve the above objectives, the embodiments of this application provide the following technical solutions: According to a first aspect of the embodiments of this application, a data security processing method is provided, the method comprising: Acquire the data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize the data attributes; Based on the aforementioned feature information and preset risk assessment parameters, the risk quantification result of the data to be processed is calculated. Generate corresponding security control instructions based on the risk quantification results; According to the security control instructions, before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed to obtain data after security processing.

[0006] In some feasible implementations, based on the feature information and preset risk assessment parameters, the risk quantification result corresponding to the data to be processed is calculated, including: A sensitivity probability value is determined based on the feature information, and the sensitivity probability value represents the confidence level that the data content to be processed is preset sensitive information. Obtain preset business impact weight parameters and external threat weight parameters; The risk quantification result is obtained by weighting the sensitivity probability value, the business impact weight parameter, and the external threat weight parameter.

[0007] In some feasible implementations, a matching security control instruction is generated based on the risk quantification result, including: The risk quantification result is compared with a first risk level threshold and a second risk level threshold; wherein the second risk level threshold is greater than the first risk level threshold. When the risk quantification result is less than the first risk level threshold, a first security control instruction is generated; the first security control instruction indicates that security marking processing and encryption processing should not be performed. When the risk quantification result is greater than or equal to the first risk level threshold and less than the second risk level threshold, a second security control instruction is generated; the second security control instruction instructs the execution of security marking processing. When the risk quantification result is greater than or equal to the second risk level threshold, a third security control instruction is generated; the third security control instruction instructs the execution of security marking processing and target level encryption processing.

[0008] In some feasible implementations, if the second security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: Intercept the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; According to the second security control instruction, a security tag is applied to the data to be processed that is in an intercepted state in memory to generate the first security-processed data; wherein, the security tag is a structured label that includes the sensitivity level information determined based on the risk quantification result; Continue transmitting the data after the first security processing to complete persistent storage.

[0009] In some feasible implementations, if the third security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: Intercept the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; In memory, according to the third security control instruction, the data to be processed in the intercepted state is subjected to security marking and encryption transformation of the target level within a single data processing cycle to generate the second security-processed data; Continue transmitting the second securely processed data to complete persistent storage.

[0010] In some feasible implementations, target-level encryption transformation is performed, including: Extract the sensitivity level information from the security tag; A preset encryption strategy is matched based on the sensitivity level information; the encryption strategy includes an encryption algorithm and an encryption key source; The data to be processed is encrypted using the matched encryption algorithm and the corresponding encryption key.

[0011] In some feasible implementations, semantic analysis is performed on the data to be processed to extract feature information used to characterize data attributes, including: The data to be processed is input into a trained artificial intelligence semantic understanding model; The AI ​​semantic understanding model parses the contextual semantics of the data to be processed and outputs analysis results as the feature information. The analysis results include entities, relationships between entities, and the context in which the data is located. The AI ​​semantic understanding model is a language model that has been adaptively trained based on target domain corpus. The adaptive training is used to enhance the model's semantic understanding ability of specialized terms and contextual expression patterns in the target domain.

[0012] According to a second aspect of the embodiments of this application, a data security processing system is provided, the system comprising: The semantic analysis module is used to acquire the data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize the data attributes. The risk quantification module is used to calculate the risk quantification result of the data to be processed based on the feature information and preset risk assessment parameters. The control instruction module is used to generate corresponding safety control instructions based on the risk quantification results. The security processing module is used to perform security processing on the data to be processed in accordance with the security control instructions before the data to be processed is persistently stored, so as to obtain data after security processing.

[0013] According to a third aspect of the present application, an electronic device is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect above.

[0014] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided having computer-readable instructions stored thereon, the computer-readable instructions being executable by a processor to implement the method described in the first aspect above.

[0015] In summary, this application provides a data security processing method, system, device, and storage medium. It extracts feature information characterizing data attributes by performing semantic analysis on the data to be processed; calculates the risk quantification result of the data to be processed based on the feature information and preset risk assessment parameters; generates corresponding security control instructions based on the risk quantification result; and performs risk-matching security processing on the data to be processed before persistent storage according to the security control instructions, obtaining securely processed data. By introducing semantic understanding to replace traditional mechanical rule matching, the accuracy of sensitive data identification and adaptability to different business scenarios are fundamentally improved. Multiple stages, including risk judgment, security marking, and encryption decision-making, are performed during data storage, ensuring that the data is always protected on the storage medium. By integrating risk assessment parameters that can be dynamically adjusted according to external threats, the encryption strategy can be optimized in real time and adaptively, thus systematically solving the shortcomings of existing technologies in terms of protection accuracy, real-time processing security, and dynamic policy adaptability. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0017] The structures, proportions, sizes, etc. illustrated in this specification are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed herein, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0018] Figure 1 This is a schematic flowchart of a data security processing method provided in an embodiment of this application; Figure 2 This is a schematic diagram of a data security processing system provided in an embodiment of this application; Figure 3 This paper shows a structural diagram of an electronic device provided in an embodiment of this application; Figure 4 A diagram of a computer-readable storage medium provided in an embodiment of this application is shown.

[0019] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0021] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0022] Furthermore, in this invention, descriptions involving "first," "second," etc., are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0023] In this invention, unless otherwise explicitly specified and limited, the terms "connection," "fixed," etc., should be interpreted broadly. For example, "fixed" can mean a fixed connection, a detachable connection, or an integral part; it can mean a mechanical connection or an electrical connection; it can mean a direct connection or an indirect connection through an intermediate medium; it can mean the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0024] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0025] Figure 1 This application illustrates a data security processing method provided by an embodiment of the present application, the method comprising: Step S101: Obtain the data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize the data attributes; Step S102: Based on the feature information and preset risk assessment parameters, calculate the risk quantification result of the data to be processed; Step S103: Generate corresponding security control instructions based on the risk quantification results; Step S104: According to the security control instruction, before the data to be processed is persistently stored, perform security processing on the data to be processed that matches the risk to obtain data after security processing.

[0026] Addressing the current data security landscape's reliance on static matching and manual annotation for identification, as well as its fragmented processing workflows and static encryption configurations, this application's embodiments first acquire the data to be processed and conduct semantic analysis to extract feature information representing data attributes. This replaces traditional static matching methods, improving the accuracy and adaptability of sensitive data identification and meeting the identification needs of industry-specific data scenarios. This application's embodiments also solve the problems of insufficient accuracy in sensitive data identification, fragmented processing workflows, and lack of dynamic adaptation of security strategies in existing technologies by constructing a complete data perception, risk assessment, and security processing linkage process. This achieves accurate and efficient security protection for data with different risk levels.

[0027] Based on this, the embodiments of this application calculate the risk quantification result of the data to be processed based on the extracted feature information and preset risk assessment parameters, thereby achieving accurate quantitative assessment of data risk and providing a quantitative basis for subsequent security processing. This solves the problems of vague risk assessment and inability to formulate processing strategies based on risk levels in the prior art. Furthermore, the embodiments of this application generate corresponding security control instructions based on the risk quantification results, breaking the rigid mode of traditional processing procedures and achieving dynamic matching between security processing strategies and data risk levels. This avoids security redundancy or insufficient protection problems caused by unified processing. Before the data to be processed is persistently stored, security processing matching the risk is executed according to the security control instructions. This integrates data identification, risk assessment, and security processing processes, ensuring that the data is always in a security protection state that meets the risk level during storage. This reduces the risk of plaintext exposure, meets the security requirements of high-compliance fields, and also takes into account processing efficiency, improving the practicality and reliability of overall data security processing.

[0028] In one possible implementation, in step S101, semantic analysis is performed on the data to be processed to extract feature information for characterizing data attributes, including: inputting the data to be processed into a trained artificial intelligence semantic understanding model; parsing the contextual semantics of the data to be processed through the artificial intelligence semantic understanding model and outputting analysis results as the feature information; the analysis results include entities, relationships between entities, and the scene in which the data is located; wherein, the artificial intelligence semantic understanding model is a language model that has been adaptively trained based on target domain corpus, and the adaptive training is used to enhance the model's semantic understanding ability of specialized terms and contextual expression patterns in the target domain.

[0029] The semantic analysis process in step S101 is specifically implemented through a pre-defined artificial intelligence semantic understanding model. After the data to be processed is input into the model, the model performs deep analysis of the contextual semantics of the data, outputting analysis results including entities, relationships between entities, and the context in which the data exists. These results serve as feature information representing the data attributes. This artificial intelligence semantic understanding model undergoes adaptive training based on target domain corpus. The training process enhances the model's ability to understand specialized terminology and contextual expression patterns within the target domain, enabling the model to accurately identify sensitive information in industry-specific data scenarios, further improving the accuracy and adaptability of sensitive data identification.

[0030] In one possible implementation, in step S102, based on the feature information and preset risk assessment parameters, the risk quantification result corresponding to the data to be processed is calculated, including: determining a sensitivity probability value according to the feature information, wherein the sensitivity probability value represents the confidence level that the content of the data to be processed is preset sensitive information; obtaining preset business impact weight parameters and external threat weight parameters; and performing weighted calculation on the sensitivity probability value, the business impact weight parameters and the external threat weight parameters to obtain the risk quantification result.

[0031] In one possible implementation, the method further includes a step of dynamically adjusting the external threat weight parameter, specifically including: periodically acquiring information related to the external threat status; and adjusting the external threat weight parameter based on the information related to the external threat status, so that the risk quantification result can reflect the changes in the current external threat status in real time.

[0032] In step S102, a sensitivity probability value is first determined based on the feature information extracted in step S101. This sensitivity probability value accurately characterizes the confidence level that the data content to be processed is preset sensitive information, providing core foundational data for risk assessment. Subsequently, preset business impact weight parameters and external threat weight parameters are obtained. The business impact weight parameter corresponds to the degree of impact of data leakage or abnormal use on the business, while the external threat weight parameter corresponds to the threat landscape of the current external network environment. Finally, the sensitivity probability value, business impact weight parameter, and external threat weight parameter are weighted and calculated. Through scientific weight allocation, a comprehensive quantification of data risk is achieved, ensuring that the risk quantification results fully reflect the sensitivity of the data itself, its business impact, and external threats.

[0033] In one possible implementation, this application embodiment further includes a dynamic adjustment step for external threat weight parameters to address real-time changes in the external threat status. This step involves periodically acquiring information related to the external threat status to understand the type, intensity, and scope of impact of current external network threats in real time, and then dynamically adjusting the external threat weight parameters based on the acquired information. This dynamic adjustment method ensures that the external threat weight parameters remain synchronized with the current threat landscape, thereby ensuring that risk quantification results reflect changes in the current external threat status in real time. This avoids risk assessment biases caused by statically fixed external threat weight parameters, further improving the timeliness and accuracy of risk assessment, and enabling subsequent security handling strategies to better adapt to the real-time threat environment.

[0034] In one possible implementation, step S103, generating a matching security control instruction based on the risk quantification result, includes: comparing the risk quantification result with a first risk level threshold and a second risk level threshold; wherein the second risk level threshold is greater than the first risk level threshold; when the risk quantification result is less than the first risk level threshold, generating a first security control instruction; the first security control instruction instructs not to perform security marking processing and not to perform encryption processing; when the risk quantification result is greater than or equal to the first risk level threshold and less than the second risk level threshold, generating a second security control instruction; the second security control instruction instructs to perform security marking processing; when the risk quantification result is greater than or equal to the second risk level threshold, generating a third security control instruction; the third security control instruction instructs to perform security marking processing and target level encryption processing.

[0035] In one possible implementation, a step of dynamically adjusting the risk level threshold is also included: dynamically adjusting the first risk level threshold and / or the second risk level threshold according to the historical risk quantification result distribution statistics or updated compliance requirements.

[0036] The generation process of security control instructions in step S103 revolves around the hierarchical judgment of risk quantification results, ensuring that the instructions accurately match the data risk level. First, the risk quantification result obtained in step S102 is compared with preset first and second risk level thresholds, where the second risk level threshold is greater than the first. This dual threshold division forms three distinct risk level intervals. When the risk quantification result is less than the first risk level threshold, it indicates that the data to be processed has a low risk, and a first security control instruction is generated, instructing that security marking and encryption processes not be performed to avoid resource waste caused by over-processing. When the risk quantification result is greater than or equal to the first risk level threshold but less than the second risk level threshold, it indicates that the data to be processed has some risk, and a second security control instruction is generated, instructing that security marking processes be performed to effectively identify the data risk. When the risk quantification result is greater than or equal to the second risk level threshold, it indicates that the data to be processed has a high risk, and a third security control instruction is generated, instructing that security marking and target level encryption processes be performed to achieve comprehensive protection for high-risk data. This hierarchical instruction generation method allows security control instructions to accurately adapt to data of different risk levels, balancing security protection and processing efficiency.

[0037] In one possible implementation, this application embodiment further includes a dynamic adjustment step for risk level thresholds to ensure that the risk level classification can adapt to changes in actual application scenarios. This step analyzes the changing patterns of data risk based on the distribution statistics of historical risk quantification results, and dynamically adjusts the first risk level threshold and / or the second risk level threshold in conjunction with updated compliance requirements. This adjustment method avoids the grading deviation caused by statically fixed risk level thresholds, ensuring that the risk level classification always aligns with the actual data risk situation and compliance standards. This ensures that the generation of subsequent security control instructions is more accurate, further improving the adaptability and practicality of the entire data security processing method and better meeting the security protection needs in different scenarios.

[0038] In one possible implementation, in step S104, if the second security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: intercepting the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; applying a security tag to the data to be processed in the intercepted state in memory according to the second security control instruction, generating first security-processed data; wherein the security tag is a structured label including the sensitivity level information determined based on the risk quantification result; continuing to transmit the first security-processed data to complete persistent storage. The application of the security tag is completed in memory to ensure that the original data to be processed without security tagging does not reside in the persistent storage device.

[0039] In one possible implementation, when the second security control instruction is generated in step S103, the risk-matching security processing in step S104 will be executed according to a defined process to ensure that the security processing is accurately matched to the data risk level and meets security requirements. First, the data to be processed is intercepted on the write path to the persistent storage device to prevent data that has not undergone security processing from directly entering the storage stage. Then, according to the second security control instruction, a security mark is applied to the intercepted data in memory to generate the first security-processed data.

[0040] The applied security tag is a structured label containing sensitivity level information determined based on the risk quantification results obtained in step S102. This label clearly identifies the risk level of the data to be processed, facilitating subsequent data management and risk tracing. The entire security tagging process is completed in memory, without writing the untagged raw data to persistent storage. This ensures that untagged raw data does not reside in persistent storage, guaranteeing data traceability and security from the storage source. Finally, the data after the first security processing, which has undergone security tagging, continues to be transmitted until persistent storage is completed. This achieves both effective identification of medium-risk data and maintains data processing efficiency.

[0041] In one possible implementation, in step S104, if the third security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: intercepting the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; in memory, according to the third security control instruction, applying a security mark and performing a target-level encryption transformation on the intercepted data to be processed within a single data processing cycle to generate second-secured data; and continuing to transmit the second-secured data to complete persistent storage. The application of the security mark and the target-level encryption transformation are continuously executed in memory, ensuring that the data to be processed is always in a protected state throughout the entire process of being written to the persistent storage device, and that no unencrypted plaintext data resides there.

[0042] In one possible implementation, performing a target-level encryption transformation includes: extracting the sensitivity level information from the security tag; matching a preset encryption strategy based on the sensitivity level information; the encryption strategy including an encryption algorithm and an encryption key source; and using the matched encryption algorithm and the corresponding encryption key to perform encryption operations on the data to be processed.

[0043] In one possible implementation, intercepting the data to be processed on the write path of the data to be processed to the persistent storage device is achieved by: deploying a programmable hook program at the operating system kernel layer; and using the programmable hook program to intercept write operating system calls initiated by the application to the persistent storage device in order to capture the data to be processed.

[0044] In one possible implementation, when the third security control instruction is generated in step S103, the risk-matching security processing in step S104 will perform more comprehensive security operations to address the protection needs of high-risk data, ensuring data storage security. First, the data to be processed is intercepted on the write path to the persistent storage device, preventing high-risk data without security processing from directly entering the storage stage at the source of transmission. Then, in memory, according to the third security control instruction, security marking and target-level encryption transformation are applied to the intercepted data in a single data processing cycle, generating second-level security-processed data. The application of security marking and target-level encryption transformation are continuously executed in memory without interruption or leaving the memory environment, ensuring that the data to be processed remains protected throughout the entire process of being written to the persistent storage device, preventing unencrypted plaintext data from residing in the storage device, fundamentally reducing the risk of high-risk data leakage. Finally, the second-level security-processed data, after security marking and encryption, continues to be transmitted until persistent storage is completed, achieving comprehensive, end-to-end protection for high-risk data and meeting the stringent data security requirements of high-compliance fields.

[0045] In one possible implementation, the encryption transformation at the target level is performed according to a defined set of steps to ensure a precise match between the encryption level and the data risk level. First, sensitivity level information is extracted from security tags. This sensitivity level information, determined based on previous risk quantification results, accurately reflects the risk level of the data to be processed. Then, based on the extracted sensitivity level information, a preset encryption strategy is matched. This strategy explicitly includes the encryption algorithm and the source of the encryption key, ensuring that the encryption operation is systematic and based on established procedures. Finally, the matched encryption algorithm and corresponding encryption key are used to encrypt the data to be processed, making the encryption strength compatible with the data sensitivity level. This ensures the encryption security of high-risk data while avoiding resource waste caused by over-encryption, improving the rationality and accuracy of the encryption process.

[0046] In one possible implementation, the interception of data to be processed on the write path to persistent storage involves, specifically, deploying a programmable hook at the operating system kernel level. This programmable hook can deeply intervene in the operating system's execution flow, accurately capturing various operations initiated by applications. Through this programmable hook, write operating system calls initiated by applications and directed to persistent storage are specifically intercepted, thereby capturing the data to be processed contained within them. This achieves effective interception of data on the write path, providing reliable pre-emptive protection for subsequent security processing and ensuring that data that has not undergone secure processing cannot enter the storage stage.

[0047] In one possible implementation, after step S104, a security audit step is further included: recording a full-process log from feature information extraction to the generation of data after security processing, wherein the full-process log includes at least risk quantification results, security control instructions, security label types, encryption levels, and processing time; generating a compliance audit report based on the full-process log, wherein the compliance audit report is used to prove that the data processing process complies with preset security standards. The compliance audit report includes processing effectiveness verification information; the processing effectiveness verification information is obtained by comparing the automated processing results of this method with the results of preset benchmark security processing rules, and is used to prove that the processing effectiveness of this method reaches or exceeds the benchmark security processing rules.

[0048] After the data is persistently stored following the security processing in step S104, this embodiment further includes a security audit step. This step is used to trace, verify, and confirm the compliance of the entire data security processing flow, further improving the standardization and traceability of data processing. The security audit step specifically includes two core components. First, it records a complete log of the entire process from feature information extraction to the generation of data after security processing, ensuring that the log information fully covers the entire processing chain. This log includes at least risk quantification results, security control instructions, security tag types, encryption levels, and processing time, providing comprehensive and accurate raw data support for subsequent auditing and tracing. Then, a compliance audit report is generated based on the recorded complete log. This report visually demonstrates that the data processing process fully complies with preset security standards and meets the audit requirements of high-compliance fields. Simultaneously, the compliance audit report includes processing effectiveness verification information. This information is obtained by comparing the automated processing results provided in this embodiment with the results of preset benchmark security processing rules. This clearly demonstrates that the processing effectiveness of this method reaches or exceeds the preset benchmark security processing rules, further verifying the practicality and reliability of this method and providing strong support for its promotion and application.

[0049] The data security processing method provided in this application simultaneously performs in-depth understanding of the content, risk quantification, decision-making, and security hardening of a single piece of data before it is first written to the storage device. This fundamentally improves protection accuracy, eliminates security gaps, and enables dynamic adaptation of strategies. The aforementioned data security processing method specifically includes the following stages: Phase 1: Business scenario determination and initial configuration phase.

[0050] The first step in this phase is to clearly define the scope of data to be protected. For example, in aviation information systems, this can be divided into different data domains such as airborne messages, maintenance work orders, and passenger service records. Secondly, a unified data sensitivity classification standard needs to be established. For instance, it can be divided into four levels, from public to extremely sensitive, referring to the "Civil Aviation Personal Information Classification and Grading Guidelines," specifically S0 public level, S1 low-sensitivity level, S2 medium-sensitivity level, and S3 extremely sensitive level.

[0051] Furthermore, define the semantic feature targets to be extracted. That is, not only to identify isolated sensitive words, but also to capture meaningful combinations of entities, relationships between entities, and the specific context in which the entities are situated. For example, the system needs to understand that when a specific aircraft tail number, hydraulic oil levels below the standard value, and a post-flight inspection work order occur simultaneously, they constitute a high-risk semantic scenario representing a potential safety hazard.

[0052] Phase Two: Intelligent Semantic Perception Phase.

[0053] This stage is responsible for understanding the true meaning of the data. The system inputs the acquired data to be processed into a specially trained artificial intelligence semantic understanding model. The core of this model lies in its domain specificity. Its foundation is a language model pre-trained on a large-scale general corpus, such as the 12-layer BERT model with 768 hidden dimensions.

[0054] To further enhance understanding of specific industries such as civil aviation, a large amount of professional texts in this field, such as maintenance manuals, operating standards, and work order records, totaling 2.3 billion tokens, were used to continue training the model, familiarizing it with industry terminology and expression logic. The model was ultimately designed to output two results: first, the identification results of nested entities in the data, such as engine serial numbers in fault descriptions, and the relationships between entities; second, a key probability value that quantifies the confidence that the current data content belongs to sensitive information in a given context. After training and validation, the model achieved an F1 score of 0.994, an AUC of 0.998, and a single-data-line inference latency of only 18ms, meeting real-time processing requirements when running on a GPU T4 environment.

[0055] Phase 3: Dynamic Risk Assessment Phase.

[0056] This step involves a comprehensive quantitative assessment of the perceived results. The system employs a risk quantification model, which does not solely rely on the sensitivity probability obtained from the semantic analysis described above. Instead, it combines this probability with factors from two other dimensions, calculating the overall result using a weighted formula. The specific formula is as follows: Risk Score=α·P(sensitive|context)+β·Business Impact+γ·ThreatIntel Wherein, α=0.6: Sensitivity probability weight, corresponding to the proportion of the sensitivity of the data itself in the risk assessment; β=0.3: Business impact weight, corresponding to the proportion of the impact of data leakage or abnormal use on business operations; γ=0.1: External threat weight, corresponding to the proportion of the current external network environment threat situation in the risk assessment; P (sensitive|context): output by the AII semantic understanding model, representing the confidence level that the data is sensitive information in a given data context; Business Impact: Business impact factor, a predefined, static or semi-static parameter used to measure the potential loss that such data leakage may cause to business operations; Threat Intel: External threat intelligence factor, a dynamic parameter corresponding to the type, intensity and scope of impact of the current external network threat. The system will periodically, for example every 24 hours, obtain the latest security events and vulnerability information from the external threat intelligence platform, such as CVE vulnerabilities, dark web airline data leakage incidents, etc., and dynamically update the value of this factor accordingly, and even adjust its weight in the overall risk calculation through automated regression analysis.

[0057] The above weighted calculation yields a risk score between 0 and 1. This score comprehensively reflects the sensitivity of the data content itself, its business value, and the urgency of the threats posed to it by the current external environment.

[0058] Phase 4: Tiered security decision-making phase.

[0059] This step generates precise action instructions based on risk scores. The system presets two dynamic decision thresholds: a lower marking threshold T1 = 0.75 and a higher encryption threshold T2 = 0.90, with the encryption threshold being greater than the marking threshold. The calculated risk score is compared with these two thresholds: 1. If the risk score is lower than the marking threshold, it is determined to be low-risk, and an instruction requiring no special processing is generated. 2. If the risk score reaches or exceeds the marking threshold but is lower than the encryption threshold, it is determined to be medium-risk, and an instruction requiring the addition of a security marker is generated. 3. If the risk score reaches or exceeds the encryption threshold, it is determined to be high-risk, and an instruction requiring the addition of a security marker and encryption is generated.

[0060] Meanwhile, the system can dynamically adjust the two thresholds based on the distribution statistics of historical risk quantification results or updated compliance requirements to ensure the adaptability of the decision.

[0061] Phase 5: Integrated Security Execution Phase.

[0062] This step is crucial for ensuring safe processing; it completes all operations on the final path where data is written to disk. The specific process is as follows: Step 1: Path Interception: At the operating system kernel level, programmable technologies such as eBPF are used to intercept disk write requests initiated by applications, thereby capturing the data stream that is about to be written to disk and achieving full control over the data write path.

[0063] Step 2: Synchronous security processing: The intercepted data is processed atomically in memory according to the decision instructions to ensure the continuity and security of the operation.

[0064] (1) Security tag: Generate a structured tag containing information such as data sensitivity level. For example, in the aviation field, an extended PAC privacy attribute certificate tag can be used, embedding XML annotation fields and associating it with the data body as metadata.

[0065] (2) Hierarchical encryption: If the instruction requires encryption, the preset hierarchical encryption strategy is triggered according to the level information in the above tags. S0 public level is not encrypted; S1 low sensitivity level uses the AES-128 algorithm and the key is rotated every 7 days; S2 medium sensitivity level uses the AES-256 algorithm with external key management KMS and uploads the audit digest to the chain; S3 extremely sensitive level uses the AES-256 algorithm combined with Shamir secret sharing 3 / 5 and quantum random number IV.

[0066] The embedding and encryption transformation of security tags are completed continuously and synchronously in memory without interruption. The two belong to the same inseparable operation cycle and are executed entirely in memory without involving plaintext data being stored on the disk.

[0067] Step 3: Secure Disk Writing: After processing, the secure data, now tagged and encrypted, is directly delivered to the storage system and written to the physical disk. Through this design, the data never exists in plaintext form on the storage medium, completely eliminating the unavoidable plaintext exposure window in the traditional pre-processing, post-protection model, achieving the goal of a plaintext time window of 0ms.

[0068] Phase 6: Compliance Audit and Enhancement Mechanism Phase.

[0069] To meet the needs of high compliance scenarios, this method may also include the following enhancement mechanisms: 1. Full-process audit: The system automatically records key logs throughout the entire chain from semantic awareness to secure execution, including risk scores, decision instructions, encryption key identifiers used, processing time, security tag types, etc., forming an immutable chain of evidence to support subsequent compliance audits.

[0070] 2. Compliance Mapping: Based on operational logs, the system can automatically analyze and generate reports demonstrating that this automated processing workflow can completely or partially replace the original manual inspections or fixed-rule inspections, supporting predictive substitution audits similar to MSG-3 / IP-180. Mapping conclusions are categorized into three types: complete substitution, partial substitution, retaining 5% manual sampling, and no substitution, with the reasons written to the audit logs. This supports the equivalence audits and traceability required by regulatory agencies.

[0071] 3. System Resilience Design: Considering extreme situations, the system can deploy dual AI model redundancy: a primary model and a lightweight backup model. When the confidence level of the primary model drops below 0.8, it automatically degrades to reduce the risk of false positives and false negatives. Simultaneously, in the event of encryption hardware failure, it has the capability to switch to software encryption within ≤50ms to ensure business continuity.

[0072] 4. Performance Guarantee: Through the above design, the processing latency of a single data item before its first disk write is ≤50ms, the increase in encryption overhead is ≤5%, the false alarm rate is ≤0.5%, and the false alarm rate is ≤1%, meeting the requirements of high compliance and high real-time scenarios.

[0073] By combining the above stages, this method achieves forward-looking, precise, and atomic protection for data security, and can effectively address high-value, high-compliance-requirement scenarios, such as data security challenges in the civil aviation sector.

[0074] In summary, this application provides a data security processing method. It involves semantic analysis of the data to be processed to extract feature information characterizing data attributes; calculating the risk quantification result of the data based on the feature information and preset risk assessment parameters; generating corresponding security control instructions based on the risk quantification result; and performing risk-matching security processing on the data before persistent storage according to the security control instructions, resulting in securely processed data. By introducing semantic understanding to replace traditional mechanical rule matching, the accuracy of sensitive data identification and adaptability to different business scenarios are fundamentally improved. Multiple stages, including risk assessment, security marking, and encryption decision-making, are performed during data storage, ensuring that data is always protected on the storage medium. By integrating risk assessment parameters that can be dynamically adjusted according to external threats, encryption strategies can be optimized in real time and adaptively, thus systematically solving the shortcomings of existing technologies in terms of protection accuracy, real-time processing security, and dynamic policy adaptability.

[0075] Based on the same technical concept, embodiments of this application also provide a data security processing system, such as... Figure 2 As shown, the system includes: The semantic analysis module 201 is used to acquire data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize data attributes. Risk quantification module 202 is used to calculate the risk quantification result of the data to be processed based on the feature information and preset risk assessment parameters; Control instruction module 203 is used to generate corresponding safety control instructions based on the risk quantification results; The security processing module 204 is used to perform security processing on the data to be processed in accordance with the security control instructions before the data to be processed is persistently stored, so as to obtain data after security processing.

[0076] This application also provides an electronic device corresponding to the method provided in the foregoing embodiments. Please refer to... Figure 3 The diagram illustrates an electronic device provided by some embodiments of this application. The electronic device 30 may include: a processor 300, a memory 301, a bus 302, and a communication interface 303, wherein the processor 300, the communication interface 303, and the memory 301 are connected via the bus 302; the memory 301 stores a computer program that can run on the processor 300, and when the processor 300 runs the computer program, it executes the method provided by any of the foregoing embodiments of this application.

[0077] The memory 301 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one physical port (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.

[0078] Bus 302 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 301 is used to store programs. After receiving an execution instruction, the processor 300 executes the program. The method disclosed in any of the foregoing embodiments of this application can be applied to the processor 300, or implemented by the processor 300.

[0079] The processor 300 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 300 or by instructions in software form. The processor 300 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 301. The processor 300 reads the information in memory 301 and, in conjunction with its hardware, completes the steps of the above method.

[0080] The electronic devices and methods provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods they employ, operate, or implement.

[0081] This application also provides a computer-readable storage medium corresponding to the method provided in the foregoing embodiments. Please refer to... Figure 4 The computer-readable storage medium shown is an optical disc 40, on which a computer program (i.e., a program product) is stored, which, when run by a processor, performs the methods provided in any of the foregoing embodiments.

[0082] The computer-readable storage medium provided in the above embodiments of this application and the method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0083] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0084] The above description is merely a preferred embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0085] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made under the concept of the present invention using the contents of the present invention specification and drawings, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A data security processing method, characterized by, include: Acquire the data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize the data attributes; Based on the aforementioned feature information and preset risk assessment parameters, the risk quantification result of the data to be processed is calculated. Generate corresponding security control instructions based on the risk quantification results; According to the security control instructions, before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed to obtain data after security processing.

2. The method of claim 1, wherein, Based on the aforementioned feature information and preset risk assessment parameters, the risk quantification result corresponding to the data to be processed is calculated, including: A sensitivity probability value is determined based on the feature information, and the sensitivity probability value represents the confidence level that the data content to be processed is preset sensitive information. Obtain preset business impact weight parameters and external threat weight parameters; The risk quantification result is obtained by weighting the sensitivity probability value, the business impact weight parameter, and the external threat weight parameter.

3. The method of claim 1, wherein, Based on the risk quantification results, a matching security control instruction is generated, including: The risk quantification result is compared with a first risk level threshold and a second risk level threshold; wherein the second risk level threshold is greater than the first risk level threshold. When the risk quantification result is less than the first risk level threshold, a first security control instruction is generated; the first security control instruction indicates that security marking processing and encryption processing should not be performed. When the risk quantification result is greater than or equal to the first risk level threshold and less than the second risk level threshold, a second security control instruction is generated; the second security control instruction instructs the execution of security marking processing. When the risk quantification result is greater than or equal to the second risk level threshold, a third security control instruction is generated; the third security control instruction instructs the execution of security marking processing and target level encryption processing.

4. The method of claim 3, wherein, If the second security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: Intercept the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; According to the second security control instruction, a security tag is applied to the data to be processed that is in an intercepted state in memory to generate the first security-processed data; wherein, the security tag is a structured label that includes the sensitivity level information determined based on the risk quantification result; Continue transmitting the data after the first security processing to complete persistent storage.

5. The method of claim 3, wherein, If the third security control instruction is generated, then before the data to be processed is persistently stored, security processing matching the risk is performed on the data to be processed, including: Intercept the data to be processed on the write path of the data to be processed being transmitted to the persistent storage device; In memory, according to the third security control instruction, the data to be processed in the intercepted state is subjected to security marking and encryption transformation of the target level within a single data processing cycle to generate the second security-processed data; Continue transmitting the second securely processed data to complete persistent storage.

6. The method of claim 5, wherein, Perform encryption transformation at the target level, including: Extract the sensitivity level information from the security tag; A preset encryption strategy is matched based on the sensitivity level information; the encryption strategy includes an encryption algorithm and an encryption key source; The data to be processed is encrypted using the matched encryption algorithm and the corresponding encryption key.

7. The method according to any one of claims 1 to 6, characterized in that, Semantic analysis is performed on the data to be processed to extract feature information used to characterize data attributes, including: The data to be processed is input into a trained artificial intelligence semantic understanding model; The AI ​​semantic understanding model parses the contextual semantics of the data to be processed and outputs analysis results as the feature information. The analysis results include entities, relationships between entities, and the context in which the data is located. The AI ​​semantic understanding model is a language model that has been adaptively trained based on target domain corpus. The adaptive training is used to enhance the model's semantic understanding ability of specialized terms and contextual expression patterns in the target domain.

8. A data security processing system, characterized by, include: The semantic analysis module is used to acquire the data to be processed, perform semantic analysis on the data to be processed, and extract feature information used to characterize the data attributes. The risk quantification module is used to calculate the risk quantification result of the data to be processed based on the feature information and preset risk assessment parameters. The control instruction module is used to generate corresponding safety control instructions based on the risk quantification results. The security processing module is used to perform security processing on the data to be processed in accordance with the security control instructions before the data to be processed is persistently stored, so as to obtain data after security processing.

9. An electronic device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when running the computer program, performs an action to implement the method as claimed in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that can be executed by a processor to implement the method as described in any one of claims 1-7.

Images