A comprehensive security management system for trusted data space

Abstract

The present invention provides a comprehensive security management system for a trusted data space, which relates to the field of management data processing technology, and includes: an authority determination module: a user sends a data extraction request to a blockchain node, obtains the user's data and analyzes it, and determines whether to grant the user's extraction authority; a request positioning module: locates the target block in the distributed ledger according to the key parameters of the extraction request; a data verification module: extracts the target data in the target block and verifies the integrity of the data; a data monitoring module: when the user operates on the target data, the user's data operation is monitored to generate an operation chain, and encrypted storage is performed. The security management of the entire process of data extraction, verification, and monitoring is realized.

Description

Technical Field

[0001] The present invention relates to the field of management data processing technology, and in particular to a comprehensive security management system for a trusted data space. Background Art

[0002] With the continuous advancement of digital transformation, data security and privacy protection have become the focus of attention in various industries. Especially in data space management, how to ensure the credibility and security of data is an urgent problem to be solved.

[0003] Existing technical solutions usually adopt a single permission control and data verification method, but this method has problems such as insufficient security and difficulty in ensuring data integrity when facing a complex distributed data environment. For example, in some existing technologies, the user's permission control and data extraction process lack refined management, resulting in an increased risk of data leakage or tampering. In addition, the monitoring and storage methods of user operations in the existing technologies are relatively simple and difficult to meet high security requirements.

[0004] Therefore, the present invention provides a comprehensive security management system for a trusted data space. Summary of the invention

[0005] The present invention provides a comprehensive security management system for trusted data space, which is used to ensure data access security through dynamic permission analysis, improve retrieval efficiency by nonlinearly locating target blocks using key parameters, verify data integrity to prevent tampering, and achieve full traceability and auditing of operations by generating encrypted operation chains, thereby enhancing the transparency and security of data management.

[0006] The present invention provides a comprehensive security management system for a trusted data space, comprising:

[0007] Permission determination module: The user sends a data extraction request to the blockchain node, obtains the user's data and analyzes it to determine whether to grant the user extraction permission;

[0008] Request location module: locates the target block in the distributed ledger according to the key parameters of the extraction request;

[0009] Data verification module: extracts target data from the target block and verifies the integrity of the data;

[0010] Data monitoring module: When a user operates on target data, the user's data operation is monitored to generate an operation chain, which is then encrypted and stored;

[0011] The data monitoring module includes:

[0012] Operation capture unit: When a user operates on data, it monitors the user's data operation based on a preset multi-level capture mechanism and records the relevant information of each data operation;

[0013] Operation chain generation unit: generates a corresponding operation chain based on the relevant information of the user's data operation;

[0014] Operation chain encryption unit: Based on the preset double-layer encryption strategy, each operation node in the operation chain is individually encrypted based on the preset node encryption algorithm, and the entire operation chain is encrypted as a whole based on the preset chain encryption algorithm;

[0015] Operation chain storage unit: stores the encrypted operation chain based on a preset storage method, generates a new chain when storing the operation chain, and links the new chain with the previous storage chain to form a storage chain;

[0016] The operation chain generation unit includes:

[0017] Data calculation subunit: performs hash calculation on the data involved in the data operation based on a preset combined hash algorithm to generate a unique hash value of the operation data;

[0018] Data chain generation subunit: Generates a data chain based on the data version affected by each data operation, the specific data operation summary of each data operation, the dependency relationship between the data and related data for each data operation, and the hash value of the data and related data for each data operation;

[0019] Permission chain generation subunit: generates permission chains based on user information and authorization records of data operations;

[0020] Behavior chain generation subunit: generates a behavior chain based on the type of data operation performed by the user, the time when the operation occurs, and the context information of the operation;

[0021] Operation chain determination subunit: associate the data chain, permission chain and behavior chain based on a preset association algorithm to generate a corresponding operation chain.

[0022] The present invention provides a comprehensive security management system for a trusted data space, an authority determination module, comprising:

[0023] Data acquisition unit: when a user sends a data extraction request to a blockchain node, the data extraction request is analyzed to obtain relevant data of the data extraction request;

[0024] Permission determination unit: obtains user data and analyzes it to determine the user's access rights;

[0025] Permission determination unit: performs permission determination based on the user's access rights and the relevant data of the data extraction request to determine whether to grant the user extraction permission.

[0026] The present invention provides a comprehensive security management system for a trusted data space, an authority determination unit, comprising:

[0027] Information extraction subunit: obtains the user's basic information and extracts the user's security level and historical access records from the user database;

[0028] Level determination subunit: Based on the user role and department, obtain the user's corresponding data access permission level from the preset permission rule database;

[0029] Record analysis subunit: Analyze the user's historical access records, and then determine the user's behavior trustworthiness based on the user's basic information:

[0030] ;in, is the user's behavior trust, F is the frequency of the user accessing the system, is the average access frequency of all users, is the normalized frequency of user access to the system, β is the preset adjustment coefficient of the access frequency, is the preset weight of the access frequency, t is the total time the user visits the system, is the expected total access time. is a preset adjustment parameter used to control the impact of access time deviation on behavior trust. Score the user's abnormal behavior based on historical access records. is a preset adjustment parameter used to control the impact of abnormal behavior on behavior trust. is the hyperbolic tangent function, Mapping value for the basic information of the i-th user, is the preset standard mapping value corresponding to the basic information of the i-th user, is a preset adjustment parameter for controlling the impact of differences in users’ basic information on behavior trust, and n is the number of items of users’ basic information;

[0031] Score determination subunit: Determines the user's comprehensive access rights score based on the user's behavior trust and the corresponding data access rights level:

[0032] ;in, is the user's comprehensive access permission score, L is the user's basic data access permission level, The user's behavioral trust, To control the preset weights of data access permissions, To control the preset weight of user behavior trust, is the influence weight used to adjust the data access rights and user behavior trust difference scores, is the conversion coefficient corresponding to the user's basic data access permission level, is the conversion coefficient corresponding to the user's behavioral trust, The preset adjustment coefficient corresponding to the difference between data access rights and user behavior trust, is the preset adjustment item. To smooth the transition between the trust of user behavior and data access rights, is a preset scaling factor used to adjust the overall calculation result;

[0033] Permission determination subunit: determines whether to grant the user's extraction permission based on the user's comprehensive access permission score and the preset permission score.

[0034] The present invention provides a comprehensive security management system for a trusted data space, a request positioning module, comprising:

[0035] Parameter extraction unit: analyzes the user's data extraction request, and then obtains several request parameters of the user's data extraction request;

[0036] Data determination unit: determines the matching hash value of the target data set to be extracted based on the request parameters:

[0037] ;in, is the matching hash value of the target dataset to be extracted, is the first nested hash value, t is the timestamp corresponding to the current time, , are respectively the preset first random salt value and the second random salt value, is the user ID, is the second nested hash value, Status data of the current request operation;

[0038] Data matching unit: extracting the hash value of each transaction record in the corresponding block based on the matching hash value of the target data set to be extracted and the corresponding block on the blockchain;

[0039] Block positioning unit: The hash values ​​of all transaction records in the corresponding block are matched and analyzed with the matching hash values ​​of the target data set to be extracted. If the hash value in the corresponding block exists in the matching hash value of the target data set to be extracted, the corresponding block is positioned as the target block.

[0040] The present invention provides a comprehensive security management system for a trusted data space, a data verification module, comprising:

[0041] Data extraction unit: extracts target data from the located target block and determines the hash value of the target data that needs to be verified;

[0042] Data verification unit: Verifies the integrity of the extracted target data based on the hash value of the target data to be verified and the matching hash value of the target data set:

[0043] ;in, For the integrity of the target data, The hash value of the target data that needs to be verified. is the matching hash value of the target dataset, The hash value of the j-th data block of the target data that needs to be verified, is the matching hash value of the jth data block of the target data set, m is the number of hash values ​​of the target block appearing in the target data set, is a bitwise XOR operator, used to compare the difference between two hash values. To preset the hash judgment threshold, For modulo operation.

[0044] The present invention provides a comprehensive security management system for a trusted data space, wherein the node encryption algorithm is a symmetric encryption algorithm and the chain encryption algorithm is an asymmetric encryption algorithm.

[0045] The present invention provides a comprehensive security management system for a trusted data space, which ensures data access security through dynamic permission analysis, improves retrieval efficiency by nonlinearly locating target blocks using key parameters, verifies data integrity to prevent tampering, and achieves full traceability and auditing of operations by generating encrypted operation chains, thereby enhancing the transparency and security of data management. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 It is a structural diagram of a comprehensive security management system for a trusted data space provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Example 1

[0050] like Figure 1 As shown, an embodiment of the present invention provides a comprehensive security management system for a trusted data space, including:

[0051] Permission determination module: The user sends a data extraction request to the blockchain node, obtains the user's data and analyzes it to determine whether to grant the user extraction permission;

[0052] Request location module: locates the target block in the distributed ledger according to the key parameters of the extraction request;

[0053] Data verification module: extracts target data from the target block and verifies the integrity of the data;

[0054] Data monitoring module: When a user operates on target data, the user's data operation is monitored to generate an operation chain, which is then encrypted and stored;

[0055] The data monitoring module includes:

[0056] Operation capture unit: When a user operates on data, it monitors the user's data operation based on a preset multi-level capture mechanism and records the relevant information of each data operation;

[0057] Operation chain generation unit: generates a corresponding operation chain based on the relevant information of the user's data operation;

[0058] Operation chain encryption unit: Based on the preset double-layer encryption strategy, each operation node in the operation chain is individually encrypted based on the preset node encryption algorithm, and the entire operation chain is encrypted as a whole based on the preset chain encryption algorithm;

[0059] Operation chain storage unit: stores the encrypted operation chain based on a preset storage method, generates a new chain when storing the operation chain, and links the new chain with the previous storage chain to form a storage chain;

[0060] The operation chain generation unit includes:

[0061] Data calculation subunit: performs hash calculation on the data involved in the data operation based on a preset combined hash algorithm to generate a unique hash value of the operation data;

[0062] Data chain generation subunit: Generates a data chain based on the data version affected by each data operation, the specific data operation summary of each data operation, the dependency relationship between the data and related data for each data operation, and the hash value of the data and related data for each data operation;

[0063] Permission chain generation subunit: generates permission chains based on user information and authorization records of data operations;

[0064] Behavior chain generation subunit: generates a behavior chain based on the type of data operation performed by the user, the time when the operation occurs, and the context information of the operation;

[0065] Operation chain determination subunit: associate the data chain, permission chain and behavior chain based on a preset association algorithm to generate a corresponding operation chain.

[0066] In this embodiment, a blockchain node is a computing device participating in a blockchain network, which is responsible for maintaining and verifying data records in the blockchain. Nodes share data and jointly execute network protocols. For example, in a blockchain network, each node stores a complete copy of the ledger. When a user sends a data extraction request, these nodes process the request and verify the authenticity of the data.

[0067] In this embodiment, a data extraction request is a request sent by a user to the blockchain network to extract or access specific data from the blockchain, for example, a company sends a data extraction request to the blockchain to obtain a contract document that they previously stored on the blockchain;

[0068] In this embodiment, extraction permission refers to the user's permission to extract specific data from the blockchain. The granting of permission is based on the analysis of the user's identity and the content of the request. For example, if a user wants to extract the contract data of a certain project, the system analyzes the user's identity and permission configuration to decide whether to allow the user to obtain the data. If the user is a signatory of the contract, the extraction permission is granted.

[0069] In this embodiment, the key parameters of the extraction request are specific information used to locate the target data in the blockchain, including: a unique identifier of the data, a timestamp or a data category. For example, when a user requests to obtain a transaction record, the key parameters include the transaction ID, timestamp or the public keys of both parties to the transaction.

[0070] In this embodiment, the target block refers to the block in the blockchain that contains the data requested by the user to be extracted. For example, the contract data requested to be extracted by the user may be stored in the 500th block, which is the target block.

[0071] In this embodiment, the target data refers to the specific data that the user wants to obtain from the blockchain through the extraction request. The target data may be an encrypted hash of a contract document, and the user needs this data to verify the authenticity of the contract;

[0072] In this embodiment, data integrity means that the data in the blockchain has not been tampered with during the extraction process and remains in its original state. For example, when a user extracts a contract document, the system will verify whether the hash value of the file is consistent with that when it was stored to ensure data integrity.

[0073] In this embodiment, the user's data operation refers to various operations performed by the user on the target data in the blockchain, such as reading, modifying or deleting. For example, the user views the extracted contract document, updates the remark information or performs a signing operation;

[0074] In this embodiment, the operation chain refers to the record chain generated by the system when the user operates on the data, which records the order and details of the operation. For example, every read and modify operation performed by the user on the contract data will be recorded in the operation chain for auditing and tracing;

[0075] In this embodiment, encrypted storage refers to encrypting the user operation chain and other sensitive data before storage to protect the privacy and security of the data. For example, the system will encrypt all user operation records of the contract and store them on the blockchain. Even if unauthorized users obtain these data, they cannot read the content.

[0076] In this embodiment, the target block is located in the distributed ledger according to the key parameters of the extraction request. The location of the blockchain data may rely on the chain structure of the block, sequential traversal or search based on the block hash value, and a complex hash function is used to map the key parameters to a specific block position in the blockchain, rather than traversing each block in the blockchain one by one. This hash mapping can quickly narrow the search range and directly locate the target block.

[0077] In this embodiment, when a user operates on target data, the user's data operation is monitored to generate an operation chain, which is then encrypted and stored. When a user performs an operation on specific data (such as a file, record, or database entry), the module records these operations and generates an operation chain. The operation chain refers to a chain log that records the sequence and content of user operations, and can track each action in detail. The generated operation chain will be encrypted to ensure the security and integrity of the operation record, and then stored in the system, on the blockchain or other secure storage media. It not only records user behavior, but can also be regarded as an "anti-tampering" and "accountability" mechanism, which can provide a very efficient way to track and verify the legality of any data operation, and even audit when internal malicious behavior occurs. The encrypted storage of the operation chain ensures that even if the system is attacked or data is leaked, the operation record remains private and cannot be tampered with.

[0078] In this embodiment, the multi-level capture mechanism is divided into three types: real-time capture, timed capture, and triggered capture. Real-time capture is used for real-time monitoring of critical data operations, timed capture is used for periodic recording of non-critical operations, and triggered capture is used for monitoring of specific events or abnormal situations.

[0079] In this embodiment, the preset double-layer encryption strategy is a double encryption method used by the system to ensure the security of the operation chain. The strategy includes two levels: first, each operation node in the operation chain is encrypted separately, and then the entire operation chain is encrypted as a whole, thereby providing multi-level security protection. Assuming that the user performs "read" and "modify" operations on a certain data, the system will first encrypt the two operation nodes of "read" and "modify" respectively, and then encrypt the entire operation chain as a whole, ensuring that the operation information cannot be tampered with or leaked at multiple levels.

[0080] In this embodiment, the operation chain not only includes timestamp, user ID, data summary, but also needs to generate a multi-chain structure, including data chain, permission chain, behavior chain, etc. Each chain records information of different dimensions and is interconnected through a specific algorithm.

[0081] In this embodiment, the storage chain is a chain structure formed by storing the encrypted operation chain in sequence and generating a new chain linked to the previously stored operation chain. This storage method ensures the continuity and integrity of the operation chain, and is convenient for traceability and auditing. For example, when a user completes a series of operations and generates an encrypted operation chain, the system will link this operation chain with the previous operation chain. For example, operation chain 1 records the user's data operations last week, and operation chain 2 records this week's operations. The system will link operation chain 2 to operation chain 1 to form a continuously growing storage chain, ensuring the traceability of all operations;

[0082] In this embodiment, the data involved in the data operation refers to the data content that is processed, modified or accessed in a specific operation. Assuming that an update operation is performed on a record in a database, the data involved in the data operation may be all fields of the record;

[0083] In this embodiment, the preset combined hash algorithm is a combination of encryption algorithms used to generate a unique identification of data, and usually combines multiple hash algorithms to increase security and anti-collision. For example, SHA-256 and MD5 can be used in combination, and the data is first hashed using SHA-256, and then the result is hashed through MD5 to enhance the unique identification of the data;

[0084] In this embodiment, the operation data hash value is a unique identifier generated by calculating the data involved in the operation through a hash algorithm, which is used to ensure the integrity and non-tamperability of the data. If a piece of text data "data123" is processed, the operation data hash value generated by the SHA-256 algorithm may be "e1a0f68e..."

[0085] In this embodiment, the data version refers to a new version generated after each data operation, so as to track the historical changes of the data. For example, a document is version 1 when it is first saved, and is saved as version 2 after modification. A new version number is created for each update;

[0086] In this embodiment, the data operation summary is a brief description of each data operation, which usually includes the content and result of the operation. For example, the summary of updating a record in the database may be "update the value of field X to Y";

[0087] In this embodiment, the dependency relationship between data and related data describes the association between different data items, especially how changes in a certain data affect other related data. If there is a foreign key relationship between two database tables, when the data in one table is modified, it may affect the data in the other table. This is the data dependency relationship.

[0088] In this embodiment, the authorization record of the data operation is that the operation involves multiple levels of authorization or crosses the authority boundary, and records the user IDs and authorization timestamps of all users involved in the authorization;

[0089] In this embodiment, the operation types are read, write, delete, and modify;

[0090] In this embodiment, the context information of the operation includes: the source IP address of the operation, the device type, and the operating environment (such as the operating system, software version, etc.).

[0091] The beneficial effects of the above technical solution are: ensuring data access security through dynamic analysis of permissions, improving retrieval efficiency by nonlinearly locating target blocks using key parameters, verifying data integrity to prevent tampering, and achieving full traceability and auditing of operations by generating encrypted operation chains, thereby enhancing the transparency and security of data management.

[0092] Example 2

[0093] An embodiment of the present invention provides a comprehensive security management system for a trusted data space, a permission determination module, including:

[0094] Data acquisition unit: when a user sends a data extraction request to a blockchain node, the data extraction request is analyzed to obtain relevant data of the data extraction request;

[0095] Permission determination unit: obtains user data and analyzes it to determine the user's access rights;

[0096] Permission determination unit: performs permission determination based on the user's access rights and the relevant data of the data extraction request to determine whether to grant the user extraction permission.

[0097] In this embodiment, a blockchain node refers to an independent participant or computer in a blockchain network, which stores all or part of the blockchain data and participates in the consensus mechanism of the blockchain. Each node can send, receive, verify, and store transaction and block data to form a decentralized network structure. For example, in a blockchain-based file sharing system, assume that there are five nodes (A, B, C, D, E). These nodes are all involved in the maintenance of the blockchain network. Each node stores the hash values ​​and metadata of all files. When a user sends a data extraction request, node A receives the request and is responsible for verifying the user's authority and deciding whether to allow access to the requested data;

[0098] In this embodiment, the relevant data of the data extraction request refers to the information associated with the request when the user sends a data extraction request to the blockchain node, including the user's identity information, the type of data requested, the timestamp of the request, and the specific conditions of the request, etc. User B sends a request to node A to obtain the content of a certain file. The relevant data may include: user B's identity information (such as user ID), the identifier of the requested file, the request time (2024-08-22 12:00), and other request parameters (such as the specified file version number).

[0099] In this embodiment, the user's access rights refer to the permission level or access rights assigned by the blockchain system to a specific user, which determines what data the user can access or what operations the user can perform. These permissions are usually determined based on the user's identity, role, or organization, and are closely related to the access control policy of the blockchain network. For example, in a company's internal blockchain system, user C, as a project manager, has access to project documents, but does not have access to financial records. The determination of access rights will be based on the role of user C and the specific type of data requested.

[0100] In this embodiment, the permission determination is the process by which the system determines whether to allow the user to access the requested data based on the user's access rights and the relevant data of the request after receiving the data extraction request. This process is usually performed by a permission determination unit according to preset access control rules or policies. For example, when user D requests to access a sensitive data file, the system first obtains the access rights of user D and finds that user D only has ordinary access rights. According to the rules of the permission determination unit, the system decides to reject the request of user D and returns a "no access" response.

[0101] The beneficial effects of the above technical solution are: by integrating blockchain nodes and dynamic permission analysis, accurate and real-time permission control is achieved, the security of the data space is enhanced, the permission determination process is tamper-proof, malicious access is prevented, and the system's adaptability to complex permission scenarios is improved.

[0102] Example 3

[0103] An embodiment of the present invention provides a comprehensive security management system for a trusted data space, and a permission determination unit, including:

[0104] Information extraction subunit: obtains the user's basic information and extracts the user's security level and historical access records from the user database;

[0105] Level determination subunit: Based on the user role and department, obtain the user's corresponding data access permission level from the preset permission rule database;

[0106] Record analysis subunit: Analyze the user's historical access records, and then determine the user's behavior trustworthiness based on the user's basic information:

[0107] ;in, is the user's behavior trust, F is the frequency of the user accessing the system, is the average access frequency of all users, is the normalized frequency of user access to the system, β is the preset adjustment coefficient of the access frequency, is the preset weight of the access frequency, t is the total time the user visits the system, is the expected total access time. is a preset adjustment parameter used to control the impact of access time deviation on behavior trust. Score the user's abnormal behavior based on historical access records. is a preset adjustment parameter used to control the impact of abnormal behavior on behavior trust. is the hyperbolic tangent function, Mapping value for the basic information of the i-th user, is the preset standard mapping value corresponding to the basic information of the i-th user, is a preset adjustment parameter for controlling the impact of differences in users’ basic information on behavior trust, and n is the number of items of users’ basic information;

[0108] Score determination subunit: Determines the user's comprehensive access rights score based on the user's behavior trust and the corresponding data access rights level:

[0109] ;in, is the user's comprehensive access permission score, L is the user's basic data access permission level, The user's behavioral trust, To control the preset weights of data access permissions, To control the preset weight of user behavior trust, is the influence weight used to adjust the data access rights and user behavior trust difference scores, is the conversion coefficient corresponding to the user's basic data access permission level, is the conversion coefficient corresponding to the user's behavioral trust, The preset adjustment coefficient corresponding to the difference between data access rights and user behavior trust, is the preset adjustment item. To smooth the transition between the trust of user behavior and data access rights, is a preset scaling factor used to adjust the overall calculation result;

[0110] Permission determination subunit: determines whether to grant the user's extraction permission based on the user's comprehensive access permission score and the preset permission score.

[0111] In this embodiment, the frequency of user access to the system is an average value, which indicates the number of times a user accesses the system within a certain period of time;

[0112] In this embodiment, based on the user role and department, the data access permission level corresponding to the user is obtained from the preset permission rule database. The system extracts the user's corresponding permission level from the pre-set permission rule database according to the user's role in the organization and the department to which he belongs. Users with different roles and departments will have different access permissions to ensure that each type of user can only access data related to their work. For example, in a company, managers in the finance department and engineers in the technical department have different roles and permissions. The finance manager may be granted permission to view financial statements, while engineers may be restricted to accessing technical documents. The system will obtain the corresponding permission level from the permission rule database based on their roles and departments.

[0113] In this embodiment, the total access time refers to the total amount of time a user accesses the system within a period of time, which measures the length of time a user stays in or uses the system. For example, if a user accesses the system for a total of 3 hours in one day, then these 3 hours are the total access time of the user.

[0114] In this embodiment, the preset expected total access time is the ideal access time range pre-set by the system for different types of users, which is used to measure whether the user's access behavior is normal. Assuming that the system stipulates that the ideal time for ordinary employees to access the system is 2 hours per day, if a user's access time is significantly higher or lower than this expected value, the system may consider that the user's behavior is abnormal;

[0115] In this embodiment, the preset adjustment parameter for controlling the impact of the access time deviation on the score is a parameter pre-set in the system, which is used to adjust the impact of the deviation between the user's actual access time and the expected access time on the final score. If the total access time of a user obviously deviates from the preset expected time, the adjustment parameter can amplify or reduce the impact of this deviation on the trust of the user's behavior, ensuring that the score reasonably reflects the user's behavior;

[0116] In this embodiment, the preset adjustment parameter for controlling the impact of abnormal behavior on the score is a pre-set parameter used to adjust the impact of abnormal behavior in the user's historical access record on the overall score. If a user has had abnormal access behavior in the past, such as frequently accessing the system during non-working hours, this parameter can amplify or reduce the impact of such abnormal behavior on the user's behavior trust;

[0117] In this embodiment, the abnormal behavior score determined based on historical access records is based on the user's past access records, and the system scores the user's possible abnormal behavior. This score is used to assess whether the user has risky behavior. If a user repeatedly attempts to access data beyond his or her authority, his or her abnormal behavior score may be very high, thereby reducing his or her overall trust score;

[0118] In this embodiment, the preset standard mapping value corresponding to the user's basic information is a set of standard values ​​preset by the system for the user's basic information, which is used to compare and evaluate whether the user's basic information is within the normal range. Assuming that the system presets the user's working experience to be 5 years, then for a user with only 1 year of working experience, the gap between his basic information and the standard mapping value may affect his authority score.

[0119] In this embodiment, the user's behavior trust is a scoring indicator used to measure the reliability and security of user behavior. It is calculated based on multiple factors such as the user's access frequency, total time, abnormal behavior, etc. If the user's access behavior is consistent and compliant, his behavior trust will be higher; on the contrary, users who frequently have abnormal behavior will have a lower trust;

[0120] In this embodiment, the influence weight used to adjust the data access permission and user behavior trust difference score is an adjustment factor, which is used to control the influence of the data access permission and user behavior trust difference on the final comprehensive score. If the user's behavior trust is significantly different from his preset data access permission, the weight factor can adjust the impact of this difference on the final permission score to make the score more fair.

[0121] The beneficial effects of the above technical solution are: through comprehensive analysis of user roles, access frequency, historical behavior and basic information, refined permission management is achieved, a dual evaluation mechanism of behavioral trust and data access permission level is integrated, and the user's permission score is dynamically adjusted, which improves the security and credibility of the data space, while effectively preventing the potential risks of abnormal behavior.

[0122] Example 4

[0123] An embodiment of the present invention provides a comprehensive security management system for a trusted data space, a request positioning module, including:

[0124] Parameter extraction unit: analyzes the user's data extraction request, and then obtains several request parameters of the user's data extraction request;

[0125] Data determination unit: determines the matching hash value of the target data set to be extracted based on the request parameters:

[0126] ;in, is the matching hash value of the target dataset to be extracted, is the first nested hash value, t is the timestamp corresponding to the current time, , are respectively the preset first random salt value and the second random salt value, is the user ID, is the second nested hash value, Status data of the current request operation;

[0127] Data matching unit: extracting the hash value of each transaction record in the corresponding block based on the matching hash value of the target data set to be extracted and the corresponding block on the blockchain;

[0128] Block positioning unit: The hash values ​​of all transaction records in the corresponding block are matched and analyzed with the matching hash values ​​of the target data set to be extracted. If the hash value in the corresponding block exists in the matching hash value of the target data set to be extracted, the corresponding block is positioned as the target block.

[0129] In this embodiment, the request parameters include: a unique identifier of the data (such as a file hash), a data generation time, an uploader ID, and metadata related to the data.

[0130] In this embodiment, the first nested hash value is an initial hash value generated based on a set of key parameters requested by the user, obtained by combining and hashing multiple parameters (such as timestamp, random salt value, user ID, etc.). Assuming that the user requests to extract a certain data set, the system combines the current timestamp, the randomly generated salt value, and the user ID, and the value obtained by hashing is the first nested hash value. This hash value is used to uniquely identify a certain part of the parameters of the current request;

[0131] In this embodiment, the second nested hash value is a value obtained by further hashing the first nested hash value in combination with additional state data or other parameters, and is used to more accurately identify the target data set. In the system, in addition to the first nested hash value, the system may also add the requested state data to perform a secondary hash operation to generate the second nested hash value. This further ensures the uniqueness and security of the data request;

[0132] In this embodiment, the user ID is used to identify the user who initiates the operation and is a coded value.

[0133] In this embodiment, the addition in the formula represents string concatenation or binary concatenation.

[0134] In this embodiment, matching analysis means that the system compares the hash value of the extracted target data set with the hash value recorded in the blockchain to determine whether there is a matching hash value, so as to determine the block where the target data set is located. For example, in the system, a user requests to extract a certain data set and generates a corresponding matching hash value. The system then performs a matching analysis on the hash values ​​of all transaction records in the blockchain. If it is found that the hash value of a block is consistent with the matching hash value of the target data set, the system determines that the block contains the data requested by the user.

[0135] The beneficial effects of the above technical solution are: through multiple hashing and the introduction of random salt values, even if there is a slight change in the input content, the output hash value will be completely different, ensuring the integrity of the data. The irreversibility of the hash function ensures that the original data cannot be easily inferred from the hash value. The use of salt values ​​increases randomness, effectively ensuring the uniqueness and accuracy of the target data, while improving the efficiency of data positioning and extraction, preventing data tampering and mis-access, and enhancing the credibility of the system.

[0136] Example 5

[0137] An embodiment of the present invention provides a comprehensive security management system for a trusted data space, a data verification module, including:

[0138] Data extraction unit: extracts target data from the located target block and determines the hash value of the target data that needs to be verified;

[0139] Data verification unit: Verifies the integrity of the extracted target data based on the hash value of the target data to be verified and the matching hash value of the target data set:

[0140] ;in, For the integrity of the target data, The hash value of the target data that needs to be verified. is the matching hash value of the target dataset, The hash value of the j-th data block of the target data that needs to be verified, is the matching hash value of the jth data block of the target data set, m is the number of hash values ​​of the target block appearing in the target data set, is a bitwise XOR operator, used to compare the difference between two hash values. To preset the hash judgment threshold, For modulo operation.

[0141] In this embodiment, the hash value of the target data that needs to be verified is a hash value extracted from the target data for verifying its integrity. By calculating this hash value, it is determined whether the data has been tampered with during transmission or storage. Assuming that a certain target data extracted from the blockchain is file A, the system will generate a hash value based on the content of file A, that is, the hash of the target data that needs to be verified. This hash value is an important identifier for verifying data integrity;

[0142] In this embodiment, the matching hash value of the target data set is a hash value generated by the system for the data set to which the target data belongs, and is used to match the extracted hash value to verify the integrity and correctness of the data. Assuming that file A belongs to data set B, the system will generate a hash value for data set B, which is the matching hash value of the target data set. This value is an important reference for the system to verify whether the extracted data is consistent with the original data;

[0143] In this embodiment, the preset hash judgment threshold is a threshold preset by the system, which is used to measure whether the difference between two hash values ​​is acceptable. If the difference between the two hash values ​​is less than this threshold, the data is considered to be complete, otherwise there may be a problem, for example,

[0144] A preset hash judgment threshold is set to "0", indicating that only completely consistent hash values ​​can pass verification; if the threshold is set to "1", a certain range of differences is allowed, for example, only one bit of difference in the hash value is acceptable;

[0145] In this embodiment, Returns a value indicating the difference, 0 for the same and 1 for different.

[0146] In this embodiment, the data verification module assumes that the system is used to manage a highly sensitive research project data. Researcher B operates on a certain experimental data set, such as exporting data and deleting the original file. For example, the system finds that researcher B usually only views data and does not delete it. This behavior may be a potential traitor or stolen account operation, triggering additional security review. The operation chain is not only for auditing and tracking, but also becomes a tool for active defense and anomaly detection of the system. After this operation chain is encrypted, it can not only verify the authenticity of the operation, but also prevent the operator from tampering with or erasing his own behavior traces.

[0147] The beneficial effect of the above technical solution is: by combining the bitwise XOR operation and the preset hash judgment threshold, the hash value of the target data is verified block by block, ensuring that the data is correct during extraction and transmission, and effectively preventing potential tampering and damage, thereby improving the security and credibility of the system.

[0148] Example 6

[0149] An embodiment of the present invention provides a comprehensive security management system for a trusted data space, wherein the node encryption algorithm is a symmetric encryption algorithm, and the chain encryption algorithm is an asymmetric encryption algorithm.

[0150] In this embodiment, the symmetric encryption algorithm is an encryption method in which the same key is used for encryption and decryption, that is, the key used when encrypting the data is the same as the key used when decrypting it. The symmetric encryption algorithm has the advantages of fast encryption speed and high computational efficiency, but key management and transmission security are its key issues. Assuming that a node in the operation chain records the user's "read" operation on certain data, the system will use a symmetric encryption algorithm (such as the AES algorithm) to encrypt the information of the "read" operation. If the key used for encryption is "key123", then the same "key123" must be used for decryption to restore the original operation information;

[0151] In this embodiment, the asymmetric encryption algorithm uses a pair of related keys: a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data. The asymmetric encryption algorithm solves the security problem in key transmission because different keys are used for encryption and decryption. Even if the encrypted public key is made public, the data is still safe because the corresponding private key is required for decryption. For example, after generating the entire operation chain, the system uses an asymmetric encryption algorithm (such as the RSA algorithm) to encrypt the entire operation chain. Assuming that the system uses the public key "publicKey123" to encrypt the operation chain, only the user or system holding the private key "privateKey123" that matches "publicKey123" can decrypt and view the entire content of the operation chain. This encryption method ensures that even if the operation chain is intercepted, only the authorized party can read the content.

[0152] The beneficial effect of the above technical solution is that by combining symmetric encryption and asymmetric encryption, an efficient and secure double-layer encryption strategy is provided: symmetric encryption ensures fast encryption and decryption of operation nodes, and asymmetric encryption ensures the security of the entire operation chain and prevents unauthorized access. This combination effectively improves the security and encryption efficiency of the system and is suitable for the security management of complex data spaces.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A comprehensive security management system for a trusted data space, characterized in that: include: Permission determination module: The user sends a data extraction request to the blockchain node, obtains the user's data and analyzes it to determine whether to grant the user extraction permission; Request location module: locates the target block in the distributed ledger according to the key parameters of the extraction request; Data verification module: extracts target data from the target block and verifies the integrity of the data; Data monitoring module: When a user operates on target data, the user's data operation is monitored to generate an operation chain, which is then encrypted and stored; The data monitoring module includes: Operation capture unit: When a user operates on data, it monitors the user's data operation based on a preset multi-level capture mechanism and records the relevant information of each data operation; Operation chain generation unit: generates a corresponding operation chain based on the relevant information of the user's data operation; Operation chain encryption unit: Based on the preset double-layer encryption strategy, each operation node in the operation chain is individually encrypted based on the preset node encryption algorithm, and the entire operation chain is encrypted as a whole based on the preset chain encryption algorithm; Operation chain storage unit: stores the encrypted operation chain based on a preset storage method, generates a new chain when storing the operation chain, and links the new chain with the previous storage chain to form a storage chain; The operation chain generation unit includes: Data calculation subunit: performs hash calculation on the data involved in the data operation based on a preset combined hash algorithm to generate a unique hash value of the operation data; Data chain generation subunit: Generates a data chain based on the data version affected by each data operation, the specific data operation summary of each data operation, the dependency relationship between the data and related data for each data operation, and the hash value of the data and related data for each data operation; Permission chain generation subunit: generates permission chains based on user information and authorization records of data operations; Behavior chain generation subunit: generates a behavior chain based on the type of data operation performed by the user, the time when the operation occurs, and the context information of the operation; Operation chain determination subunit: associate the data chain, permission chain and behavior chain based on a preset association algorithm to generate a corresponding operation chain.

2. A comprehensive security management system for a trusted data space according to claim 1, characterized in that: The permission determination module includes: Data acquisition unit: when a user sends a data extraction request to a blockchain node, the data extraction request is analyzed to obtain relevant data of the data extraction request; Permission determination unit: obtains user data and analyzes it to determine the user's access rights; Permission determination unit: performs permission determination based on the user's access rights and the relevant data of the data extraction request to determine whether to grant the user extraction permission.

3. A comprehensive security management system for a trusted data space according to claim 2, characterized in that: The authority determination unit includes: Information extraction subunit: obtains the user's basic information and extracts the user's security level and historical access records from the user database; Level determination subunit: Based on the user role and department, obtain the user's corresponding data access permission level from the preset permission rule database; Record analysis subunit: Analyze the user's historical access records, and then determine the user's behavior trustworthiness based on the user's basic information: ;in, is the user's behavior trust, F is the frequency of the user accessing the system, is the average access frequency of all users, is the normalized frequency of user access to the system, β is the preset adjustment coefficient of the access frequency, is the preset weight of the access frequency, t is the total time the user visits the system, is the expected total access time. is a preset adjustment parameter used to control the impact of access time deviation on behavior trust. Score the user's abnormal behavior based on historical access records. is a preset adjustment parameter used to control the impact of abnormal behavior on behavior trust. is the hyperbolic tangent function, Mapping value for the basic information of the i-th user, is the preset standard mapping value corresponding to the basic information of the i-th user, is a preset adjustment parameter for controlling the impact of differences in users’ basic information on behavior trust, and n is the number of items of users’ basic information; Score determination subunit: Determines the user's comprehensive access rights score based on the user's behavior trust and the corresponding data access rights level: ;in, is the user's comprehensive access permission score, L is the user's basic data access permission level, The user's behavioral trust, To control the preset weights of data access permissions, To control the preset weight of user behavior trust, is the influence weight used to adjust the data access rights and user behavior trust difference scores, is the conversion coefficient corresponding to the user's basic data access permission level, is the conversion coefficient corresponding to the user's behavioral trust, The preset adjustment coefficient corresponding to the difference between data access rights and user behavior trust, is the preset adjustment item. To smooth the transition between the trust of user behavior and data access rights, is a preset scaling factor used to adjust the overall calculation result; Permission determination subunit: determines whether to grant the user's extraction permission based on the user's comprehensive access permission score and the preset permission score.

4. The integrated security management system for a trusted data space according to claim 1, characterized in that: Request positioning module, including: Parameter extraction unit: analyzes the user's data extraction request, and then obtains several request parameters of the user's data extraction request; Data determination unit: determines the matching hash value of the target data set to be extracted based on the request parameters: ;in, is the matching hash value of the target dataset to be extracted, is the first nested hash value, t is the timestamp corresponding to the current time, and are respectively the preset first random salt value and the second random salt value, is the user ID, is the second nested hash value, Status data of the current request operation; Data matching unit: extracting the hash value of each transaction record in the corresponding block based on the matching hash value of the target data set to be extracted and the corresponding block on the blockchain; Block positioning unit: The hash values ​​of all transaction records in the corresponding block are matched and analyzed with the matching hash values ​​of the target data set to be extracted. If the hash value in the corresponding block exists in the matching hash value of the target data set to be extracted, the corresponding block is positioned as the target block.

5. A comprehensive security management system for a trusted data space according to claim 4, characterized in that: Data validation module, including: Data extraction unit: extracts target data from the located target block and determines the hash value of the target data that needs to be verified; Data verification unit: Verifies the integrity of the extracted target data based on the hash value of the target data to be verified and the matching hash value of the target data set: ;in, For the integrity of the target data, The hash value of the target data that needs to be verified. is the matching hash value of the target dataset, The hash value of the j-th data block of the target data that needs to be verified, is the matching hash value of the jth data block of the target data set, m is the number of hash values ​​of the target block appearing in the target data set, is a bitwise XOR operator, used to compare the difference between two hash values. To preset the hash judgment threshold, For modulo operation.

6. The integrated security management system for a trusted data space according to claim 1, characterized in that: The node encryption algorithm is a symmetric encryption algorithm, and the chain encryption algorithm is an asymmetric encryption algorithm.

Images