A data security protection method for cloud platform

Abstract

The present invention relates to the field of data security protection technology, and specifically to a data security protection method for a cloud platform. The method first divides the data information of the acquired user into multiple sensitivity levels; determines the information missing degree of the user at the current sensitivity level, and constructs a level vector; analyzes the information missing degree and level vector of different users at the sensitivity level with other users, and determines the level correlation of users at the current sensitivity level; classifies users to obtain multiple user sets; determines the necessity of adjusting the current sensitivity level according to the difference in level correlation between two users in the user set, and selects the best sensitivity level from multiple sensitivity levels; encrypts the corresponding relationship between levels associated with the best sensitivity level. The present invention improves the encryption security of data information by analyzing and encrypting the correlation between sensitive data.

Description

Technical Field

[0001] The present invention relates to the technical field of data security protection, and in particular to a data security protection method for a cloud platform. Background Art

[0002] Data often involves security issues, and data in the medical industry is no exception. Health and medical big data is an important basic data resource, and it is crucial to improve the security protection of medical information data. The data protection of existing medical data cloud platforms usually classifies medical data and divides medical data into different sensitivity levels. For example, data can be divided into highly sensitive, such as patient identity information and diagnosis reports; moderately sensitive, such as medical records and drug prescriptions; and low sensitive, such as statistical data and non-personal data. According to the sensitivity level of the data, corresponding protection measures are formulated for hierarchical protection. Highly sensitive data requires more stringent protection measures, while low-sensitivity data can take more relaxed measures. However, the current medical data cloud platform has many data categories, large volumes, and high requirements for real-time updates and sharing. Therefore, it is necessary to further adjust the data security storage protection strategy of the medical data cloud platform.

[0003] Since the medical data cloud platform has relatively high requirements for real-time updates and sharing, encrypted storage at multiple sensitivity levels often affects the real-time display efficiency of data requirements. The sensitivity level division of the corresponding medical data cloud platform is based on the semantic information evaluation index of medical data. In the actual data storage and transmission process of the medical data cloud platform, more attention is paid to the association between the storage of multiple types of information of the same patient in different data tables. For example, if only highly sensitive data is encrypted at a higher level, and low-sensitive data is encrypted in a more easily crackable way, it is easy to cause the encryption effect of low-sensitive data to be lower. If all levels of sensitive data are encrypted at a higher level, there will be a problem of a large workload. Therefore, the sensitivity classification can be refined and adjusted according to the association relationship to improve the efficiency of data security protection and sharing. Summary of the invention

[0004] In order to solve the technical problem that only sensitive data is encrypted but the encryption effect is poor, the purpose of the present invention is to provide a data security protection method for a cloud platform. The technical solution adopted is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a data security protection method for a cloud platform, the method comprising:

[0006] Obtaining user data information stored in the cloud platform, and dividing the data information into multiple sensitivity levels;

[0007] Determine the degree of missing information of the user at the current sensitivity level according to the completion of the data information; construct a level vector using the user's data information at each sensitivity level as a vector element;

[0008] Analyze the information missing degree and level vector of different users at the sensitivity level and other users, and determine the level correlation of users at the current sensitivity level;

[0009] Based on the current sensitivity level, users are classified according to the level association to obtain multiple user sets; the necessity of adjusting the current sensitivity level is determined according to the difference in the level association between two users in the user set; based on the necessity of adjustment, the optimal sensitivity level is screened out from the multiple sensitivity levels;

[0010] The correspondence between the levels associated with the optimal sensitivity level is encrypted.

[0011] Furthermore, the analysis of the information missing degree and level vector of different users at the sensitivity level with other users to determine the level correlation of users at the current sensitivity level includes:

[0012] Analyze the difference between the level vectors of the current user and other users at the same sensitivity level, as well as the information missing degree of the current user, to determine the accuracy of the information of the current user and other users;

[0013] At the same sensitivity level, the level vectors of other users that are similar to the level vector of the current user are screened out as the approximate level vector of each sensitivity level;

[0014] The hierarchical correlation of users at the current sensitivity level is determined by the number of approximate hierarchical vectors and the accuracy of the information between the current user and other users.

[0015] Furthermore, determining the degree of missing information of the user at the current sensitivity level according to the completion status of the data information includes:

[0016] The proportion of data information that users have not filled in at the current sensitivity level is taken as the information missing degree of the current sensitivity level.

[0017] Furthermore, the step of constructing a hierarchical vector by using the user's data information at each sensitivity level as a vector element includes:

[0018] The word vector is extracted for the data information, and the word vector of the data information at each sensitivity level is used as the vector element in the level vector to obtain the level vector.

[0019] Furthermore, the analyzing the difference between the level vectors at the same sensitivity level between the current user and other users, and the information missing degree of the current user, and determining the accuracy of the information of the current user and other users includes:

[0020] Taking other users except the current user as target users, calculating the similarity of the hierarchical vectors corresponding to the same sensitivity level between the current user and the target user as the single-level similarity; analyzing the discreteness of all single-level similarities corresponding to the current user and the target user, and determining the discrete values ​​of the user information of the current user and the target user;

[0021] According to the user information discrete value and the information missing degree, the information accuracy of the current user and the target user at the current sensitivity level is determined; wherein the user information discrete value and the information missing degree are negatively correlated with the information accuracy.

[0022] Furthermore, the step of selecting the level vectors of other users that are similar to the level vector of the current user at the same sensitivity level as the approximate level vector of each sensitivity level includes:

[0023] For each sensitivity level, when the single-level similarity between the current user and other users is greater than a preset threshold, the level vector corresponding to the single-level similarity is used as the approximate level vector of the current user at the sensitivity level.

[0024] Furthermore, the step of determining the level correlation of users at the current sensitivity level based on the number of approximate level vectors and the accuracy of information between the current user and other users includes:

[0025] The average of the information accuracy of the current user and all other users at the current sensitivity level is used as the numerator, the number of approximate level vectors is used as the denominator, and the normalized value of the ratio corresponding to the numerator and the denominator is used as the level association of the user at the current sensitivity level.

[0026] Furthermore, based on the current sensitivity level, the users are classified according to the level association to obtain multiple user sets, including:

[0027] Using the density clustering algorithm, the difference in the hierarchical association between two users is taken as the distance between the two users, and multiple users are classified to obtain multiple user sets.

[0028] Furthermore, determining the necessity of adjusting the current sensitivity level according to the difference in level association between two users in the user set includes:

[0029] For each user set, the average of the absolute values ​​of the differences in the hierarchical associations between any two users in the user set is taken as the set difference representation value of the user set;

[0030] The negative correlation mapping value of the mean of the set difference representation values ​​of all user sets at the current sensitivity level is used as the necessity of adjusting the current sensitivity level.

[0031] Furthermore, based on the necessity of the adjustment, the optimal sensitivity level is screened out from multiple sensitivity levels, including:

[0032] A sensitivity level whose adjustment necessity is greater than a preset necessity threshold is selected from multiple sensitivity levels as a high sensitivity level; and a sensitivity level one level lower than the high sensitivity level is marked as an optimal sensitivity level.

[0033] In a second aspect, a data security protection system for a cloud platform is provided, the system comprising the following modules:

[0034] A data preprocessing module is used to obtain the user's data information stored in the cloud platform and divide the data information into multiple sensitivity levels;

[0035] An information construction module, used to determine the degree of missing information of the user at the current sensitivity level according to the completion of the data information; and to construct a level vector using the user's data information at each sensitivity level as a vector element;

[0036] The association analysis module is used to analyze the information missing degree and level vector of different users at the sensitivity level with other users, and determine the level association degree of users at the current sensitivity level;

[0037] The optimal sensitivity level determination module is used to classify users based on the current sensitivity level and the level correlation to obtain multiple user sets; determine the necessity of adjusting the current sensitivity level according to the difference in the level correlation between two users in the user set; and screen out the optimal sensitivity level from the multiple sensitivity levels based on the necessity of adjustment;

[0038] An encryption module is used to encrypt the corresponding relationship between the levels associated with the optimal sensitivity level.

[0039] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, various possible embodiments of the first aspect are implemented.

[0040] In a fourth aspect, an embodiment of the present invention provides a computer program product, which includes: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0041] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute various possible implementations of the first aspect.

[0042] The embodiments of the present invention have at least the following beneficial effects:

[0043] The present invention relates to the technical field of data security protection. The method firstly divides the acquired user data information into multiple sensitivity levels to realize hierarchical encryption of the user data information. Compared with the traditional unified and indiscriminate encryption, the data information is divided into multiple sensitivity levels, and different sensitivity levels are analyzed to improve the efficiency of data encryption; the information missing degree of the user at the current sensitivity level is determined, and a level vector is constructed. The level vector is used to reflect the information of each user at the current sensitivity level; the information missing degree and level vector of different users at the sensitivity level and other users are analyzed to determine the level correlation of users at the current sensitivity level; the level correlation between the levels is determined by analyzing the correlation characteristics of the data of different users at different sensitivity levels. The level correlation reflects the relationship between the current user and other users. The correlation of data between the same sensitivity level and different sensitivity levels for each user other than the current user; classify the users to obtain multiple user sets, divide the users with greater correlation into the same user set, and then analyze each user set to avoid the situation where the information data between users has a large deviation; the greater the difference between two users in the same user, the lower the accuracy of the user set corresponding to the sensitivity level, and the more stringent encryption of the current sensitivity level is needed, so the necessity of adjusting the current sensitivity level is determined according to the difference in the level correlation between two users in the user set, and the best sensitivity level is selected from multiple sensitivity levels; the corresponding relationship between the levels associated with the best sensitivity level is encrypted. The present invention improves the encryption security of data information by analyzing and encrypting the correlation between sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A method flow chart of a data security protection method for a cloud platform provided by an embodiment of the present invention;

[0046] Figure 2 A method flow chart of a method for obtaining information accuracy provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in combination with the accompanying drawings and preferred embodiments, a data security protection method for a cloud platform proposed by the present invention, its specific implementation method, structure, characteristics and effects are described in detail as follows.

[0049] In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0050] Among them, in the description of the embodiments of the present invention, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a way to describe the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present invention, "multiple" refers to two or more than two.

[0051] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0052] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0053] The embodiments of the present invention are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0054] The embodiment of the present invention provides a specific implementation method of a data security protection method for a cloud platform, which is applicable to a data security protection method based on medical data. In order to solve the technical problem of poor encryption effect when encrypting sensitive data, the present invention improves the encryption security of data information by analyzing and encrypting the association relationship between sensitive data.

[0055] The following is a detailed description of a data security protection method for a cloud platform provided by the present invention in conjunction with the accompanying drawings.

[0056] See also Figure 1 , which shows a step flow chart of a data security protection method for a cloud platform provided by an embodiment of the present invention, the method comprising the following steps:

[0057] Step S100, obtaining the user's data information stored in the cloud platform, and dividing the data information into multiple sensitivity levels.

[0058] The user information storage architecture of the medical data cloud platform is a complex system involving multiple components such as database, file storage system, data security and privacy protection, data integration and standardization, data analysis and mining, etc. These components work together to provide medical institutions and doctors with reliable, secure and efficient medical patient information management and analysis services.

[0059] The medical patient information storage architecture of the medical data cloud platform usually includes the following parts:

[0060] 1. Database: Medical patient information is usually stored in a database in the form of structured data. Common database types include relational databases (such as MySQL, Oracle) and NoSQL databases (such as MongoDB, Cassandra). The database is responsible for storing and managing patients' personal identity information, medical records, examination reports, drug prescriptions and other data.

[0061] 2. File storage system: Medical patient information may contain a large amount of impact data (such as X-rays, MRI images, etc.) and document data (such as medical records, surgical reports, etc.). These data are usually stored in the form of files, and the file storage system is responsible for managing the storage, indexing, and access of these files.

[0062] 3. Data security and privacy protection: Medical patient information is sensitive information, so data security and privacy protection are important components of the medical data cloud platform. The platform needs to take strict security measures, including data encryption, identity authentication, access control, audit logs, etc., to ensure the security and privacy of patient information.

[0063] 4. Data integration and standardization: The medical data cloud platform needs to be integrated with multiple data sources, including the hospital's electronic medical record system, laboratory information system, imaging diagnosis system, etc. In order to achieve data consistency and interoperability, the platform needs to standardize data from different data sources, usually using medical standard vocabulary, such as the International Classification of Diseases-10 (ICD-10), the Standard Clinical Medical Terminology (SNOMEDCT), and data exchange standards, such as Health Level Seven (HL7) and Digital Imaging and Communications in Medicine (DICOM).

[0064] 5. Data analysis and mining: The medical data cloud platform can conduct in-depth research and analysis of medical patient information through data analysis and mining technology. This can help doctors and researchers discover potential disease risk factors, predict disease development trends, and optimize treatment plans.

[0065] The medical patient information of the same disease type on the medical data cloud platform is processed. The information is mainly divided into two parts. The first category is the information filled in by oneself, and the second category is the information generated by the hospital system or doctors. The main difference between the two is that the information filled in by oneself is prone to omissions and errors. Therefore, the medical patient information of the same disease type on the medical data cloud platform needs to be pre-processed.

[0066] First, medical patient information of the same disease is classified into multiple levels according to the existing sensitivity classification, and arranged from high to low in terms of sensitivity. There are multiple data information in each level, that is, there are multiple information items in each level. For example, when the user's data information includes user basic information, user payment records, user wearable device self-collected data, user smart furniture device data, etc., the user's basic information and user payment records can be classified into one sensitivity level, and the user's wearable device self-collected data and user smart furniture device data can be classified into one sensitivity level; it should be noted that the user's basic information may include items such as name, gender, blood type and height, which can be further used as user data information. Specifically, the division of sensitivity levels can be further supplemented and refined based on the grading method for sensitivity classification in the "Guidelines for Medical Big Data Security Management and Control Grading" according to the implementer's own situation.

[0067] Step S200, determining the degree of missing information of the user at the current sensitivity level according to the completion status of the data information; and constructing a level vector using the user's data information at each sensitivity level as a vector element.

[0068] These information items are generated by patients, hospital systems or doctors. When comparing these information with the standard filling template, the main comparison is the amount of information, that is, the number of information categories. For example, the filling of user basic information includes: name, gender, blood type and other information categories.

[0069] According to the completion of the data information, the method for determining the degree of missing information of the user at the current sensitivity level is as follows: for the data information at each sensitivity level, the proportion of the data information that the user has not filled in at the current sensitivity level is used as the degree of missing information at the current sensitivity level. More specifically, for the data information at each sensitivity level, the data information that the user has not filled in can be labeled as 1, and the data information that the user has not filled in can be labeled as 0, and the proportion of the number of data information labeled 1 in the number of all data information that should be filled in is used as the degree of missing information of the user at the current sensitivity level. Then, the degree of missing information of the user at each sensitivity level can be obtained, that is, each user has a corresponding degree of missing information at each sensitivity level.

[0070] The hierarchical vector is constructed by taking the user's data information at each sensitivity level as a vector element: word vectors are extracted from the data information, and the word vectors of the data information at each sensitivity level are taken as vector elements in the hierarchical vector to obtain the hierarchical vector. The integration method here is to arrange all the word vectors in the original order of the database storage data table, and the difference in the hierarchical vector can be regarded as the information difference of the medical patient at this sensitivity level. Among them, the database storage data table is used to store the user's data information, and the original order of the database storage data table can be the storage time sequence of the user's data information.

[0071] Step S300, analyzing the information missing degree and level vector of different users at the sensitivity level and other users, and determining the level correlation of users at the current sensitivity level.

[0072] Due to the association relationship between the storage of multiple types of information of the same user in different data tables, that is, the data information of users in different sensitivity levels has a corresponding relationship with the data information of multiple levels. For example, the image information of the chest scan results of a user is basically consistent with that of users of the same type, but it is more specific in the medical records of another sensitivity level, such as repeated hospitalization. Since the information of these two levels belongs to the same user, there is such a connection relationship. Then the particularity of the image information mainly comes from this connection relationship. Correspondingly, this mapping relationship can be retained without encrypting the image information. Therefore, the sensitivity classification can be refined and adjusted according to the association relationship to improve the efficiency of data security protection and sharing. It should be noted that the mapping relationship here refers to the relationship between different sensitivity levels belonging to the same user. For example, for user A, there are sensitivity levels b1 and b2. What is specifically encrypted here is the relationship between sensitivity levels b1 and b2, that is, the relationship between sensitivity levels b1 and b2 belonging to the same user is encrypted.

[0073] Since the sensitive characteristics of user data information during storage and transmission are based on the correlation relationship between medical information levels, the accuracy of the data information must be ensured before obtaining the correlation relationship, thereby analyzing the hierarchical correlation characteristics of the medical data of different users.

[0074] First, after obtaining a user's medical data information and recording the information missing degree and level vector corresponding to each sensitivity level, when there is a lot of missing information in the patient's input data information, the corresponding level vector itself will show a large abnormality, so the accuracy of the patient's level information should be analyzed under the condition of missing information.

[0075] In some embodiments, the information accuracy of the current user and other users is determined by analyzing the difference between the level vectors at the same sensitivity level between the current user and other users, and the information missing degree of the current user. That is, the above step S300 can be performed by Figure 2 The steps shown achieve:

[0076] Step S310 , analyzing the difference between the level vectors of the current user and other users at the same sensitivity level, and the information missing degree of the current user, to determine the accuracy of the information of the current user and other users.

[0077] For the hierarchical vector of the sensitivity level of any user, the stronger the overall specificity, the more likely it is that the information content of the sensitivity level is highly correlated with the user itself, that is, the information of different users tends to be inconsistent, and the less impact the missing information has on the similarity between connected levels.

[0078] First, any user is analyzed, the user to be analyzed is taken as the current user, and other users except the current user are taken as the target users. The similarity of the hierarchical vectors corresponding to the same sensitivity level between the current user and the target user is calculated as the single-level similarity.

[0079] In some embodiments, the similarity can be obtained by using cosine similarity to determine the similarity of the level vectors corresponding to the same sensitivity level between the current user and the target user as the single-level similarity.

[0080] Furthermore, the specificity of the hierarchical information can be reflected by the overall change of the single-level similarity of all sensitivity levels of the user. The overall change state can be characterized by the discrete state of the data, and the specificity of the hierarchical information can be reflected by the discrete value of the user information.

[0081] Therefore, the discrete situations of all single-level similarities corresponding to the current user and the target user are analyzed to determine the discrete values ​​of user information of the current user and the target user. The discrete values ​​of user information are reflected by all single-level similarities in the embodiment of the present invention.

[0082] In some embodiments, the variance of all single-level similarities may be used as a discrete value of user information between the current user and the target user.

[0083] In some other embodiments, the standard deviation of all single-level similarities may also be used as the discrete value of the user information of the current user and the target user. Both the variance and the standard deviation can reflect the discreteness of the single-level similarities.

[0084] Furthermore, according to the user information discrete value and the information missing degree, the information accuracy of the current user and the target user at the current sensitivity level is determined. When the user information discrete value is larger, it reflects that the user's data information is more unstable, and the corresponding user information accuracy is lower; and when the user's information missing degree is larger, it reflects that the type or quantity of data information filled in by the user is smaller, and the corresponding user information accuracy is also lower. Therefore, in an embodiment of the present invention, the user information discrete value and the information missing degree are negatively correlated with the information accuracy. The smaller the information missing degree and the stronger the consistency of the information within the level itself, the higher the information accuracy of the patient's hierarchical information. The information accuracy is related to the similarity characteristics and information missing degree of the corresponding hierarchical vector. The smaller the information missing degree and the stronger the consistency of the information within the level itself, the higher the information accuracy of the patient's hierarchical information, and the more accurate the analysis results of the associated features used for subsequent analysis between levels.

[0085] In some embodiments, the product value of the information missing degree and the user information discrete value is negatively correlated and normalized to obtain the information accuracy.

[0086] More specifically: the method for negatively correlating and normalizing the product of the information missing degree and the user information discrete value is: using the opposite of the product of the information missing degree and the user information discrete value as the exponent, using a natural constant as the base, and using the exponential function value obtained as the information accuracy.

[0087] Taking the i-th user as the current user, the r-th sensitivity level is analyzed as an example. The accuracy of this information The calculation formula is: ; Wherein, exp is an exponential function with the natural constant e as the base; is the discrete value of user information of the i-th user; is the information missing degree of the i-th user at the r-th sensitivity level.

[0088] Step S320 , at the same sensitivity level, the level vectors of other users that are similar to the level vector of the current user are screened out as the approximate level vectors of each sensitivity level.

[0089] Using the information vector differences within the hierarchy to quantify the hierarchical correlation can effectively reveal the relationship between data at different hierarchies. The information of different patients is inconsistent within multiple hierarchies, and hierarchical correlation with a high degree of consistency is low.

[0090] For the user's medical data information, the hierarchical vectors of different sensitivity levels and the adjacent hierarchical vectors of the lower level are recorded. The association relationship in the database storage data table is mainly realized through the primary key and the foreign key. The more common the combination relationship between these two adjacent hierarchical vectors between different users is, the weaker the hierarchical association relationship is.

[0091] By calculating the cosine similarity method, the similarity of the hierarchical vectors of the current user and other users is calculated to obtain the single-level similarity of the current user and other users. Then, the hierarchical vectors of other users are screened using a preset threshold. For each sensitivity level, when the single-level similarity between the current user and other users is greater than the preset threshold, the hierarchical vector corresponding to the single-level similarity is used as the approximate hierarchical vector of the current user at the sensitivity level. In the embodiment of the present invention, the value of the preset threshold is 0.85, and in other embodiments, it can be adjusted by the implementer according to actual conditions.

[0092] Step S330 , determining the level association of users at the current sensitivity level based on the number of approximate level vectors and the accuracy of information between the current user and other users.

[0093] The hierarchical correlation reflects the correlation between the data of the current user and each user other than the current user, at the same sensitivity level and at different sensitivity levels. The greater the hierarchical correlation, the greater the correlation between the current user and other users, and the more unified the data information corresponding to the users.

[0094] The average of the information accuracy of the current user and all other users at the current sensitivity level is used as the numerator, the number of approximate level vectors is used as the denominator, and the normalized value of the ratio corresponding to the numerator and the denominator is used as the level association of the user at the current sensitivity level.

[0095] Take the i-th user as the current user and the r-th sensitivity level as the current sensitivity level for analysis. The calculation formula is: ; Among them, norm is the normalization function; is the mean value of the information accuracy of the current user and all other users at the rth sensitivity level; is the number of approximation level vectors.

[0096] Step S400, based on the current sensitivity level, users are classified according to the level correlation to obtain multiple user sets; the necessity of adjusting the current sensitivity level is determined according to the difference in level correlation between any two users in the user set; based on the necessity of adjustment, the optimal sensitivity level is screened out from the multiple sensitivity levels.

[0097] Since the hierarchical correlation of medical user information refers to the hierarchical information of a single user, the correlation of the entire sensitivity hierarchy shows a strong and significant characteristic, which proves that the greater the degree of sensitivity adjustment required within the hierarchy.

[0098] The hierarchical correlation of all patients in the hierarchy is subjected to density clustering, and the constructed sample space is a one-dimensional sample space, and multiple clusters are obtained. That is, using the density clustering algorithm, the difference in the hierarchical correlation between two users is used as the distance between the two users, and multiple users are classified to obtain multiple user sets.

[0099] The average of the hierarchical correlation difference between two patients in each cluster is analyzed and recorded as the set difference representation value of the user set. For example, for the user set {a1, a2, a3}, the absolute value b1 of the difference between the hierarchical correlation of a1 and a2, the absolute value b2 of the difference between the hierarchical correlation of a1 and a3, and the absolute value b3 of the difference between the hierarchical correlation of a2 and a3 are calculated respectively, and the average of b1, b2, and b3 is used as the set difference representation value of the user set {a1, a2, a3}.

[0100] The necessity of adjusting the current sensitivity level is determined according to the difference in the level correlation between any two users in the user set, including: for each user set, taking the mean of the absolute values ​​of the differences in the level correlation between any two users in the user set as the set difference representation value of the user set; taking the negative correlation mapping value of the mean of the set difference representation values ​​of all user sets of the current sensitivity level as the necessity of adjusting the current sensitivity level.

[0101] Taking the rth sensitivity level as the current sensitivity level as an example, the necessity of this adjustment The calculation formula is: ; Where exp is an exponential function with the natural constant e as the base; J is the number of user sets at the rth sensitivity level; is the set difference representation value of the j-th user set at the r-th sensitivity level corresponding to the ith user.

[0102] For each user, the necessity of adjustment of different sensitivity levels is obtained. Therefore, the optimal sensitivity level must be the sensitivity level after the change of the corresponding adjustment necessity. Since the adjustment necessity is based on the distribution combination of this level and the next level, the corresponding is the necessity of sensitivity degradation. Here, a necessity threshold of 0.92 can be preset for screening. If it is higher than the threshold, a lower sensitivity level is selected as the optimal sensitivity scale. Specifically: the sensitivity level whose adjustment necessity is greater than the preset necessity threshold is screened out from multiple sensitivity levels as a high sensitivity level; the lower sensitivity level corresponding to the high sensitivity level is marked as the optimal sensitivity level. In the embodiment of the present invention, the value of the preset necessity threshold is 0.92, and in other embodiments, it can also be limited by the implementer according to actual conditions.

[0103] Step S500: encrypting the correspondence between the levels associated with the optimal sensitivity level.

[0104] According to the best sensitivity level obtained, for the sensitivity level that needs to be downgraded, it actually reflects the strength of the correlation between the medical patient data between the two levels. The weaker the correlation, the more it proves that the sensitivity of the level mainly comes from the association relationship between the primary and foreign keys of the patient information between the levels, and is not affected by the information content. Therefore, here we can choose to only retain the corresponding relationship between the two sensitivity levels of the original patient information and encrypt it, while the original content information is not encrypted, thereby realizing the security protection and sharing of medical patient information data on the medical data cloud platform, and effectively improving the efficiency of data sharing. It should be noted that the corresponding relationship between the two sensitivity levels here is explained in step S300, which will not be repeated here.

[0105] As a preferred embodiment of the present invention, the best sensitivity level and the levels associated with the best sensitivity level may also be encrypted to achieve encryption of important data.

[0106] The embodiment of the present invention provides a data security protection system for a cloud platform, the system comprising:

[0107] A data preprocessing module is used to obtain the user's data information stored in the cloud platform and divide the data information into multiple sensitivity levels;

[0108] An information construction module, used to determine the degree of missing information of the user at the current sensitivity level according to the completion of the data information; and to construct a level vector using the user's data information at each sensitivity level as a vector element;

[0109] The association analysis module is used to analyze the information missing degree and level vector of different users at the sensitivity level with other users, and determine the level association degree of users at the current sensitivity level;

[0110] The optimal sensitivity level determination module is used to classify users based on the current sensitivity level and the level correlation to obtain multiple user sets; determine the necessity of adjusting the current sensitivity level according to the difference in the level correlation between two users in the user set; and screen out the optimal sensitivity level from the multiple sensitivity levels based on the necessity of adjustment;

[0111] An encryption module is used to encrypt the corresponding relationship between the levels associated with the optimal sensitivity level.

[0112] Optionally, the transmission medium may be a wired link, such as but not limited to coaxial cable, optical fiber, and digital subscriber line, or a wireless link, such as but not limited to Wireless Fidelity (WIFI), Bluetooth, and mobile device network.

[0113] It should be noted that the device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above.

[0114] Figure 3 is a schematic diagram of the structure of a computer device provided by an embodiment of the present invention. Figure 3 As shown, the computer device 600 includes: a memory 610, a processor 620, and a computer program 630 stored in the memory 610 and running on the processor 620, wherein when the processor 620 executes the computer program 630, the computer device can execute any one of the data security protection methods for the cloud platform introduced above.

[0115] In addition, an embodiment of the present invention also protects a device, which may include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to execute a data security protection method for a cloud platform provided by an embodiment of the present invention.

[0116] The embodiment of the present invention can divide the functional modules of the device according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0117] In the case of dividing each module according to each function, the device may also include a signal uploading module, a determining module, an adjusting module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0118] It should be understood that the device provided in the embodiment of the present invention is used to execute the above-mentioned data security protection method for the cloud platform, and thus can achieve the same effect as the above-mentioned implementation method.

[0119] In the case of an integrated unit, the device may include a processing module and a storage module. When the device is applied to a device, the processing module may be used to control and manage the actions of the device. The storage module may be used to support the device to execute mutual program codes, etc. The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. The processor may also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0120] In addition, the device provided in an embodiment of the present invention may specifically be a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a data security protection method for a cloud platform provided in the above embodiment.

[0121] An embodiment of the present invention also provides a computer-readable storage medium, which stores computer program code. When the computer program code runs on a computer, the computer executes the above-mentioned related method steps to implement a data security protection method for a cloud platform provided by the above embodiment.

[0122] An embodiment of the present invention also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement a data security protection method for a cloud platform provided by the above embodiment.

[0123] Among them, the device, computer-readable storage medium, computer program product or chip provided in the embodiments of the present invention are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here. Through the description of the above implementation methods, technicians in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways.

[0124] The device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical function division. There may be other divisions in actual implementation. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0125] It should also be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0126] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0127] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0128] The above contents are only specific implementation modes of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered within the protection scope of the present invention.

Claims

1. A data security protection method for a cloud platform, characterized in that: The method comprises the following steps: Obtaining user data information stored in the cloud platform, and dividing the data information into multiple sensitivity levels; Determine the degree of missing information of the user at the current sensitivity level according to the completion of the data information; construct a level vector using the user's data information at each sensitivity level as a vector element; Analyze the information missing degree and level vector of different users at the sensitivity level with other users, and determine the level correlation of users at the current sensitivity level; Based on the current sensitivity level, users are classified according to the level association to obtain multiple user sets; the necessity of adjusting the current sensitivity level is determined according to the difference in the level association between two users in the user set; based on the necessity of adjustment, the optimal sensitivity level is screened out from the multiple sensitivity levels; The correspondence between the levels associated with the optimal sensitivity level is encrypted.

2. The data security protection method for cloud platforms according to claim 1 is characterized in that: The analyzing the information missing degree and level vector of different users at the sensitivity level with other users to determine the level correlation of users at the current sensitivity level includes: Analyze the difference between the level vectors of the current user and other users at the same sensitivity level, as well as the information missing degree of the current user, to determine the accuracy of the information of the current user and other users; At the same sensitivity level, the level vectors of other users that are similar to the level vector of the current user are screened out as the approximate level vector of each sensitivity level; The hierarchical correlation of users at the current sensitivity level is determined by the number of approximate hierarchical vectors and the accuracy of the information between the current user and other users.

3. The data security protection method for cloud platforms according to claim 1 is characterized in that: Determining the degree of missing information of the user at the current sensitivity level according to the completion status of the data information includes: The proportion of data information that users have not filled in at the current sensitivity level is taken as the information missing degree of the current sensitivity level.

4. The data security protection method for cloud platforms according to claim 1 is characterized in that: The method of constructing a hierarchical vector by using the user's data information at each sensitivity level as a vector element includes: The word vector is extracted for the data information, and the word vector of the data information at each sensitivity level is used as the vector element in the level vector to obtain the level vector.

5. The data security protection method for cloud platforms according to claim 2 is characterized in that: The analyzing the difference between the level vectors at the same sensitivity level between the current user and other users, and the information missing degree of the current user, and determining the accuracy of the information between the current user and other users, includes: Taking other users except the current user as target users, calculating the similarity of the hierarchical vectors corresponding to the same sensitivity level between the current user and the target user as the single-level similarity; analyzing the discreteness of all single-level similarities corresponding to the current user and the target user, and determining the discrete values ​​of the user information of the current user and the target user; According to the user information discrete value and the information missing degree, the information accuracy of the current user and the target user at the current sensitivity level is determined; wherein the user information discrete value and the information missing degree are negatively correlated with the information accuracy.

6. The data security protection method for cloud platforms according to claim 5 is characterized in that: The step of selecting the level vectors of other users that are similar to the level vector of the current user at the same sensitivity level as the approximate level vector of each sensitivity level includes: For each sensitivity level, when the single-level similarity between the current user and other users is greater than a preset threshold, the level vector corresponding to the single-level similarity is used as the approximate level vector of the current user at the sensitivity level.

7. The data security protection method for cloud platforms according to claim 2 is characterized in that: Determining the level correlation of users at the current sensitivity level based on the number of approximate level vectors and the accuracy of information of the current user and other users includes: The average of the information accuracy of the current user and all other users at the current sensitivity level is used as the numerator, the number of approximate level vectors is used as the denominator, and the normalized value of the ratio corresponding to the numerator and the denominator is used as the level association of the user at the current sensitivity level.

8. The data security protection method for cloud platforms according to claim 1 is characterized in that: Based on the current sensitivity level, users are classified according to the level association to obtain multiple user sets, including: Using the density clustering algorithm, the difference in the hierarchical association between two users is taken as the distance between the two users, and multiple users are classified to obtain multiple user sets.

9. The data security protection method for cloud platforms according to claim 1, characterized in that: The step of determining the necessity of adjusting the current sensitivity level according to the difference in level association between two users in the user set includes: For each user set, the average of the absolute values ​​of the differences in the hierarchical associations between any two users in the user set is taken as the set difference representation value of the user set; The negative correlation mapping value of the mean of the set difference representation values ​​of all user sets at the current sensitivity level is used as the necessity of adjusting the current sensitivity level.

10. The data security protection method for cloud platforms according to claim 1, characterized in that: Based on the necessity of the adjustment, the optimal sensitivity level is screened out from multiple sensitivity levels, including: A sensitivity level whose adjustment necessity is greater than a preset necessity threshold is selected from multiple sensitivity levels as a high sensitivity level; and a sensitivity level one level lower than the high sensitivity level is marked as an optimal sensitivity level.

Images