A User Data Security Management Method and System

Abstract

The present application relates to the field of information security technology, and discloses a user data security management method and system. The method includes storage security management, retrieval security management, and tracking security management. The system corresponds to the method. The user data security management method and system of the present application ensure the security of user data in multiple directions of data access security - data storage security - data usage security through storage security management, retrieval security management, and tracking security management, and can comprehensively manage the security of user data, with high information security.

Description

Technical Field

[0001] This application relates to the field of information security technology, and specifically to a user data security management method and system. Background Art

[0002] With the progress of technology level and living standard, more and more intelligent technologies have entered people's lives. In particular, in order to help expectant mothers, fathers-to-be or groups preparing for pregnancy to have more accurate "pregnancy" knowledge data, some software operation platforms for such technologies have emerged. However, for such software operation platforms, in addition to being able to use scientific, true and credible medical technologies as a support to judge the pregnancy index of users (such as ovulation detection, report interpretation, test list backup / analysis, pregnancy success rate estimation, etc.), the security management of user data is also very important, which not only involves the security of the user's personal information / privacy, but may also involve the security of the related privacy of the user's next generation. Therefore, the data security management of this kind of software operation platform is very important.

[0003] Looking at the data management technologies in the existing technologies, most of them achieve the secure storage of data through methods such as data encryption. However, due to the importance of data, simply achieving security in storage cannot avoid data leakage. Therefore, a comprehensive user data management technology is urgently needed. Summary of the Invention

[0004] The purpose of this application is to provide a user data security management method and system to solve the technical problems raised in the above background.

[0005] To achieve the above purpose, this application discloses the following technical solutions:

[0006] In the first aspect, this application discloses a user data security management method, including storage security management, retrieval security management and tracking security management;

[0007] The storage security management is used to respond to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, perform security encryption on the user data and store it in the storage space;

[0008] The retrieval security management is used to respond to a data retrieval instruction, perform a security verification on the data retrieval request, and after the security verification passes, send the retrieved data to the corresponding request end in the form of a data packet, otherwise, reject the data retrieval request;

[0009] The tracking security management is used to track the usage of user data in the data packet based on the permitted operating environment built when the data packet is in use in response to a data usage instruction, and determine whether there is an abnormality in the usage. If so, execute a prohibition order to terminate the usage of the data packet.

[0010] Preferably, the security inspection of the accessed user data specifically includes:

[0011] Identify the accessed user data based on the user identity, where the user identity includes the user identity and the administrator identity, and the user data includes user data and administrator data;

[0012] When the accessed user data is user data, authenticate the identity information in the user data, and after the authentication passes, mask the identity information and privacy data in the user data with a pseudocode;

[0013] When the accessed user data is the administrator identity, authenticate the identity information in the administrator data, and after the authentication passes, perform a network security detection on the application management data in the administrator data. When the network security detection passes, it indicates that the security inspection of the accessed user data passes; otherwise, it indicates that the security inspection of the accessed user data fails, and freeze the access to the identity information corresponding to the administrator data.

[0014] Preferably, the network security detection is used to detect whether there is network attack data in the application management data; the network security detection specifically includes:

[0015] Scan the management data features of the application management data, where the management data features include one or more of: traffic data connection frequency, protocol type, source / destination IP address, or user behavior metrics;

[0016] Import the scanned management data features into an isolation forest model for anomaly detection;

[0017] When an anomaly is detected, it indicates that the security inspection fails; otherwise, it indicates that the security inspection passes.

[0018] Preferably, the specific method of securely encrypting the user data and storing it in the storage space is: securely encrypt the identity information and privacy data in the user data after pseudocode masking and store them in the storage space.

[0019] Preferably, the permitted operating environment built when the data packet is in use specifically includes:

[0020] The data packet includes an environment construction instruction at the front stage and the retrieved data at the back stage;

[0021] When the data packet is opened, the environment construction instruction at the front stage runs to construct the permission running environment, which is used to collect the usage situation of the retrieved data and send it back to the background. Only when the permission running environment is constructed and enabled can the retrieved data at the back stage be used.

[0022] Preferably, the permission running environment is used to collect the usage situation of the retrieved data and send it back to the background, specifically including:

[0023] After the permission running environment is constructed and enabled, the user operates on the retrieved data;

[0024] The permission running environment reads the operation data of the user during the operation process;

[0025] The permission running environment sends the collected operation data back to the background.

[0026] Preferably, the judgment of whether the usage situation is abnormal specifically includes:

[0027] Perform data cleaning on the received operation data;

[0028] Extract operation features from the operation data after data cleaning;

[0029] Perform normalization processing on the extracted operation features;

[0030] Use the isolation forest model to train the operation features after normalization processing;

[0031] Identify whether the operation features are abnormal features;

[0032] Calculate the abnormal score corresponding to each usage situation based on the identified abnormal features;

[0033] Compare the calculated abnormal score with a preset score threshold;

[0034] When the abnormal score is greater than the score threshold, it is determined that the usage situation is abnormal; otherwise, it is determined that the usage situation is normal.

[0035] Preferably, the abnormal score is calculated by the following formula:

[0036]

[0037] Where N is the total number of operation features after normalization processing, n is the number of identified abnormal features, s i is the severity of feature i, f iis the occurrence frequency of feature i, d i is the duration of the occurrence of feature i, w i is the weight corresponding to feature i.

[0038] Preferably, when identifying whether the operation feature is an abnormal feature, analyze the identified abnormal features in combination with the actual usage requirements to obtain ignorable abnormal features;

[0039] The abnormal score is calculated by the following formula:

[0040]

[0041] where N is the total number of operation features after normalization processing, n is the number of identified abnormal features, m is the number of identified ignorable abnormal features, s i is the severity of feature i, f i is the occurrence frequency of feature i, d i is the duration of the occurrence of feature i, w i is the weight corresponding to feature i.

[0042] In a second aspect, the present application discloses a user data security management system, which is applicable to the user data security management method as described above. The system includes:

[0043] A user terminal for uploading user data;

[0044] A management terminal for performing security management on user data;

[0045] A usage terminal for using user data;

[0046] wherein, the management terminal includes a storage management module, a retrieval management module, and a usage management module;

[0047] The storage management module is configured to: in response to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, perform security encryption on the user data and store it in the storage space;

[0048] The retrieval management module is configured to: in response to a data retrieval instruction, perform a security verification on the data retrieval request initiated by the user terminal or the usage terminal, and after the security verification passes, send the retrieved data to the corresponding request terminal in the form of a data packet, otherwise, reject the data retrieval request;

[0049] The usage management module is configured to: in response to a data usage instruction, track the usage situation of the user data in the data packet based on the permission running environment constructed by the usage terminal when using the data packet, and determine whether there is an abnormality in the usage situation. If so, execute a prohibition order to terminate the usage of the data packet by the usage terminal.

[0050] Beneficial effects: The user data security management method and system of the present application ensure the security of user data in multiple directions of data access security - data storage security - data usage security through storage security management, retrieval security management, and tracking security management, and can comprehensively manage the security of user data, with high information security. Description of the Drawings

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following-described drawings are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative efforts.

[0052] Figure 1 It is a flowchart showing the user data security management method provided by the embodiment of the present application. Detailed Embodiments

[0053] The following will clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.

[0054] In this article, the term "including" is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements but also includes other elements not explicitly listed, or also includes elements inherent to such a process, method, article, or device. Without further limitations, the elements defined by the statement "including..." do not exclude the existence of additional identical elements in the process, method, article, or device including the said elements.

[0055] In the first aspect, this embodiment discloses a user data security management method as Figure 1 shown, including storage security management, retrieval security management, and tracking security management.

[0056] Specifically:

[0057] The storage security management is used to respond to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, perform security encryption on the user data and store it in the storage space;

[0058] The retrieved security management is used to respond to a data retrieval instruction, perform security verification on a data retrieval request, and after the security verification passes, send the retrieved data to the corresponding requestor in the form of a data packet; otherwise, reject the data retrieval request.

[0059] The tracking security management is used to respond to a data usage instruction, track the usage of user data in the data packet based on the permitted operating environment constructed during the usage of the data packet, and determine whether there is an abnormality in the usage situation. If so, execute a prohibition order to terminate the usage of the data packet.

[0060] In the above, the storage security management is used to ensure the security of user data during data access and data storage, and the retrieved security management and the tracking security management are used to ensure the security of user data during data usage.

[0061] Among them, the security inspection of the accessed user data specifically includes:

[0062] Identify the accessed user data based on the user identity, where the user identity includes the user identity and the administrator identity, and the user data includes the user data and the administrator data;

[0063] When the accessed user data is user data, identify the authenticity of the identity information in the user data, and after the authenticity identification passes, perform pseudo-code masking on the identity information and privacy data in the user data; here, the pseudo-code masking can but is not limited to content conversion of the data content, such as matrix conversion and other methods;

[0064] When the accessed user data is the administrator identity, identify the authenticity of the identity information in the administrator data, and after the authenticity identification passes, perform network security detection on the application management data in the administrator data. Among them, the application management data can but is not limited to data packets for software upgrade / optimization, etc. When the network security detection passes, it means that the security inspection of the accessed user data passes; otherwise, it means that the security inspection of the accessed user data fails, and the identity information corresponding to the administrator data is access-frozen.

[0065] It is conceivable that the people using the software operation platform include not only users but also management personnel. To ensure data security, it is necessary to comprehensively monitor all groups that can access the data to ensure data security. During the data access process, even users can use software vulnerabilities to intrude into the software's database and infringe on user data. Personnel with administrator status can access backend data. Network hackers who steal administrator identities can even use the stolen identities to wantonly steal backend data in the form of fake data packets for software upgrade / optimization. Therefore, by conducting security inspections on the accessed user data, it is possible to conduct security reviews on platform users at a higher level, thereby improving information security.

[0066] In this embodiment, the network security detection is used to detect whether there is network attack data in the application management data; the network security detection specifically includes:

[0067] Perform a feature scan on the application management data, and the management data features include one or more of: traffic data connection frequency, protocol type, source / destination IP address, or user behavior metrics;

[0068] Import the scanned management data features into the Isolation Forest model for anomaly detection;

[0069] When an anomaly is detected, it means that the security inspection fails; otherwise, it means that the security inspection passes.

[0070] It should be noted that the implementation of network security detection using the Isolation Forest model here can be any one in the prior art. And to ensure the reliability of security detection, it is also possible to conduct real-time monitoring of the platform's network traffic, quickly respond to discovered threats, and use cross-validation and continuous monitoring methods to ensure the effectiveness of the model and regularly retrain the model to adapt to new threat types.

[0071] By the above, in this embodiment, the specific method of securely encrypting and storing the user data in the storage space is: securely encrypting the identity information and privacy data in the user data after pseudocode masking and storing them in the storage space.

[0072] To ensure the security of the called data during use, for example, whether the called data is used for transactions, malicious modification, etc., this embodiment adopts a tracking security management method to avoid the occurrence of such events. Based on the above tracking security management framework, in this embodiment, the permission running environment constructed when the data packet is used specifically includes:

[0073] The data packet includes an environment construction instruction at the front stage and retrieved data at the back stage;

[0074] When the data packet is opened, the environment construction instruction at the front stage runs to construct the permitted operating environment, which is used to collect the usage situation of the retrieved data and send it back to the background. Only when the permitted operating environment is constructed and enabled can the retrieved data at the back stage be used.

[0075] Here, it should be noted that the construction and enabling of the permitted operating environment are the prerequisites for the retrieved data to be opened, browsed, copied, tampered with, or even displayed for a long time. Therefore, even when background staff wants to use a certain user's data, they also need to be fully supervised during the usage process.

[0076] Furthermore, the permitted operating environment is used to collect the usage situation of the retrieved data and send it back to the background, specifically including:

[0077] After the permitted operating environment is constructed and enabled, the user operates on the retrieved data;

[0078] The permitted operating environment reads the operation data during the operation process of the user;

[0079] The permitted operating environment sends the collected operation data back to the background.

[0080] Among them, the operation data includes one or more of log records, metadata collection, or user behavior. Among them, log records: record all data access events, including access time, visitor identity, access type (read, write, etc.). Metadata collection: collect metadata about data files, such as file size, creation time, modification time, etc. User behavior tracking: record the user's login time, active time, access frequency, etc.

[0081] In a feasible implementation manner, the anomaly score is calculated through the following formula:

[0082]

[0083] Among them, N is the total number of operation features after normalization processing, n is the number of identified abnormal features, s i is the severity of feature i, f i is the occurrence frequency of feature i, d i is the duration of the occurrence of feature i, w iis the weight corresponding to feature i. Further, regarding the severity of an abnormal feature, the larger the corresponding value, the more severe the abnormal situation corresponding to the feature; the occurrence frequency represents the usage frequency of the feature, and the larger the corresponding value, the more frequently the feature is used; the duration refers to the duration when a feature is used, and the larger the corresponding value, the longer the usage time of the feature; the weight is used to reflect the importance of the feature, and it can be a value preset based on big data. The larger the corresponding value, the more severe the abnormal situation once the feature appears.

[0084] In another feasible implementation, it can be envisioned that due to the necessity of some actions, for example, the need to modify certain content of user data according to actual technical requirements, or the situation of scientifically using and medically analyzing user data after forwarding it with permission, etc., abnormal features that can be ignored under some preconditions can be set. During the implementation of this process, these abnormal features are allowed to be ignored. Therefore, when identifying whether an operation feature is an abnormal feature, combined with the actual usage requirements, the identified abnormal features are analyzed to obtain the abnormal features that can be ignored;

[0085] The abnormal score is calculated through the following formula:

[0086]

[0087] where N is the total number of operation features after normalization processing, n is the number of identified abnormal features, m is the number of identified abnormal features that can be ignored, s i is the severity of feature i, f i is the occurrence frequency of feature i, d i is the duration when feature i appears, w i is the weight corresponding to feature i.

[0088] Thus, in the process of tracking and security management in this embodiment, it is possible to perform security disposal on user data more comprehensively and more in line with actual usage requirements, with high information security and practicality.

[0089] Furthermore, in order to improve the accuracy of abnormal feature recognition, in some feasible implementation manners, a method combining a local outlier factor detection model and an isolation forest model is used to identify abnormal features. On the one hand, it improves the recognition efficiency and comprehensiveness of abnormal situations, avoiding omissions. On the other hand, it can also improve the recognition accuracy of abnormal situations and improve the detection accuracy. Simply put, based on the aforementioned use of the isolation forest model, this method further includes the following steps:

[0090] Model training: Use the local outlier factor detection model to train the preliminarily screened suspected abnormal features;

[0091] Anomaly scoring: Calculate the anomaly score of the local anomaly factor for each suspected anomaly feature;

[0092] Final screening: Based on the anomaly score of the local anomaly factor and the dynamic threshold, perform final screening to determine the anomaly features. Here, the dynamic threshold is calculated from the anomaly score distribution of the isolation forest model.

[0093] Based on this, the user data security management method of this embodiment realizes comprehensive security management of user data.

[0094] In the second aspect of this embodiment, a user data security management system is disclosed, and the system includes:

[0095] A user terminal for uploading user data;

[0096] A management terminal for performing security management on user data;

[0097] A usage terminal for using user data;

[0098] Among them, the management terminal includes a storage management module, a retrieval management module, and a usage management module;

[0099] The storage management module is configured to: in response to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, perform security encryption on the user data and store it in the storage space;

[0100] The retrieval management module is configured to: in response to a data retrieval instruction, perform a security verification on the data retrieval request initiated by the user terminal or the usage terminal, and after the security verification passes, send the retrieved data to the corresponding request terminal in the form of a data packet, otherwise, reject the data retrieval request;

[0101] The usage management module is configured to: in response to a data usage instruction, track the usage of the user data in the data packet based on the permission running environment constructed by the usage terminal when using the data packet, and determine whether there is an anomaly in the usage situation. If so, execute a prohibition order to terminate the usage of the data packet by the usage terminal.

[0102] It should be noted that the user data security management system of this embodiment corresponds to the aforementioned user data security management method. Therefore, for the parts not disclosed in the user data security management system of this embodiment (including but not limited to technical effects, specific implementation contents, etc.), reference can be made to the records in the aforementioned user data security management method, and this text will not elaborate here.

[0103] In summary, the user data security management method and system of this embodiment ensure the security of user data in multiple directions from data access security to data storage security and then to data usage security through storage security management, retrieval security management, and tracking security management. It can comprehensively manage the security of user data and has high information security.

[0104] In the embodiments provided in this application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: application specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), processor, controller, microcontroller, microprocessor, or other electronic units designed to implement the functions described herein or a combination thereof. For software implementation, part or all of the processes of the embodiments can be completed by a computer program instructing the relevant hardware. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. The computer-readable storage medium includes computer storage media and communication media, where the communication media includes any medium that facilitates the transfer of a computer program from one place to another. The storage media can be any available medium that can be accessed by a computer. The computer-readable storage medium can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM, or other optical disk storage, magnetic disk storage media, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer.

[0105] Finally, it should be noted that the above are only the preferred embodiments of this application and are not used to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of this application shall be included in the protection scope of this application.

Claims

1. A user data security management method, characterized in that It includes storage security management, retrieval security management, and tracking security management; The storage security management is used to, in response to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, securely encrypt the user data and store it in the storage space; The retrieval security management is used to, in response to a data retrieval instruction, perform a security verification on the data retrieval request, and after the security verification passes, send the retrieved data to the corresponding requestor in the form of a data packet, otherwise, reject the data retrieval request; The tracking security management is used to, in response to a data usage instruction, based on the permitted operating environment constructed when the data packet is used, track the usage of the user data in the data packet, and determine whether there is an abnormality in the usage situation. If so, execute a prohibition order to terminate the usage of the data packet; The permitted operating environment constructed when the data packet is used specifically includes: The data packet includes an environment construction instruction at the front stage and the retrieved data at the back stage; When the data packet is opened, the environment construction instruction at the front stage runs to construct the permitted operating environment. The permitted operating environment is used to collect and send back to the background the usage situation of the retrieved data. Only when the permitted operating environment is constructed and enabled can the retrieved data at the back stage be used; The permitted operating environment is used to collect and send back to the background the usage situation of the retrieved data, and specifically includes: After the permitted operating environment is constructed and enabled, the user operates on the retrieved data; The permitted operating environment reads the operation data of the user during the operation process; The permitted operating environment sends the collected operation data back to the background; The determination of whether there is an abnormality in the usage situation specifically includes: Performing data cleaning on the received operation data; Performing operation feature extraction on the operation data after data cleaning; Performing normalization processing on the extracted operation features; Using an isolation forest model to train the normalized operation features; Identifying whether the operation features are abnormal features; Calculating an abnormal score corresponding to each usage situation based on the identified abnormal features; Comparing the calculated abnormal score with a preset score threshold; When the abnormal score is greater than the score threshold, it is determined that there is an abnormality in this usage situation, otherwise, it is determined that there is no abnormality in this usage situation; Among them, when identifying whether the operation features are abnormal features, the identified abnormal features are analyzed in combination with the actual usage requirements to obtain negligible abnormal features; The abnormal score is calculated through the following formula: Among them, is the total number of operation characteristics after normalization processing, is the number of identified abnormal characteristics, is the number of identified negligible abnormal characteristics, is the feature severity, is the feature occurrence frequency, is the feature occurrence duration, is the feature corresponding weight.

2. The user data security management method according to claim 1, wherein The security check on the accessed user data specifically includes: Identifying the accessed user data based on the user identity. The user identity includes the user identity and the administrator identity, and the user data includes the user data of the user and the administrator data; When the accessed user data is user data, the authenticity of the identity information in the user data is identified, and after the authenticity identification passes, the identity information and privacy data in the user data are pseudocoded and masked; When the accessed user data is of an administrator identity, authenticate the authenticity of the identity information in the administrator data. After successful authentication, perform network security detection on the application management data in the administrator data. When the network security detection passes, it indicates that the security check of the accessed user data has passed; otherwise, it indicates that the security check of the accessed user data has failed, and freeze access to the identity information corresponding to the administrator data.

3. The user data security management method according to claim 2, wherein, The network security detection is used to detect whether there is network attack data in the application management data. The network security detection specifically includes: Scan the management data features of the application management data. The management data features include one or more of: traffic data connection frequency, protocol type, source / destination IP address, or user behavior metrics. Import the scanned management data features into an isolation forest model for anomaly detection. When an anomaly is detected, it indicates that the security check has failed; otherwise, it indicates that the security check has passed.

4. The user data security management method according to claim 2, wherein The specific method of securely encrypting and storing the user data in the storage space is: securely encrypt the identity information and privacy data in the user data after pseudocode masking and store them in the storage space.

5. A user data security management system, applicable to the user data security management method according to any one of claims 1 to 4, characterized in that, The system includes: A user terminal for uploading user data. A management terminal for securely managing user data. A usage terminal for using user data. Among them, the management terminal includes a storage management module, a retrieval management module, and a usage management module. The storage management module is configured to: in response to a data storage instruction, perform a security check on the accessed user data, and after the security check passes, securely encrypt the user data and store it in the storage space. The retrieval management module is configured to: in response to a data retrieval instruction, perform a security verification on the data retrieval request initiated by the user terminal or the usage terminal. After the security verification passes, send the retrieved data to the corresponding request terminal in the form of a data packet; otherwise, reject the data retrieval request. The usage management module is configured to: in response to a data usage instruction, track the usage of the user data in the data packet based on the permission running environment constructed by the usage terminal when using the data packet, and determine whether there is an anomaly in the usage situation. If so, execute a prohibition order to terminate the usage of the data packet by the usage terminal.

Images