Encrypted information management system based on big data

Abstract

The present invention discloses an encrypted information management system based on big data, and relates to the technical field of encrypted information management. The present invention comprises a grading module, a level matching module, an anomaly detection module and a notification module; the grading module is used to analyze the importance of different data in the encrypted information; firstly, the encrypted information is obtained and preliminarily parsed, different data in the encrypted information is obtained, and then the importance of the different data is judged, and specifically a comprehensive analysis is performed through the re-judgment parameters of the collected data, wherein the re-judgment parameters; the present invention dynamically analyzes the importance of data through the grading module, automatically divides the data into three importance levels of low, medium and high, and matches the corresponding encryption strategy, effectively improving the flexibility and security of data management, and ensuring that data of different importance are properly protected.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted information management, and in particular to an encrypted information management system based on big data. Background Art

[0002] In modern society, with the rapid development of information technology, data has become one of the most valuable assets for organizations and businesses. The application of big data technology has brought profound changes to various industries, but it has also brought challenges in data security and privacy protection. In this big data environment, how to effectively manage and protect massive amounts of encrypted information and ensure data security and integrity has become a pressing issue.

[0003] Existing encryption information management systems mostly use static encryption strategies, making them difficult to adapt to the dynamic changes and diversity of data in big data environments. Furthermore, traditional systems lack key management, data access control, and anomaly detection, failing to meet growing security demands. For example, some systems may lack automated key update mechanisms, increasing the risk of key leaks; some systems lack granular data access controls, failing to effectively prevent unauthorized access; and still others rely on manual anomaly detection, resulting in slow response times and an inability to promptly detect and respond to security incidents.

[0004] Although some improvement measures have been taken to address these problems, the existing technology still has the following major defects:

[0005] Insufficient data classification: Existing systems often lack effective data classification mechanisms and are unable to dynamically adjust encryption policies based on data importance.

[0006] Single encryption strategy: Most systems use a unified encryption strategy that cannot meet the differentiated security requirements of data of different importance;

[0007] Limited anomaly detection capabilities: Existing systems have limited anomaly detection capabilities and are insufficient for identifying complex and hidden security threats;

[0008] Inefficient response mechanism: When anomalies are detected, the notification and response mechanism of the existing system is not efficient enough, resulting in processing delays.

[0009] In order to solve the above defects, a technical solution is now provided. Summary of the Invention

[0010] The purpose of the present invention is to solve the problems faced by existing encryption information management systems in a big data environment, such as insufficient data classification, single encryption strategy, limited anomaly detection capability, and inefficient response mechanism, and to propose an encryption information management system based on big data.

[0011] The purpose of the present invention can be achieved through the following technical solutions:

[0012] Encrypted information management system based on big data, including:

[0013] The classification module is used to analyze the importance of different data in the encrypted information. The specific steps are as follows:

[0014] First, the encrypted information is obtained and preliminarily parsed to obtain different data in the encrypted information. Then, the importance of different data is judged, and a comprehensive analysis is performed based on the re-judgment parameters of the collected data.

[0015] Then, based on user needs and salesperson environment, several key parameters in the re-judgment parameters are screened and weights are assigned to each key parameter;

[0016] Set a scoring standard for each key parameter, specifically a quantitative scale, and assign a score to each parameter based on the scoring standard;

[0017] Multiply the score of each parameter by its corresponding weight to obtain the weighted score of the parameter. Calculate the sum of the weighted scores of each parameter to obtain the weighted total score, which is recorded as the re-judgment score. This re-judgment score is used as the criterion for measuring the importance of the data.

[0018] Compare the re-scores calculated for all data in the encrypted information with three preset re-score intervals, where the three preset re-score intervals correspond to low importance, medium importance, and high importance, respectively. Once the re-score of the data falls into the re-score interval, the importance level of the data is determined.

[0019] The level matching module is used to set corresponding encryption strategies for different data according to the classification results of different data;

[0020] Anomaly detection module, which is used to monitor encrypted information in real time after the encryption policy is implemented, and detect data that is not encrypted according to the corresponding policy; it is also used to monitor other anomalies of encrypted information;

[0021] The notification module is used to notify and alert the correct personnel when anomalies in encrypted information are detected.

[0022] Furthermore, the re-judgment parameters in the grading module include:

[0023] Data sensitivity: sensitivity level and amount of data containing personally identifiable information;

[0024] Data value: the commercial or market value of the data and its importance to the organization's operations;

[0025] Data access frequency: the number of times the data is accessed and the activity of the data;

[0026] Data sharing needs: how many organizations or individuals the data needs to be shared between, and the scope and frequency of data sharing;

[0027] Data lifecycle: the cycle of data creation, use, storage and destruction and the storage period of data;

[0028] Potential impact of a data breach: financial losses and potential damage to customer trust and company reputation caused by a data breach;

[0029] Data availability requirements: the impact of data on business continuity and critical operations, and the need for data recovery and backup;

[0030] Data integrity requirements: The importance of data remaining accurate and unaltered during transmission and storage;

[0031] Data dependencies: the dependencies of the data on other systems or data sets and the degree to which the data supports other business processes;

[0032] Data storage and transmission security: security requirements for data during storage and transmission and the security measures and encryption technologies that need to be adopted;

[0033] Classification and labeling of data;

[0034] User and permission levels: Different users’ access rights to data and the impact of user roles and responsibilities on data access;

[0035] Historical importance of data: assessment of the importance of data in the past and the role and impact of data in historical events;

[0036] Data update and maintenance costs: the cost required to maintain data security and the frequency of data update and maintenance.

[0037] Furthermore, the process of the level matching module setting corresponding encryption strategies for different data according to the level matching results of different data is as follows:

[0038] First, define specific encryption strategies for data of different importance levels, including:

[0039] Strategy for low-importance data:

[0040] Encryption algorithm: Use AES-128 bit encryption algorithm;

[0041] Key management: The key is automatically generated by the system, stored in the internal key management system, and replaced every quarter;

[0042] Data access control: Implement basic user authentication, including username and password;

[0043] Data transmission: Use SSL / TLS protocol to protect data transmission on the Internet;

[0044] Data Storage: Store documents using file-level encryption on internal network drives;

[0045] Audit and monitoring: record access logs and conduct security reviews every quarter;

[0046] Encryption strategy for medium-importance data:

[0047] Encryption algorithm: Use AES-256 bit encryption algorithm;

[0048] Key management: The key is generated and managed by the hardware security module and is replaced every six months;

[0049] Data access control: Implement role-based access control and log all access attempts;

[0050] Data transmission: Use end-to-end encryption technology to ensure the security of data during transmission;

[0051] Data storage: Store data in an encrypted database using transparent data encryption;

[0052] Audit and monitoring: Implement real-time monitoring and intrusion detection systems to log all access and changes in detail;

[0053] Encryption strategy for high-importance data:

[0054] Encryption algorithm: Use two-factor encryption, including AES-256 bit encryption plus RSA 4096 bit asymmetric encryption;

[0055] Key management: Keys are generated and managed by a dedicated hardware security module, implementing strict physical and network security measures;

[0056] Data access control: Implement multi-factor authentication and the principle of least privilege to strictly control access rights;

[0057] Data transmission: Use VPN and end-to-end encryption technology to ensure the security of data during transmission;

[0058] Data storage: Implement full disk encryption and encrypted database to ensure the security of data stored on the server;

[0059] Audit and Monitoring: Implement advanced audit and monitoring strategies, including real-time monitoring, intrusion detection, and behavioral analysis;

[0060] Data backup: Encrypt backup data and store it in a secure offline location;

[0061] Disaster recovery: Develop a disaster recovery plan to ensure rapid data recovery;

[0062] Physical security: Strengthen the physical security of the data center, including access control and surveillance cameras;

[0063] Personnel training: Regularly conduct security awareness training and emergency response drills for employees;

[0064] Match the data of different importance levels in the encrypted information with the corresponding encryption strategies, and automatically apply the corresponding encryption strategies to the data based on the matching results;

[0065] Then, user restrictions are imposed on accessing and modifying encryption policies to ensure that only authorized users can access and modify them.

[0066] Furthermore, the anomaly detection module monitors the encrypted information after the encryption policy is implemented in real time, and the specific operation steps for detecting data that is not encrypted according to the corresponding policy are as follows:

[0067] First, detailed data access and encryption status logs are recorded for subsequent anomaly detection and analysis. Automated tools are then used to regularly scan data storage and transmission paths to detect the encryption status of the data. By comparing the actual encryption status with policy rules, data that is not encrypted at the corresponding encryption level is identified.

[0068] When data that is not encrypted according to the corresponding policy is detected, the system automatically triggers an alarm and automatically isolates the data that does not comply with the encryption policy to prevent potential data leakage or abuse. At the same time, it restricts or revokes access rights to the data that does not comply with the encryption policy until the data is correctly encrypted according to the established encryption policy.

[0069] Trace the data's source and access history to determine the reason and responsible party for not encrypting according to the policy. If the data not encrypted according to the corresponding policy is personal data, notify the user and guide the user to take remedial measures.

[0070] Before data is encrypted according to the correct policy, unencrypted data is automatically encrypted according to the encryption policy for high-importance data, and detailed event information is recorded, including events, affected data, and detected anomalies.

[0071] Furthermore, the specific operation steps of the anomaly detection module for monitoring other anomalies of the encrypted information are as follows:

[0072] First, define the abnormal behavior baseline to determine what operations constitute abnormal behavior and establish a baseline based on normal operations. Then, label and classify the data and mark it according to sensitivity so that appropriate monitoring strategies can be applied.

[0073] Deploy a security information and event management system, implement a security information and event management system to centrally manage logs, monitor and analyze security events, and integrate intrusion detection systems and intrusion prevention systems to defend against potential intrusions and abnormal traffic;

[0074] Then, use FIM tools to monitor key encryption information and corresponding configuration changes to detect unauthorized changes, and deploy EDR tools on endpoints to monitor and respond to malicious behavior and abnormal activities.

[0075] Automatically execute security policies and compliance checks to ensure compliance with security standards, and then use machine learning models to analyze data and identify abnormal patterns;

[0076] When an abnormal situation of encrypted information is detected or identified, an alert is triggered and the correct personnel are notified to take appropriate actions.

[0077] Furthermore, the specific operation steps for the notification module to notify and alert the correct personnel when detecting an abnormality in the encrypted information are as follows:

[0078] First, analyze the abnormal situation of the encrypted information to determine its urgency. Then, analyze the evaluation parameters of the abnormal situation and conduct a comprehensive analysis to obtain the emergency assessment value. Then, compare the obtained emergency assessment value with the preset emergency assessment threshold. If the emergency assessment value is greater than or equal to the preset emergency assessment threshold, the data abnormal situation is judged to be an emergency abnormal event. Otherwise, the data abnormal situation is judged to be a normal abnormal event.

[0079] When the data anomaly is determined to be an emergency anomaly, the recipients who can receive the notification are identified and listed. The notification channel is configured based on the recipient's preferences, and the preferred notification recipient is determined based on the recipient's priority.

[0080] The priority of the receiver is determined by collecting the priority parameters of the receiver and comprehensively analyzing them to obtain the priority value. The priority values ​​calculated for all listed receivers that can receive notifications are sorted by size, and receivers with larger priority values ​​are notified first, thereby improving the efficiency of responding to emergency abnormal situations.

[0081] Furthermore, the analysis process of the tight assessment value in the notification module is as follows:

[0082] Judging parameters include:

[0083] Impact Scope: Count the number of users and systems affected by the data anomaly, normalize the number of users and systems, multiply them by the user weight factor and the system weight factor respectively, and sum them to obtain the impact value. This impact value is used as the standard for measuring the impact scope of the data anomaly.

[0084] Leakage risk: Analyze the probability of leakage after the data anomaly occurs and record it as the leakage rate value;

[0085] Data completeness: The percentage of statistical data that has been tampered with or damaged, recorded as the data completeness value;

[0086] Data level: Determine the importance level of the abnormal data, including low importance, medium importance, and high importance. Compare the low importance level, medium importance level, and high importance level and assign scores of 5, 10, and 15 respectively, which are recorded as the level value;

[0087] Then normalize the obtained Fanying value, leakage rate value, number completion value and level value respectively and substitute them into the following formula: To obtain the tight assessment value JPZ, and use this tight assessment value as a measure of the urgency of the abnormal data. In the formula, fy, xl, sw and jb are the range value, leakage rate value, number completion value and level value respectively.

[0088] Furthermore, the analysis process of the priority value in the notification module is as follows:

[0089] The receiver priority is determined by collecting the receiver's priority parameters, including:

[0090] Responsibility relevance: Evaluate the relevance of the data anomaly to the recipient's personal responsibilities and assign a score of 1-10 to the relevance, which is recorded as the job evaluation value;

[0091] Historical processing data: Analyze the total number, success rate, and average duration of the receiver's processing of the data anomaly type. After normalizing the total number, success rate, and average duration, multiply the total number and success rate by the average duration as the two sides of a triangle. Set a preset angle and connect the remaining sides of the triangle to form a triangle. The preset angle is set between 60-75 degrees. Use half of the average duration as the radius and draw a circle with the midpoint of the average duration as the length of the three sides of the triangle as the center. Cut the triangle and calculate the remaining area of ​​the triangle, which is recorded as the historical judgment value.

[0092] Geolocation: Obtain the actual distance between the receiver and the location of the data anomaly, recorded as the distance evaluation value;

[0093] Response event: Analyze the interval between the time when the receiver receives an emergency notification and the time when the receiver handles the event, and calculate the average value;

[0094] Then normalize the job evaluation value, history judgment value, distance evaluation value and location mean value respectively and substitute them into the following formula: In order to obtain the priority value YJZ, this priority value is used as the measurement standard for measuring the priority notification of the recipient, where zpz, lpz, jpz and cjz are the job evaluation value, history judgment value, distance evaluation value and location average value respectively.

[0095] Compared with the prior art, the present invention has the following beneficial effects:

[0096] (1) The present invention dynamically analyzes the importance of data through a grading module, automatically classifies the data into three importance levels: low, medium, and high, and matches the corresponding encryption strategies, effectively improving the flexibility and security of data management and ensuring that data of different importance levels are properly protected;

[0097] (2) The anomaly detection module of the present invention can monitor the status of encrypted information in real time, and promptly detect and respond to data that is not encrypted according to the policy and other anomalies. The real-time monitoring and rapid response capabilities can effectively and significantly improve the system's defense capabilities against potential security threats and reduce the risk of data leakage and abuse.

[0098] (3) In the present invention, the notification module can intelligently assess the urgency of the event based on preset urgency evaluation parameters when an anomaly is detected, and give priority to notifying the most relevant personnel. This intelligent notification mechanism improves the efficiency of responding to emergency anomalies and ensures that key personnel can take quick action. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0100] Figure 1 This is the overall system block diagram of the present invention. DETAILED DESCRIPTION

[0101] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0102] It should be understood that the terms “include” and “comprising” used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0103] It should also be understood that the terminology used in this disclosure is for the purpose of describing specific embodiments only and is not intended to limit the disclosure. As used in this disclosure and the claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should be further understood that the term "and / or" as used in this disclosure and the claims refers to any and all possible combinations of one or more of the associated listed items, including and including these combinations.

[0104] like Figure 1 As shown, the encryption information management system based on big data includes a grading module, a level matching module, an anomaly detection module and a notification module;

[0105] The classification module is used to analyze the importance of different data in the encrypted information;

[0106] First, the encrypted information is obtained and preliminarily parsed to obtain different data in the encrypted information. Then, the importance of different data is judged. Specifically, a comprehensive analysis is performed using the re-judgment parameters of the collected data, where the re-judgment parameters include:

[0107] Data sensitivity: sensitivity level (such as public, internal, confidential, top secret); amount of data containing personally identifiable information (PII); data value: the commercial value or market value of the data; the importance of the data to the organization's operations; data access frequency: the number of times the data is accessed; data activity (i.e., how often the data is used and updated); data sharing requirements: how many organizations or individuals the data needs to be shared between; the scope and frequency of data sharing; data life cycle: the cycle of data creation, use, storage and destruction; the storage period of data; the potential impact of data leakage: the financial loss that may result from data leakage; the potential damage to customer trust and company reputation; data availability requirements: the impact of data on business continuity and critical operations; data recovery and backup requirements; data integrity ... The importance of maintaining accuracy and non-tampering during transmission and storage; Data dependencies: the dependencies of data on other systems or data sets; the degree to which data supports other business processes; Data storage and transmission security: the security requirements for data during storage and transmission; the security measures and encryption technologies that need to be adopted; Data classification and labeling: data classification (such as financial data, personal data, operational data, etc.); Data labels (such as high risk, high value, need to be protected, etc.); User and permission levels: the access rights of different users to data; the impact of user roles and responsibilities on data access; The historical importance of data: the assessment of the importance of data in the past; the role and impact of data in historical events; Data update and maintenance costs: the cost required to maintain data security; the frequency of data updates and maintenance;

[0108] Based on user needs and the salesperson's environment, several key parameters in the re-judgment parameters are screened, and a weight is assigned to each key parameter. The weight reflects the importance of the parameter in the data importance assessment, and the total weight is 1. A scoring standard is then set for each key parameter, specifically a quantitative scale, including 1-10 or 1-100, and a score is assigned to each parameter based on the scoring standard. The score of each parameter is multiplied by its corresponding weight to obtain the parameter's weighted score. The sum of the weighted scores of each parameter is calculated to obtain the weighted total score, which is recorded as the re-judgment score. This re-judgment score is used as the judgment standard for measuring the importance of the data.

[0109] The re-scores calculated for all data in the encrypted information are compared with the three preset re-score intervals, where the three preset re-score intervals correspond to low importance level, medium importance level and high importance level respectively. When the re-score interval to which the data belongs is determined, the importance level of the data is determined.

[0110] The level matching module is used to set corresponding encryption strategies for different data according to the classification results of different data;

[0111] First, define specific encryption strategies for data of different importance levels, including:

[0112] Strategy for low-importance data: Encryption algorithm: Use AES-128-bit encryption algorithm; Key management: Keys are automatically generated by the system, stored in the internal key management system, and replaced every quarter; Data access control: Implement basic user authentication, including username and password; Data transmission: Use SSL / TLS protocol to protect data transmission over the Internet; Data storage: Use file-level encryption to store documents on internal network drives; Audit and monitoring: Record access logs and conduct security reviews every quarter;

[0113] Encryption strategy for medium-critical data: Encryption algorithm: Use the AES-256-bit encryption algorithm; Key management: Keys are generated and managed by a hardware security module (HSM) and replaced every six months; Data access control: Implement role-based access control (RBAC) and log all access attempts; Data transmission: Use end-to-end encryption technology to ensure data security during transmission; Data storage: Store data in an encrypted database using transparent data encryption (TDE); Audit and monitoring: Implement real-time monitoring and intrusion detection systems to record all access and changes in detail;

[0114] Encryption strategy for high-importance data: Encryption algorithm: Use two-factor encryption, including AES-256-bit encryption plus RSA 4096-bit asymmetric encryption; Key management: Keys are generated and managed by a dedicated hardware security module (HSM), and strict physical and network security measures are implemented; Data access control: Implement multi-factor authentication and the principle of least privilege to strictly control access rights; Data transmission: Use VPN and end-to-end encryption technology to ensure the security of data during transmission; Data storage: Implement full-disk encryption and encrypted database to ensure the security of data stored on the server; Audit and monitoring: Implement advanced audit and monitoring strategies, including real-time monitoring, intrusion detection, and behavioral analysis; Data backup: Encrypt backup data and store it in a secure offline location; Disaster recovery: Develop a detailed disaster recovery plan to ensure rapid data recovery; Physical security: Strengthen the physical security of the data center, including access control and surveillance cameras; Personnel training: Conduct regular security awareness training and emergency response drills for employees; Match data of different importance levels in the encrypted information with the corresponding encryption policies mentioned above, and automatically apply the corresponding encryption policies to the data based on the matching results; User restrictions are then implemented on accessing and modifying encryption policies to ensure that only authorized users can access and modify them.

[0115] The anomaly detection module is used to monitor encrypted information in real time after the encryption policy is implemented, and detect data that is not encrypted according to the corresponding policy. The specific steps are as follows:

[0116] First, detailed data access and encryption status logs are recorded for subsequent anomaly detection and analysis. Automated tools are then used to regularly scan data storage and transmission paths to detect the encryption status of the data. By comparing the actual encryption status with policy rules, data that is not encrypted according to the corresponding encryption level is identified. When data that is not encrypted according to the corresponding policy is detected, the system automatically triggers an alarm and automatically isolates the data that does not comply with the encryption policy to prevent potential data leakage or abuse. At the same time, access rights to data that does not comply with the encryption policy are restricted or revoked until the data is correctly encrypted according to the established encryption policy. The data source and access history are traced back to determine the reasons and responsible persons for not being encrypted according to the policy. When the data that is not encrypted according to the corresponding policy is personal data, the user is notified and guided to take remedial measures. Before the data is encrypted according to the correct policy, the unencrypted data is automatically encrypted according to the encryption policy for high-importance data, and detailed event information is recorded, including the event, the affected data, and the detected anomalies.

[0117] It is also used to monitor other abnormal situations of encrypted information. The specific steps are as follows:

[0118] First, define the abnormal behavior baseline, determine what operations constitute abnormal behavior, and establish a baseline based on normal operations, label and classify the data, and mark it according to sensitivity so that appropriate monitoring strategies can be applied; deploy a security information and event management (SIEM) system, implement the SIEM system to centrally manage logs, monitor and analyze security events, and integrate intrusion detection systems (IDS) and intrusion prevention systems (IPS) to defend against potential intrusions and abnormal traffic; then use FIM tools to monitor key encrypted information and corresponding configuration changes to detect unauthorized changes, deploy EDR tools on endpoints to monitor and respond to malicious behavior and abnormal activities; automatically perform security policy and compliance checks to ensure compliance with security standards, and then use machine learning models to analyze data and identify abnormal patterns; when it is determined that an abnormal situation of encrypted information is monitored or identified, an early warning is initiated and the correct personnel are notified to take appropriate actions.

[0119] The notification module is used to notify the correct personnel when anomalies in encrypted information are detected. The specific process is as follows:

[0120] First, analyze the abnormal situation of the encrypted information to determine its urgency. A comprehensive analysis is performed by analyzing the evaluation parameters of the abnormal situation, including:

[0121] Impact Scope: Count the number of users and systems affected by the data anomaly, normalize the number of users and systems, multiply them by the user number weight factor and the system number weight factor respectively, and sum them to obtain the range value. This range value is used as the standard for measuring the impact scope of the data anomaly. Leakage Risk: Analyze the probability of leakage after the data anomaly, and record it as the leakage rate value. Data Completeness: The percentage of statistical data that has been tampered with or damaged is recorded as the data completeness value. Data Level: Determine the importance level of the data with the anomaly, including low importance, medium importance, and high importance. Compare the low importance level, medium importance level, and high importance level, and assign scores of 5, 10, and 15 to the low importance level, medium importance level, and high importance level, respectively, and record them as the level value.

[0122] Then normalize the obtained Fanying value, leakage rate value, number completion value and level value respectively and substitute them into the following formula: The emergency assessment value JPZ is obtained and used as a measure of the urgency of the abnormal data. In the formula, fy, xl, sw and jb are the fan value, leakage rate value, data completion value and level value respectively. The obtained emergency assessment value is then compared with the preset emergency assessment threshold. When the emergency assessment value is greater than or equal to the preset emergency assessment threshold, the data abnormality is judged to be an emergency abnormal event. Otherwise, the data abnormality is judged to be a normal abnormal event.

[0123] When the data anomaly is determined to be an emergency anomaly, the recipients who can receive the notification are identified and listed. According to the recipient's preferences, notification channels are configured, including email, SMS, phone, mobile application push, etc., and the preferred notification recipient is determined based on the recipient's priority. The recipient priority is determined by collecting the recipient's priority parameters, including:

[0124] Responsibility relevance: Evaluate the relevance of data anomalies to the recipient's personal responsibilities, and assign a score of 1-10 to the relevance, which is recorded as the job evaluation value; Historical processing data: Analyze the total number, success rate and average time of the recipient's processing of this data anomaly type, and after normalizing the total number, success rate and average time, multiply the total number and success rate by the average time as the two sides of the triangle, and preset an angle to connect the remaining side of the triangle to form a triangle, where the preset angle is set between 60-75°, and then use half of the average time as the radius, and draw a circle with the midpoint of the average time of the three sides of the triangle as the side length as the center, cut the triangle, calculate the remaining area of ​​the triangle, and record it as the historical judgment value; Geographic positioning: Obtain the actual distance between the recipient and the location of the data anomaly, which is recorded as the distance evaluation value; Response event: Analyze the interval between the recipient receiving an emergency notification and the event processing, and calculate the average to obtain the average value;

[0125] Then normalize the job evaluation value, history judgment value, distance evaluation value and location mean value respectively and substitute them into the following formula: In order to obtain the priority value YJZ, this priority value is used as the measurement standard for the priority notification of the receiver, where zpz, lpz, jpz and cjz are the job evaluation value, history judgment value, distance evaluation value and location average value respectively; the priority values ​​calculated for all the listed receivers who can receive the notification are sorted according to size, and the receivers with larger priority values ​​are notified first, so as to improve the efficiency of responding to emergency abnormal situations.

[0126] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An encrypted information management system based on big data, characterized in that: include; The classification module is used to analyze the importance of different data in the encrypted information. The specific steps are as follows: First, the encrypted information is obtained and preliminarily analyzed to obtain different data in the encrypted information, and then the importance of different data is judged, specifically by performing a comprehensive analysis through the re-judgment parameters of the collected data; Then, according to user needs and salesperson environment, several key parameters in the re-judgment parameters are screened and weights are assigned to each key parameter; Set a scoring standard for each key parameter, specifically a quantitative scale, and assign a score to each parameter based on the scoring standard; Multiply the score of each parameter by its corresponding weight to get the weighted score of the parameter. Calculate the sum of the weighted scores of each parameter to get the weighted total score, which is recorded as the re-judgment score. This re-judgment score is used as the criterion for measuring the importance of the data. Compare the re-judgment scores calculated for all data in the encrypted information with three preset re-judgment score intervals, wherein the three preset re-judgment score intervals correspond to low importance level, medium importance level and high importance level respectively. When the re-judgment score interval to which the data belongs is determined, the importance level to which the data belongs is determined; A level matching module is used to set corresponding encryption strategies for different data according to the classification results of different data; The anomaly detection module is used to monitor the encrypted information after the encryption policy is implemented in real time and detect the data that is not encrypted according to the corresponding policy. The specific process is as follows: First, record detailed data access and encryption status logs for subsequent anomaly detection and analysis. Then use automated tools to regularly scan data storage and transmission paths to detect the encryption status of data. By comparing the actual encryption status with policy rules, identify data that is not encrypted at the corresponding encryption level. When data that is not encrypted according to the corresponding policy is detected, the system automatically triggers an alarm and automatically isolates the data that does not comply with the encryption policy to prevent potential data leakage or abuse. At the same time, it restricts or revokes access rights to the data that does not comply with the encryption policy until the data is correctly encrypted according to the established encryption policy. Trace the data source and access history to determine the reason and person responsible for not encrypting according to the policy. When the data not encrypted according to the corresponding policy is personal data, notify the user and guide the user to take remedial measures. Before data is encrypted according to the correct policy, unencrypted data is automatically encrypted according to the encryption policy for high-importance data, and detailed event information is recorded, including the event, the affected data, and the detected anomalies; It is also used to monitor other abnormal situations of encrypted information. The specific operation steps are as follows: First, define the abnormal behavior baseline, determine what operations constitute abnormal behavior, and establish a baseline based on normal operations. Label and classify the data and mark it according to sensitivity so that appropriate monitoring strategies can be applied. Deploy a security information and event management system, implement a security information and event management system to centrally manage logs, monitor and analyze security events, and integrate intrusion detection systems and intrusion prevention systems to defend against potential intrusions and abnormal traffic; Then, use FIM tools to monitor key encryption information and corresponding configuration changes to detect unauthorized changes, and deploy EDR tools on endpoints to monitor and respond to malicious behavior and abnormal activities. Automatically execute security policies and compliance checks to ensure compliance with security standards, and then use machine learning models to analyze data and identify abnormal patterns; When an abnormal situation of encrypted information is detected or identified, an early warning is initiated and the correct personnel are notified to take appropriate actions; The notification module is used to notify the correct personnel when anomalies in encrypted information are detected.

2. The encryption information management system based on big data according to claim 1 is characterized in that: The re-judgment parameters in the classification module include: Data sensitivity: sensitivity level and amount of data containing personally identifiable information; Data value: the commercial or market value of the data and its importance to the organization’s operations; Data access frequency: the number of times the data is accessed and the activity of the data; Data sharing needs: how many organizations or individuals the data needs to be shared between, and the scope and frequency of data sharing; Data life cycle: the cycle of data creation, use, storage and destruction and the storage period of data; Potential impact of a data breach: financial losses and potential damage to customer trust and company reputation caused by a data breach; Data availability requirements: the impact of data on business continuity and key operations and the need for data recovery and backup; Data integrity requirements: the importance of data remaining accurate and unaltered during transmission and storage; Data dependency: the dependency of data on other systems or data sets and the degree to which data supports other business processes; Data storage and transmission security: security requirements for data during storage and transmission and the security measures and encryption technologies that need to be adopted; Classification and labeling of data; Users and permission levels: the access rights of different users to data and the impact of user roles and responsibilities on data access; Historical importance of data: assessment of the importance of data in the past and the role and impact of data in historical events; Data update and maintenance costs: the cost required to maintain data security and the frequency of data update and maintenance.

3. The encryption information management system based on big data according to claim 1 is characterized in that: The process of the level matching module setting corresponding encryption strategies for different data according to the level matching results of different data is as follows: First, define specific encryption strategies for data of different importance levels, including: Strategy for low importance data: Encryption algorithm: Use AES-128 bit encryption algorithm; Key management: The key is automatically generated by the system, stored in the internal key management system, and replaced every quarter; Data access control: Implement basic user authentication, including username and password; Data transmission: Use SSL / TLS protocol to protect data transmission over the Internet; Data storage: Store documents using file-level encryption on internal network drives; Audit and monitoring: record access logs and conduct security reviews every quarter; Encryption strategy for medium-importance data: Encryption algorithm: Use AES-256 bit encryption algorithm; Key management: The key is generated and managed by the hardware security module and is replaced every six months; Data access control: Implement role-based access control and log all access attempts; Data transmission: Use end-to-end encryption technology to ensure the security of data during transmission; Data storage: Store data in an encrypted database using transparent data encryption; Audit and monitoring: Implement real-time monitoring and intrusion detection systems to log all access and changes in detail; Encryption strategy for high-importance data: Encryption algorithm: Use two-factor encryption, including AES-256-bit encryption plus RSA 4096-bit asymmetric encryption; Key management: Keys are generated and managed by dedicated hardware security modules, implementing strict physical and network security measures; Data access control: Implement multi-factor authentication and the principle of least privilege to strictly control access rights; Data transmission: Use VPN and end-to-end encryption technology to ensure the security of data during transmission; Data storage: Implement full disk encryption and encrypted database to ensure the security of data stored on the server; Audit and Monitoring: Implement advanced audit and monitoring strategies, including real-time monitoring, intrusion detection, and behavioral analysis; Data backup: Encrypt backup data and store it in a secure offline location; Disaster recovery: Develop a disaster recovery plan to ensure rapid data recovery; Physical security: Strengthen the physical security of the data center, including access control and surveillance cameras; Personnel training: Regularly conduct security awareness training and emergency response drills for employees; Matching data of different importance levels in the encrypted information with the corresponding encryption strategies, and automatically applying the corresponding encryption strategies to the data based on the matching results; Then, impose user restrictions on accessing and modifying encryption policies to ensure that only authorized users can access and modify them.

4. The encryption information management system based on big data according to claim 1 is characterized in that: The specific operation steps of the notification module to notify and alert the correct personnel when detecting an abnormality in encrypted information are as follows: First, analyze the abnormal situation of the encrypted information to determine its urgency. Perform a comprehensive analysis of the evaluation parameters of the abnormal situation to obtain an emergency assessment value. Then compare the obtained emergency assessment value with the preset emergency assessment threshold. When the emergency assessment value is greater than or equal to the preset emergency assessment threshold, it is determined that the data abnormal situation is an emergency abnormal event. Otherwise, it is determined that the data abnormal situation is a normal abnormal event. When it is determined that the data anomaly is an emergency anomaly, the recipients who can receive the notification are determined and listed, and the notification channel is configured according to the preferences of the recipients, and the preferred notification recipients are determined according to the priorities of the recipients; The priority of the receiver is determined by collecting the priority parameters of the receiver and comprehensively analyzing them to obtain the priority value. The priority values ​​calculated for all listed receivers that can receive notifications are sorted by size, and receivers with larger priority values ​​are notified first, thereby improving the efficiency of responding to emergency abnormal situations.

5. The encryption information management system based on big data according to claim 4 is characterized in that: The analysis process of the tight assessment value in the notification module is as follows: The judging parameters include: Impact scope: Count the number of users and systems affected by the data anomaly, normalize the number of users and systems, multiply them by the user number weight factor and the system number weight factor respectively, and sum them up to get the impact value, which is used as the standard to measure the impact scope of the data anomaly; Leakage risk: Analyze the probability of leakage after the data is abnormal and record it as the leakage rate value; Data completeness: The percentage of data that has been tampered with or damaged, recorded as the data completeness value; Data level: Determine the importance level of the abnormal data, including low importance level, medium importance level and high importance level. Compare the low importance level, medium importance level and high importance level and assign scores of 5, 10 and 15 respectively, which are recorded as the level value; Then normalize the obtained Fanying value, leakage rate value, number of complete values ​​and level value respectively and substitute them into the following formula: ; To obtain the tight assessment value JPZ, and use this tight assessment value as a measure of the urgency of the abnormal data, where fy, xl, sw and jb are the fan value, leakage rate value, digital completion value and level value respectively.

6. The encryption information management system based on big data according to claim 4 is characterized in that: The analysis process of the priority value in the notification module is as follows: The receiver priority is determined by collecting the receiver's priority parameters, including: Responsibility relevance: Evaluate the relevance of the data anomaly to the recipient's personal responsibilities and assign a score of 1-10 to the relevance, which is recorded as the job evaluation value; Historical processing data: Analyze the total number, success rate and average duration of the receiver's processing of the data anomaly type, and after normalizing the total number, success rate and average duration, multiply the total number and success rate by the average duration as the two sides of the triangle, and preset the angle, connect the other remaining side of the triangle to form a triangle, where the preset angle is set between 60-75°, and then use half of the average duration as the radius, draw a circle with the midpoint of the average duration of the three sides of the triangle as the side length as the center, cut the triangle, and calculate the remaining area of ​​the triangle, which is recorded as the historical judgment value; Geolocation: Get the actual distance between the receiver and the location of the data anomaly, recorded as the distance evaluation value; Response event: Analyze the interval between the time when the receiver receives an emergency notification and the time when it processes the notification, and calculate the average value to obtain the average value; Then normalize the job evaluation value, historical judgment value, distance evaluation value and location mean value respectively and substitute them into the following formula: ; To obtain the priority value YJZ, and use this priority value as the measurement standard for measuring the priority notification of the recipient, where zpz, lpz, jpz and cjz are the job evaluation value, historical judgment value, distance evaluation value and location average value respectively.

Images