Enterprise data secure transmission method and system based on multistage verification

Abstract

The invention discloses an enterprise data secure transmission method and system based on multistage verification, and relates to the field of data transmission security and technology.The method comprises the steps that service nodes of an enterprise and data transmission paths between the service nodes are obtained, and a data transmission network is constructed; acquiring information of the first data transmission request, and performing request cooperative relationship evaluation on the information of the first data transmission request to acquire a first cooperative evaluation index; and obtaining a verification mechanism matching model, verifying the request service node and the requested service node according to the verification mechanism of the matching verification channel, and transmitting the content of the data packet to the requested service node after the verification is passed. The technical problems of single data transmission verification mode, insufficient data security and low transmission efficiency in the prior art are solved, and the technical effect of accurately evaluating the collaborative relationship of the data transmission request to ensure safe and efficient transmission of the data in a complex service scene is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission security, and in particular to a method and system for secure transmission of enterprise data based on multi-level authentication. Background Art

[0002] In today's digital business environment, enterprises are increasingly dependent on data. Data has become one of the core assets of enterprises, covering key content such as customer information, financial data, business secrets, and R&D results. However, with the expansion of corporate business and the rapid development of network technology, the security risks of data transmission are also increasing day by day, and the traditional unified verification model cannot meet this differentiated demand.

[0003] The existing technology has the technical problems of single data transmission verification method, insufficient data security and low transmission efficiency. Summary of the invention

[0004] The present application provides a method and system for secure transmission of enterprise data based on multi-level verification, which is used to solve the technical problems in the prior art of single data transmission verification method, insufficient data security and low transmission efficiency.

[0005] In view of the above problems, the present application provides a method and system for secure transmission of enterprise data based on multi-level verification.

[0006] In a first aspect of the present application, a method for secure transmission of enterprise data based on multi-level authentication is provided, the method comprising:

[0007] Acquire the business nodes of the enterprise and the data transmission paths between the business nodes; construct a data transmission network according to the business nodes and the data transmission paths between the business nodes; acquire information of a first data transmission request, wherein the information of the first data transmission request includes a requesting business node, a requested business node, a data transmission path and data packet content; perform a request coordination relationship evaluation on the information of the first data transmission request based on the data transmission network to acquire a first coordination evaluation index; acquire a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, input the first coordination evaluation index into the verification mechanism matching model to acquire a matching verification channel; verify the requesting business node and the requested business node according to the verification mechanism of the matching verification channel, and when the verification passes, the requesting business node transmits the data packet content to the requested business node according to the data transmission path.

[0008] A second aspect of the present application provides an enterprise data security transmission system based on multi-level authentication, the system comprising:

[0009] A service node acquisition module, the service node acquisition module is used to acquire the service nodes of an enterprise and the data transmission paths between the service nodes; a data transmission network construction module, the data transmission network construction module is used to construct a data transmission network according to the service nodes and the data transmission paths between the service nodes; a first data transmission request information acquisition module, the first data transmission request information acquisition module is used to acquire information of the first data transmission request, the information of the first data transmission request includes a requesting service node, a requested service node, a data transmission path and a data packet content; a first collaborative evaluation index acquisition module, the first collaborative evaluation index acquisition module is used to perform a request collaborative relationship evaluation on the information of the first data transmission request based on the data transmission network to acquire a first collaborative evaluation index; a matching verification channel acquisition module, the matching verification channel acquisition module is used to acquire a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, the first collaborative evaluation index is input into the verification mechanism matching model, and a matching verification channel is acquired; a service node verification module, the service node verification module is used to verify the requesting service node and the requested service node according to the verification mechanism of the matching verification channel, and when the verification is passed, the requesting service node transmits the data packet content to the requested service node according to the data transmission path.

[0010] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0011] Obtain the business nodes of the enterprise and the data transmission paths between the business nodes; construct a data transmission network based on the business nodes and the data transmission paths between the business nodes; obtain the information of the first data transmission request, and evaluate the request coordination relationship of the information of the first data transmission request based on the data transmission network to obtain the first coordination evaluation index; obtain the verification mechanism matching model, and verify the requesting business node and the requested business node according to the verification mechanism of the matching verification channel. When the verification is passed, the requesting business node transmits the data packet content to the requested business node according to the data transmission path. The technical effect of accurately evaluating the coordination relationship of data transmission requests to ensure the safe and efficient transmission of data in complex business scenarios is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A flowchart of a method for securely transmitting enterprise data based on multi-level authentication provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of a process for obtaining a verification mechanism matching model in a method for secure transmission of enterprise data based on multi-level verification provided in an embodiment of the present application;

[0015] Figure 3 A schematic diagram of the structure of a system for secure transmission of enterprise data based on multi-level authentication provided in an embodiment of the present application.

[0016] Explanation of the reference numerals: business node acquisition module 10 , data transmission network construction module 20 , first data transmission request information acquisition module 30 , first collaborative evaluation index acquisition module 40 , matching verification channel acquisition module 50 , business node verification module 60 . DETAILED DESCRIPTION

[0017] The present application provides a method and system for secure transmission of enterprise data based on multi-level verification, which is used to solve the technical problems in the prior art of single data transmission verification method, insufficient data security and low transmission efficiency.

[0018] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] Embodiment 1

[0020] like Figure 1 As shown, the present application provides a method for secure transmission of enterprise data based on multi-level authentication, the method comprising:

[0021] Step S100: Acquire the business nodes of the enterprise and the data transmission paths between the business nodes.

[0022] Specifically, by communicating with various departments of the enterprise, consulting relevant business process documents, and analyzing existing information systems, all business nodes in the enterprise involving data transmission and interaction are determined. For example, these business nodes include but are not limited to the fund management node of the finance department, the customer order processing node of the sales department, the production plan formulation node of the production department, etc. Then, further study how data is transmitted between these business nodes. This involves understanding the network topology, tracking the flow of data in specific software or systems, and mastering the methods and channels of information transmission between different departments. For example, data is transmitted between business nodes through the internal network of the enterprise, dedicated data interfaces, file sharing systems, or cloud services. Finally, each business node and the specific data transmission path between them are clarified and recorded to provide basic information for the subsequent construction of a data transmission network and related evaluation and verification work. Provide accurate basic information for the subsequent construction of an efficient and reliable data transmission network, thereby improving the efficiency, accuracy and security of data transmission.

[0023] Step S200: constructing a data transmission network according to the service nodes and the data transmission paths between the service nodes.

[0024] Specifically, the obtained business node and data transmission path information is sorted and analyzed to determine the location, function and importance of each business node, as well as the bandwidth, delay, reliability and other characteristics of the data transmission path. Using professional network modeling tools and techniques, business nodes are represented as nodes in the network, and data transmission paths are represented as lines between nodes. According to the characteristics of the path, the lines are given corresponding attributes, such as bandwidth value, delay time, etc. In the process of building the network, the topology of the network should be considered. You can choose star, bus, ring or mesh structures, or use a mixed structure according to the actual situation. For example, if the data transmission volume between some business nodes is large and the reliability requirements are high, a mesh structure may be used to provide multiple redundant paths. At the same time, configure routers, switches and other devices in the network to ensure that data can be transmitted accurately and quickly along the predetermined path. Set a reasonable routing strategy so that data can dynamically select the optimal path according to the network conditions. It is also necessary to consider the security of the network, set up security mechanisms such as access control and data encryption, and protect the security of data during transmission. After the construction is completed, the data transmission network is simulated and tested, and simulated data traffic and business scenarios are input to detect the performance of the network, such as whether there is congestion, whether the delay meets business needs, etc. The network is optimized and adjusted according to the test results to ensure that it can meet the actual business needs of the enterprise. An efficient, reliable and secure data transmission network is built to provide strong support for the business operation of the enterprise.

[0025] Step S300: Acquire information of a first data transmission request, where the information of the first data transmission request includes a requesting service node, a requested service node, a data transmission path, and data packet content.

[0026] Specifically, comprehensive and detailed information about a specific data transfer request is obtained from various sources. The requesting business node refers to the business link or department that initiates the data transfer demand. It is the source of the motivation for data transfer because its business operations need to obtain or share data with other nodes to complete its own tasks. The requested business node is the target link or department that receives and responds to the data transfer request. This node has the data required by the requesting business node or can perform the operations expected by the requesting business node. The data transfer path describes the specific route and method through which data will flow from the requesting business node to the requested business node. This involves specific network connections, communication protocols, intermediate servers or switching devices, etc. The data packet content refers to the data information actually to be transmitted in this data transfer request. It can include various forms of data, such as text, images, audio, video, or structured data that has been encoded and formatted, and its content is closely related to specific business needs and operations. It is crucial to obtain this information to accurately understand the needs and background of data transfer, plan and execute appropriate data transfer processes, and ensure that data can be accurately, timely and securely transmitted from the requesting party to the requested party to support the smooth progress of business processes.

[0027] Step S400: performing a request coordination relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a first coordination evaluation index.

[0028] Specifically, according to the relevant characteristics and rules of the constructed data transmission network, the various information contained in the first data transmission request is deeply analyzed and evaluated. The focus of the evaluation is to determine the degree of coordination between the requesting service node, the requested service node, and the data transmission path between them. Three key indicators are obtained: path access frequency indicator, data dependency indicator, and data impact range. Penalty calculation is performed on these three indicators. The purpose of penalty calculation is to deduct or weight the unfavorable factors in the indicators according to the preset rules and weights to more accurately reflect the quality of the request coordination relationship. For example, if the path access frequency is too high and exceeds the preset threshold, a certain penalty score will be given; if the data dependency exceeds the reasonable range or the data impact range is too large and may bring risks, points will be deducted accordingly. Through such penalty calculation, the first coordination evaluation indicator corresponding to the information of the first data transmission request is finally output. It achieves the accurate evaluation of the coordination quality of the data transmission request, optimizes the allocation of data transmission network resources, and ensures the reliability and accuracy of the data.

[0029] Step S500: Acquire a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, input the first collaborative evaluation indicator into the verification mechanism matching model, and acquire a matching verification channel.

[0030] Specifically, first obtain a pre-built verification mechanism matching model, which has multiple levels of verification channels configured internally, each of which has different verification rules, strengths, and scopes of application. Input the first collaborative evaluation indicator obtained into this verification mechanism matching model, and the model will analyze and process the input indicator. The model compares and matches the preset conditions of the verification channels at all levels according to the specific values, characteristics, and distribution of the first collaborative evaluation indicator. Through this comparison and matching process, the verification channel that is compatible with the first collaborative evaluation indicator is finally determined, that is, the matching verification channel is obtained. This matching verification channel will be used to perform corresponding verification operations on subsequent data transmission requests to ensure the security, accuracy, and compliance of data transmission.

[0031] Step S600: the requesting service node and the requested service node are verified according to the verification mechanism of the matching verification channel. When the verification is passed, the requesting service node transmits the data packet content to the requested service node according to the data transmission path.

[0032] Specifically, the verification work is carried out on the requesting business node and the requested business node in strict accordance with the verification mechanism set by the matching verification channel. The verification mechanism covers multiple aspects of inspection and confirmation, such as the identity authentication of the requesting business node, authority verification, data integrity and accuracy verification, and the reception readiness status and processing capacity evaluation of the requested business node. For the identity authentication of the requesting business node, its login credentials, digital certificates or other specific identity identifiers will be checked to ensure that it has the legal authority to initiate this data transmission request. At the same time, the integrity and accuracy of the data packet content to be transmitted will also be verified, for example, by comparing hash values, checking data formats, etc., to confirm that the data has not been damaged or tampered with during the generation and transmission process. For the requested business node, its current workload, system resource availability, and whether it has the relevant capabilities and conditions to process the received data will be evaluated. If the requested business node is in a busy or abnormal state, the data transmission will be temporarily postponed until it returns to normal. Only after both the requesting business node and the requested business node have passed the above verifications will the requesting business node be allowed to transmit the data packet content to the requested business node securely and accurately according to the predetermined data transmission path. During the transmission process, the transmission status is continuously monitored to ensure that the data can reach the destination intact and without error. Through such a strict verification and transmission process, the security, reliability and accuracy of data transmission can be effectively guaranteed, thus supporting the normal operation and development of the business.

[0033] In a possible implementation, step S400 further includes:

[0034] Step S410: Based on the data transmission network, a request coordination relationship evaluation is performed on the information of the first data transmission request to obtain a path access frequency index, a data dependency index and a data impact range.

[0035] Step S420: performing penalty calculation on the path access frequency index, the data dependency index and the data impact range, and outputting a first collaborative evaluation index corresponding to the information of the first data transmission request.

[0036] Specifically, make full use of the information and rules provided by the established data transmission network to conduct a comprehensive and in-depth request coordination relationship evaluation on the details of the first data transmission request. During the evaluation process, focus on and obtain three key indicators: path access frequency indicator, data dependency indicator and data impact scope. The path access frequency indicator is obtained by counting and analyzing the frequency of the data transmission path involved in this request being used by other data transmission requests within a certain period of time, which can reflect the busyness and potential load pressure of the path. The data dependency indicator is determined by measuring the degree of dependence of the requesting business node on the data obtained from the requested business node. For example, if the business process of the requesting business node is completely dependent on specific data to continue, then the degree of dependence will be high. The data impact scope is to evaluate the scope of the data involved in this data transmission request that may have an impact on the business process of the entire enterprise or organization. The larger the impact scope, the higher the importance and potential risk of the data.

[0037] The specific method of performing penalty calculation on the path access frequency index, data dependency index, and data influence range to output the first collaborative evaluation index may vary depending on the specific application scenario and requirements. One possible implementation method is to set a corresponding weight for each indicator and then perform a weighted calculation based on the weight. For example, the path access frequency index, data dependency index, and data influence range are assigned weights ω1, ω2, and ω3, respectively, then the first collaborative evaluation index Σ can be calculated by the following formula:

[0038] Σ = ω1 × path access frequency index + ω2 × data dependency index + ω3 × data influence range.

[0039] When determining the weight, consider the relative importance of each indicator and the degree of impact on the data transmission request. If the path access frequency is high, it may mean that the path is more critical and its weight is relatively large; the data dependency indicator reflects the degree of correlation between the data, and its importance cannot be ignored; the data impact range indicates the size of the impact that the transmitted data may have. In addition, the penalty calculation may also involve some other rules or conditions. For example, when a certain indicator exceeds a certain threshold, a greater penalty weight is given; the specific penalty calculation method needs to be designed and adjusted according to the actual situation to ensure that the output of the first collaborative evaluation indicator can effectively reflect the collaborative relationship and importance of the data transmission request, thereby providing a reliable basis for subsequent verification and transmission decisions.

[0040] In one possible implementation, Figure 2 As shown, step S500 also includes:

[0041] Step S510: Obtain collaborative evaluation indicator samples.

[0042] Step S520: Obtaining initialization model parameters of the verification mechanism matching model.

[0043] Step S530: clustering the collaborative evaluation index samples according to the number of channels in the initialization model parameters to obtain multi-level collaborative intervals.

[0044] Step S540: Map and configure the multi-level verification mechanism corresponding to the multi-level collaborative interval, and train to obtain the verification mechanism matching model, wherein the multi-level verification channel corresponding to the verification mechanism matching model corresponds to the multi-level verification mechanism, and the security of each level of the verification mechanism is proportional to the size of the collaborative evaluation index.

[0045] Specifically, it is necessary to determine which data sources to obtain samples from, including system history, relevant data in the database, data collected by monitoring tools, or data collected through specific tests and experiments. Then, filter out indicator data related to collaborative evaluation according to predetermined standards and conditions. These standards are based on time range, business type, specific scenarios of data transmission, etc. When obtaining samples, it is also necessary to ensure the accuracy and completeness of the data, and pre-process the data, such as cleaning outliers and processing missing data. The obtained collaborative evaluation indicator samples will provide basic data support for subsequent model training and analysis, so as to better understand and optimize collaborative relationships.

[0046] Obtaining the initialization model parameters of the verification mechanism matching model is to prepare for the training and optimization of the model. The process of initializing model parameters may include the following aspects: First, determine the architecture and structure of the model, which includes determining the number of layers contained in the model, the number of neurons in each layer, the connection method, etc. Then, assign initial values ​​to parameters such as weights and biases in the model. The selection of these initial values ​​will affect the training efficiency and final performance of the model. Common initialization methods include random initialization, such as using normal distribution or uniform distribution to generate initial values; and some initialization methods based on specific rules, such as calculating the appropriate initial value range based on the dimensions of input and output. In addition, it also includes setting the initial values ​​of some hyperparameters, such as learning rate, regularization parameters, etc. These hyperparameters will be adjusted and optimized during the training process of the model. Obtaining appropriate initialization model parameters can provide a good starting point for model training, help the model converge to better performance faster, and reduce instability and deviation during training.

[0047] Cluster the collaborative evaluation index samples according to the number of channels in the initialization model parameters to obtain multi-level collaborative intervals. One of the common methods is to use the K-Means clustering algorithm. The basic idea of ​​the K-Means clustering algorithm is to divide the samples in the data set into K clusters (classes) so that the sum of the distances from each sample to the center of the cluster to which it belongs is minimized. The following is the general K-Means clustering algorithm process: Initialization, randomly select K sample points as the centers of the initial clusters (other methods can also be used to initialize the centers to improve the clustering effect). Sample clustering, calculate the distance from each sample to each cluster center, and assign each sample to the cluster with the closest center. Update the class center, calculate the mean of the samples in each current cluster for the clustering result, as the new class center. Repeat the steps of sample clustering and updating the class center. If the iteration converges or meets the stopping conditions (for example, the center no longer changes significantly, the maximum number of iterations is reached, etc.), the clustering results are output, otherwise the sample clustering is returned to continue the iteration. In this step, the number of channels K is a key parameter that determines how many clusters the collaborative evaluation index samples are divided into. Through clustering, similar collaborative evaluation indicator samples can be divided into the same cluster, thus obtaining multiple different clusters, namely multi-level collaborative intervals. Dividing collaborative evaluation indicator samples into multi-level collaborative intervals achieves a fine classification of different collaborative levels, which helps to more accurately understand and handle different degrees of collaborative situations.

[0048] The previously obtained multi-level collaborative intervals are mapped and configured with the corresponding multi-level verification mechanisms, which means that specific verification methods and rules are determined for each collaborative interval. In the verification mechanism matching model, the multi-level verification channels correspond to the multi-level verification mechanisms. Moreover, the security of each level of the verification mechanism is proportional to the size of the collaborative evaluation index, which means that the higher the collaborative evaluation index, the higher the security of the corresponding verification mechanism, including stricter identity authentication, more complex data encryption, more comprehensive data verification, etc. On the contrary, when the collaborative evaluation index is low, the security of the verification mechanism is relatively low, but it can still meet basic security requirements. Through such mapping configuration and training, the verification mechanism matching model can automatically select and apply the verification mechanism that is suitable for the input collaborative evaluation index, thereby achieving a balance between ensuring data security and transmission efficiency, improving the security and efficiency of data transmission, avoiding resource waste and inefficiency caused by excessive verification, and preventing security risks caused by insufficient verification.

[0049] In a possible implementation, step S500 further includes:

[0050] Step S550: input the first collaborative evaluation indicator into the verification mechanism matching model to match it with the multi-level collaborative interval to obtain the corresponding collaborative interval.

[0051] Step S560: mapping the corresponding collaborative interval in the multi-level authentication channel to obtain a matching authentication channel.

[0052] Specifically, the verification mechanism matching model has learned the correspondence between the collaborative evaluation indicators and the multi-level collaborative intervals through the previous training process. When the first collaborative evaluation indicator is input, the model will calculate the degree of match or similarity between the indicator and each collaborative interval based on its internal algorithm and parameters. Through this matching process, the model can determine the collaborative interval that the first collaborative evaluation indicator best matches or is closest to, thereby obtaining the information of the belonging collaborative interval. This belonging collaborative interval will be used to map the corresponding matching verification channel in the multi-level verification channel. For example, assuming that the collaborative evaluation indicator has been divided into three collaborative intervals of high, medium, and low, the model will analyze the characteristics of the first collaborative evaluation indicator and determine whether it is more inclined to belong to the high, medium, or low collaborative interval. This judgment is based on the patterns and rules learned by the model during the training process, as well as the feature matching between the first collaborative evaluation indicator and each collaborative interval. The purpose of this is to classify the collaborative evaluation indicators into corresponding collaborative intervals according to their specific values ​​or characteristics, so that they can be subsequently processed according to the verification mechanism corresponding to the interval, such as selecting a specific verification method, setting a corresponding security level, or taking other related operations. This matching process helps to take appropriate verification and processing measures according to different collaborative situations, thereby improving the efficiency and security of data transmission.

[0053] After the specific collaborative interval to which the first collaborative evaluation indicator belongs is determined, the corresponding verification channel is found in the multi-level verification channel according to the pre-established mapping rules. This mapping relationship is determined in the system design and configuration stage. Each collaborative interval has its specific characteristics or range, and the verification channel matching it has a corresponding verification method, process or standard to meet the needs of different collaborative intervals. For example, there are multiple collaborative intervals, such as high collaborative intervals, medium collaborative intervals and low collaborative intervals, and each interval corresponds to a verification channel with a different degree of strictness or method. The high collaborative interval corresponds to a more stringent and comprehensive verification channel; the low collaborative interval corresponds to a relatively simple and efficient verification channel. Through this mapping, it is possible to ensure that the appropriate verification method is used for evaluation indicators of different collaborative levels to balance the accuracy and efficiency of verification, so that the overall operation efficiency and resource utilization efficiency of the system can be improved while ensuring data security and accuracy. The specific mapping method and the characteristics of the verification channel will vary according to the actual application scenario, requirements and system design.

[0054] In a possible implementation, step S550 further includes:

[0055] Step S551: The multi-level authentication mechanism is configured through a security encryption tool, which includes PIN encryption, OTP encryption, TLS encryption, SSL encryption, and VPN encryption.

[0056] Specifically, the multi-level authentication mechanism is configured through a variety of security encryption tools, among which PIN encryption is a simple encryption method based on a digital password. OTP encryption generates a different password each time and is used only once, which increases security. TLS encryption and SSL encryption are used to provide encryption and authentication for communications on the network to ensure the security of data transmission. VPN encryption encrypts the transmitted data to achieve secure communication by establishing a private network on a public network. By combining these security encryption tools, different levels of authentication mechanisms can be provided with diversified and more powerful security guarantees to meet the data security needs of different collaborative intervals and application scenarios.

[0057] Step S552: Setting the number of multiple levels, wherein the number of multiple levels increases sequentially based on the multi-level verification mechanism.

[0058] Step S553: ​​Connect the security encryption tool and repeatedly and incrementally configure the multi-level verification mechanism according to the multi-level quantity.

[0059] Specifically, according to the hierarchy or level of the multi-level verification mechanism, the quantity corresponding to each level is set accordingly, and these quantities gradually increase in a certain order. For example, assuming there is a three-level verification mechanism, the quantity set for the first level may be 5, then the quantity for the second level may be set to 10, the third level may be 15, and so on.

[0060] Connect the security encryption tools mentioned above (such as PIN encryption, OTP encryption, TLS encryption, SSL encryption, VPN encryption, etc.). Then, set the number of multiple levels and repeatedly configure the multi-level verification mechanism in an incremental manner. In other words, according to the number corresponding to each level, apply the corresponding security encryption tools level by level and configure them in an incremental manner. In this way, gradually increasing verification strength or complexity can be achieved at different levels to meet different security requirements. Through this repeated incremental configuration, a set of clearly layered and gradually increasing security verification system can be established. This multi-level verification mechanism is commonly used in systems or application scenarios with high security requirements. It aims to provide more comprehensive and reliable security protection to ensure that only users or operations that have been verified at the appropriate level can obtain corresponding permissions or access specific resources. At the same time, through the incremental method, it can balance security and convenience of use to a certain extent, avoid unnecessary troubles to users caused by overly complex verification processes, and provide sufficient security protection at key links.

[0061] In a possible implementation, step S550 further includes:

[0062] Step S554: Connect the security encryption tool and configure the multi-level verification mechanism in a non-repetitive and incremental manner according to the multi-level quantity.

[0063] Specifically, after connecting the security encryption tool, the multi-level verification mechanism is configured non-repetitively and incrementally according to the previously set number of multi-levels. Unlike the repetitive incremental configuration, the non-repetitive incremental configuration means that different methods or parameters are used at each level to set the verification mechanism. This non-repetitive configuration method may be more complex and diverse to provide a higher level of security or meet specific security requirements. For example, in a system with a three-level verification mechanism, the first level may use simple password verification, the second level uses fingerprint recognition, and the third level uses biometric technology such as facial recognition. The verification method for each level is different, and it is enhanced in sequence according to the number of levels. Through this non-repetitive incremental configuration, multiple encryption and verification methods can be combined to increase the difficulty and complexity of cracking and improve the security of data transmission.

[0064] In a possible implementation, step S300 further includes:

[0065] Step S310: Obtain information of a second data transmission request.

[0066] Step S320: judging whether the second data transmission request is a return request of the first data transmission request according to the information of the second data transmission request and the information of the first data transmission request.

[0067] Step S330: If the second data transmission request is a return request of the first data transmission request, the primary verification mechanism of the multi-level verification mechanism is executed for verification.

[0068] Specifically, through relevant interfaces, protocols or monitoring mechanisms, various information contained in the second data transmission request is captured and extracted from network communications. This information includes the sender identification of the request, the receiver identification, the type of request (such as read, write, update, etc.), the data characteristics involved in the request (such as the format, size, key fields, etc. of the data), the timestamp of the request, and other specific metadata related to the request that may exist, etc. By fully acquiring this information, the necessary data basis is provided for subsequent judgment and processing.

[0069] The information contained in the second data transmission request is compared and analyzed in detail with the corresponding information of the first data transmission request, including whether the sender and receiver of the comparison request match, whether the types of requests are related to each other (for example, the first request is to send data, and the second request is a response to the data), whether there is a corresponding relationship between the key identifiers or tags of the data, and whether the time sequence conforms to the expected round-trip logic, etc., to determine whether the second data transmission request is actually a return response to the first data transmission request. If the key features echo each other and conform to specific logical rules, then the second data transmission request can be determined to be a return request for the first data transmission request; otherwise, it is considered that there is no such association between the two.

[0070] After the previous judgment determines that the second data transmission request is a return request for the first data transmission request, the primary verification mechanism in the multi-level verification mechanism will be started and executed to verify it. The primary verification mechanism is a relatively basic and simple link in the entire verification process, involving the preliminary confirmation of the source and destination of the request, checking whether some basic identification or tokens are legal and valid, verifying the approximate integrity of the data (such as the length of the data, whether key fields exist, etc.), or performing preliminary verification of some simple encryption or signatures. The reason for adopting the primary verification mechanism is that for data transmission that has been determined to be a return request, a relatively simplified verification method that still guarantees a certain degree of security can be adopted to a certain extent based on previous interactions and trust relationships, so as to improve processing efficiency and reduce system resource consumption and time delays caused by unnecessary complex verification operations.

[0071] Embodiment 2

[0072] Based on the same inventive concept as the enterprise data security transmission method based on multi-level authentication in the aforementioned embodiment, Figure 3 As shown, the present application provides a system for secure transmission of enterprise data based on multi-level verification, and the system and method embodiments in the present application are based on the same inventive concept. The system includes:

[0073] The service node acquisition module 10 is used to acquire the service nodes of an enterprise and the data transmission paths between the service nodes.

[0074] The data transmission network construction module 20 is used to construct a data transmission network according to the service nodes and the data transmission paths between the service nodes.

[0075] The information acquisition module 30 for the first data transmission request is used to acquire information of the first data transmission request, wherein the information of the first data transmission request includes a requesting service node, a requested service node, a data transmission path and data packet content.

[0076] The first collaborative evaluation indicator acquisition module 40 is used to perform a request collaborative relationship evaluation on the information of the first data transmission request based on the data transmission network to acquire a first collaborative evaluation indicator.

[0077] The matching verification channel acquisition module 50 is used to obtain a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, and the first collaborative evaluation indicator is input into the verification mechanism matching model to obtain a matching verification channel.

[0078] The business node verification module 60 is used to verify the requesting business node and the requested business node according to the verification mechanism of the matching verification channel. When the verification is passed, the requesting business node transmits the data packet content to the requested business node according to the data transmission path.

[0079] Furthermore, the first collaborative evaluation indicator acquisition module 40 further includes:

[0080] A collaborative relationship evaluation unit is configured to perform a request collaborative relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a path access frequency index, a data dependency index, and a data impact range.

[0081] The first collaborative evaluation index output unit is used to perform penalty calculation on the path access frequency index, the data dependency index and the data impact range, and output a first collaborative evaluation index corresponding to the information of the first data transmission request.

[0082] Furthermore, the matching verification channel acquisition module 50 also includes:

[0083] A collaborative evaluation sample acquisition unit is used to acquire collaborative evaluation indicator samples.

[0084] An initialization model parameter acquisition unit is used to acquire initialization model parameters of the verification mechanism matching model.

[0085] A multi-level collaborative interval acquisition unit is used to cluster the collaborative evaluation index samples according to the number of channels in the initialization model parameters to obtain multi-level collaborative intervals.

[0086] A verification mechanism matching model training acquisition unit is used to map and configure the multi-level verification mechanism corresponding to the multi-level collaborative interval, and train and acquire the verification mechanism matching model, wherein the multi-level verification channel corresponding to the verification mechanism matching model corresponds to the multi-level verification mechanism, and the security of each level of the verification mechanism is proportional to the size of the collaborative evaluation index.

[0087] Furthermore, the matching verification channel acquisition module 50 also includes:

[0088] The belonging collaborative interval acquisition unit is used to input the first collaborative evaluation indicator into the verification mechanism matching model to match the multi-level collaborative interval to obtain the belonging collaborative interval.

[0089] A matching verification channel mapping unit is used to map the matching verification channel in the multi-level verification channel according to the corresponding collaborative interval.

[0090] Furthermore, the verification mechanism matching model training acquisition unit also includes:

[0091] A security encryption tool configuration unit, wherein the security encryption tool configuration unit is used to configure the multi-level authentication mechanism through a security encryption tool, wherein the security encryption tool includes PIN encryption, OTP encryption, TLS encryption, SSL encryption, and VPN encryption.

[0092] Furthermore, the security encryption tool configuration unit also includes:

[0093] A multi-level number setting unit, the multi-level number setting unit is used to set the multi-level number, and the multi-level number increases sequentially based on the multi-level verification mechanism.

[0094] A security encryption tool connection unit, the security encryption tool connection unit is used to connect the security encryption tool and repeatedly and incrementally configure the multi-level verification mechanism according to the multi-level number.

[0095] Furthermore, the security encryption tool connection unit also includes:

[0096] A non-repetitive incremental configuration unit, wherein the non-repetitive incremental configuration unit is used to connect to the security encryption tool and perform non-repetitive incremental configuration on the multi-level verification mechanism according to the multi-level number.

[0097] Furthermore, the information acquisition module 30 of the first data transmission request further includes:

[0098] a second data transmission request information acquisition unit, the second data transmission request information acquisition unit being used to acquire information of the second data transmission request;

[0099] A return request determination unit, the return request determination unit is used to determine whether the second data transmission request is a return request for the first data transmission request based on information about the second data transmission request and information about the first data transmission request.

[0100] A primary verification mechanism verification unit, wherein the primary verification mechanism verification unit is used to execute the primary verification mechanism of the multi-level verification mechanism for verification if the second data transmission request is a return request of the first data transmission request.

[0101] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0102] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0103] This specification and the drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. Enterprise data security transmission method based on multi-level verification, It is characterized in that The method comprises: Acquire the business nodes of the enterprise and the data transmission paths between the business nodes; Building a data transmission network according to the service nodes and the data transmission paths between the service nodes; Acquire information of a first data transmission request, where the information of the first data transmission request includes a requesting service node, a requested service node, a data transmission path, and data packet content; Performing a request coordination relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a first coordination evaluation index; Acquire a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, input the first collaborative evaluation indicator into the verification mechanism matching model, and acquire a matching verification channel; The requesting service node and the requested service node are verified according to the verification mechanism of the matching verification channel. When the verification is passed, the requesting service node transmits the data packet content to the requested service node according to the data transmission path.

2. The method according to claim 1, It is characterized in that The method includes: performing a request coordination relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a first coordination evaluation index. Performing request coordination relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a path access frequency index, a data dependency index, and a data impact range; Penalty calculation is performed on the path access frequency index, the data dependency index and the data impact range, and a first collaborative evaluation index corresponding to the information of the first data transmission request is output.

3. The method according to claim 1, It is characterized in that Get the verification mechanism matching model, including: Obtain collaborative evaluation indicator samples; Obtaining initialization model parameters of the verification mechanism matching model; Clustering the collaborative evaluation indicator samples according to the number of channels in the initialization model parameters to obtain multi-level collaborative intervals; The multi-level verification mechanism corresponding to the multi-level collaborative interval is mapped and configured, and the verification mechanism matching model is obtained through training, wherein the multi-level verification channel corresponding to the verification mechanism matching model corresponds to the multi-level verification mechanism, and the security of each level of the verification mechanism is proportional to the size of the collaborative evaluation index.

4. The method according to claim 3, It is characterized in that Inputting the first collaborative evaluation indicator into the verification mechanism matching model to obtain a matching verification channel includes: Inputting the first collaborative evaluation indicator into the verification mechanism matching model to match the multi-level collaborative interval to obtain the corresponding collaborative interval; A matching verification channel is obtained by mapping in the multi-level verification channel according to the corresponding cooperative interval.

5. The method according to claim 3, It is characterized in that The multi-level authentication mechanism is configured through a security encryption tool, which includes PIN encryption, OTP encryption, TLS encryption, SSL encryption, and VPN encryption.

6. The method according to claim 5, It is characterized in that The multi-level verification mechanism performs encryption quantity hierarchical configuration through the security encryption tool, including: Setting the number of multiple levels, the number of multiple levels increasing in sequence based on the multi-level verification mechanism; The security encryption tool is connected to repeatedly and incrementally configure the multi-level verification mechanism according to the multi-level quantity.

7. The method according to claim 6, It is characterized in that The security encryption tool is connected to configure the multi-level verification mechanism in a non-repetitive and incremental manner according to the multi-level quantity.

8. The method according to claim 3, It is characterized in that After obtaining the information of the first data transmission request, the method further includes: Acquire information of a second data transmission request; determining, according to information of the second data transmission request and information of the first data transmission request, whether the second data transmission request is a return request of the first data transmission request; If the second data transmission request is a return request of the first data transmission request, a primary authentication mechanism of the multi-level authentication mechanism is executed for authentication.

9. Enterprise data security transmission system based on multi-level verification, It is characterized in that The system comprises: A service node acquisition module, which is used to acquire the service nodes of an enterprise and the data transmission paths between the service nodes; A data transmission network construction module, the data transmission network construction module is used to construct a data transmission network according to the service nodes and the data transmission paths between the service nodes; An information acquisition module for a first data transmission request, the information acquisition module for the first data transmission request is used to acquire information of the first data transmission request, the information of the first data transmission request includes a requesting service node, a requested service node, a data transmission path, and data packet content; A first collaborative evaluation indicator acquisition module, the first collaborative evaluation indicator acquisition module is used to perform a request collaborative relationship evaluation on the information of the first data transmission request based on the data transmission network to obtain a first collaborative evaluation indicator; A matching verification channel acquisition module, wherein the matching verification channel acquisition module is used to acquire a verification mechanism matching model, wherein the verification mechanism matching model is configured with a multi-level verification channel, and the first collaborative evaluation indicator is input into the verification mechanism matching model to acquire a matching verification channel; A business node verification module, wherein the business node verification module is used to verify the requesting business node and the requested business node according to the verification mechanism of the matching verification channel. When the verification is passed, the requesting business node transmits the data packet content to the requested business node according to the data transmission path.

Images