Data security sharing method and system

Abstract

The invention discloses a data security sharing method and system, and relates to the technical field of enterprise data transmission protection, and the method comprises the following steps: building an enterprise user database through MySQL, collecting information data of employees under the jurisdiction of an enterprise, building employee archives in the enterprise user database, and collecting and recording data access behaviors of the employees; a data sharing platform is established, enterprise internal data files are collected, encrypted and transmitted, an auditing point is set based on the enterprise equipment scale, an administrator is endowed with account permission, and the internal transmission data files are summarized and approved. According to the method and the system, the disguise file is generated based on the content of the data file by integrating the grade of the internal data of the enterprise, and the disguise file is displayed in the process that the data is abnormally accessed and abnormally received, so that the security and the secrecy of data transmission and access are improved, and the jurisdiction information is classified and transmitted in batches by setting the auditing point; the data transmission efficiency is improved, and it is ensured that sensitive information is not accessed or stolen by unauthorized personnel.

Description

Technical Field

[0001] The present invention relates to the technical field of enterprise data transmission protection, and in particular to a data security sharing method and system. Background Art

[0002] Internal enterprise data transmission refers to the process of data exchange and transmission between members within an enterprise, involving various forms of information, including but not limited to text, files, and data. It is usually based on the enterprise's internal LAN and uses computer equipment to transmit and access information.

[0003] Since there is a lot of complex internal data in an enterprise, data leakage and unauthorized data access are prone to occur during the transmission of computer data within the enterprise. The existing data security sharing mainly ensures data security by encrypting the data uniformly. However, simple data encryption does not have the problem of data obfuscation and has the problem of low practicality. It is also impossible to mark related devices and files after abnormal data access behavior, resulting in data leakage after the employee account is stolen. At the same time, the process of summarizing and approving internal data is cumbersome and slow, which makes confidential information easy to be stolen during transmission and large files are relatively slow to transmit, affecting the normal operation and work efficiency of the enterprise.

[0004] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention

[0005] In view of the problems in the related art, the present invention proposes a data security sharing method and system to overcome the above technical problems existing in the existing related art.

[0006] To this end, the specific technical solution adopted by the present invention is as follows: A data security sharing method, the method comprising the following steps: S1. Establish an enterprise user database through MySQL, collect information data of employees under the enterprise, establish employee files in the enterprise user database, and collect and record employees' data access behavior; S2. Establish a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; S3. Based on the level of the data file, a disguised data file is generated based on the characteristics of the original data file in the data sharing platform, and a data file access display strategy is set in combination with the employee permissions and data access behavior in the enterprise user database; S4. Regularly back up data files transmitted within the enterprise and attach timestamps.

[0007] As a preferred embodiment, S2 includes the following sub-steps: S21, through Build a data sharing platform to receive data files transmitted within the enterprise. Based on the scale of the enterprise's equipment, set audit points and match administrator accounts and permissions to set levels for internally transmitted data files. S22. Based on the internal data file transmission information received by the data sharing platform, different data file transmission methods and strategies are adopted.

[0008] As a preferred embodiment, the S21 includes the following sub-steps: S211. According to the number of equipment under the enterprise ,set up Audit points, match the administrator account according to the number of audit points; S212. Bind 1-10 computer devices to each audit point and associate them with employee files in the enterprise user database, and summarize the data files transmitted by the subordinate computers within the data sharing platform; S213. Pre-analyze and set the level of the summary information through the audit points. The specific steps are as follows: Set a capacity threshold for the transfer data file capacity A of the computers under the audit point , , for classifying the transmission data files, the following steps are included: When A< , then the capacity level of the transferred data file is marked as small; when ≤A< , then the capacity level of the transferred data file is marked as normal; When A≥ , then the capacity level of the transferred data file is marked as large; At the same time, the data file type is identified by regular expression matching, including notification type and non-notification type: For notification data files, the internal administrator account of the audit point is used to quickly send unencrypted mass messages to subordinate computers; For non-notification data files, based on the confidentiality level of the data files, the internal administrator account of the review point manually sets the level, including public level, internal level, and confidential level, and the data files are labeled with the level.

[0009] As a preferred embodiment, the S22 includes the following sub-steps: S221. Based on the size level of the transmitted data file, formulate a transmission strategy within the data sharing platform. The specific steps are as follows: For files with small file capacity, direct transmission within the network is adopted to directly transfer files; For files with normal file capacity, the file compression method is adopted to perform file compression transmission; For files with large file capacity, adopt the method of splitting file transmission, add transmission nodes in the current enterprise LAN, and transfer files through parallel transmission; S222. Based on the confidentiality level of the data files, different key encryption strategies are adopted for data files of different levels. The specific steps are as follows: For data files with a public level, the audit point is based on AES The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: , 1≤ i ≤ n ; Decryption formula: , 1≤ i ≤ n ; in, Indicates the encrypted i characters, Indicates the decrypted i characters, represents the encryption function, represents the decryption function, n Represents the total number of characters; For internal-level data files, the audit point is based on RSA The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: ; in, Represents plain text information, Represents ciphertext information, e is the exponent in the public key, n is the modulus in the public key; Decryption formula: ; in, Represents plain text information, Represents ciphertext information, d is the exponent in the private key, n is the modulus in the private key; For confidential data files, AES Encryption algorithm and RSA Encryption algorithm performs mixed encryption of data files; S223. A decoding key is issued to the computer at the destination of the transmission data file through the audit point to decrypt the encryption key of the corresponding transmission data file.

[0010] As a preferred embodiment, S3 includes the following sub-steps: S31. Based on the data file level set at the audit point, a disguised data file is generated in the data sharing platform based on the original data file characteristics; S32. Based on the employee rights and data access behaviors in the enterprise user database and in combination with the disguised data files, an access display strategy for the transmitted data files is set, including the enterprise internal data access strategy and the transmission file access strategy.

[0011] As a preferred embodiment, S31 includes the following sub-steps: S311, extracting the internal data of the internal and confidential data files, and dividing the data files into plain text type and text-digital type; S312, for the plain text data file, based on the storage size of the data file, select a data file from the public data file by simple non-repetitive random sampling, and copy and generate a disguised file of the current plain text data file; S313: For the text-to-digital data file, a correlation analysis is performed on the numbers in the text, and the specific steps are as follows: For two variables in the data file , calculate the correlation coefficient to measure the degree of association between variables, and the specific algorithm formula is: ; in, represents the Pearson correlation coefficient, is the number of data points, and The variables are and No. Observations, and The variables are and The mean of The value of is between -1 and 1. The closer the value is to 1, the stronger the positive correlation between the two variables is. The closer the value is to -1, the stronger the negative correlation between the two variables is. If the value of is equal to 0, it means that the two variables are not correlated at present; S314, combined variables , adjust the current data file and generate a disguised data file. The specific steps are: For positively correlated variables, , perform simple random sampling to extract the proportion of variables Perform synchronous zooming in or out and generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; For negatively correlated variables, group the variables according to the proportion , , for variables Make adjustments to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; For irrelevant variables, Randomly zoom in or out to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file.

[0012] As a preferred embodiment, S32 includes the following sub-steps: S321. For internal data of an enterprise, based on the employee permissions in the enterprise user database, when the current employee permissions are greater than the data permissions, the real data file content is displayed; when the current employee permissions are less than the data permissions, the disguised data file content is displayed; S322. For the transmission data file, the access computer is judged through the audit point. When the access computer decoding key and the login employee authority meet the requirements, the real transmission data file is displayed. When the computer decoding key and the login employee authority do not meet the requirements, the disguised data file is displayed. S323, extract the data access behavior in the employee file, when the data access behavior record contains a unit time Continuous When the data is accessed for the first time, the current employee file will be marked as abnormal. For the employee file marked as abnormal, a disguised file will be displayed when accessing internal enterprise data and receiving transmitted data files.

[0013] As a preferred embodiment, S1 includes the following sub-steps: S11. Collect information data of employees under the enterprise and establish employee files, including name, department, position, length of service, computer IP address, grant employees level permissions through administrator accounts, and record them in relevant employee files; S12. Record every data access behavior of an employee in the employee file, including the type of data accessed, level, and access timestamp.

[0014] A data security sharing system, comprising an information collection module, a data storage and transfer module, a disguised data generation module, and a data security sharing and access module; The information collection module collects information data of employees under the enterprise, establishes an enterprise user database through MySQL, and establishes employee files in the enterprise user database, including name, department, position, length of service, computer IP address, grants employees level permissions through administrator accounts, and collects and records employees' data access behaviors; The data storage and transfer module, through Build a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions at the audit points, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; The disguised data generation module generates a disguised data file based on the level of the data file and the characteristics of the original data file in the data sharing platform; The data security sharing and access module combines the employee permissions and data access behaviors in the enterprise user database to set the enterprise internal data file access policy and the enterprise transmission data file access policy, and reviews and determines the employee's access behavior.

[0015] The beneficial effects of the present invention are: 1. The present invention sets audit points and administrator accounts based on the number of devices under the enterprise, summarizes and disperses the approval of internal transmission data, speeds up the approval of data transmission, improves work efficiency, and classifies and sets levels based on the size and type of data files to manage data in a refined manner; 2. The present invention classifies and categorizes data, sets different data transmission modes and strategies, adopts different transmission modes for data of different sizes, formulates transmission strategies within the local area network, improves the transmission efficiency of large files, effectively utilizes network bandwidth and resources, reduces the error rate in the transmission process, ensures the accuracy of transmission, and improves the reliability of information transmission; 3. The present invention generates disguised files based on the content of data files by comprehensively considering the level of internal enterprise data. When data is accessed and transmitted, disguised files are displayed for access that does not meet security judgment, preventing unauthorized users from obtaining real data, effectively preventing data leakage, and enhancing security. 4. The present invention provides multi-level data protection by combining data level, access rights and disguised files, ensuring the security of internal enterprise data and transmission data during access and transmission. At the same time, it marks abnormal continuous access behaviors, reduces the risk of large-scale data leakage, and enhances the security of enterprise data sharing; The present invention integrates the level of internal enterprise data, generates a disguised file based on the content of the data file, and displays the disguised file during abnormal access and abnormal reception of data, thereby improving the security and confidentiality of data transmission and access. By setting audit points, the subordinate information is graded and transmitted in batches, thereby improving data transmission efficiency and ensuring that sensitive information is not accessed or stolen by unauthorized personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 is a flow chart of a data security sharing method according to an embodiment of the present invention; Figure 2 The figure is a block diagram of a data security sharing system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0019] According to an embodiment of the present invention, a data security sharing method and system are provided.

[0020] The present invention is further described with reference to the accompanying drawings and specific embodiments: Example 1: Figure 1 As shown, a data security sharing method according to an embodiment of the present invention comprises the following steps: S1. Establish an enterprise user database through MySQL, collect information data of employees under the enterprise, establish employee files in the enterprise user database, and collect and record employees' data access behavior; S11. Collect information data of employees under the enterprise and establish employee files, including name, department, position, length of service, computer IP address, grant employees level permissions through administrator accounts, and record them in relevant employee files; S12. Record every data access behavior of an employee in the employee file, including the type of data accessed, level, and access timestamp.

[0021] It should be noted that employee level permissions correspond to the employee's corporate position. Depending on the size of the company, the number of permission levels can be flexibly set, usually from 1 to 3 levels, where accounts with level 1 permission can access data files of all permission levels, including confidential, internal, and public levels; accounts with level 2 permission can access data files of levels 2 and 3, internal and public; accounts with level 3 permission can only access data files of level 3 permission, public.

[0022] S2. Establish a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; S21, through Build a data sharing platform to receive data files transmitted within the enterprise. Based on the scale of the enterprise's equipment, set audit points and match administrator accounts and permissions to set levels for internally transmitted data files. S211. According to the number of equipment under the enterprise ,set up Audit points, match the administrator account according to the number of audit points; S212. Bind 1-10 computer devices to each audit point and associate them with employee files in the enterprise user database, and summarize the data files transmitted by the subordinate computers within the data sharing platform; S213. Pre-analyze and set the level of the summary information through the audit points. The specific steps are as follows: Set a capacity threshold for the transfer data file capacity A of the computers under the audit point , , for classifying the transmission data files, the following steps are included: When A< , then the capacity level of the transferred data file is marked as small; when ≤A< , then the capacity level of the transferred data file is marked as normal; When A≥ , then the capacity level of the transferred data file is marked as large; At the same time, the data file type is identified by regular expression matching, including notification type and non-notification type: For notification data files, the internal administrator account of the audit point is used to quickly send unencrypted mass messages to subordinate computers; It should be noted that type identification is performed through regular expression matching, using multi-level regular expression matching rules, first performing a rough match and then a fine-grained match. The first-level match uses primary keywords for matching, including "notice" and "announcement". The second-level match uses secondary keywords for matching, including "date" and "unit". The file type is determined based on the multi-level matching results.

[0023] For non-notification data files, based on the confidentiality level of the data files, the internal administrator account of the review point manually sets the level, including public level, internal level, and confidential level, and the data files are labeled with the level.

[0024] It should be noted that by classifying the information based on the file size and type of the transmitted information, the information transmission method can be further refined. By adopting different transmission strategies for information of different levels, the information transmission efficiency can be improved, the work efficiency of the enterprise can be enhanced, and different encryption strategies can be adopted according to the different sensitivity levels, while taking into account the transmission efficiency and security of information. Public-level data means that the current data can be viewed by everyone, internal-level data means that it can be viewed by employees of relevant departments, and confidential-level data can be viewed by department managers or enterprise management personnel.

[0025] S22, based on the enterprise internal transmission data file information received by the data sharing platform, adopt different data file transmission methods and strategies; S221. Based on the size level of the transmitted data file, formulate a transmission strategy within the data sharing platform. The specific steps are as follows: For files with small file capacity, direct transmission within the network is adopted to directly transfer files; For files with normal file capacity, the file compression method is adopted to perform file compression transmission; For files with large file capacity, adopt the method of splitting file transmission, add transmission nodes in the current enterprise LAN, and transfer files through parallel transmission; S222. Based on the confidentiality level of the data files, different key encryption strategies are adopted for data files of different levels. The specific steps are as follows: For data files with a public level, the audit point is based on AES The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: , 1≤i ≤ n ; Decryption formula: , 1≤ i ≤ n ; in, Indicates the encrypted i characters, Indicates the decrypted i characters, represents the encryption function, represents the decryption function, n Represents the total number of characters; For internal-level data files, the audit point is based on RSA The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: ; in, Represents plain text information, Represents ciphertext information, e is the exponent in the public key, n is the modulus in the public key; Decryption formula: ; in, Represents plain text information, Represents ciphertext information, d is the exponent in the private key, n is the modulus in the private key; For confidential data files, AES Encryption algorithm and RSA Encryption algorithm performs mixed encryption of data files; It should be noted that AES It is a symmetric encryption algorithm with fast encryption and decryption speed, suitable for encryption and decryption of large amounts of data, and provides good security, but requires both parties to share the key, and is suitable for public-level information transmission. RSA It is an asymmetric encryption algorithm that can solve the problem of key exchange and ensure information security. It is suitable for internal-level information transmission. Hybrid encryption combines the advantages of symmetric encryption and asymmetric encryption and is suitable for confidential-level information transmission.

[0026] Embodiment 2: S3, based on the level of the data file, generate a disguised data file based on the characteristics of the original data file in the data sharing platform, and set a data file access display strategy in combination with the employee permissions and data access behavior in the enterprise user database; S31. Based on the data file level set at the audit point, a disguised data file is generated in the data sharing platform based on the original data file characteristics; S311, extracting the internal data of the internal and confidential data files, and dividing the data files into plain text type and text-digital type; S312, for the plain text data file, based on the storage size of the data file, select a data file from the public data file by simple non-repetitive random sampling, and copy and generate a disguised file of the current plain text data file; S313: For the text-to-digital data file, a correlation analysis is performed on the numbers in the text, and the specific steps are as follows: For two variables in the data file , calculate the correlation coefficient to measure the degree of association between variables, and the specific algorithm formula is: ; in, represents the Pearson correlation coefficient, is the number of data points, and The variables are and No. Observations, and The variables are and The mean of The value of is between -1 and 1. The closer the value is to 1, the stronger the positive correlation between the two variables is. The closer the value is to -1, the stronger the negative correlation between the two variables is. If the value of is equal to 0, it means that the two variables are not correlated at present; S314, combined variables , adjust the current data file and generate a disguised data file. The specific steps are: For positively correlated variables, , perform simple random sampling to extract the proportion of variables Perform synchronous zooming in or out and generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; It should be noted that The values ​​can be 0.2, 0.3, 0.5, 0.8, 1.4, 1.6, 1.8, 2.2, 2.5, and 3.1, and can also be increased or decreased according to actual conditions.

[0027] For negatively correlated variables, group the variables according to the proportion , , for variables Make adjustments to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; For irrelevant variables, Randomly zoom in or out to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file.

[0028] It should be noted that by performing correlation analysis on the digital variables in the data file, a disguised file can be generated according to digital logic to improve the disguise of the disguised file, thereby protecting the real data file during the transmission process. S32. Based on the employee rights and data access behaviors in the enterprise user database and in combination with the disguised data files, set the access display policy for the transmitted data files, including the enterprise internal data access policy and the access policy for the transmitted files; S321. For internal data of an enterprise, based on the employee permissions in the enterprise user database, when the current employee permissions are greater than the data permissions, the real data file content is displayed; when the current employee permissions are less than the data permissions, the disguised data file content is displayed; S322. For the transmission data file, the access computer is judged through the audit point. When the access computer decoding key and the login employee authority meet the requirements, the real transmission data file is displayed. When the computer decoding key and the login employee authority do not meet the requirements, the disguised data file is displayed. S323, extract the data access behavior in the employee file, when the data access behavior record contains a unit time Continuous When the data is accessed for the first time, the current employee file will be marked as abnormal. For the employee file marked as abnormal, a disguised file will be displayed when accessing internal enterprise data and receiving transmitted data files.

[0029] It should be noted that the data access behavior of employees is judged by comprehensively judging the employee files and computer permissions at the audit point, and the real data files are protected by displaying disguised files for accounts that do not meet the permissions and abnormal accounts, preventing unauthorized data access to enhance security. Usually set to 15 minutes, the number of times Set it to 10 times, and judge the file anomaly based on the timestamp of employee file data access. You can also adjust the unit time and number of times according to actual conditions.

[0030] S4. Regularly back up data files transmitted within the enterprise and attach timestamps.

[0031] A data security sharing system, comprising an information collection module, a data storage and transfer module, a disguised data generation module, and a data security sharing and access module; The information collection module collects information data of employees under the enterprise, establishes an enterprise user database through MySQL, and creates employee files in the enterprise user database, including name, department, position, length of service, computer IP address, grants employees level permissions through administrator accounts, and collects and records employees' data access behaviors; Data storage and transfer module, through Build a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions at the audit points, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; A disguised data generation module generates a disguised data file based on the level of the data file and the characteristics of the original data file in the data sharing platform; The data security sharing and access module combines the employee permissions and data access behaviors in the enterprise user database to set the enterprise internal data file access policy and enterprise transmission data file access policy, and reviews and judges the employee's access behavior. In summary, the present invention sets audit points and administrator accounts based on the number of devices under the enterprise, summarizes and disperses the approval of internal transmission data, speeds up the approval speed of data transmission, improves work efficiency, and classifies and sets levels based on the size and type of data files to manage data in a refined manner. By integrating the level of internal enterprise data, a disguised file is generated based on the content of the data file. When the data is accessed and transmitted, the disguised file is displayed for access that does not meet the security judgment, preventing unauthorized users from obtaining real data, effectively preventing data leakage, and enhancing security. By combining data levels, access rights and disguised files, multi-level data protection is provided to ensure the security of internal enterprise data and transmitted data during access and transmission. At the same time, abnormal continuous access behaviors are marked to reduce the risk of large-scale data leakage and enhance the security of enterprise data sharing.

[0032] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security sharing method, characterized in that: The method comprises the following steps: S1. Establish an enterprise user database through MySQL, collect information data of employees under the enterprise, establish employee files in the enterprise user database, and collect and record employees' data access behavior; S2. Establish a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; S3. Based on the level of the data file, a disguised data file is generated based on the characteristics of the original data file in the data sharing platform, and a data file access display strategy is set in combination with the employee permissions and data access behavior in the enterprise user database; S4. Regularly back up data files transmitted within the enterprise and attach timestamps.

2. A data security sharing method according to claim 1, characterized in that: The S2 comprises the following sub-steps: S21, through Build a data sharing platform to receive data files transmitted within the enterprise. Based on the scale of the enterprise's equipment, set audit points and match administrator accounts and permissions to set levels for internally transmitted data files. S22. Based on the internal data file transmission information received by the data sharing platform, different data file transmission methods and strategies are adopted.

3. A data security sharing method according to claim 2, characterized in that: The S21 comprises the following sub-steps: S211. According to the number of equipment under the enterprise ,set up Audit points, match the administrator account according to the number of audit points; S212. Bind 1-10 computer devices to each audit point and associate them with employee files in the enterprise user database, and summarize the data files transmitted by the subordinate computers within the data sharing platform; S213. Pre-analyze and set the level of the summary information through the audit points. The specific steps are as follows: Set a capacity threshold for the transfer data file capacity A of the computers under the audit point , , for classifying the transmission data files, the following steps are included: When A< , then the capacity level of the transferred data file is marked as small; when ≤A< , then the capacity level of the transferred data file is marked as normal; When A≥ , then the capacity level of the transferred data file is marked as large; At the same time, the data file type is identified by regular expression matching, including notification type and non-notification type: For notification data files, the internal administrator account of the audit point is used to quickly send unencrypted mass messages to subordinate computers; For non-notification data files, based on the confidentiality level of the data files, the internal administrator account of the review point manually sets the level, including public level, internal level, and confidential level, and the data files are labeled with the level.

4. A data security sharing method according to claim 3, characterized in that: The S22 comprises the following sub-steps: S221. Based on the size level of the transmitted data file, formulate a transmission strategy within the data sharing platform. The specific steps are as follows: For files with small file capacity, direct transmission within the network is adopted to directly transfer files; For files with normal file capacity, the file compression method is adopted to perform file compression transmission; For files with large file capacity, adopt the method of splitting file transmission, add transmission nodes in the current enterprise LAN, and transfer files through parallel transmission; S222. Based on the confidentiality level of the data files, different key encryption strategies are adopted for data files of different levels. The specific steps are as follows: For data files with a public level, the audit point is based on AES The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: , 1≤ i ≤ n ; Decryption formula: , 1≤ i ≤ n ; in, Indicates the encrypted i characters, Indicates the decrypted i characters, represents the encryption function, represents the decryption function, n Represents the total number of characters; For internal-level data files, the audit point is based on RSA The encryption algorithm is used to encrypt data files. The specific algorithm formula is: Encryption formula: ; in, Represents plain text information, Represents ciphertext information, e is the exponent in the public key, n is the modulus in the public key; Decryption formula: ; in, Represents plain text information, Represents ciphertext information, d is the exponent in the private key, n is the modulus in the private key; For confidential data files, AES Encryption algorithm and RSA Encryption algorithm performs mixed encryption of data files; S223. A decoding key is issued to the computer at the destination of the transmission data file through the audit point to decrypt the encryption key of the corresponding transmission data file.

5. A data security sharing method according to claim 1, characterized in that: The S3 comprises the following sub-steps: S31. Based on the data file level set at the audit point, a disguised data file is generated in the data sharing platform based on the original data file characteristics; S32. Based on the employee rights and data access behaviors in the enterprise user database and in combination with the disguised data files, an access display strategy for the transmitted data files is set, including the enterprise internal data access strategy and the transmission file access strategy.

6. A data security sharing method according to claim 5, characterized in that: The S31 includes the following sub-steps: S311, extracting the internal data of the internal and confidential data files, and dividing the data files into plain text type and text-digital type; S312, for the plain text data file, based on the storage size of the data file, select a data file from the public data file by simple non-repetitive random sampling, and copy and generate a disguised file of the current plain text data file; S313: For the text-to-digital data file, a correlation analysis is performed on the numbers in the text, and the specific steps are as follows: For two variables in the data file , calculate the correlation coefficient to measure the degree of association between variables, and the specific algorithm formula is: ； in, represents the Pearson correlation coefficient, is the number of data points, and The variables are and No. Observations, and The variables are and The mean of The value of is between -1 and 1. The closer the value is to 1, the stronger the positive correlation between the two variables is. The closer the value is to -1, the stronger the negative correlation between the two variables is. If the value of is equal to 0, it means that the two variables are not correlated at present; S314, combined variables , adjust the current data file and generate a disguised data file. The specific steps are: For positively correlated variables, , perform simple random sampling to extract the proportion of variables Perform synchronous zooming in or out and generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; For negatively correlated variables, group the variables according to the proportion , , for variables Make adjustments to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file; For irrelevant variables, Randomly zoom in or out to generate replacement variables , replace the variables in the original transfer data file , generate a disguised file.

7. A data security sharing method according to claim 6, characterized in that: The S32 includes the following sub-steps: S321. For internal data of an enterprise, based on the employee permissions in the enterprise user database, when the current employee permissions are greater than the data permissions, the real data file content is displayed; when the current employee permissions are less than the data permissions, the disguised data file content is displayed; S322. For the transmission data file, the access computer is judged through the audit point. When the access computer decoding key and the login employee authority meet the requirements, the real transmission data file is displayed. When the computer decoding key and the login employee authority do not meet the requirements, the disguised data file is displayed. S323, extract the data access behavior in the employee file, when the data access behavior record contains a unit time Continuous When the data is accessed for the first time, the current employee file will be marked as abnormal. For the employee file marked as abnormal, a disguised file will be displayed when accessing internal enterprise data and receiving transmitted data files.

8. A data security sharing method according to claim 1, characterized in that: The S1 comprises the following sub-steps: S11. Collect information data of employees under the enterprise and establish employee files, including name, department, position, length of service, computer IP address, grant employees level permissions through administrator accounts, and record them in relevant employee files; S12. Record every data access behavior of an employee in the employee file, including the type of data accessed, level, and access timestamp.

9. A data security sharing system, characterized in that: The method adopts the data security sharing method as described in any one of claims 1 to 8, including an information collection module, a data storage and transfer module, a disguised data generation module, and a data security sharing and access module; The information collection module collects information data of employees under the enterprise, establishes an enterprise user database through MySQL, and establishes employee files in the enterprise user database, including name, department, position, length of service, computer IP address, grants employees level permissions through administrator accounts, and collects and records employees' data access behaviors; The data storage and transfer module, through Build a data sharing platform to collect, encrypt and transmit internal enterprise data files, set audit points based on the scale of enterprise equipment, grant administrator account permissions at the audit points, summarize and approve internal transmission data files, and set levels and data transmission methods based on data type and size; The disguised data generation module generates a disguised data file based on the level of the data file and the characteristics of the original data file in the data sharing platform; The data security sharing and access module combines the employee permissions and data access behaviors in the enterprise user database to set the enterprise internal data file access policy and the enterprise transmission data file access policy, and reviews and determines the employee's access behavior.

Images