A method and system for electronic data security management

Abstract

The present invention relates to the field of data security technology, and in particular to an electronic data security management method and system. An electronic data security management system comprises: an electronic data access request acquisition module, an electronic data access request matching module, a user authority library periodic update module, and a authority self-regulation model real-time update module. The present invention characterizes the user experience under the current authority setting by acquiring the authority verification failure rate and the number of user authority applications, and sends the authority verification failure rate, the number of user authority applications, and the user authority data into the authority self-regulation model for processing, automatically regulates the authority setting, and matches the regulated user authority data with the user's electronic data access request to achieve user authority authentication; and the authority self-regulation model is updated by the authority verification failure rate and the number of user authority applications, so that the regulated authority setting can improve the user experience.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an electronic data security management method and system. Background Art

[0002] In the existing electronic data security management technology, permission management is one of the key links to ensure data security. Traditional permission management methods mainly rely on manual setting and adjustment of permissions, that is, administrators manually assign permissions based on user roles or responsibilities. Although this manual adjustment of permissions can ensure data security to a certain extent, it also has many inconveniences and limitations.

[0003] First, manually adjusting permissions usually requires administrators to set them one by one according to the specific needs of each user, which not only increases the complexity of management, but also is difficult to complete efficiently when faced with a large number of users or frequently changing permission requirements. Especially in large enterprises or dynamic work environments, where employee roles, responsibilities, and project participation often change, manually managing permissions results in a huge workload. In addition, with the rapid growth of data volume and number of users, it is difficult for administrators to respond to permission changes in a timely manner, resulting in a lag in permission configuration and an increased risk of data leakage. Summary of the invention

[0004] The present invention characterizes the user experience under the current permission setting by obtaining the permission verification failure rate and the number of user permission applications, and sends the permission verification failure rate, the number of user permission applications and the user permission data into the permission self-regulation model for processing, automatically regulates the permission setting, and matches the regulated user permission data with the user's electronic data access request to achieve user permission authentication; and updates the permission self-regulation model according to the permission verification failure rate and the number of user permission applications, so that the regulated permission setting can improve the user experience.

[0005] The present invention includes a method for electronic data security management, comprising:

[0006] Obtain the user's electronic data access request, which includes user information, electronic data information and access request; match the user's electronic data access request with the user authority library, and if the match is successful, approve the user's electronic data access request; if the match fails, reject the user's electronic data access request to achieve safe management of electronic data. The user authority library includes user authority data, which includes user information, electronic data information and authority settings, where the authority settings are consistent with the storage format of the access request; the user authority library is updated regularly;

[0007] Update the user permission library, including the following:

[0008] At the permission control time point, obtain the permission verification failure rate and the number of user permission applications within a preset period. The preset period is the time period between two adjacent permission control time points. The permission verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests. The number of user permission applications is the number of times a user requests to change permissions due to permission verification failure. Add the permission verification failure rate and the number of user permission applications to the end of each user permission data in the user permission library, construct permission analysis data, and then send all permission analysis data to the permission self-control model for processing. The permission self-control model is established based on the BP neural network, outputs all new user permission data, and replaces the original user permission data in the user permission library with all new user permission data to update the user permission library.

[0009] At the permission control time point, the permission self-control model is updated in real time, which specifically includes the following steps:

[0010] The permission verification failure rate and the number of user permission applications within the preset period obtained at the current permission control time point constitute the post-item effect analysis part, the permission verification failure rate and the number of user permission applications within the preset period obtained at the previous permission control time point constitute the previous item effect analysis part, the user permission library corresponding to the previous permission control time point is recorded as the post-item strategy part, and the user permission library corresponding to the second permission control time point before the current permission control time point is recorded as the previous item strategy part;

[0011] The preceding strategy part, the preceding effect analysis part and the following strategy part form the strategy analysis data, and the strategy analysis data is sent to the update evaluation network for processing, and the real-time evaluation value is output. The strategy analysis data is then sent to the target update evaluation network for processing, and the target evaluation value is output. The square of the difference between the real-time evaluation value and the target evaluation value is recorded as the mean square error of the evaluation value; the strategy reward value is calculated based on the preceding effect analysis part and the following effect analysis part, and the difference between the mean square error of the evaluation value and the strategy reward value is used as the evaluation loss value. By minimizing the evaluation loss value, the parameters of the update evaluation network are updated in real time using the gradient descent method;

[0012] The previous policy part and the previous effect analysis part are combined into policy control data, and the policy control data is sent to the target permission self-control model for processing, and all target user permission data are output, and all target user permission data are combined into a simulated user permission library, and the policy control data and the simulated user permission library are combined into simulated policy analysis data, and then the simulated policy analysis data is sent to the updated update evaluation network for processing, and a simulated evaluation value is output. The simulated evaluation value represents the rationality of the permission setting corresponding to the simulated user permission library. By maximizing the simulated evaluation value, the parameters of the permission self-control model are updated using the gradient ascent method;

[0013] It also includes updates to the target update evaluation network and the target authority self-regulation model.

[0014] Preferably, matching the user's electronic data access request with the user authority library specifically includes the following steps:

[0015] Step S1: Let i=1, i is used to record the serial number of the user authority data in the user authority library;

[0016] Step S2: Select the i-th user authority data in the user authority library, first fully match the user information and electronic data information in the electronic data access request with the user information and electronic data information in the i-th user authority data, if the user information and electronic data information in the electronic data access request successfully match the user information and electronic data information in the i-th user authority data, go to step S3; if the user information and electronic data information in the electronic data access request fails to match the user information and electronic data information in the i-th user authority data, go to step S4:

[0017] Step S3: Determine whether the access request in the electronic data access request is included in the permission setting in the i-th user permission data. If the access request in the electronic data access request is included in the permission setting in the i-th user permission data, it is deemed that the user's electronic data access request is successfully matched with the user permission library, and the matching ends; if the access request in the electronic data access request is not included in the permission setting in the i-th user permission data, proceed to step S4;

[0018] Step S4: Determine whether i<I is true, where I is the total number of user authority data in the user authority library. If i<I is true, assign i+1 to i and return to step S2; if i<I is not true, it is deemed that the user's electronic data access request fails to match the user authority library and the matching is terminated.

[0019] Preferably, the strategy reward value is calculated based on the preceding effect analysis part and the following effect analysis part, specifically including the following steps:

[0020] Calculate the difference between the previous effect analysis part and the subsequent effect analysis part, output the permission verification failure rate difference μ and the user permission application number difference ε, and record the permission verification failure rate and user permission application number in the subsequent effect analysis part as E and G respectively, and calculate the strategy reward value U=α 1 μ+α 2 ε+α 3 E+α 4 G, where α 1 , α 2 , α 3 and α 4They are the first weight coefficient, the second weight coefficient, the third weight coefficient and the fourth weight coefficient respectively.

[0021] Preferably, updating the target update evaluation network and the target authority self-regulation model specifically includes the following steps:

[0022] At the target network update time point, the current update evaluation network is directly replaced with the target update evaluation network to achieve the update of the target update evaluation network, and there are M authority control time points between two adjacent target network update time points;

[0023] At the target network update time point, the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the optimal user permission library are used as target training samples, and the target permission self-regulation model is updated through the target training samples. Specifically, the current user permission library, the obtained permission verification failure rate and the number of user permission applications are used as the input of the target permission self-regulation model, and the optimal user permission library is used as the target output of the target permission self-regulation model; and the optimal user permission library is obtained by simulation calculation of the swarm optimization algorithm.

[0024] Preferably, the optimal user authority library is obtained by simulating and calculating through a group optimization algorithm, which specifically includes the following steps:

[0025] Construct several simulated user permission library individuals, and form a population set of all simulated user permission library individuals, and set the maximum number of iterations;

[0026] Calculate the fitness of the individual in the simulated user permission library. The specific calculation method is to send the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the individual in the simulated user permission library to the target update evaluation network for processing, output the target simulation evaluation value, and use the target simulation evaluation value as the fitness of the individual in the simulated user permission library;

[0027] Based on the fitness of the individuals in the simulated user permission library, the population set is iteratively updated through the population optimization algorithm;

[0028] Until the number of iterations reaches the maximum number of iterations, the simulated user permission library individual with the largest fitness is output as the optimal user permission library.

[0029] Preferably, updating the update evaluation network and the authority self-regulation model specifically includes the following steps:

[0030] Acquire a number of permission self-regulation training samples, which include permission analysis data and its corresponding target user permission library; combine all permission self-regulation training samples into a permission self-regulation training set, and send the permission self-regulation training set to the permission self-regulation model with parameter initialization for training. During the training, the permission analysis data is used as the target input, and the corresponding target user permission library is used as the target output. The permission self-regulation loss value is calculated to determine whether the permission self-regulation loss value is within a first preset range. If the permission self-regulation loss value is within the first preset range, the trained permission self-regulation model is output; otherwise, the permission self-regulation model is continuously trained through the permission self-regulation training set;

[0031] Acquire several update evaluation training samples, which include strategy analysis data, and label the update evaluation training samples with target evaluation values; combine all labeled update evaluation training samples into an update evaluation training set, and send the update evaluation training set to an update evaluation network with parameter initialization for training, calculate the update evaluation loss value, and determine whether the update evaluation loss value is within a second preset range. If so, output the trained update evaluation network; otherwise, continue to train the update evaluation network with the update evaluation training set.

[0032] Preferably, the population optimization algorithm adopts a genetic algorithm.

[0033] The present invention also includes an electronic data security management system, comprising:

[0034] An electronic data access request acquisition module is used to acquire a user's electronic data access request, where the electronic data access request includes user information, electronic data information, and access request;

[0035] An electronic data access request matching module is used to match the user's electronic data access request with the user authority library. If the match is successful, the user's electronic data access request is approved. If the match fails, the user's electronic data access request is rejected to achieve safe management of electronic data. The user authority library includes user authority data, and the user authority data includes user information, electronic data information, and authority settings, wherein the authority settings are consistent with the storage format of the access request;

[0036] The user authority library periodic update module is used to obtain the authority verification failure rate and the number of user authority applications within a preset period at the authority control time point. The preset period is the time period between two adjacent authority control time points. The authority verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests. The number of user authority applications is the number of times a user requests to change authority due to authority verification failure. The authority verification failure rate and the number of user authority applications are added to the end of each user authority data in the user authority library to construct authority analysis data, and then all authority analysis data are sent to the authority self-control model for processing. The authority self-control model is established based on the BP neural network, outputs all new user authority data, and replaces the original user authority data in the user authority library with all new user authority data to achieve the update of the user authority library;

[0037] The permission self-regulation model real-time update module is used to update the permission self-regulation model in real time at the permission regulation time point.

[0038] The present invention has the following advantages:

[0039] The present invention characterizes the user experience under the current permission setting by obtaining the permission verification failure rate and the number of user permission applications, and sends the permission verification failure rate, the number of user permission applications and the user permission data into the permission self-regulation model for processing, automatically regulates the permission setting, and matches the regulated user permission data with the user's electronic data access request to achieve user permission authentication; and updates the permission self-regulation model according to the permission verification failure rate and the number of user permission applications, so that the regulated permission setting can improve the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the structure of the electronic data security management system used in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to enable persons skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0042] Embodiment 1, a method for electronic data security management, comprising:

[0043] The electronic data access request of the user is obtained. The electronic data here refers to different contents in different scenarios. In this embodiment, it refers to data within the enterprise, such as business information, project plans, product design drawings, and program source code files within the enterprise. The electronic data access request includes user information, electronic data information, and access request. The user information is a string of binary codes, which is generally set by one-hot coding. The electronic data information is the electronic data code to be accessed by the electronic data access request. In the electronic data information library, each electronic data is generally marked by the electronic data code. The access request includes the operation that the user wants to perform on the accessed electronic data, specifically: Read, write and execute, etc. are generally stored in three-digit binary codes, for example, "011" indicates that the accessed electronic data needs to be written and executed, and "100" indicates that the accessed electronic data needs to be read; the user's electronic data access request is matched with the user authority library. If the match is successful, the user's electronic data access request is approved. If the match fails, the user's electronic data access request is rejected to achieve the security management of electronic data. The user authority library includes user authority data, which includes user information, electronic data information and authority settings, where the authority settings are consistent with the storage format of the access request; the user authority library is updated regularly;

[0044] Update the user permission library, including the following:

[0045] At the permission control time point, obtain the permission verification failure rate and the number of user permission applications within a preset period. The preset period is the time period between two adjacent permission control time points, which is set by the operator and is generally 1 hour. The permission verification failure rate and the number of user permission applications obtained at the permission control time point correspond to the preset period specifically between the previous permission control time point and the current permission control time point. The permission verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests, which can reflect the accuracy of permission settings. The lower the permission verification failure rate, the more accurate the permission settings in the user permission library. The number of user permission applications is the number of times a user requests to change permissions due to permission verification failure. The permission verification failure rate and the number of user permission applications are added to the end of each user permission data in the user permission library to construct permission analysis data, and then all permission analysis data are sent to the permission self-regulation model for processing. The permission self-regulation model is established based on the BP neural network, outputs all new user permission data, and replaces the original user permission data in the user permission library with all new user permission data to update the user permission library.

[0046] At the permission control time point, the permission self-control model is updated in real time, which specifically includes the following steps:

[0047] The permission verification failure rate and the number of user permission applications within the preset period obtained at the current permission control time point constitute the post-item effect analysis part, the permission verification failure rate and the number of user permission applications within the preset period obtained at the previous permission control time point constitute the previous item effect analysis part, the user permission library corresponding to the previous permission control time point is recorded as the post-item strategy part, and the user permission library corresponding to the second permission control time point before the current permission control time point is recorded as the previous item strategy part;

[0048] The preceding strategy part, the preceding effect analysis part and the succeeding strategy part form the strategy analysis data, and the strategy analysis data is sent to the update evaluation network for processing, and the real-time evaluation value is output. The strategy analysis data is then sent to the target update evaluation network for processing, and the target evaluation value is output. The square of the difference between the real-time evaluation value and the target evaluation value is recorded as the evaluation value mean square error, and the evaluation value mean square error is used to characterize the difference between the update evaluation network and the target update evaluation network; the strategy reward value is calculated based on the preceding effect analysis part and the succeeding effect analysis part, and the strategy reward value is used to characterize the user's electronic data access experience after each execution permission update. The difference between the evaluation value mean square error and the strategy reward value is used as the evaluation loss value, and the parameters of the update evaluation network are updated in real time by minimizing the evaluation loss value using the gradient descent method. In the process of minimizing the evaluation loss value, the difference between the update evaluation network and the target update evaluation network can be minimized while the strategy reward value is improved, that is, the update evaluation network is updated in the direction of improving the user's electronic data access experience after each execution permission update and reducing the difference between the update evaluation network and the target update evaluation network.

[0049] The previous policy part and the previous effect analysis part are combined into policy control data, and the policy control data is sent to the target permission self-control model for processing, and all target user permission data are output, and all target user permission data are combined into a simulated user permission library, and the policy control data and the simulated user permission library are combined into simulated policy analysis data, and then the simulated policy analysis data is sent to the updated update evaluation network for processing, and a simulated evaluation value is output. The simulated evaluation value represents the rationality of the permission setting corresponding to the simulated user permission library. By maximizing the simulated evaluation value, the parameters of the permission self-control model are updated using the gradient ascent method. In the process of maximizing the simulated evaluation value, the permission self-control model can be adjusted from the perspective of improving the rationality of the permission setting;

[0050] It also includes updates to the target update evaluation network and the target authority self-regulation model;

[0051] This application characterizes the user experience under the current permission setting by obtaining the permission verification failure rate and the number of user permission applications, and sends the permission verification failure rate, the number of user permission applications and the user permission data into the permission self-regulation model for processing, automatically regulates the permission setting, and matches the regulated user permission data with the user's electronic data access request to achieve user permission authentication; and updates the permission self-regulation model through the permission verification failure rate and the number of user permission applications, so that the regulated permission setting can improve the user experience.

[0052] Matching the user's electronic data access request with the user authority database includes the following steps:

[0053] Step S1: Let i=1, i is used to record the serial number of the user authority data in the user authority library;

[0054] Step S2: Select the i-th user authority data in the user authority library, first fully match the user information and electronic data information in the electronic data access request with the user information and electronic data information in the i-th user authority data, that is, the corresponding data are fully matched. If the user information and electronic data information in the electronic data access request successfully match the user information and electronic data information in the i-th user authority data, that is, the user information and electronic data information in the electronic data access request are completely consistent with the user information and electronic data information in the user authority data, go to step S3; if the user information and electronic data information in the electronic data access request fail to match the user information and electronic data information in the i-th user authority data, go to step S4:

[0055] Step S3: Determine whether the access request in the electronic data access request is included in the permission setting in the i-th user permission data. The method adopted in this implementation is to perform bitwise multiplication of the access request in the electronic data access request and the permission setting in the i-th user permission data. If the result contains 1, it is deemed that the access request in the electronic data access request is included in the permission setting in the i-th user permission data. Since the permission setting may contain multiple permissions, and the access request may contain only one permission, it is necessary to determine the inclusion relationship. If the access request in the electronic data access request is included in the permission setting in the i-th user permission data, it is deemed that the user's electronic data access request is successfully matched with the user permission library, and the matching is terminated; if the access request in the electronic data access request is not included in the permission setting in the i-th user permission data, proceed to step S4;

[0056] Step S4: Determine whether i<I holds, where I is the total number of user authority data in the user authority library. If i<I holds, it means that not all user authority data in the user authority library have been selected, and i+1 is assigned to i, and the process returns to step S2. If i<I does not hold, it means that all user authority data in the user authority library have been selected, and it is deemed that the user's electronic data access request fails to match the user authority library, and the matching is terminated.

[0057] The strategy reward value is calculated based on the previous effect analysis part and the subsequent effect analysis part, which specifically includes the following steps:

[0058] Calculate the difference between the previous effect analysis part and the subsequent effect analysis part, output the permission verification failure rate difference μ and the user permission application number difference ε, and record the permission verification failure rate and user permission application number in the subsequent effect analysis part as E and G respectively, and calculate the strategy reward value U=α 1 μ+α 2 ε+α 3 E+α 4 G, where α 1 , α 2 , α 3 and α 4 They are the first weight coefficient, the second weight coefficient, the third weight coefficient and the fourth weight coefficient, respectively, which can be set by the developer or simulated by the group optimization algorithm; this application analyzes the effect of the permission adjustment by calculating the permission verification failure rate and the number of user permission applications fed back later, as well as the difference between the permission verification failure rate and the number of user permission applications.

[0059] The target update evaluation network and the target authority self-regulation model are updated, which specifically includes the following steps:

[0060] At the target network update time point, the current update evaluation network is directly replaced with the target update evaluation network to achieve the update of the target update evaluation network. There are M permission control time points between two adjacent target network update time points. The M value is determined by the developer and is generally 22.

[0061] At the target network update time point, the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the optimal user permission library are used as target training samples, and the target permission self-regulation model is updated through the target training samples. Specifically, the current user permission library, the obtained permission verification failure rate and the number of user permission applications are used as the input of the target permission self-regulation model, and the optimal user permission library is used as the target output of the target permission self-regulation model; and the optimal user permission library is obtained by simulation calculation of the group optimization algorithm;

[0062] The optimal user permission library is obtained through simulation calculation of the group optimization algorithm, which specifically includes the following steps:

[0063] Construct several simulated user permission library individuals, and form a population set with all simulated user permission library individuals, and set the maximum number of iterations. It should be noted that in the process of constructing simulated user permission library individuals, the user information and electronic data information in the user permission data remain unchanged, which is determined by the actual usage scenario. What changes is the permission setting, which can be a change between 0 and 1.

[0064] Calculate the fitness of the individual in the simulated user permission library. The specific calculation method is to send the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the individual in the simulated user permission library to the target update evaluation network for processing, output the target simulation evaluation value, and use the target simulation evaluation value as the fitness of the individual in the simulated user permission library;

[0065] Based on the fitness of the individuals in the simulated user permission library, the population set is iteratively updated through a genetic algorithm. During the iterative update process, selection, recombination and mutation operations are performed, and the recombination and mutation operations are all based on the permission setting part;

[0066] Until the number of iterations reaches the maximum number of iterations, the simulated user permission library individual with the largest fitness is output as the optimal user permission library. During the iteration process, the permission adjustment plan can be optimized, further improving the accuracy of the permission self-regulation model for permission adjustment.

[0067] The update evaluation network and the permission self-regulation model are updated, which specifically includes the following steps:

[0068] A plurality of permission self-regulation training samples are obtained, wherein the permission self-regulation training samples include permission analysis data and a corresponding target user permission library. It should be noted that the permission analysis data and the corresponding target user permission library in the permission self-regulation training samples are actually obtained, and the target user permission library is the most suitable permission configuration manually adjusted by the user according to the actual situation; all permission self-regulation training samples are combined into a permission self-regulation training set, and the permission self-regulation training set is sent to the permission self-regulation model with parameter initialization for training. During the training, the permission analysis data is used as the target input, and the corresponding target user permission library is used as the target output. The permission self-regulation loss value is calculated to determine whether the permission self-regulation loss value is within a first preset range, which is manually set. If the permission self-regulation loss value is within the first preset range, the trained permission self-regulation model is output; otherwise, the permission self-regulation model is continuously trained through the permission self-regulation training set;

[0069] A number of update evaluation training samples are obtained, and the update evaluation training samples include policy analysis data. It should be noted that the policy analysis data in the update evaluation training samples are actually obtained and are consistent with the acquisition method when the permission self-regulation model is updated in real time. The update evaluation training samples are labeled by target evaluation values. The target evaluation value is generally 1 or 0. 1 indicates that the permission adjustment in the update evaluation training sample has a positive effect, and 0 indicates that the permission adjustment in the update evaluation training sample has a negative effect; all labeled update evaluation training samples are combined into an update evaluation training set, and the update evaluation training set is sent to the update evaluation network with parameter initialization for training, and the update evaluation loss value is calculated to determine whether the update evaluation loss value is within a second preset range. The second preset range is artificially set. If the update evaluation loss value is within the second preset range, the trained update evaluation network is output; otherwise, the update evaluation network continues to be trained through the update evaluation training set.

[0070] Embodiment 2, an electronic data security management system, such as Figure 1 As shown, including:

[0071] An electronic data access request acquisition module is used to acquire the user's electronic data access request. The electronic data here refers to different reference contents in different scenarios. In this embodiment, it refers to data within the enterprise, such as business information within the enterprise, project plans, product design drawings, and program source code files. The electronic data access request includes user information, electronic data information, and access request. The user information is a string of binary codes, which is generally set by one-hot coding. The electronic data information is the electronic data code to be accessed by the electronic data access request. In the electronic data information library, each electronic data is generally marked by the electronic data code. The access request includes the operation that the user wants to perform on the accessed electronic data, specifically read, write, and execute, etc., which is generally stored in a three-bit binary code, such as "011", indicating that the accessed electronic data needs to be written and executed, and "100" indicates that the accessed electronic data needs to be read.

[0072] An electronic data access request matching module is used to match the user's electronic data access request with the user authority library. If the match is successful, the user's electronic data access request is approved. If the match fails, the user's electronic data access request is rejected to achieve safe management of electronic data. The user authority library includes user authority data, and the user authority data includes user information, electronic data information, and authority settings, wherein the authority settings are consistent with the storage format of the access request;

[0073] The user authority library periodic update module is used to obtain the authority verification failure rate and the number of user authority applications within a preset period at the authority control time point. The preset period is the time period between two adjacent authority control time points, which is set by the operator and is generally 1 hour. The authority verification failure rate and the number of user authority applications obtained at the authority control time point correspond to the preset period between the previous authority control time point and the current authority control time point. The authority verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests, which can reflect the accuracy of authority settings. The lower the authority verification failure rate, the more accurate the authority settings in the user authority library. The number of user authority applications is the number of times a user requests to change permissions due to authority verification failure. The authority verification failure rate and the number of user authority applications are added to the end of each user authority data in the user authority library to construct authority analysis data, and then all authority analysis data are sent to the authority self-regulation model for processing. The authority self-regulation model is established based on the BP neural network, outputs all new user authority data, and replaces the original user authority data in the user authority library with all new user authority data to achieve the update of the user authority library;

[0074] The permission self-regulation model real-time update module is used to update the permission self-regulation model in real time at the permission regulation time point.

[0075] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all such improvements and changes should fall within the scope of protection of the appended claims of the present invention. Parts not described in detail in this specification belong to the prior art known to those skilled in the art.

Claims

1. A method for electronic data security management, characterized in that: include: Obtaining a user's electronic data access request, which includes user information, electronic data information, and access request; Match the user's electronic data access request with the user authority library. If the match is successful, the user's electronic data access request is approved. If the match fails, the user's electronic data access request is rejected to achieve safe management of electronic data. The user authority library includes user authority data, which includes user information, electronic data information and authority settings, where the authority settings are consistent with the storage format of the access request; The user permission database is updated regularly; Update the user permission library, including the following: At the permission control time point, obtain the permission verification failure rate and the number of user permission applications within a preset period. The preset period is the time period between two adjacent permission control time points. The permission verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests. The number of user permission applications is the number of times a user requests to change permissions due to permission verification failure. Add the permission verification failure rate and the number of user permission applications to the end of each user permission data in the user permission library, construct permission analysis data, and then send all permission analysis data to the permission self-control model for processing. The permission self-control model is established based on the BP neural network, outputs all new user permission data, and replaces the original user permission data in the user permission library with all new user permission data to update the user permission library. At the permission control time point, the permission self-control model is updated in real time, which specifically includes the following steps: The permission verification failure rate and the number of user permission applications within the preset period obtained at the current permission control time point constitute the post-item effect analysis part, the permission verification failure rate and the number of user permission applications within the preset period obtained at the previous permission control time point constitute the previous item effect analysis part, the user permission library corresponding to the previous permission control time point is recorded as the post-item strategy part, and the user permission library corresponding to the second permission control time point before the current permission control time point is recorded as the previous item strategy part; The preceding strategy part, the preceding effect analysis part and the following strategy part form the strategy analysis data, and the strategy analysis data is sent to the update evaluation network for processing, and the real-time evaluation value is output. The strategy analysis data is then sent to the target update evaluation network for processing, and the target evaluation value is output. The square of the difference between the real-time evaluation value and the target evaluation value is recorded as the mean square error of the evaluation value; the strategy reward value is calculated based on the preceding effect analysis part and the following effect analysis part, and the difference between the mean square error of the evaluation value and the strategy reward value is used as the evaluation loss value. By minimizing the evaluation loss value, the parameters of the update evaluation network are updated in real time using the gradient descent method; The previous policy part and the previous effect analysis part are combined into policy control data, and the policy control data is sent to the target permission self-control model for processing, and all target user permission data are output, and all target user permission data are combined into a simulated user permission library, and the policy control data and the simulated user permission library are combined into simulated policy analysis data, and then the simulated policy analysis data is sent to the updated update evaluation network for processing, and a simulated evaluation value is output. The simulated evaluation value represents the rationality of the permission setting corresponding to the simulated user permission library. By maximizing the simulated evaluation value, the parameters of the permission self-control model are updated using the gradient ascent method; It also includes updates to the target update evaluation network and the target authority self-regulation model.

2. The electronic data security management method according to claim 1, characterized in that: Matching the user's electronic data access request with the user authority database includes the following steps: Step S1: Let i=1, i is used to record the serial number of the user authority data in the user authority library; Step S2: Select the i-th user authority data in the user authority library, first fully match the user information and electronic data information in the electronic data access request with the user information and electronic data information in the i-th user authority data, if the user information and electronic data information in the electronic data access request successfully match the user information and electronic data information in the i-th user authority data, go to step S3; if the user information and electronic data information in the electronic data access request fails to match the user information and electronic data information in the i-th user authority data, go to step S4: Step S3: Determine whether the access request in the electronic data access request is included in the permission setting in the i-th user permission data. If the access request in the electronic data access request is included in the permission setting in the i-th user permission data, it is deemed that the user's electronic data access request is successfully matched with the user permission library, and the matching ends; if the access request in the electronic data access request is not included in the permission setting in the i-th user permission data, proceed to step S4; Step S4: determine whether i<I is established, where I is the total number of user authority data in the user authority library. If i<I is established, assign i+1 to i and return to step S2; If i<I does not hold, it is considered that the user's electronic data access request fails to match the user authority library, and the matching is terminated.

3. The electronic data security management method according to claim 2, characterized in that: The strategy reward value is calculated based on the previous effect analysis part and the subsequent effect analysis part, which specifically includes the following steps: Calculate the difference between the antecedent effect analysis part and the latter effect analysis part, output the permission verification failure rate difference μ and the user permission application number difference ε, and record the permission verification failure rate and the user permission application number in the latter effect analysis part as E and G respectively, and calculate the strategy reward value U=α1μ+α2ε+α3E+α4G, where α1, α2, α3 and α4 are the first weight coefficient, the second weight coefficient, the third weight coefficient and the fourth weight coefficient respectively.

4. The electronic data security management method according to claim 3, characterized in that: The target update evaluation network and the target authority self-regulation model are updated, which specifically includes the following steps: At the target network update time point, the current update evaluation network is directly replaced with the target update evaluation network to achieve the update of the target update evaluation network, and there are M authority control time points between two adjacent target network update time points; At the target network update time point, the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the optimal user permission library are used as target training samples, and the target permission self-regulation model is updated through the target training samples. Specifically, the current user permission library, the obtained permission verification failure rate and the number of user permission applications are used as the input of the target permission self-regulation model, and the optimal user permission library is used as the target output of the target permission self-regulation model; and the optimal user permission library is obtained by simulation calculation of the swarm optimization algorithm.

5. The electronic data security management method according to claim 4, characterized in that: The optimal user permission library is obtained through simulation calculation of the group optimization algorithm, which specifically includes the following steps: Construct several simulated user permission library individuals, and form a population set of all simulated user permission library individuals, and set the maximum number of iterations; Calculate the fitness of the individual in the simulated user permission library. The specific calculation method is to send the current user permission library, the obtained permission verification failure rate and the number of user permission applications, and the individual in the simulated user permission library to the target update evaluation network for processing, output the target simulation evaluation value, and use the target simulation evaluation value as the fitness of the individual in the simulated user permission library; Based on the fitness of the individuals in the simulated user permission library, the population set is iteratively updated through the group optimization algorithm; Until the number of iterations reaches the maximum number of iterations, the simulated user permission library individual with the largest fitness is output as the optimal user permission library.

6. The electronic data security management method according to claim 5, characterized in that: The update evaluation network and the permission self-regulation model are updated, which specifically includes the following steps: Acquire a number of permission self-regulation training samples, which include permission analysis data and its corresponding target user permission library; combine all permission self-regulation training samples into a permission self-regulation training set, and send the permission self-regulation training set to the permission self-regulation model with parameter initialization for training. During the training, the permission analysis data is used as the target input, and the corresponding target user permission library is used as the target output. The permission self-regulation loss value is calculated to determine whether the permission self-regulation loss value is within a first preset range. If the permission self-regulation loss value is within the first preset range, the trained permission self-regulation model is output; otherwise, the permission self-regulation model is continuously trained through the permission self-regulation training set; Obtain a number of update evaluation training samples, the update evaluation training samples including strategy analysis data, and annotate the update evaluation training samples by target evaluation values; All labeled update evaluation training samples are combined into an update evaluation training set, and the update evaluation training set is sent to the update evaluation network with parameter initialization for training, the update evaluation loss value is calculated, and it is determined whether the update evaluation loss value is within the second preset range. If the update evaluation loss value is within the second preset range, the trained update evaluation network is output; otherwise, the update evaluation network is continued to be trained through the update evaluation training set.

7. The electronic data security management method according to claim 6, characterized in that: The population optimization algorithm adopts genetic algorithm.

8. An electronic data security management system, characterized in that: The system applies an electronic data security management method as described in any one of claims 1 to 7, including: An electronic data access request acquisition module is used to acquire a user's electronic data access request, where the electronic data access request includes user information, electronic data information, and access request; An electronic data access request matching module is used to match the user's electronic data access request with the user authority library. If the match is successful, the user's electronic data access request is approved. If the match fails, the user's electronic data access request is rejected to achieve safe management of electronic data. The user authority library includes user authority data, and the user authority data includes user information, electronic data information, and authority settings, wherein the authority settings are consistent with the storage format of the access request; The user authority library periodic update module is used to obtain the authority verification failure rate and the number of user authority applications within a preset period at the authority control time point. The preset period is the time period between two adjacent authority control time points. The authority verification failure rate is the ratio of rejected electronic data access requests to all electronic data access requests. The number of user authority applications is the number of times a user requests to change authority due to authority verification failure. The authority verification failure rate and the number of user authority applications are added to the end of each user authority data in the user authority library to construct authority analysis data, and then all authority analysis data are sent to the authority self-control model for processing. The authority self-control model is established based on the BP neural network, outputs all new user authority data, and replaces the original user authority data in the user authority library with all new user authority data to achieve the update of the user authority library; The permission self-regulation model real-time update module is used to update the permission self-regulation model in real time at the permission regulation time point.

Images