User data security management method and system

Abstract

The invention relates to the technical field of information security, and discloses a user data security management method and system, and the method comprises storage security management, calling security management and tracking security management. The system corresponds to the method. According to the user data security management method and system, through storage security management, calling security management and tracking security management, the security of the user data is ensured in multiple directions of data access security-data storage security-data use security, security management can be carried out on the user data in all directions, and the security of the user data is ensured. And the information security is relatively high.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a user data security management method and system. Background Art

[0002] With the advancement of science and technology and living standards, more and more intelligent technologies are entering people's lives. In particular, in order to help expectant mothers, expectant fathers or people preparing for pregnancy to have more accurate "pregnancy" knowledge data, some software operation platforms for this type of technology have emerged. However, for this type of software operation platform, in addition to being able to use scientific, real and reliable medical technology as a support to judge the user's pregnancy index (such as ovulation detection, report interpretation, test sheet backup / analysis, pregnancy success rate estimation, etc.), the security management of user data is also very important. This not only involves the security of the user's own personal information / privacy, but may also involve the security of the user's next generation of related privacy. Therefore, data security management of this type of software operation platform is very important.

[0003] Looking at the data management technologies in the existing technology, most of them achieve secure data storage by means of data encryption, etc. However, due to the importance of data, simply achieving security in storage cannot prevent data leakage. Therefore, a comprehensive user data management technology is urgently needed. Summary of the invention

[0004] The purpose of this application is to provide a user data security management method and system to solve the technical problems raised in the above background.

[0005] To achieve the above objectives, this application discloses the following technical solutions:

[0006] In a first aspect, the present application discloses a user data security management method, including storage security management, retrieval security management, and tracking security management;

[0007] The storage security management is used to respond to the data storage instruction, perform security inspection on the accessed user data, and after the security inspection passes, securely encrypt the user data and store it in the storage space;

[0008] The retrieval security management is used to respond to the data retrieval instruction, perform security verification on the data retrieval request, and send the retrieved data to the corresponding request end in the form of a data packet after the security verification passes, otherwise, the data retrieval request is rejected;

[0009] The tracking security management is used to respond to data usage instructions, track the usage of user data in the data packet based on the licensed operating environment constructed when the data packet is used, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the use of the data packet.

[0010] Preferably, the security check of the accessed user data specifically includes:

[0011] Identifying the accessed user data based on the user identity, wherein the user identity includes a user identity and an administrator identity, and the user data includes user data and administrator data;

[0012] When the accessed user data is user data, the identity information in the user data is authenticated, and after the authenticity authentication is passed, the identity information and privacy data in the user data are masked with pseudo code;

[0013] When the accessed user data is an administrator, the identity information in the administrator data is authenticated, and after the authenticity identification is passed, the application management data in the administrator data is subjected to a network security check. When the network security check passes, it indicates that the security check of the accessed user data has passed. Otherwise, it indicates that the security check of the accessed user data has failed, and access to the identity information corresponding to the administrator data is frozen.

[0014] Preferably, the network security detection is used to detect whether there is network attack data in the application management data; the network security detection specifically includes:

[0015] Scanning the application management data for management data characteristics, wherein the management data characteristics include: one or more of flow data connection frequency, protocol type, source / destination IP address, or user behavior indicator;

[0016] Import the scanned management data features into the isolation forest model for anomaly detection;

[0017] When an abnormality is detected, it means that the safety check has failed, otherwise, it means that the safety check has passed.

[0018] Preferably, the securely encrypting the user data and storing them in the storage space specifically includes: securely encrypting the identity information and privacy data in the user data masked by the pseudocode and storing them in the storage space.

[0019] Preferably, the licensed operating environment constructed by the data package when used specifically includes:

[0020] The data packet includes environment construction instructions at the front stage and retrieved data at the back stage;

[0021] When the data packet is opened, the environment construction instruction at the front level is executed to build the licensed operating environment, and the licensed operating environment is used to collect the usage of the retrieved data and transmit it back to the background. When and only when the licensed operating environment is built and opened, the retrieved data at the back level can be used.

[0022] Preferably, the license operating environment is used to collect the usage of the retrieved data and transmit it back to the background, specifically including:

[0023] When the license operating environment is constructed and started, the user operates on the retrieved data;

[0024] The license operation environment reads the operation data of the user during the operation process;

[0025] The license operating environment transmits the collected operation data back to the background.

[0026] Preferably, the determining whether the usage is abnormal specifically includes:

[0027] Perform data cleaning on the received operation data;

[0028] Extract operation features from the operation data after data cleaning;

[0029] Normalize the extracted operation features;

[0030] Use the isolation forest model to train the normalized operational features;

[0031] Identify whether the operation characteristics are abnormal characteristics;

[0032] Calculating an abnormality score corresponding to each usage situation based on the identified abnormal features;

[0033] Compare the calculated anomaly score with a preset score threshold;

[0034] When the abnormality score is greater than the score threshold, it is determined that the usage is abnormal; otherwise, it is determined that the usage is not abnormal.

[0035] Preferably, the anomaly score is calculated by the following formula:

[0036]

[0037] Where N is the total number of normalized operation features, n is the number of identified abnormal features, and s i is the severity of feature i, f iis the frequency of occurrence of feature i, d i is the duration of feature i, w i is the weight corresponding to feature i.

[0038] Preferably, when determining whether the operation feature is an abnormal feature, the identified abnormal feature is analyzed in combination with actual usage requirements to obtain negligible abnormal features;

[0039] The anomaly score is calculated by the following formula:

[0040]

[0041] Where N is the total number of normalized operational features, n is the number of identified abnormal features, m is the number of negligible abnormal features identified, and s is the number of i is the severity of feature i, f i is the frequency of occurrence of feature i, d i is the duration of feature i, w i is the weight corresponding to feature i.

[0042] In a second aspect, the present application discloses a user data security management system, which is applicable to the user data security management method as described above, and the system includes:

[0043] The user side is used to upload user data;

[0044] Management side, used for secure management of user data;

[0045] The user end is used to use user data;

[0046] Wherein, the management end includes a storage management module, a retrieval management module and a use management module;

[0047] The storage management module is configured to: in response to the data storage instruction, perform a security check on the accessed user data, and after the security check passes, securely encrypt the user data and store it in the storage space;

[0048] The retrieval management module is configured to: in response to the data retrieval instruction, perform security verification on the data retrieval request initiated by the user end or the user end, and after the security verification is passed, send the retrieved data to the corresponding request end in the form of a data packet, otherwise, reject the data retrieval request;

[0049] The usage management module is configured to: respond to a data usage instruction, track the usage of the user data in the data packet based on the licensed operating environment constructed by the user end when using the data packet, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the user end's use of the data packet.

[0050] Beneficial effects: The user data security management method and system of the present application, through storage security management, retrieval security management and tracking security management, ensure the security of user data in multiple directions of data access security - data storage security - data usage security, and can manage user data securely in all directions with high information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 A flowchart of a user data security management method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0054] In this article, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0055] In a first aspect, this embodiment discloses Figure 1 A user data security management method is shown, including storage security management, retrieval security management and tracking security management.

[0056] Specifically:

[0057] The storage security management is used to respond to the data storage instruction, perform security inspection on the accessed user data, and after the security inspection passes, securely encrypt the user data and store it in the storage space;

[0058] The retrieval security management is used to respond to the data retrieval instruction, perform security verification on the data retrieval request, and send the retrieved data to the corresponding request end in the form of a data packet after the security verification passes, otherwise, the data retrieval request is rejected;

[0059] The tracking security management is used to respond to data usage instructions, track the usage of user data in the data packet based on the licensed operating environment constructed when the data packet is used, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the use of the data packet.

[0060] Among the above, storage security management is used to ensure the security of user data in data access and data storage, and retrieval security management and tracking security management are used to ensure the security of user data in data usage.

[0061] The security check of the accessed user data specifically includes:

[0062] Identifying the accessed user data based on the user identity, wherein the user identity includes a user identity and an administrator identity, and the user data includes user data and administrator data;

[0063] When the accessed user data is user data, the identity information in the user data is authenticated, and after the authenticity authentication is passed, the identity information and privacy data in the user data are masked by pseudocode; here, the pseudocode masking may include but is not limited to content conversion of the data content, such as matrix conversion, etc.;

[0064] When the accessed user data is an administrator identity, the identity information in the administrator data is authenticated, and after the authenticity identification is passed, a network security check is performed on the application management data in the administrator data, wherein the application management data may be, but is not limited to, data packets used for software upgrades / optimizations, etc. When the network security check passes, it indicates that the security check of the accessed user data has passed, otherwise, it indicates that the security check of the accessed user data has failed, and access to the identity information corresponding to the administrator data is frozen.

[0065] As you can imagine, the people who use the software operation platform include not only users but also managers. In order to ensure the security of data, it is necessary to conduct comprehensive monitoring of all groups that can access the data to ensure the security of the data. During the data access process, even users can use software vulnerabilities to invade the software database and infringe on user data accordingly. People with administrator identities can access back-end data, and network hackers who steal administrator identities can use stolen identities to steal back-end data in the form of fake data packets for software upgrades / optimizations. Therefore, by conducting security checks on the accessed user data, it is possible to conduct security reviews on platform users at a higher level, thereby improving information security.

[0066] In this embodiment, the network security detection is used to detect whether there is network attack data in the application management data; the network security detection specifically includes:

[0067] Scanning the application management data for management data characteristics, wherein the management data characteristics include: one or more of flow data connection frequency, protocol type, source / destination IP address, or user behavior indicator;

[0068] Import the scanned management data features into the isolation forest model for anomaly detection;

[0069] When an abnormality is detected, it means that the safety check has failed, otherwise, it means that the safety check has passed.

[0070] It should be noted that the implementation of the isolation forest model for network security detection here can be any of the existing technologies. In addition, in order to ensure the reliability of security detection, the platform can also monitor network traffic in real time and respond quickly to discovered threats, and use cross-validation and continuous monitoring to ensure the effectiveness of the model and regularly retrain the model to adapt to new threat types.

[0071] Based on the above, in this embodiment, the secure encryption of user data and storage in the storage space specifically includes: secure encryption of identity information and privacy data in the user data masked by pseudocode and storage in the storage space.

[0072] In order to ensure the security of the called data during use, for example, whether the called data is used for transactions, maliciously modified, etc., this embodiment adopts a tracking security management method to avoid this incident. Based on the above tracking security management framework, in this embodiment, the licensed operating environment constructed by the data package when it is used specifically includes:

[0073] The data packet includes environment construction instructions at the front stage and retrieved data at the back stage;

[0074] When the data packet is opened, the environment construction instruction at the front level is executed to build the licensed operating environment, and the licensed operating environment is used to collect the usage of the retrieved data and transmit it back to the background. When and only when the licensed operating environment is built and opened, the retrieved data at the back level can be used.

[0075] Here, it should be noted that the construction and opening of the licensed operating environment is the premise for the retrieved data to be opened for browsing, copying, tampering, or even long-term display. Therefore, even if the back-end staff wants to use a certain user's data, they need to be fully supervised during the use process.

[0076] Furthermore, the license operating environment is used to collect the usage of the retrieved data and transmit it back to the background, specifically including:

[0077] When the license operating environment is constructed and started, the user operates on the retrieved data;

[0078] The license operation environment reads the operation data of the user during the operation process;

[0079] The license operating environment transmits the collected operation data back to the background.

[0080] The operation data includes one or more of log records, metadata collection, or user behavior. Log records: record all data access events, including access time, visitor identity, access type (read, write, etc.). Metadata collection: collect metadata about data files, such as file size, creation time, modification time, etc. User behavior tracking: record user login time, active time, access frequency, etc.

[0081] In a feasible implementation manner, the abnormality score is calculated by the following formula:

[0082]

[0083] Where N is the total number of normalized operation features, n is the number of identified abnormal features, and s i is the severity of feature i, f i is the frequency of occurrence of feature i, d i is the duration of feature i, w iis the weight corresponding to feature i. To further illustrate, the severity of the abnormal feature, the larger the corresponding value, the more serious the abnormality corresponding to the feature; the frequency of occurrence indicates the frequency of use of the feature, the larger the corresponding value, the more frequently the feature is used; the duration refers to the duration of a feature being used, the larger the corresponding value, the longer the feature is used; the weight is used to reflect the importance of the feature, which can be a preset value based on big data, the larger the corresponding value, the more serious the abnormality once the feature appears.

[0084] In another feasible implementation, it is conceivable that due to the necessity of some actions, for example, it is necessary to modify certain contents of user data according to actual technical needs, or to forward user data for scientific use or medical analysis under the premise of obtaining permission, etc., ignorable abnormal features under some prerequisites can be set. In the process of implementing this process, these abnormal features are allowed to be ignored. Therefore, when determining whether the operation feature is an abnormal feature, the identified abnormal features are analyzed in combination with actual use requirements to obtain ignorable abnormal features;

[0085] The anomaly score is calculated by the following formula:

[0086]

[0087] Where N is the total number of normalized operational features, n is the number of identified abnormal features, m is the number of negligible abnormal features identified, and s is the number of i is the severity of feature i, f i is the frequency of occurrence of feature i, d i is the duration of feature i, w i is the weight corresponding to feature i.

[0088] Therefore, in the process of tracking security management, this embodiment can handle user data securely in a more comprehensive and more practical manner, and has higher information security and practicality.

[0089] Furthermore, in order to improve the accuracy of abnormal feature recognition, in some feasible implementations, the local anomaly factor detection model is combined with the isolation forest model to clarify the abnormal features. On the one hand, the efficiency and comprehensiveness of abnormal situation recognition are improved to avoid omissions. On the other hand, the accuracy of abnormal situation recognition and detection accuracy can be improved. In short, this method, based on the aforementioned use of the isolation forest model, also includes the following steps:

[0090] Model training: Use the local anomaly factor detection model to train the suspected abnormal features that are initially screened;

[0091] Anomaly score: Calculate the local anomaly factor anomaly score for each suspected abnormal feature;

[0092] Final screening: Final screening is performed based on the anomaly score of the local anomaly factor and the dynamic threshold to determine the anomaly characteristics. Here, the dynamic threshold is calculated from the anomaly score distribution of the isolation forest model.

[0093] Based on this, the user data security management method of this embodiment realizes comprehensive security management of user data.

[0094] In a second aspect, this embodiment discloses a user data security management system, the system comprising:

[0095] The user side is used to upload user data;

[0096] Management side, used for secure management of user data;

[0097] The user end is used to use user data;

[0098] Wherein, the management end includes a storage management module, a retrieval management module and a use management module;

[0099] The storage management module is configured to: in response to the data storage instruction, perform a security check on the accessed user data, and after the security check passes, securely encrypt the user data and store it in the storage space;

[0100] The retrieval management module is configured to: in response to the data retrieval instruction, perform security verification on the data retrieval request initiated by the user end or the user end, and after the security verification is passed, send the retrieved data to the corresponding request end in the form of a data packet, otherwise, reject the data retrieval request;

[0101] The usage management module is configured to: respond to a data usage instruction, track the usage of the user data in the data packet based on the licensed operating environment constructed by the user end when using the data packet, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the user end's use of the data packet.

[0102] It should be noted that the user data security management system of this embodiment corresponds to the aforementioned user data security management method. Therefore, the undisclosed parts of the user data security management system of this embodiment (including but not limited to technical effects, specific implementation contents, etc.) can be correspondingly referred to the records in the aforementioned user data security management method, and this text will not elaborate on them here.

[0103] To sum up, the user data security management method and system of this embodiment, through storage security management, retrieval security management and tracking security management, ensure the security of user data in multiple directions such as data access security, data storage security and data usage security, and can manage user data securely in all directions with high information security.

[0104] In the embodiments provided in the present application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code or any appropriate combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: application specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), processor, controller, microcontroller, microprocessor, other electronic units designed to implement the functions described herein or their combination. For software implementation, part or all of the flow of the embodiment can be completed by instructing the relevant hardware through a computer program. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication medium includes any medium that is convenient for transmitting a computer program from one place to another. The storage medium can be any available medium that a computer can access. The computer-readable storage medium can include but is not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer.

[0105] Finally, it should be noted that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A user data security management method, characterized in that: Including storage security management, retrieval security management and tracking security management; The storage security management is used to respond to the data storage instruction, perform security inspection on the accessed user data, and after the security inspection passes, securely encrypt the user data and store it in the storage space; The retrieval security management is used to respond to the data retrieval instruction, perform security verification on the data retrieval request, and send the retrieved data to the corresponding request end in the form of a data packet after the security verification passes, otherwise, the data retrieval request is rejected; The tracking security management is used to respond to data usage instructions, track the usage of user data in the data packet based on the licensed operating environment constructed when the data packet is used, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the use of the data packet.

2. The user data security management method according to claim 1, characterized in that: The security check of the accessed user data specifically includes: Identifying the accessed user data based on the user identity, wherein the user identity includes a user identity and an administrator identity, and the user data includes user data and administrator data; When the accessed user data is user data, the identity information in the user data is authenticated, and after the authenticity authentication is passed, the identity information and privacy data in the user data are masked with pseudo code; When the accessed user data is an administrator, the identity information in the administrator data is authenticated, and after the authenticity identification is passed, the application management data in the administrator data is subjected to a network security check. When the network security check passes, it indicates that the security check of the accessed user data has passed. Otherwise, it indicates that the security check of the accessed user data has failed, and access to the identity information corresponding to the administrator data is frozen.

3. The user data security management method according to claim 2, characterized in that: The network security detection is used to detect whether there is network attack data in the application management data; The network security detection specifically includes: Scanning the application management data for management data characteristics, wherein the management data characteristics include: one or more of flow data connection frequency, protocol type, source / destination IP address, or user behavior indicator; Import the scanned management data features into the isolation forest model for anomaly detection; When an abnormality is detected, it means that the safety check has failed, otherwise, it means that the safety check has passed.

4. The user data security management method according to claim 2, characterized in that: The secure encryption of the user data and storage in the storage space specifically includes: secure encryption of the identity information and privacy data in the user data masked by the pseudocode and storage in the storage space.

5. The user data security management method according to claim 1, characterized in that: The licensed operating environment constructed by the data package when used specifically includes: The data packet includes environment construction instructions at the front stage and retrieved data at the back stage; When the data packet is opened, the environment construction instruction at the front level is executed to build the licensed operating environment, and the licensed operating environment is used to collect the usage of the retrieved data and transmit it back to the background. When and only when the licensed operating environment is built and opened, the retrieved data at the back level can be used.

6. The user data security management method according to claim 5, characterized in that: The license operating environment is used to collect the usage of the retrieved data and transmit it back to the background, specifically including: When the license operating environment is constructed and started, the user operates on the retrieved data; The license operation environment reads the operation data of the user during the operation process; The license operating environment transmits the collected operation data back to the background.

7. The user data security management method according to claim 6, characterized in that: The determining whether the usage is abnormal specifically includes: Perform data cleaning on the received operation data; Extract operation features from the operation data after data cleaning; Normalize the extracted operation features; Use the isolation forest model to train the normalized operational features; Identify whether the operation characteristics are abnormal characteristics; Calculating an abnormality score corresponding to each usage situation based on the identified abnormal features; Compare the calculated anomaly score with a preset score threshold; When the abnormality score is greater than the score threshold, it is determined that the usage is abnormal; otherwise, it is determined that the usage is not abnormal.

8. The user data security management method according to claim 7, characterized in that: The anomaly score is calculated by the following formula: Where N is the total number of normalized operation features, n is the number of identified abnormal features, and s i is the severity of feature i, f i is the frequency of occurrence of feature i, d i is the duration of feature i, w i is the weight corresponding to feature i.

9. The user data security management method according to claim 7, characterized in that: When determining whether the identification operation feature is an abnormal feature, analyzing the identified abnormal feature in combination with actual usage requirements to obtain negligible abnormal features; The anomaly score is calculated by the following formula: Where N is the total number of normalized operational features, n is the number of identified abnormal features, m is the number of negligible abnormal features identified, and s is the number of i is the severity of feature i, f i is the frequency of occurrence of feature i, d i is the duration of feature i, w i is the weight corresponding to feature i.

10. A user data security management system, applicable to the user data security management method according to any one of claims 1 to 9, characterized in that: The system includes: The user side is used to upload user data; Management side, used for secure management of user data; The user end is used to use user data; Wherein, the management end includes a storage management module, a retrieval management module and a use management module; The storage management module is configured to: in response to the data storage instruction, perform a security check on the accessed user data, and after the security check passes, securely encrypt the user data and store it in the storage space; The retrieval management module is configured to: in response to the data retrieval instruction, perform security verification on the data retrieval request initiated by the user end or the user end, and after the security verification is passed, send the retrieved data to the corresponding request end in the form of a data packet, otherwise, reject the data retrieval request; The usage management module is configured to: respond to a data usage instruction, track the usage of the user data in the data packet based on the licensed operating environment constructed by the user end when using the data packet, and determine whether there is any abnormality in the usage. If so, execute a prohibition command to terminate the user end's use of the data packet.

Images