A security protection method, device, equipment and storage medium

Abstract

The present invention discloses a security protection method, device, equipment and storage medium. The method comprises: obtaining open data to be protected and a target framework; inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected; determining a target node according to the target path, and performing security processing on the target node. The security problem of the open data to be protected is solved, and the open authorization is withdrawn through value investment drive, and the acquisition path of implicit data is destroyed, thereby achieving the purpose of implicit data security protection, so that users can enjoy the service convenience brought by open banking while ensuring the security of users' implicit data.

Description

Technical Field

[0001] The embodiments of the present invention relate to the intersection of software engineering, information security and big data, and in particular to a security protection method, device, equipment and storage medium. Background Art

[0002] With the development of open banking models such as the Bank of China Open Platform and the Industrial and Commercial Bank of China Open Platform, data, algorithms, transactions, etc. are more shared and open among financial technology companies, financial institutions, and customers. Open data generally exists explicitly, but the rapid development of artificial intelligence and big data has made it possible to mine implicit content based on explicit data. Implicit data exists implicitly or even not in the form of data, and is scattered in data, information, knowledge and other resources, making it difficult to protect its security as well as explicit data.

[0003] Existing technologies focus on the security protection of explicit content, but fail to provide more secure protection for implicit content. For example, a user uses a bank card to shop on an online shopping platform with the help of a third-party payment platform. Based on the consumption records, the third-party platform can learn about the user's pregnancy score, reading hobbies, clothing style and other implicit data that are not disclosed. Once these implicit data involve user privacy, it will easily lead to privacy leakage.

[0004] How to search for and further protect implicit data in an open banking environment so that it is not accessed, obtained, used, tampered with, destroyed, or other illegal operations by unauthorized users has become a challenge. Summary of the invention

[0005] The embodiments of the present invention provide a security protection method, device, equipment and storage medium to achieve security protection of data in an open banking environment.

[0006] In a first aspect, an embodiment of the present invention provides a security protection method, including:

[0007] Access to open data to be protected and target frameworks;

[0008] Inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected;

[0009] A target node is determined according to the target path, and security processing is performed on the target node.

[0010] In a second aspect, an embodiment of the present invention further provides a safety protection device, the device comprising:

[0011] An acquisition module, used to acquire the open data to be protected and the target framework;

[0012] A target path determination module, used for inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected;

[0013] A processing module is used to determine a target node according to the target path and perform security processing on the target node.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a security protection method as described in any one of the embodiments of the present invention is implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the security protection method as described in any one of the embodiments of the present invention is implemented.

[0016] The present invention discloses a security protection method, device, equipment and storage medium. The method comprises: obtaining open data to be protected and a target framework; inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected; determining a target node according to the target path, and performing security processing on the target node. By using this method, the security problem of the open data to be protected is solved, the open authorization is withdrawn through value investment drive, and the acquisition path of implicit data is destroyed, thereby achieving the purpose of implicit data security protection, so that users can enjoy the service convenience brought by open banking while ensuring the security of their implicit data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 is a flow chart of a security protection method in Embodiment 1 of the present invention;

[0019] Figure 2 is a flow chart of a security protection method in Embodiment 2 of the present invention;

[0020] Figure 3 It is a structural schematic diagram of a safety protection device in Embodiment 3 of the present invention;

[0021] Figure 4 is a structural schematic diagram of an electronic device in Embodiment 4 of the present invention;

[0022] Figure 5 It is a structural diagram of a computer-readable storage medium containing a computer program in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only the parts related to the present invention, rather than all structures, are shown in the accompanying drawings. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other without conflict.

[0024] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0025] The term “including” and its variations used in the present invention are open inclusions, that is, “including but not limited to.” The term “based on” means “based at least in part on.” The term “one embodiment” means “at least one embodiment.”

[0026] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0027] Embodiment 1

[0028] Figure 1 This is a flowchart of a security protection method provided in the first embodiment of the present invention. This embodiment can be applied to data security protection in an open banking environment. The method can be executed by the security protection device in the embodiment of the present invention. The device can be implemented in software and / or hardware. Figure 1 As shown, the method specifically comprises the following steps:

[0029] S110. Obtain the open data and target framework to be protected.

[0030] Among them, open data to be protected refers to open data that needs to be protected. Open data is data that explicitly exists in an open banking environment. Open data can be obtained from an open banking platform, a third-party payment platform, or an online shopping platform.

[0031] At present, it is possible to mine the implicit data behind open data. These unopened implicit data exist in an implicit form or even in the form of no data. When implicit data involves user privacy, it is easy to cause privacy leakage. Therefore, it is necessary to obtain the open data to be protected to search for implicit data and perform subsequent data security protection processing. For example, the user's consumption records, that is, open data, can be obtained from the online shopping platform. These consumption records exist in the form of display data. The user's privacy data may be inferred based on the consumption records. Therefore, open data needs to be protected.

[0032] The method of obtaining the open data to be protected may be to obtain data in real time or to obtain data from historical data, including but not limited to the above.

[0033] Among them, the target framework includes data graph, information graph and knowledge graph, among which the data graph can be a collection of various data structures including arrays, linked lists, stacks, queues, trees and graphs. The data graph can record the frequency of data occurrence. Data is a symbolic representation of these observable attributes, and is a symbol representing the attributes of objects, events and their environment. The information graph can contain the time relationship of data security resources in a specific scenario. The information graph represents the interaction relationship and transformation between information security resources in the form of a directed graph. The information graph can record the interaction between entities. The knowledge graph has a more complete mapping of demand semantics and a wider coverage. Intelligent reasoning can be performed on the knowledge graph to complete knowledge or complete knowledge questions and answers.

[0034] It should be noted that the target framework is pre-built by relevant configuration personnel based on business resources, which can be open resources and non-open resources within a specified scope. The target framework can be understood as a database for inputting the open data to be protected into the target framework for searching and securely processing the implicit data.

[0035] S120: Input the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected.

[0036] Among them, the target path corresponding to the open data to be protected is the target path corresponding to the data to be protected with implicit data as the effective conclusion.

[0037] Specifically, the open data to be protected is input into the target framework, and a method for obtaining a target path corresponding to the open data to be protected may be: obtaining a comprehensive occurrence frequency of the open data to be protected relative to the data graph and a comprehensive interaction frequency of the open data to be protected relative to the information graph, updating the knowledge graph according to the open data to be protected to obtain a target knowledge graph, and determining at least one strongly connected graph according to the target knowledge graph; determining a target path according to the at least one strongly connected graph, for example, it may be that the occurrence frequency of the open data to be protected in all spaces is counted, and the comprehensive occurrence frequency of the open data to be protected is determined according to the occurrence frequency of the open data to be protected in all spaces; counting two interaction frequencies of the open data to be protected within a space and between spaces, determining a comprehensive interaction frequency according to the two interaction frequencies, updating the knowledge graph according to the open data to be protected to obtain a target knowledge graph; determining at least one strongly connected graph according to the target knowledge graph; and determining a target path according to the at least one strongly connected graph.

[0038] S130: Determine a target node according to the target path, and perform security processing on the target node.

[0039] Specifically, the method for determining the target node according to the target path may be: obtaining the nodes included in the target path, where the target path includes at least one node, and selecting the target node from the nodes included in the target path; the method for determining the target node according to the target path may also be: directly determining the target node according to the target path, which is not limited in this embodiment of the present invention.

[0040] Specifically, the target node is determined according to the target path. For example, the path value of each target path and the node value of each node are obtained, the path node value is determined according to the path value of each target path and the node value of each node, and the node whose path node value is greater than a second threshold is determined as the target node.

[0041] Optionally, determining the target node according to the target path includes:

[0042] Obtain the path value of each target path; obtain the node value of each node; determine the path node value according to the path value of each target path and the node value of each node; determine the node whose path node value is greater than a second threshold as the target node.

[0043] In this embodiment, the second threshold value may be considered as a critical value of the path node value, which may be set in advance by relevant configuration personnel or by the system, and the embodiment of the present invention does not limit this.

[0044] Specifically, path value refers to the value level of the path. The path value of each target path can be obtained by multiplying the length of each target path by the corresponding first value coefficient, and the target paths are sorted according to the obtained target path values. Among them, the first value coefficient refers to the importance of the path among all paths.

[0045] Among them, the node value refers to the value degree of the node. The node value of each node can be obtained by multiplying the importance of each data node by the corresponding second value coefficient, and the nodes are sorted according to each node value. Among them, the second value coefficient refers to the importance of the node relative to all nodes. It should be noted that the first value coefficient and the second value coefficient are only used to distinguish different objects, and can be the same or different.

[0046] The path node value refers to the value of the node relative to the path, for example, the value of node 1 relative to path A.

[0047] Specifically, the path value of each target path is obtained; the node value of each node is obtained; the path node value is determined according to the path value of each target path and the node value of each node; and the node whose path node value is greater than the second threshold is determined as the target node. For example, the path value of the target path can be calculated based on the weighted path length and the first value coefficient, and the target path is sorted according to the path value of the target path, the node value of each node is calculated based on the node importance and the second value coefficient, and the nodes are sorted according to the node value, and the path node value is determined according to the path value of each target path and the node value of each node; the node whose path node value is greater than the second threshold is determined as the target node.

[0048] Optionally, a path node value is determined based on the path value of each target path and the node value of each node, including:

[0049] The path node value can be determined based on the following formula:

[0050]

[0051] Among them, PathValue this PathValue is the path value of the target path VP to which node D belongs. all is the sum of the path values ​​of all target paths, is the node value of node D, and DI is the weight of the node in the knowledge graph.

[0052] Exemplarily, the paths include path 1, path 2, and path 3. The nodes on path 1 include node a, node b, and node c, and the value of node a relative to path 1 is equal to the product of the first ratio, the second value coefficient, and the importance of node a, wherein the first ratio is the ratio of the path value of path 1 to the sum of the path values ​​of all paths (path 1, path 2, and path 3).

[0053] Specifically, given a value input range and a value coefficient range, a set of target path node pairs is obtained, and the open authorization of the target node is revoked or other security processing is performed on the target node.

[0054] Specifically, there may be data insecurity in the nodes in the target path. It is necessary to obtain the path node value and compare it with the set critical value of the path node value to determine whether the node is in danger of exposure. The node whose path node value is greater than the second threshold is determined as the target node, so that the target node is safely processed to achieve the purpose of security protection.

[0055] The first embodiment of the present invention provides a security protection method, which includes: obtaining the open data to be protected and the target framework; inputting the open data to be protected into the target framework to obtain the target path corresponding to the open data to be protected; determining the target node according to the target path, and performing security processing on the target node. The technical solution of this embodiment solves the security problem of the open data to be protected, drives the withdrawal of open authorization through value investment, destroys the acquisition path of implicit data, thereby achieving the purpose of implicit data security protection, allowing users to enjoy the service convenience brought by open banking while ensuring the security of their implicit data.

[0056] Embodiment 2

[0057] Figure 2 A flowchart of a security protection method provided for the second embodiment of the present invention, this embodiment is optimized on the basis of the above embodiment. In this embodiment, the target framework includes: a data graph, an information graph and a knowledge graph; accordingly, the open data to be protected is input into the target framework to obtain the target path corresponding to the open data to be protected, including: obtaining the comprehensive occurrence frequency of the open data to be protected and the data graph; obtaining the comprehensive interaction frequency of the open data to be protected and the information graph; updating the knowledge graph according to the open data to be protected to obtain the target knowledge graph; determining at least one strongly connected graph according to the target knowledge graph; determining the target path and the nodes contained in the target path according to the at least one strongly connected graph.

[0058] like Figure 2 As shown, the security protection method provided by the second embodiment of the present invention specifically includes the following steps:

[0059] S210. Obtain the open data and target framework to be protected.

[0060] It can be understood in this embodiment that before security protection is performed, the data graph, information graph and knowledge graph have been pre-constructed based on business resources, and when security protection is performed, the open data to be protected and the constructed data graph, information graph and knowledge graph are obtained.

[0061] S220: Obtain the comprehensive occurrence frequency of the open data to be protected and the data map.

[0062] Among them, the comprehensive occurrence frequency refers to the comprehensive frequency of the open data to be protected appearing in each space of the data map. It is understandable that in the data map, data nodes have different attributes. In different spatial states, data nodes may be distributed nodes, modules, etc., or they may be custom attributes. It is necessary to count the occurrence frequency of the open data to be protected in all spaces.

[0063] Specifically, the occurrence frequency of the open data to be protected in all spaces is counted; the spatial importance coefficient of the open data to be protected in each space is set, the occurrence frequency of the open data to be protected in all spaces is multiplied by the spatial importance coefficient of each space, and the cumulative sum is obtained to obtain the comprehensive occurrence frequency of the data on the data map.

[0064] In the embodiment of the present invention, a comprehensive appearance frequency (CAF) is defined, and a space of open data to be protected (SOD) is defined. The comprehensive appearance frequency of open data to be protected in the data map is calculated as follows:

[0065] CAF=∑α SOD *Frequency SOD

[0066] Among them, α SOD Represents the spatial importance coefficient, Frequency SOD Indicates the frequency of occurrence of the open data to be protected in this space.

[0067] S230: Obtain the comprehensive interaction frequency between the open data to be protected and the information graph.

[0068] Among them, the comprehensive interaction frequency is a comprehensive value obtained based on the interaction frequency of the open data to be protected within the space, the interaction frequency of the open data to be protected between different spaces, the coefficient of data interaction within the space, and the coefficient of data interaction between different spaces. This comprehensive value is used to characterize the comprehensive interaction frequency of the open data to be protected and the information graph.

[0069] Specifically, the data can be processed for consistency according to the attributes of the open data to be protected; the interaction frequency of the open data to be protected within the space and the interaction frequency of the open data to be protected between different spaces are counted; the coefficient of the data interaction within the space and the coefficient of the data interaction between different spaces are obtained, and the sum of the first interaction frequency and the second interaction frequency is determined as the comprehensive interaction frequency, wherein the first interaction frequency is equal to the product of the interaction frequency of the open data to be protected within the space and the coefficient of the data interaction within the space, and the second interaction frequency is equal to the product of the interaction frequency of the open data to be protected between different spaces and the coefficient of the data interaction between different spaces.

[0070] In the embodiment of the present invention, a comprehensive interaction frequency (CIF) is defined, and the comprehensive interaction frequency of the open data to be protected in the information graph is as follows:

[0071] CIF=∑β SODI *Frequency SODI +∑β SODO *Frequency SODO

[0072] Among them, ∑β SODI *Frequency SODI Represents the frequency of interaction within the space, Frequency SODI represents the interaction frequency of the open data to be protected within the space, β SODI The coefficient representing the interaction within the space; ∑β SODO *Frequency SODO Represents the sum of the interaction frequencies between different spaces. SODO represents the interaction frequency of the open data to be protected between different spaces, β SODO The coefficient representing the interaction between different spaces.

[0073] S240. Update the knowledge graph according to the open data to be protected to obtain a target knowledge graph.

[0074] Specifically, the knowledge graph is updated according to the open data to be protected, and the target knowledge graph is obtained by: obtaining the weights of the nodes in the knowledge graph; determining the entropy of the association relationship between two nodes on the knowledge graph as the weight of the edge; updating the knowledge graph according to the weights of the nodes and the weights of the edges in the knowledge graph. For example, the importance of the nodes in the knowledge graph is calculated based on the comprehensive occurrence frequency, the comprehensive interaction frequency and the node degree, and it is used as the weight of the node. The present invention defines the importance of data nodes as (The degree of importance, DI), and based on the amount of information of the relationship, the entropy of the association relationship between two data on the knowledge graph is calculated, and it is used as the weight of the edge. The present invention defines the entropy of the relationship between data as (The entropy of relationship, ER).

[0075] Optionally, updating the knowledge graph according to the open data to be protected to obtain a target knowledge graph includes:

[0076] Obtain the weights of nodes in the knowledge graph; determine the entropy of the association relationship between two nodes on the knowledge graph as the weight of the edge; and update the knowledge graph according to the weights of the nodes and the weights of the edges in the knowledge graph.

[0077] Among them, the weight of the node can be considered as the importance of the data node in the knowledge graph.

[0078] Specifically, the method for obtaining the weight of a node in a knowledge graph may be: determining the weight of the node according to the weight of the comprehensive occurrence frequency, the weight of the comprehensive interaction frequency, the comprehensive occurrence frequency of the open data to be protected and the data graph, the comprehensive interaction frequency of the open data to be protected and the information graph, and the first adjustment coefficient; the method for obtaining the weight of a node in a knowledge graph may also be: determining the weight of the node according to the weight of the comprehensive occurrence frequency, the weight of the comprehensive interaction frequency, the comprehensive occurrence frequency of the open data to be protected and the data graph, the comprehensive interaction frequency of the open data to be protected and the information graph, the degree of the current node, and the maximum node degree in the knowledge graph.

[0079] Optionally, the weights of nodes in the knowledge graph are calculated based on the following formulas, including:

[0080] DI = θ * (μ1 * CAF + μ2 * CIF);

[0081] Wherein, μ1 is the weight of the comprehensive occurrence frequency, μ2 is the weight of the comprehensive interaction frequency, θ is the first adjustment coefficient, CAF is the comprehensive occurrence frequency of the open data to be protected and the data map, CIF is the comprehensive interaction frequency of the open data to be protected and the information map, Degree this is the node degree, max(Degreeeach ) is the maximum node degree in the knowledge graph.

[0082] Among them, the node degree refers to the number of edges associated with the node, also known as the association degree.

[0083] Specifically, the entropy of the association relationship between two nodes on the knowledge graph is determined as the weight of the edge. For example, the entropy of the association relationship between two data on the knowledge graph is calculated based on the information content of the relationship, and it is used as the weight of the edge. Specifically, in an embodiment of the present invention, the entropy of the relationship between the data is defined (The entropy of relationship, ER), and the calculation of ER is as follows:

[0084] ER=-∑P(x i )log2(x i ),i=1,2,...,n

[0085] Among them, DI is the node weight, xi represents the association relationship between two nodes, P(xi) represents the probability of the association relationship (xi) being established, which is a function of DI, P(x i )=π*DI.

[0086] S250. Determine at least one strongly connected graph according to the target knowledge graph.

[0087] The strongly connected graph is a directed graph, and any two nodes Vi and Vj in the directed graph are connected from Vi to Vj and from Vj to Vi, that is, any two nodes have at least one path. It should be noted that any two nodes can reach each other, and the way of reaching each other can be through other points as a transfer, or directly from one node to another.

[0088] For example, in a directed graph G, if there is at least one mutually reachable path between two nodes, the two nodes are said to be strongly connected. If every two nodes in a directed graph G are strongly connected, G is called a strongly connected graph.

[0089] Optionally, at least one strongly connected graph can be determined based on the target knowledge graph. The method for determining a strongly connected graph can be a depth-first search. Specifically, take any node S of a directed graph G, and perform a depth-first search from S. If all nodes of G can be traversed, reverse all edges of G, and perform a depth-first search from S again. If all nodes of G can be traversed again, then G is a strongly connected graph. If one of the two searches fails to traverse all nodes, then G is not a strongly connected graph. In addition, the method for determining a strongly connected graph can also be a breadth-first search. It should be noted that the embodiments of the present invention only give examples of methods for determining a strongly connected graph, and do not limit them.

[0090] S260: Determine a target path and nodes included in the target path according to the at least one strongly connected graph.

[0091] Specifically, a breadth-first search is performed on at least one strongly connected graph in the target knowledge graph to obtain all unconnected data pairs. It can be understood that a strongly connected graph means that the open data to be protected may be unsafe, and the degree of association between the data in the strongly connected graph needs to be calculated. When the association relationship between the open data to be protected and the data pair is established, the target path and the nodes included in the target path are determined.

[0092] Optionally, determining a target path and nodes included in the target path according to the at least one strongly connected graph includes:

[0093] Obtain the adjacency degree of each strongly connected graph; obtain the target path corresponding to the strongly connected graph whose adjacency degree is greater than the first threshold and the nodes included in the target path.

[0094] The degree of adjacency refers to the degree to which an association relationship is established. The first threshold can be considered as a critical value for reaching an association relationship. This first threshold can be pre-set by relevant configuration personnel or can be set by the system. The embodiment of the present invention does not limit this.

[0095] Specifically, all data pairs that are not adjacent to the open data to be protected can be obtained through at least one strongly connected graph, and the degree of adjacency between the open data to be protected and each data pair can be obtained by calculating all path lengths and numbers of each data pair in the strongly connected graph.

[0096] In the embodiment of the present invention, the degree of adjacency (TDA) is defined, and the calculation of TDA is as follows:

[0097]

[0098] Wherein, Path represents a path set, ∑WPL represents all path lengths of data pairs in a strongly connected graph, and δ represents the second adjustment coefficient.

[0099] Exemplarily, when the degree of adjacency between the open data to be protected and the data pair is greater than a first threshold, it can be considered that this adjacency association relationship is established, indicating that the open data to be protected and the data pair have a close adjacency relationship, and all target paths where the adjacency is established and the nodes included in the paths are output.

[0100] Correspondingly, when the adjacency degree between the open data to be protected and the data pair is less than or equal to the first threshold, it means that the adjacency relationship between the open data to be protected and the data pair has not reached the set adjacency critical value. At this time, the adjacency relationship between the data pair and the open data to be protected is discarded and the next data pair is processed.

[0101] S270: Determine a target node according to the target path, and perform security processing on the target node.

[0102] The target path and the nodes included in the path can be obtained through the above steps. The path value of each target path and the node value of each node can be obtained through calculation. The path node value can be determined according to the path value of each target path and the node value of each node. The path node value is compared with the second threshold. According to the comparison result, the node whose path node value is greater than the second threshold is determined as the target node.

[0103] The target node can be considered as the data node that is most closely associated with the open data to be protected. In order to protect the target node, it is necessary to destroy the acquisition path of the target node, revoke the open authorization of the open data to be protected, or perform security processing.

[0104] The second embodiment provides a security protection method, which includes: obtaining the open data to be protected and the target framework; obtaining the comprehensive occurrence frequency of the open data to be protected and the data graph; obtaining the comprehensive interaction frequency of the open data to be protected and the information graph; updating the knowledge graph according to the open data to be protected to obtain the target knowledge graph; determining at least one strongly connected graph according to the target knowledge graph; determining the target path and the nodes included in the target path according to the at least one strongly connected graph; determining the target node according to the target path, and performing security processing on the target node. The technical solution of this embodiment solves the security problem of the open data to be protected, drives the withdrawal of open authorization through value investment, destroys the acquisition path of implicit data, thereby achieving the purpose of protecting implicit data security, allowing users to enjoy the service convenience brought by open banking while ensuring the security of their implicit data.

[0105] Embodiment 3

[0106] Figure 3 This is a schematic diagram of the structure of a security protection device provided in the third embodiment of the present invention. This embodiment can be applied to the security protection of data in an open banking environment. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides security protection functions, such as Figure 3 As shown, the security protection device specifically includes: an acquisition module 310, a target path determination module 320 and a processing module 330.

[0107] The acquisition module 310 is used to acquire the open data to be protected and the target framework;

[0108] A target path determination module 320, configured to input the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected;

[0109] The processing module 330 is used to determine the target node according to the target path and perform security processing on the target node.

[0110] A security protection device provided in the third embodiment of the present invention obtains the open data to be protected and the target framework; inputs the open data to be protected into the target framework to obtain the target path corresponding to the open data to be protected; determines the target node according to the target path, and performs security processing on the target node. By using this method, the security problem of the open data to be protected is solved, the open authorization is withdrawn through value investment drive, and the acquisition path of implicit data is destroyed, thereby achieving the purpose of implicit data security protection, so that users can enjoy the service convenience brought by open banking while ensuring the security of their implicit data.

[0111] Furthermore, the target framework includes: data graph, information graph and knowledge graph;

[0112] Accordingly, the target path determination module 320 includes:

[0113] An occurrence frequency acquisition unit, used to acquire the comprehensive occurrence frequency of the open data to be protected and the data map;

[0114] An interaction frequency acquisition unit, used to acquire the comprehensive interaction frequency of the open data to be protected and the information graph;

[0115] A target knowledge graph determination unit, configured to update the knowledge graph according to the open data to be protected to obtain a target knowledge graph;

[0116] A strongly connected graph determining unit, used to determine at least one strongly connected graph according to the target knowledge graph;

[0117] A path determination unit is used to determine a target path and nodes included in the target path according to the at least one strongly connected graph.

[0118] Furthermore, the path determination unit is specifically used for:

[0119] Get the adjacency degree of each strongly connected graph;

[0120] A target path corresponding to a strongly connected graph having an adjacency degree greater than a first threshold and nodes included in the target path are obtained.

[0121] Furthermore, the target knowledge graph determination unit is specifically used for:

[0122] Get the weight of the node in the knowledge graph;

[0123] The entropy of the relationship between two nodes on the knowledge graph is determined as the weight of the edge;

[0124] The knowledge graph is updated according to the weights of the nodes and the weights of the edges in the knowledge graph.

[0125] Furthermore, the target knowledge graph determination unit is specifically used for:

[0126] The weight of the node in the knowledge graph is calculated based on the following formula:

[0127] DI = θ * (μ1 * CAF + μ2 * CIF);

[0128] Among them, μ1 is the weight of the comprehensive occurrence frequency, μ2 is the weight of the comprehensive interaction frequency, θ is the first adjustment coefficient, CAF is the comprehensive occurrence frequency, CIF is the comprehensive interaction frequency, Degree this is the node degree, max(Degree each ) is the maximum node degree in the knowledge graph.

[0129] Furthermore, the processing module 330 includes:

[0130] A path value acquisition unit, used to acquire the path value of each target path;

[0131] A node value acquisition unit, used to acquire the node value of each node;

[0132] A path node value determination unit, used to determine the path node value according to the path value of each target path and the node value of each node;

[0133] The target node determination unit is used to determine a node whose path node value is greater than a second threshold as a target node.

[0134] Furthermore, the path node value determination unit is specifically used for:

[0135] The path node value is determined according to the path value of each target path and the node value of each node, including:

[0136] The path node value is determined based on the following formula:

[0137]

[0138] Among them, PathValue this PathValue is the path value of the target path VP to which node D belongs. all is the sum of the path values ​​of all target paths, is the node value of node D, and DI is the weight of the node in the knowledge graph.

[0139] The above-mentioned product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0140] Embodiment 4

[0141] Figure 4 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Figure 4 A block diagram of an electronic device 412 suitable for implementing embodiments of the present invention is shown. Figure 4 The electronic device 412 shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention. The device 412 is a typical computing device for trajectory fitting functions.

[0142] like Figure 4 As shown, the electronic device 412 is in the form of a general purpose computing device. The components of the electronic device 412 may include, but are not limited to: one or more processors 416, a memory 428, and a bus 418 connecting different system components (including the memory 428 and the processor 416).

[0143] Bus 418 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0144] The electronic device 412 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 412, including volatile and non-volatile media, removable and non-removable media.

[0145] The memory 428 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 430 and / or cache memory 432. The electronic device 412 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 434 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a read-only optical disk (Compact Disc-Read Only Memory, CD-ROM), a digital video disk (Digital Video Disc-Read Only Memory, DVD-ROM) or other optical media) may be provided. In these cases, each drive may be connected to the bus 418 via one or more data medium interfaces. The memory 428 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0146] A program 436 having a set (at least one) of program modules 426 may be stored, for example, in a memory 428, such program modules 426 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 426 generally perform the functions and / or methods of the embodiments described herein.

[0147] The electronic device 412 may also communicate with one or more external devices 414 (e.g., keyboard, pointing device, camera, display 424, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 412, and / or communicate with any device that enables the electronic device 412 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 422. In addition, the electronic device 412 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 420. As shown, the network adapter 420 communicates with other modules of the electronic device 412 through a bus 418. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 412, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, disk arrays (Redundant Arrays of Independent Disks, RAID) systems, tape drives, and data backup storage systems.

[0148] The processor 416 executes various functional applications and data processing by running the program stored in the memory 428, for example, implementing the security protection method provided in the above embodiment of the present invention:

[0149] Access to open data to be protected and target frameworks;

[0150] Inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected;

[0151] A target node is determined according to the target path, and security processing is performed on the target node.

[0152] Embodiment 5

[0153] Figure 5 Schematic diagram of the structure of a computer-readable storage medium containing a computer program in an embodiment of the present invention. The embodiment of the present invention provides a computer-readable storage medium 61 on which a computer program 610 is stored. When the program is executed by one or more processors, the security protection method provided in all the invention embodiments of the present application is implemented:

[0154] Access to open data to be protected and target frameworks;

[0155] Inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected;

[0156] A target node is determined according to the target path, and security processing is performed on the target node.

[0157] Any combination of one or more computer-readable media can be used. Computer-readable media can be computer-readable signal media or computer-readable storage media or any combination of the above two. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0158] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0159] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0160] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0161] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0162] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0163] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0164] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0165] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0166] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A security protection method, characterized in that: include: Access to open data to be protected and target frameworks; Inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected; Determine a target node according to the target path, and perform security processing on the target node; The target framework includes: data graph, information graph and knowledge graph; Accordingly, the open data to be protected is input into the target framework to obtain the target path corresponding to the open data to be protected, including: Obtaining the comprehensive occurrence frequency of the open data to be protected in the data map; Obtaining the comprehensive interaction frequency of the open data to be protected in the information graph; Updating the knowledge graph according to the open data to be protected to obtain a target knowledge graph; Determine at least one strongly connected graph according to the target knowledge graph; Determining a target path and nodes included in the target path according to the at least one strongly connected graph; The updating of the knowledge graph according to the open data to be protected to obtain a target knowledge graph includes: Obtaining the weight of the node in the knowledge graph; wherein the weight of the node in the knowledge graph is obtained by calculating the importance of the node in the knowledge graph based on the comprehensive occurrence frequency, the comprehensive interaction frequency and the node degree; The entropy of the relationship between two nodes on the knowledge graph is determined as the weight of the edge; The knowledge graph is updated according to the weights of the nodes and the weights of the edges in the knowledge graph.

2. The method according to claim 1, characterized in that Determining a target path and nodes included in the target path according to the at least one strongly connected graph includes: Get the adjacency degree of each strongly connected graph; A target path corresponding to a strongly connected graph having an adjacency degree greater than a first threshold and nodes included in the target path are obtained.

3. The method according to claim 1, characterized in that The weights of nodes in the knowledge graph are calculated based on the following formulas, including: DI = θ * (μ1 * CAF + μ2 * CIF); Among them, μ1 is the weight of the comprehensive occurrence frequency, μ2 is the weight of the comprehensive interaction frequency, θ is the first adjustment coefficient, CAF is the comprehensive occurrence frequency, CIF is the comprehensive interaction frequency, Degree this is the node degree, max(Degree each ) is the maximum node degree in the knowledge graph.

4. The method according to claim 1, characterized in that: Determining the target node according to the target path includes: Get the path value of each target path; Get the node value of each node; Determine the path node value according to the path value of each target path and the node value of each node; A node whose path node value is greater than a second threshold is determined as a target node.

5. The method according to claim 4, characterized in that The path node value is determined according to the path value of each target path and the node value of each node, including: The path node value is determined based on the following formula: Among them, PathValue this PathValue is the path value of the target path VP to which node D belongs. all is the sum of the path values ​​of all target paths, is the node value of node D, and DI is the weight of the node in the knowledge graph.

6. A safety protection device, characterized in that: include: An acquisition module, used to acquire the open data to be protected and the target framework; A target path determination module, used for inputting the open data to be protected into the target framework to obtain a target path corresponding to the open data to be protected; A processing module, used to determine a target node according to the target path, and perform security processing on the target node; The target framework includes: data graph, information graph and knowledge graph; Accordingly, the target path determination module includes: An occurrence frequency acquisition unit, used to acquire the comprehensive occurrence frequency of the open data to be protected in the data map; An interaction frequency acquisition unit, used to acquire the comprehensive interaction frequency of the open data to be protected in the information graph; A target knowledge graph determination unit, configured to update the knowledge graph according to the open data to be protected to obtain a target knowledge graph; A strongly connected graph determining unit, used to determine at least one strongly connected graph according to the target knowledge graph; A path determination unit, configured to determine a target path and nodes included in the target path according to the at least one strongly connected graph; The target knowledge graph determination unit is specifically used to: Obtaining the weight of the node in the knowledge graph; wherein the weight of the node in the knowledge graph is obtained by calculating the importance of the node in the knowledge graph based on the comprehensive occurrence frequency, the comprehensive interaction frequency and the node degree; The entropy of the relationship between two nodes on the knowledge graph is determined as the weight of the edge; The knowledge graph is updated according to the weights of the nodes and the weights of the edges in the knowledge graph.

7. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the processors are enabled to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium containing a computer program, wherein the computer program is stored thereon, characterized in that: When the program is executed by one or more processors, the method according to any one of claims 1 to 5 is implemented.

Images