Method and system for protecting computer data security

Abstract

The invention discloses a method for protecting computer data security, which relates to the technical field of data security, and comprises the following steps: identifying entities in to-be-protected data and attributes of the entities, retrieving big data, extracting a relationship between the entities and a knowledge graph represented by the relationship, the method comprises the steps of obtaining the position of to-be-protected data in a knowledge graph and the correlation between the to-be-protected data, formulating an access control strategy corresponding to the to-be-protected data according to attributes and sensitivity, carrying out dynamic encryption on the to-be-protected data according to the sensitivity, screening the attributes of a user and carrying out decryption. Attributes, data correlation and sensitivity required in a data protection process are extracted by simply constructing a knowledge graph of to-be-protected data, and self-adaptive dynamic encryption technology and access control means are carried out on the attributes, the data correlation and the sensitivity. Complete and reasonable encryption is carried out through simple steps, and reasonable explanation and demand satisfaction are carried out on user requirements.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a method and system for protecting computer data security. Background Art

[0002] In the digital age, computer data security has become a focus of attention in various industries. With the rapid increase in data volume and the continuous evolution of network attack methods, protecting the security of computer data has become increasingly important. Data leakage, damage and loss not only cause economic losses to individuals and enterprises, but may also affect reputation and user trust. Computer data security faces threats from network attacks, internal threats, and insufficient data backup and recovery. To meet these challenges, data protection requires the key features of encryption technology, access control, and real-time monitoring and auditing. In order to effectively protect computer data security, data encryption methods are used to protect computer data security.

[0003] At present, the Chinese invention application with application number CN202110800589.3 discloses a computer data security protection method. In a computer with a file system drive structure supported by a Windows operating platform, the computer is provided with a USB interface, a transmission channel, a storage module and an electronic key. The computer USB interface is externally connected to a verification module and an identification module, and the computer is provided with an encryption module and a decryption module. When accessing computer data, the present invention needs to first identify the electronic key and then verify the access module. In addition, when accessing or storing data, the present invention needs to perform encryption and decryption processing, which has triple security protection, making the data stored in the computer more secure and reliable, and effectively preventing the possibility of computer data being stolen. However, the existing technology cannot extract the attributes, data relevance and sensitivity required in the process of protecting the data by simply constructing a knowledge graph of the data to be protected. It cannot use dynamic encryption technology and access control means that are adaptive to the attributes, data relevance and sensitivity. It cannot perform complete and reasonable encryption through simple steps and reasonably interpret and meet user requirements. Summary of the Invention

[0004] The technical problem solved by the present invention is that the existing technology is unable to extract the attributes, data relevance and sensitivity required in the process of protecting data by simply constructing a knowledge graph of the data to be protected, and is unable to use dynamic encryption technology and access control means to adaptively apply the attributes, data relevance and sensitivity, and is unable to perform complete and reasonable encryption through simple steps and reasonably interpret and meet user requirements.

[0005] To solve the above technical problems, the present invention provides the following technical solution: a method for protecting computer data security, comprising the following steps: Step S1: Identify entities and attributes of the entities in the data to be protected, retrieve big data to extract the relationships between the entities and the knowledge graph representing the relationships; Step S2: Mapping the attributes of the data to be protected with the nodes and edges in the knowledge graph to obtain the position of the data to be protected in the knowledge graph and the correlation between the data to be protected; Step S3: classifying attributes according to the correlation between the data to be protected, obtaining sensitivity according to the actual characteristics of the data to be protected, and formulating an access control policy corresponding to the data to be protected based on the attributes and sensitivity; Step S4: Dynamically encrypt the data to be protected according to the sensitivity, generate and distribute keys according to the user's attributes and access requirements, and when the user requests to access the data, screen the user's attributes and perform decryption.

[0006] Preferably, the step S1 includes the following sub-steps: Step S11: The computer background identifies the entities of the data to be protected. The entities are obtained by recognizing text using a NER model. The entities include personal information, product information, and transaction records. Regular expressions are used to match entities in specific formats, such as emails and phone numbers. Step S12: Analyze the data to be protected and identify all potential entities in the data set. The analysis process includes extracting data from databases, files, and API interfaces, and processing the extracted data according to step S11. Step S13: collecting network attributes of each identified entity, and reallocating attributes to the entity based on the network attributes and using k-means clustering; Step S14: using the graph database Neo4j to construct a knowledge graph based on the entities and their corresponding attributes, with the entities as nodes and relationships as edges; Step S15: Use the graph visualization tool Gephi to display the knowledge graph.

[0007] Preferably, step S2 includes the following sub-steps: Step S21: Match the attributes of the data to be protected with the nodes in the knowledge graph using natural language processing technology; Step S22: Establishing a mapping rule, wherein the mapping rule includes using a cosine similarity calculation method to match the data to be protected with entities in the knowledge graph to obtain a matched mapping relationship; Step S23: Using the mapping relationship, use the query language SPARQL to search for nodes and edges corresponding to the data to be protected, and obtain the detailed location of the data to be protected in the knowledge graph; Step S24: obtaining the degree of connection of the node in the knowledge graph by calculating the betweenness centrality of the node, where the betweenness centrality value is the degree of connection; Step S25: The connection degree of the data to be protected and the detailed position in the knowledge graph are established as a correlation database and stored in the computer background memory.

[0008] Preferably, step S3 includes the following sub-steps: Step S31: Based on the big data, collect websites where the keywords of the knowledge graph corresponding to the data to be protected appear, sort the websites according to the encryption level and store them in the corresponding website hash table, and calculate the search efficiency of the website hash table, where the search efficiency represents the sensitivity of the keywords; Step S32: constructing a sensitivity database by combining all keywords in the knowledge graph and the sensitivities corresponding to the keywords; Step S33: searching the sensitivity of the entity of the data to be protected for the corresponding keyword in the sensitivity database according to the entity of the data to be protected, and formulating a corresponding access control policy according to the sensitivity and attribute classification of the data to be protected.

[0009] Preferably, the step S33 includes a first access control policy and a second access control policy; The first access control policy includes: Role labels are defined based on attributes of the entity of the data to be protected, the role labels including a first role label, a second role label, ..., and an nth role label, where n is the number of attributes; access rights are allocated based on the sensitivity, the access rights level is obtained by weighted calculation of the sensitivity values, the access rights level values ​​are classified into intervals, and the access rights levels after the interval classification are divided into a first access rights level, a second access rights level, ..., and an mth access rights level based on the values, where m is a constant; the process of accessing the data to be protected includes: The corresponding role label is searched according to the attribute, the corresponding entity is searched according to the role label, the sensitivity is searched according to the entity, the corresponding access permission level is searched according to the sensitivity, and the user accesses the data and data access records of the corresponding access permission level in the protected data according to the access permission level.

[0010] Preferably, the second access control policy includes: Collect entities with neighboring relationships in the knowledge graph corresponding to the entity to be protected, record all collected entities, find the attributes and sensitivity corresponding to each entity, and create access control rules based on the attributes. The access control rules are filled in and updated in real time by the user of the control panel. The access control rules restrict or allow access to certain sensitive data. The sensitive data is the content filled in by the user in the keyword filling position; Monitor in real time the address and time at which users dynamically change the access control rules.

[0011] Preferably, step S4 includes the following sub-steps: Step S41: Encrypting the data to be protected using a dynamic password encryption method according to the sensitivity; Step S42: Generate a unique key using the user ID and timestamp, calculate the unique key using the key derivation function PBKDF2, and dynamically distribute the corresponding encryption key to the user based on the access control policy and user attributes; Step S43: Record the key distribution and user access logs, including user ID, timestamp, and sensitive data, and check the key usage at intervals; Step S44: extracting the attribute code in the key, and determining the decoding user according to the attribute code includes: The decoding keyword attribute input by the user on the control panel is compared with the attribute code in the key; If the attribute of the decoding keyword corresponds to the attribute in the key, decryption is performed using the decoding key assigned by the key distribution center KDC; If the attributes of the decoding keyword do not correspond to the attributes in the key, the user's decoding operation is intercepted.

[0012] Preferably, the step S41 includes: The data type accessed by the user and the sensitivity of the data are obtained based on the user's access requirements. The access requirements are obtained by the user filling in the control panel in real time. The sensitivity of the data includes the weighted average of the sensitivities of all keywords included in the data. The data is encrypted using the encryption algorithm AES. The strength of the encryption algorithm AES corresponds to the sensitivity of the data.

[0013] Preferably, the step S42 includes: Dynamic key distribution based on user activity includes: The initial key is automatically generated by the Key Distribution Center (KDC) based on the user ID and timestamp, and is updated regularly. The user's key access rights are adjusted according to the access control policy, including: Retrieve the sensitivity and attributes of the keywords entered by the user in the keyword entry area of ​​the control panel, add the unique code of the attribute to the initial key, and record the unique code and the corresponding attribute in the form of a linked list and store it in the background memory queue; When the attribute of the keyword is already stored in the linked list, the unique code corresponding to the attribute is directly called and added to the initial key; When the attribute of the keyword is not stored in the linked list, the attribute and the unique code without duplication are stored along the linked list address; The key exchange protocol Diffie-Hellman is used to distribute keys.

[0014] A system for protecting computer data security includes an attribute generation module, an encryption module, a decryption module, and a control panel: The attribute generation module is used to generate a knowledge graph related to the data to be protected, and generate the attributes, relevance and sensitivity of the data to be protected based on the knowledge graph; The encryption module is used to dynamically encrypt the data to be protected according to the attributes, relevance and sensitivity; The decryption module is used to decrypt according to the encryption key and screen the decoding users; The control panel is used for users to input access requirements, access control rule keywords and decoding keywords.

[0015] The beneficial effects of the present invention are as follows: by simply constructing a knowledge graph of the data to be protected to extract the attributes, data relevance and sensitivity required in the process of protecting the data, and by adaptively applying dynamic encryption technology and access control measures to the attributes, data relevance and sensitivity, complete and reasonable encryption is performed through simple steps, and user requirements are reasonably interpreted and satisfied, which can effectively improve data security and protect the information assets of individuals and enterprises from threats. It can not only meet current security needs, but also adapt to the ever-changing security environment in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A basic flow chart of a method for protecting computer data security provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0018] Reference Figure 1 , as an embodiment of the present invention, provides a method for protecting computer data security, comprising the following steps: Step S1: Identify entities and attributes of the entities in the data to be protected, retrieve big data to extract the relationships between the entities and the knowledge graph representing the relationships; Step S2: Mapping the attributes of the data to be protected with the nodes and edges in the knowledge graph to obtain the position of the data to be protected in the knowledge graph and the correlation between the data to be protected; Step S3: classifying attributes according to the correlation between the data to be protected, obtaining sensitivity according to the actual characteristics of the data to be protected, and formulating an access control policy corresponding to the data to be protected based on the attributes and sensitivity; Step S4: Dynamically encrypt the data to be protected according to the sensitivity, generate and distribute keys according to the user's attributes and access requirements, and when the user requests to access the data, screen the user's attributes and perform decryption.

[0019] Attribute-based data encryption combined with knowledge graphs can improve the flexibility and security of data protection. By dynamically managing data encryption and access rights, businesses and organizations can more effectively protect sensitive information and prevent unauthorized access and data leaks.

[0020] The step S1 includes the following sub-steps: Step S11: The computer background identifies the entities of the data to be protected. The entities are obtained by recognizing text using a NER model. The entities include personal information, product information, and transaction records. Regular expressions are used to match entities in specific formats, such as emails and phone numbers. Step S12: Analyze the data to be protected and identify all potential entities in the data set. The analysis process includes extracting data from databases, files, and API interfaces, integrating data from different data sources using ETL tools to ensure that entity relationship analysis and relationship identification can be performed across data sources, and using data mining and natural language processing technologies to identify the relationships between entities. The extracted data is processed according to step S11. Step S13: collecting network attributes of each identified entity, and reallocating attributes to the entity based on the network attributes and using k-means clustering; The defined attributes are, for example: phrases defining user attributes include: name, age, gender, address, contact information and email; Phrases that define product attributes include: product ID, name, category, price, and stock quantity; Phrases that define transaction record attributes include: transaction ID, date, amount, and participants; Step S14: using the graph database Neo4j to construct a knowledge graph based on the entities and their corresponding attributes, with the entities as nodes and relationships as edges; Step S15: Use the graph visualization tool Gephi to display the knowledge graph to make it easier to understand and analyze.

[0021] Through the above steps, the entities and their attributes in the data to be protected can be effectively identified, the relationships between entities can be extracted and represented as a knowledge graph, which not only improves the efficiency of data protection, but also enhances the capabilities of data management and privacy protection, and provides support for compliance.

[0022] The step S2 includes the following sub-steps: Step S21: Match the attributes of the data to be protected with the nodes in the knowledge graph using natural language processing technology; Step S22: Establishing clear mapping rules, wherein the mapping rules are used to associate the data to be protected with nodes and edges in the knowledge graph. The mapping rules include using a cosine similarity calculation method to match the data to be protected with entities in the knowledge graph to obtain a matched mapping relationship; Step S23: Using the mapping relationship, use the query language SPARQL to search for nodes and edges corresponding to the data to be protected, and obtain the detailed location of the data to be protected in the knowledge graph; Step S24: Calculate the betweenness centrality of the node to obtain the degree of connection of the node in the knowledge graph. The betweenness centrality value is the degree of connection. The betweenness centrality is used to evaluate the relative importance between different nodes. Step S25: The connection degree of the data to be protected and the detailed position in the knowledge graph are established as a correlation database and stored in the computer background memory.

[0023] By mapping the attributes of the data to be protected with the nodes and edges in the knowledge graph, the position of the data to be protected in the knowledge graph and its relevance can be effectively obtained, which not only helps data management and protection, but also improves the depth and breadth of data analysis.

[0024] The step S3 includes the following sub-steps: Step S31: Based on the big data, collect websites where the keywords of the knowledge graph corresponding to the data to be protected appear, sort the websites according to the encryption level and store them in the corresponding website hash table, and calculate the search efficiency of the website hash table, where the search efficiency represents the sensitivity of the keywords; Step S32: constructing a sensitivity database by combining all keywords in the knowledge graph and the sensitivities corresponding to the keywords; Step S33: Search the sensitivity of the entity of the data to be protected for the corresponding keyword in the sensitivity database, and formulate corresponding access control policies based on the sensitivity and attribute classification of the data to be protected to ensure data security and compliance.

[0025] Said step S33 includes a first access control policy and a second access control policy; The first access control policy includes: Role labels are defined based on attributes of the entity of the data to be protected, the role labels including a first role label, a second role label, ..., and an nth role label, where n is the number of attributes; access rights are allocated based on the sensitivity, the access rights level is obtained by weighted calculation of the sensitivity values, the access rights level values ​​are classified into intervals, and the access rights levels after the interval classification are divided into a first access rights level, a second access rights level, ..., and an mth access rights level based on the values, where m is a constant; the process of accessing the data to be protected includes: The corresponding role label is searched according to the attribute, the corresponding entity is searched according to the role label, the sensitivity is searched according to the entity, the corresponding access permission level is searched according to the sensitivity, and the user accesses the data and data access records of the corresponding access permission level in the protected data according to the access permission level.

[0026] The second access control policy includes: Collect entities with neighboring relationships in the knowledge graph corresponding to the entity to be protected, record all collected entities, find the attributes and sensitivity corresponding to each entity, and create access control rules based on the attributes. The access control rules are filled in and updated in real time by the user of the control panel. The access control rules restrict or allow access to certain sensitive data. The sensitive data is the content filled in by the user in the keyword filling position; Monitor in real time the address and time when users dynamically change the access control rules to ensure that the rules are executed and effective, and to ensure that they meet the latest security requirements.

[0027] The step S4 includes the following sub-steps: Step S41: Encrypting the data to be protected using a dynamic password encryption method according to the sensitivity to ensure data security; Step S42: Generate a unique key using the user ID and timestamp, and calculate the unique key using the key derivation function PBKDF2 to increase the complexity and security of the key. Dynamically distribute the corresponding encryption key to the user based on the access control policy and user attributes; Step S43: Record the key distribution and user access logs, which include user ID, timestamp, and sensitive data. Check the key usage at intervals to ensure there is no abnormal access behavior.

[0028] Step S44: extracting the attribute code in the key, and determining the decoding user according to the attribute code includes: The decoding keyword attribute input by the user on the control panel is compared with the attribute code in the key; If the attribute of the decoding keyword corresponds to the attribute in the key, decryption is performed using the decoding key assigned by the key distribution center KDC; If the attributes of the decoding keyword do not correspond to the attributes in the key, the user's decoding operation is intercepted.

[0029] The step S41 includes: The data type accessed by the user and the sensitivity of the data are obtained based on the user's access requirements. The access requirements are obtained by the user filling in real time on the control panel. The sensitivity of the data includes a weighted average of the sensitivities of all keywords included in the data. The data is encrypted using the encryption algorithm AES. The strength of the encryption algorithm AES corresponds to the sensitivity of the data, so that a different encryption key is generated for each access.

[0030] The step S42 includes: Dynamic key distribution based on user activity includes: The initial key is automatically generated by the Key Distribution Center (KDC) based on the user ID and timestamp. This ensures that a different password is used for each access. The initial key is updated regularly to prevent the risk of key leakage. The user's key access permissions are adjusted according to the access control policy, including: Retrieve the sensitivity and attributes of the keywords entered by the user in the keyword entry area of ​​the control panel, add the unique code of the attribute to the initial key, and record the unique code and the corresponding attribute in the form of a linked list and store it in the background memory queue; When the attribute of the keyword is already stored in the linked list, the unique code corresponding to the attribute is directly called and added to the initial key; When the attribute of the keyword is not stored in the linked list, the attribute and the unique code without duplication are stored along the linked list address; The key exchange protocol Diffie-Hellman is used when distributing keys, allowing keys to be securely shared between users and servers.

[0031] It can effectively implement dynamic encryption of protected data and flexibly generate and distribute keys based on user attributes and access requirements, thereby ensuring data security and compliance.

[0032] Through the above steps, corresponding access control policies can be effectively formulated based on the relevance of the data to be protected, and dynamic password encryption can be performed on the sensitivity. This can not only ensure the security of the data, but also meet compliance requirements and protect personal privacy and sensitive information from being leaked.

[0033] A system for protecting computer data security includes an attribute generation module, an encryption module, a decryption module, and a control panel: The attribute generation module is used to generate a knowledge graph related to the data to be protected, and generate the attributes, relevance and sensitivity of the data to be protected based on the knowledge graph; The encryption module is used to dynamically encrypt the data to be protected according to the attributes, relevance and sensitivity; The decryption module is used to decrypt according to the encryption key and screen the decoding users; The control panel is used for users to input access requirements, access control rule keywords and decoding keywords.

[0034] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0035] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for protecting computer data security, characterized in that: The following steps are involved: Step S1: Identify entities and attributes of the entities in the data to be protected, retrieve big data to extract the relationships between the entities and the knowledge graph representing the relationships; Step S2: Mapping the attributes of the data to be protected with the nodes and edges in the knowledge graph to obtain the position of the data to be protected in the knowledge graph and the correlation between the data to be protected; Step S3: classifying the attributes according to the correlation between the data to be protected, obtaining the sensitivity according to the actual characteristics of the data to be protected, and formulating the access control policy corresponding to the data to be protected according to the attributes and the sensitivity; Step S4: Dynamically encrypt the data to be protected according to the sensitivity, generate and distribute keys according to the user's attributes and access requirements, and when the user requests to access the data, screen the user's attributes and perform decryption.

2. The method for protecting computer data security according to claim 1, characterized in that: The step S1 comprises the following sub-steps: Step S11: The computer background identifies the entity of the data to be protected, the entity is obtained by the NER model recognizing the text, the entity includes personal information, product information and transaction records, and a regular expression is used to match the entity in a specific format, the entity in the specific format includes an email and a telephone number; Step S12: Analyze the data to be protected to identify all potential entities in the data set, wherein the analysis process includes extracting data from databases, files and API interfaces, and processing the extracted data through step S11; Step S13: collecting network attributes of each identified entity, and reallocating attributes to the entity based on the network attributes and using k-means clustering; Step S14: using the graph database Neo4j to construct a knowledge graph according to the entities and the attributes corresponding to the entities, with the entities as nodes and the relationships as edges; Step S15: Use the graph visualization tool Gephi to display the knowledge graph.

3. The method for protecting computer data security according to claim 1, characterized in that: The step S2 comprises the following sub-steps: Step S21: Match the attributes of the data to be protected with the nodes in the knowledge graph through natural language processing technology; Step S22: Establishing a mapping rule, wherein the mapping rule includes matching the data to be protected with entities in the knowledge graph using a cosine similarity calculation method to obtain a matched mapping relationship; Step S23: using the query language SPARQL through the mapping relationship to find the nodes and edges corresponding to the data to be protected, and obtaining the detailed location of the data to be protected in the knowledge graph; Step S24: obtaining the degree of connection of the node in the knowledge graph by calculating the betweenness centrality of the node, wherein the value of the betweenness centrality is the degree of connection; Step S25: The connection degree of the data to be protected and its detailed position in the knowledge graph are established as a correlation database and stored in the computer background memory.

4. The method for protecting computer data security according to claim 1, characterized in that: The step S3 comprises the following sub-steps: Step S31: Based on the big data, collect websites where the keywords of the knowledge graph corresponding to the data to be protected have appeared, sort the websites according to the encryption level and store them in the corresponding website hash table, calculate the search efficiency of the website hash table, and the search efficiency represents the sensitivity of the keywords; Step S32: constructing a sensitivity database by including all keywords of the knowledge graph and the sensitivities corresponding to the keywords; Step S33: searching the sensitivity of the entity of the data to be protected for the corresponding keyword in the sensitivity database according to the entity of the data to be protected, and formulating a corresponding access control policy according to the sensitivity and attribute classification of the data to be protected.

5. The method for protecting computer data security according to claim 4, characterized in that: The step S33 includes a first access control policy and a second access control policy; The first access control strategy includes: A role tag is defined according to the attribute of the entity of the data to be protected, the role tag includes a first role tag, a second role tag, ... and an nth role tag, where n is the number of attributes, access rights are allocated according to the sensitivity, the access rights level is obtained by weighted calculation of the sensitivity value, the access rights level value is interval-classified, and the access rights level after interval classification is divided into a first access rights level, a second access rights level, ... and an mth access rights level according to the value size, where m is a constant, and the data to be protected access process includes: The corresponding role label is searched according to the attribute, the corresponding entity is searched according to the role label, the sensitivity is searched according to the entity, the corresponding access permission level is searched according to the sensitivity, and the user accesses the data and data access records of the corresponding access permission level in the protected data according to the access permission level.

6. The method for protecting computer data security according to claim 5, characterized in that: The second access control strategy includes: Collect entities with neighboring relationships in the knowledge graph corresponding to the data to be protected, record all collected entities, find the attributes and sensitivity corresponding to each entity respectively, and create access control rules according to the attributes. The access control rules are filled in and updated in real time by the user of the control panel. The access control rules restrict or allow access to certain sensitive data. The sensitive data is the content filled in by the user in the keyword filling position; Monitor in real time the address and time at which the user dynamically changes the access control rules.

7. The method for protecting computer data security according to claim 6, characterized in that: The step S4 comprises the following sub-steps: Step S41: Encrypting the data to be protected by a dynamic password encryption method according to the sensitivity; Step S42: Generate a unique key using the user ID and timestamp, calculate the unique key using the key derivation function PBKDF2, and dynamically distribute the corresponding encryption key to the user according to the access control policy and user attributes; Step S43: Record the key distribution and user access logs, including user ID, timestamp and sensitive data, and check the key usage at intervals; Step S44: extracting the attribute code in the key, and determining the decoding user according to the attribute code includes: The decoding keyword attribute input by the decoding user on the control panel, and comparing the decoding keyword attribute with the attribute code in the key; If the attribute of the decoding keyword corresponds to the attribute in the key, decryption is performed using the decoding key allocated by the key distribution center KDC; If the attribute of the decoding keyword does not correspond to the attribute in the key, the decoding operation of the user is intercepted.

8. The method for protecting computer data security according to claim 7, characterized in that: The step S41 comprises: The data type accessed by the user and the sensitivity of the data are obtained according to the user's access requirements. The access requirements are obtained by the user filling in real time on the control panel. The sensitivity of the data includes the weighted average of the sensitivities of all keywords included in the data. The data is encrypted using the encryption algorithm AES, and the strength of the encryption algorithm AES corresponds to the sensitivity of the data.

9. The method for protecting computer data security according to claim 8, characterized in that: The step S42 comprises: Dynamic key distribution based on user includes: The initial key is automatically generated by the key distribution center KDC according to the user ID and timestamp, the initial key is updated regularly, and the user's permission to obtain the key is adjusted according to the access control policy, including: Retrieve the sensitivity and attributes of the keywords entered by the user in the keyword filling position of the control panel, add the unique code of the attribute to the initial key, and record the unique code and the corresponding attribute in the form of a linked list and store them in the background memory queue; When the attribute of the keyword is already stored in the linked list, the unique code corresponding to the attribute is directly called and added to the initial key; When the attribute of the keyword is not stored in the linked list, the attribute and the non-repeated unique code are stored along the linked list address; The key exchange protocol Diffie-Hellman is used to distribute keys.

10. A system for protecting computer data security, characterized in that: Including attribute generation module, encryption module, decryption module and control panel: The attribute generation module is used to generate a knowledge graph related to the data to be protected, and generate the attributes, relevance and sensitivity of the data to be protected according to the knowledge graph; The encryption module is used to dynamically encrypt the data to be protected according to the attributes, relevance and sensitivity; The decryption module is used to decrypt according to the encryption key and screen the decoding users; The control panel is used for users to input access requirements, access control rule keywords and decoding keywords.

Images