One-object-one-code multiple encryption method and system based on data security architecture

Abstract

The present invention discloses a one-object-one-code multiple encryption method and system based on a data security architecture, which relates to the field of one-object-one-code encryption methods. The present invention adopts a combination of symmetric encryption and asymmetric encryption for protection, and introduces chaos theory to enhance encryption strength. The system can monitor the sensitivity of commodity information and user access behavior in real time, and dynamically adjust the encryption level. Through the synergy of multiple permission control models, the access management efficiency is effectively improved and the risk of unauthorized access is significantly reduced.

Description

Technical Field

[0001] The present invention relates to the field of one-object-one-code encryption methods, and specifically to a one-object-one-code multiple encryption method and system based on a data security architecture. Background Art

[0002] In today's era of rapid development of information technology, data security issues are becoming more and more prominent, especially in the one-to-one-code system, where data security protection is particularly important. The one-to-one-code system assigns a unique identification code to each product or object, and uses technologies such as QR codes or RFID to achieve real-time tracking and management of information. The data information involved in the system includes product data information, marketing activity data information, channel data information, and user information, etc. The security of this data is directly related to the effective operation of the entire supply chain. Existing technologies mainly focus on data encryption, identity authentication, etc., and generally use a combination of symmetric encryption and asymmetric encryption to protect data transmission and storage. However, despite the encryption of data, there are still potential risks, especially when faced with complex user access requirements and dynamic environments, existing technologies often cannot provide effective solutions.

[0003] The data security protection of the existing one-item-one-code system mainly relies on static security measures, such as symmetric encryption algorithms (such as AES) and asymmetric encryption algorithms (such as RSA). These methods can protect data from unauthorized access to a certain extent, but they face many shortcomings. First, the existing technology often lacks a detailed division of data types in data management, and fails to take corresponding protection measures according to the sensitivity of different data. This leads to the mixed storage of high-sensitivity data and low-sensitivity data, increasing the risk of data leakage. Secondly, although the traditional permission control model provides basic access security protection, it is not flexible enough when processing dynamic access requests. Changes in user access behavior, geographic location, device information, etc. are not reflected in permission control in a timely manner, resulting in a lag in access rights. Finally, with the frequent occurrence of data leakage incidents, the existing static encryption scheme seems powerless in the face of increasingly complex attack methods, and a more flexible and intelligent protection mechanism is urgently needed. Summary of the invention

[0004] The present invention proposes a one-object-one-code multiple encryption method and system based on a data security architecture. The method improves the data security of the one-object-one-code system by combining multiple encryption with dynamic permission control.

[0005] Among them, the one-object-one-code multiple encryption method based on the data security architecture includes the following steps:

[0006] S1. Divide the data into independent modules according to different data types, use a symmetric encryption algorithm to initially encrypt each data module, and encrypt the symmetric encryption key using an asymmetric encryption algorithm;

[0007] S2. After symmetric encryption, random parameters in chaos theory are added to further encrypt the data according to the chaos encryption algorithm, and timestamps are used to add time stamps to each data module;

[0008] S3. Intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior;

[0009] S4. Jointly verify the access request to encrypted data through the attribute-based permission control model and the role-based permission control model, and dynamically evaluate the access rights through the attribute-based access control model combined with the user's environmental attributes to further perform permission control. Based on the dynamic permission evaluation results, the user is allowed or denied access to the decrypted data;

[0010] S5. Pack the encrypted data and generate a dynamic QR code including a timestamp and a digital signature, and embed the encrypted data module into the generated dynamic QR code.

[0011] Furthermore, in step S1, each data module is initially encrypted using a symmetric encryption algorithm, and the symmetric encryption key is encrypted using an asymmetric encryption algorithm. The specific process is expressed as follows:

[0012] ;

[0013] Among them, the Represents the final encryption result of combining data symmetric encryption and key asymmetric encryption. Represents the ciphertext after AES encryption, representing the symmetric encryption of the data module. Represents RSA encryption of a symmetric key, representing an asymmetric encryption process. Indicates a data module, the represents a symmetric key, the Indicates the recipient's RSA public key.

[0014] Furthermore, the ciphertext after AES encryption The encryption process is expressed as:

[0015] ;

[0016] Among them, the Indicates the ciphertext after AES encryption The encryption result, i.e. the initial ciphertext, is Represents a symmetric key The transpose of Represents a custom multidimensional nonlinear mapping.

[0017] Furthermore, the RSA encryption of the symmetric key The encryption process is specifically expressed as follows:

[0018] ;

[0019] Among them, the encryption process of RSA encryption performed by the symmetric key represents that Represents the public key exponent, Indicates the modulus.

[0020] Furthermore, the step S2 specifically includes the following sub-steps:

[0021] S201. Generating chaotic sequences using Lorentz systems;

[0022] S202. The generated chaotic sequence is combined with the initial ciphertext by an XOR operation to generate a new encryption result;

[0023] S203. Add a timestamp and bind it to the encrypted data module;

[0024] S204. Use the sender's private key to sign the timestamp and chaotically encrypted data module.

[0025] Furthermore, in step S202, the specific process of combining the generated chaotic sequence with the ciphertext through an XOR operation is represented as follows:

[0026] ;

[0027] Among them, the represents the ciphertext of the generated chaotic sequence combined with the initial ciphertext, Indicates the ciphertext after AES encryption The encryption result is Represents a pseudo-random number sequence generated by a chaotic system.

[0028] Furthermore, the step S3 specifically includes the following sub-steps:

[0029] S301 classifies the sensitivity of product information and assigns corresponding encryption policies based on the sensitivity level of product information, wherein the sensitivity levels include high, medium and low;

[0030] S302 real-time monitoring of user access information, the access information includes access frequency, location, device information and login time, through the multi-dimensional feature extraction of this information, calculate the user behavior feature value;

[0031] S303. Define the encryption level through the intelligent encryption algorithm trigger condition formula according to the sensitivity coefficient of the product information and the user behavior characteristic value.

[0032] Furthermore, in step S303, the triggering condition formula of the intelligent encryption algorithm is specifically expressed as:

[0033] ;

[0034] Among them, the Indicates the sensitivity of product information. represents the user behavior feature value, Indicates the set threshold value, the Indicates the encryption level.

[0035] Furthermore, in step S303, the encryption level is defined by the triggering condition formula of the intelligent encryption algorithm, specifically including:

[0036] When the calculation result is less than or equal to the set threshold, no further encryption requirement is triggered;

[0037] When the calculation result is greater than the set threshold, further encryption requirements are triggered, and an ECC or HMAC layer is added to the already encrypted data module.

[0038] Furthermore, the step S4 specifically includes the following sub-steps:

[0039] S401. For access requests, the system performs preliminary verification of the user through a role-based permission control model, where each user is associated with one or more roles, and the system determines the user's preliminary access rights based on the user's role;

[0040] S402. Verify the user's attributes through an attribute-based permission control model;

[0041] S403. Dynamically evaluate the user's environmental attributes, including time, geographic location and device type;

[0042] S404. Through the joint permission verification model, role permissions, attribute permissions and environmental attributes are comprehensively evaluated, and based on the dynamic permission evaluation results, the user's decryption access to the data is allowed or denied.

[0043] Furthermore, a one-object-one-code multiple encryption system based on a data security architecture is implemented based on any one of the one-object-one-code multiple encryption methods based on a data security architecture described above, including:

[0044] An initial encryption module is used to divide data into independent modules according to different types of data, perform initial encryption on each data module using a symmetric encryption algorithm, and encrypt the symmetric encryption key using an asymmetric encryption algorithm;

[0045] Chaos encryption module, which is used to add random parameters in chaos theory after symmetric encryption, further encrypt the data according to the chaos encryption algorithm, and use timestamp to add a time mark to each data module;

[0046] Hierarchical encryption module, which is used to intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior;

[0047] The access request decryption judgment module is used to jointly verify the access request to encrypted data through the attribute-based permission control model and the role-based permission control model, and dynamically evaluate the access rights through the attribute-based access control model combined with the user's environmental attributes to further perform permission control. According to the dynamic permission evaluation results, the user's decryption access to the data is allowed or denied;

[0048] The one-to-one code generation module is used to package the encrypted data and generate a dynamic QR code containing a timestamp and a digital signature, and embed the encrypted data module into the generated dynamic QR code.

[0049] The beneficial effects of the invention are:

[0050] The present invention adopts a combination of symmetric encryption and asymmetric encryption for protection, and introduces chaos theory to enhance encryption strength. The system can monitor the sensitivity of commodity information and user access behavior in real time and dynamically adjust the encryption level. Through the synergy of multiple permission control models, the access management efficiency is effectively improved and the risk of unauthorized access is significantly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A method flow chart of a one-object-one-code multiple encryption method based on a data security architecture provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings, but the protection scope of the present invention is not limited to the following.

[0053] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0054] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention. It should be noted that relational terms such as the terms "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0055] Moreover, the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a list of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus. In the absence of more restrictions, an element defined by the phrase "comprises a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0056] The features and performance of the present invention are further described in detail below in conjunction with the embodiments.

[0057] Among them, Figure 1 , a one-object-one-code multiple encryption method based on data security architecture, including the following steps:

[0058] S1. According to the different types of data, the data is divided into independent modules, each data module is initially encrypted using a symmetric encryption algorithm, and the symmetric encryption key is encrypted using an asymmetric encryption algorithm; specifically, according to the different types of data, the data is divided into independent modules for more flexible and efficient encryption. Each data module is initially encrypted using a symmetric encryption algorithm (such as AES), and the symmetric key is encrypted using an asymmetric encryption algorithm (such as RSA) to ensure the secure storage and transmission of the key. In this way, the initial protection of data can be achieved, data security can be enhanced, and the key can be ensured not to be leaked.

[0059] S2. After symmetric encryption, random parameters in chaos theory are added, and the data is further encrypted according to the chaotic encryption algorithm, and a timestamp is used to add a time mark to each data module; specifically, after symmetric encryption, chaos theory is introduced and the chaotic sequence generated by the Lorenz system is used to improve the complexity and security of the data. The generated chaotic sequence is XORed with the initial ciphertext to obtain a new encryption result. Subsequently, a timestamp is added to each data module to ensure the timeliness of the data. Finally, the sender's private key is used to sign the chaotic encrypted data module and timestamp to ensure the integrity of the data. This can enhance the encryption strength, ensure the security and integrity of the data during transmission, and effectively prevent data forgery and replay attacks.

[0060] S3. Intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior; specifically, dynamically adjust the encryption level by evaluating the sensitivity of product information and user access behavior to achieve intelligent data protection. Product information is classified into high, medium, and low levels according to sensitivity. Collect user access behavior data in real time, analyze access frequency, location and other information, and calculate user behavior feature values. Based on the sensitivity coefficient of the product and the user behavior feature value, define the encryption level through the intelligent encryption algorithm trigger condition formula, thereby achieving intelligent protection of different data types, making data security measures more targeted and flexible.

[0061] S4. For access requests to encrypted data, the system uses the attribute-based permission control model and the role-based permission control model to jointly verify the access rights, and uses the attribute-based access control model to dynamically evaluate the access rights in combination with the user's environmental attributes, and further performs permission control. According to the dynamic permission evaluation results, the system allows or denies the user's decrypted access to the data. Specifically, by combining multiple permission control models, the system performs comprehensive identity authentication and permission evaluation on the user to ensure that only authorized users can access specific data. For access requests, the system uses the role-based access control model to perform preliminary verification of the user and determine the preliminary access rights. Subsequently, the user attributes are verified through the attribute-based permission control model, and dynamically evaluated in combination with the user's environmental attributes (such as time, geographic location, and device type). Finally, through the joint verification model, the role permissions, attribute permissions, and environmental attributes are comprehensively evaluated, thereby improving the security of access control, ensuring that only qualified users can access sensitive data, and effectively reducing the risk of data leakage.

[0062] S5. Pack the encrypted data, generate a dynamic QR code containing a timestamp and a digital signature, and embed the encrypted data module into the generated dynamic QR code; specifically, generate a dynamic QR code by combining the encrypted data with the timestamp and the digital signature to facilitate secure data transmission and verification. Pack all encrypted data modules and prepare to generate a QR code. Then create a dynamic QR code, embed the encrypted data module, and attach a timestamp and a digital signature. The QR code can be published through various channels, and users can obtain the corresponding security data after scanning. In this way, a safe and convenient data transmission method is provided, which effectively prevents the forgery and reuse of the QR code and ensures the security of the data during circulation.

[0063] Among them, the above embodiment is used for data security protection in the one-object-one-code system, especially through multiple encryption mechanisms and data security architecture, to ensure the security of one-object-one-code and code package data information, commodity data information, marketing activity data information, manufacturer data information, channel data information and user information data. Further, the above embodiment adopts a modular design scheme, and each system function is divided into independent modules to ensure high cohesion and low coupling, and improve the maintainability and reusability of functional modules; the system design follows the single responsibility principle (SRP) and the open-closed principle (OCP) to improve the maintainability and incremental development capabilities of functional modules. For data transmission and encryption mechanisms, the system adopts a multi-layer encryption mechanism, using AES, RSA and other encryption algorithms to ensure the security of each data transmission and storage, and combines hybrid encryption and chaos theory encryption modes to enhance data security and reliability. In addition, through the system's built-in dynamic generation algorithm, combined with timestamp and digital signature technology, a unique dynamic QR code that can be used for product one-object-one-code management is generated.

[0064] Furthermore, this implementation introduces multiple permission models such as RBAC (role-based access control model), ABAC (attribute-based access control model), ACL (access control list model), PBAC (policy-based access control model), etc., to achieve independent identity and permission management services, centrally handle authentication and authorization, and ensure security and consistency; at the same time, use the policy engine to define and manage access control policies, dynamically adjust access rights according to different roles and attributes; optimize content distribution through the content distribution network (CDN), and provide personalized content display according to geographic location and role. The system uses OAuth 2.0 and OpenID Connect for secure authentication, and uses JWT technology to securely transmit data information between services. The core permission management service integrates multiple access control models such as RBAC, ABAC, ACL and PBAC. The policy engine dynamically evaluates and executes access control policies to ensure the consistency and security of permissions for different roles.

[0065] It should be noted that the dynamic QR code can be replaced according to actual needs, and its form includes but is not limited to QR code, barcode, digital ID, etc.

[0066] Furthermore, in step S1, each data module is initially encrypted using a symmetric encryption algorithm, and the symmetric encryption key is encrypted using an asymmetric encryption algorithm. The specific process is expressed as follows:

[0067] ;

[0068] Among them, the Represents the final encryption result of combining data symmetric encryption and key asymmetric encryption. Represents the ciphertext after AES encryption, representing the symmetric encryption of the data module. Represents RSA encryption of a symmetric key, representing an asymmetric encryption process. Indicates a data module, the represents a symmetric key, the Indicates the recipient's RSA public key.

[0069] Furthermore, the ciphertext after AES encryption The encryption process is expressed as:

[0070] ;

[0071] Among them, the Indicates the ciphertext after AES encryption The encryption result, i.e. the initial ciphertext, is Represents a symmetric key The transpose of Represents a custom multidimensional nonlinear mapping.

[0072] Furthermore, the RSA encryption of the symmetric key The encryption process is specifically expressed as follows:

[0073] ;

[0074] Among them, the encryption process of RSA encryption performed by the symmetric key represents that Represents the public key exponent, Indicates the modulus.

[0075] Furthermore, the step S2 specifically includes the following sub-steps:

[0076] S201. Generate a chaotic sequence using the Lorenz system; specifically, use the dynamic characteristics of the Lorenz system to generate a high-dimensional chaotic sequence. The Lorenz system generates complex dynamic behaviors through nonlinear differential equations, ensuring that the generated sequence has a high degree of uncertainty and unpredictability, providing a random basis for subsequent encryption.

[0077] S202. The generated chaotic sequence is combined with the initial ciphertext through an XOR operation to generate a new encryption result; specifically, the generated chaotic sequence is XORed with the initial symmetric encryption ciphertext. This step further enhances the encryption strength by introducing the randomness of the chaotic sequence into the ciphertext, making it difficult for an attacker to effectively crack the ciphertext with known ciphertext information.

[0078] S203. Add a timestamp and bind it to the encrypted data module; specifically, add a timestamp to each encrypted data module. This timestamp not only marks the time when the data was generated, but also plays an important role in subsequent verification to ensure the timeliness and uniqueness of the data, thereby preventing replay attacks.

[0079] S204. Use the sender's private key to sign the timestamp and the chaotically encrypted data module; specifically, use the sender's private key to digitally sign the timestamp and the chaotically encrypted data module. This step ensures the integrity and authenticity of the data, allowing the receiver to verify whether the data has been tampered with or forged during transmission, thereby further ensuring the security of the data.

[0080] Furthermore, in step S202, the specific process of combining the generated chaotic sequence with the ciphertext through an XOR operation is represented as follows:

[0081] ;

[0082] Among them, the represents the ciphertext of the generated chaotic sequence combined with the initial ciphertext, Indicates the ciphertext after AES encryption The encryption result is Represents a pseudo-random number sequence generated by a chaotic system.

[0083] Specifically, this embodiment adopts the encryption standard of multi-layer encryption mechanism, uses multiple encryption algorithms such as AES, RSA, ECC, and integrates hybrid encryption and chaos theory encryption modes to ensure the security of each data transmission and storage. As a preferred method, the Reed-Solomon error correction algorithm can also be combined to ensure reliable reading even in the case of partial damage, thereby ensuring the integrity and accuracy of the data. The system's built-in dynamic generation algorithm can create a unique QR code, and with the timestamp and digital signature technology, it can effectively prevent the forgery and reuse of the QR code.

[0084] Furthermore, the step S3 specifically includes the following sub-steps:

[0085] S301. Classify the sensitivity of the product information and assign corresponding encryption strategies based on the sensitivity level of the product information, where the sensitivity levels include high, medium and low; specifically, the product information and relevant standards are classified into three sensitivity levels: high, medium and low. This classification process ensures that the system can identify which data requires a higher level of protection so that corresponding encryption strategies can be applied to data of different levels.

[0086] S302. Monitor the user's access information in real time, including access frequency, location, device information and login time, and calculate the user behavior feature value by extracting multi-dimensional features from this information; specifically, the system monitors the user's access behavior in real time, collects and analyzes data such as access frequency, geographic location, device information and login time. By extracting multi-dimensional features from this information, the system can form the user's behavior feature value, which provides a basis for subsequent dynamic encryption decisions.

[0087] S303. Define the encryption level through the intelligent encryption algorithm trigger condition formula according to the sensitivity coefficient of the product information and the user behavior characteristic value; specifically, combine the sensitivity coefficient of the product information and the user's behavior characteristic value, and apply the intelligent encryption algorithm trigger condition formula to determine the encryption level. Through this process, the system can intelligently adjust the encryption strategy to ensure the security of sensitive data in different scenarios.

[0088] Furthermore, in step S303, the triggering condition formula of the intelligent encryption algorithm is specifically expressed as:

[0089] ;

[0090] Among them, the Indicates the sensitivity of product information. represents the user behavior feature value, Indicates the set threshold value, the Represents the encryption level. Specifically, user behavior characteristics are used in dynamic encryption strategies to identify security risks posed by users accessing data, thereby implementing more context-sensitive encryption strategies. Exemplarily, setting user behavior characteristics includes: access time: such as data requests made at unconventional times (late at night or non-working hours); access location: based on geographic location, detecting whether the access comes from a trusted location (such as a company's internal network) or an unknown or high-risk location; device type: detecting whether the device is a commonly used or trusted device (such as a work computer) or an unfamiliar device; access frequency: high-frequency or unusual access requests may represent a risk of data abuse, especially repeated reading of sensitive data; device security level: determine whether the device has the latest security updates, anti-virus software and other security protections. As another example, for very sensitive data information (such as confidential files), if high-risk user behavior characteristics are detected (such as sharing a public network, unauthorized device login), the system can give priority to adding a high-intensity encryption algorithm level.

[0091] Furthermore, in step S303, the encryption level is defined by the triggering condition formula of the intelligent encryption algorithm, specifically including:

[0092] When the calculation result is less than or equal to the set threshold, no further encryption requirement is triggered;

[0093] When the calculation result is greater than the set threshold, further encryption requirements are triggered, and an ECC or HMAC layer is added to the already encrypted data module.

[0094] Furthermore, the step S4 specifically includes the following sub-steps:

[0095] S401. For access requests, the system performs preliminary verification of users through a role-based permission control model, where each user is associated with one or more roles, and the system determines their preliminary access rights based on their roles; specifically, for access requests, the system uses a role-based access control (RBAC) model to perform preliminary verification of users. Each user is assigned one or more roles, and their access rights are preliminarily determined based on the roles, thereby filtering out requests that do not have basic access rights.

[0096] S402. Verify the user's attributes through the attribute-based permission control model; specifically, the system uses the attribute-based access control (ABAC) model to further verify the user's attributes, including the user's identity information, role information, etc., to ensure that only qualified users can enter the next step of verification.

[0097] S403. Dynamically evaluate the user's environment attributes, including time, geographic location, and device type. Specifically, the system dynamically evaluates the user's environment attributes (such as access time, geographic location, and device type). This step ensures that the user's access rights can be flexibly adjusted in different environments, thereby improving security.

[0098] S404. Through the joint permission verification model, the role permissions, attribute permissions and environmental attributes are comprehensively evaluated, and the user's decrypted access to data is allowed or denied based on the dynamic permission evaluation results; specifically, through the joint permission verification model, the user's role permissions, attribute permissions and environmental attributes are comprehensively evaluated. Based on the comprehensive evaluation results, the system decides whether to allow the user to decrypt the data, thereby achieving comprehensive access control and reducing the risk of data leakage.

[0099] Furthermore, the specific process formula of steps S401-S404 is expressed as follows:

[0100] The system performs preliminary authentication on users through a role-based permission control model. Each user is associated with one or more roles, and the system determines the user's preliminary access rights based on the user's role:

[0101] ;

[0102] Among them, the Indicates user The access rights described Indicates the user's role. Represents the mapping function from role to permission; for user , when its role Have access rights If the system passes the preliminary verification,

[0103] The system verifies the user's attributes and uses the attribute-based permission control model (ABAC) to ensure that the user not only has role permissions but also has the appropriate attributes to access data:

[0104] ;

[0105] Among them, the Represents a set of user attributes, Represents a mapping function from attributes to permissions, Indicates user-based Access rights to the attributes of the user; based on the user's attributes , the system determines whether the user meets the requirements for accessing the encrypted data;

[0106] The system dynamically evaluates the user's environmental attributes. Environmental attributes can include external factors such as time, geographic location, and device type. Dynamic evaluation based on environmental attributes allows the system to make more appropriate permission decisions in different scenarios:

[0107] ;

[0108] Among them, the Represents a collection of environment attributes, Represents a function from environment attributes to permission evaluation, Indicates combined user Environmental properties Access rights; when the environmental attribute requirements are met, the system grants the user the final access rights;

[0109] Through the joint permission verification model, role permissions, attribute permissions and environmental attributes are comprehensively evaluated to ensure that the final permission determination is based on multiple conditions. The specific joint verification rules are expressed by the following formula:

[0110] ;

[0111] Among them, the Indicates user The final permission determination is that only when the role, attribute, and environment permissions meet the conditions, can the user pass the verification and obtain access rights to the encrypted data.

[0112] Furthermore, the authority evaluation process of the above embodiment is as follows:

[0113] The user initiates a request to access encrypted data and provides identity information, role information, attribute information, and environment information;

[0114] The system performs preliminary permission verification based on the user's role information and determines whether it is true;

[0115] The system further verifies the user's attribute information ,judge whether it is true;

[0116] The system provides user's environmental information Conduct dynamic assessment and judgement whether it is true;

[0117] Through joint permission verification, the role, attribute and environment assessment results are comprehensively considered to determine whether the user has access rights. , the user is allowed to decrypt and access the encrypted data; otherwise, access is denied.

[0118] Furthermore, as a preferred implementation of the above embodiment, a one-object-one-code multiple encryption system based on a data security architecture is proposed, including:

[0119] An initial encryption module is used to divide data into independent modules according to different types of data, perform initial encryption on each data module using a symmetric encryption algorithm, and encrypt the symmetric encryption key using an asymmetric encryption algorithm;

[0120] Chaos encryption module, which is used to add random parameters in chaos theory after symmetric encryption, further encrypt the data according to the chaos encryption algorithm, and use timestamp to add a time mark to each data module;

[0121] Hierarchical encryption module, which is used to intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior;

[0122] The access request decryption judgment module is used to jointly verify the access request to encrypted data through the attribute-based permission control model and the role-based permission control model, and dynamically evaluate the access rights through the attribute-based access control model combined with the user's environmental attributes to further perform permission control. According to the dynamic permission evaluation results, the user's decryption access to the data is allowed or denied;

[0123] The one-to-one code generation module is used to package the encrypted data and generate a dynamic QR code containing a timestamp and a digital signature, and embed the encrypted data module into the generated dynamic QR code.

[0124] The chaotic encryption module specifically includes:

[0125] A chaotic sequence generating unit, used for generating a chaotic sequence using a Lorentz system;

[0126] The ciphertext chaotic encryption unit is used to combine the generated chaotic sequence with the initial ciphertext through an XOR operation to generate a new encryption result;

[0127] A timestamp unit, used to add a timestamp and bind it to the encrypted data module;

[0128] The digital signature unit is used to sign the timestamp and chaotically encrypted data module using the sender's private key.

[0129] The hierarchical encryption module specifically:

[0130] A commodity information sensitivity classification unit, used to classify the commodity information and assign corresponding encryption strategies based on the sensitivity level of the commodity information, wherein the sensitivity levels include high, medium and low;

[0131] An access information characteristic value calculation unit is used to monitor the user's access information in real time, wherein the access information includes access frequency, location, device information and login time, and calculate the user behavior characteristic value by extracting multi-dimensional features from the information;

[0132] The intelligent encryption algorithm trigger unit is used to define the encryption level through the intelligent encryption algorithm trigger condition formula according to the sensitivity coefficient of the commodity information and the user behavior characteristic value.

[0133] The access request decryption judgment module specifically includes:

[0134] RBAC access determination unit, used for preliminary verification of users through the role-based permission control model for access requests, where each user is associated with one or more roles, and the system determines the user's preliminary access rights based on the user's role;

[0135] ABAC access determination unit, used to verify the user's attributes through the attribute-based permission control model;

[0136] An environmental attribute judgment unit, used to perform dynamic evaluation based on the user's environmental attributes, wherein the environmental attributes include time, geographic location, and device type;

[0137] The joint verification unit is used to comprehensively evaluate role permissions, attribute permissions and environmental attributes through a joint permission verification model.

[0138] Furthermore, as a preferred implementation scheme of this embodiment, the above system provides three modes: open API interface, integration mode, and data import, to achieve seamless data exchange with third-party platforms and instant synchronization and update of data; during the data integration process, the system uses efficient data mapping and conversion tools to intelligently convert third-party data into a format that can be recognized and processed by the system, ensuring data consistency and accuracy; using the OAuth 2.0 authorization mechanism, the system ensures the security of third-party platform access to prevent unauthorized access and data leakage; using the SSL / TLS protocol to ensure the secure encryption of the data transmission process between the third-party platform and resist potential network attacks and data interception risks; in addition, through the error handling mechanism and logging system, it can monitor and record any anomalies in the data docking process in real time to ensure timely detection and response to security threats.

[0139] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. One-object-one-code multiple encryption method based on data security architecture, characterized in that: The following steps are involved: S1. Divide the data into independent modules according to different data types, use a symmetric encryption algorithm to initially encrypt each data module, and encrypt the symmetric encryption key using an asymmetric encryption algorithm; S2. After symmetric encryption, random parameters in chaos theory are added to further encrypt the data according to the chaos encryption algorithm, and timestamps are used to add time stamps to each data module; S3. Intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior; S4. Jointly verify the access request to encrypted data through the attribute-based permission control model and the role-based permission control model, and dynamically evaluate the access rights through the attribute-based access control model combined with the user's environmental attributes to further perform permission control. Based on the dynamic permission evaluation results, the user is allowed or denied access to the decrypted data; S5. Pack the encrypted data and generate a dynamic QR code containing a timestamp and digital signature, and embed the encrypted data module into the generated dynamic QR code; Wherein, the step S2 specifically includes the following sub-steps: S201. Generating chaotic sequences using Lorentz systems; S202. The generated chaotic sequence is combined with the initial ciphertext by an XOR operation to generate a new encryption result; S203. Add a timestamp and bind it to the encrypted data module; S204. Use the sender's private key to sign the timestamp and chaotic encrypted data module; In step S202, the specific process of combining the generated chaotic sequence with the ciphertext through an XOR operation is represented as follows: ； Among them, the represents the ciphertext of the generated chaotic sequence combined with the initial ciphertext, Indicates the ciphertext after AES encryption The encryption result is Represents a pseudo-random number sequence generated by a chaotic system.

2. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 1, characterized in that: In step S1, each data module is initially encrypted using a symmetric encryption algorithm, and the symmetric encryption key is encrypted using an asymmetric encryption algorithm. The specific process is as follows: ； Among them, the Represents the final encryption result of combining data symmetric encryption and key asymmetric encryption. Represents the ciphertext after AES encryption, representing the symmetric encryption of the data module. Represents RSA encryption of a symmetric key, representing an asymmetric encryption process. Indicates a data module, the represents a symmetric key, Indicates the recipient's RSA public key.

3. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 2, characterized in that: The ciphertext after AES encryption The encryption process is expressed as: ； Among them, the Indicates the ciphertext after AES encryption The encryption result, i.e. the initial ciphertext, is Represents a symmetric key The transpose of Represents a custom multidimensional nonlinear mapping.

4. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 2, characterized in that: The RSA encryption of the symmetric key The encryption process is specifically expressed as follows: ； Among them, the encryption process of RSA encryption performed by the symmetric key represents that Represents the public key exponent, Indicates the modulus.

5. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 1, characterized in that: The step S3 specifically includes the following sub-steps: S301. Classify the sensitivity of the product information and assign corresponding encryption strategies based on the sensitivity level of the product information, where the sensitivity levels include high, medium and low; S302 real-time monitoring of user access information, the access information includes access frequency, location, device information and login time, through the multi-dimensional feature extraction of this information, calculate the user behavior feature value; S303. Define the encryption level through the intelligent encryption algorithm trigger condition formula according to the sensitivity coefficient of the product information and the user behavior characteristic value.

6. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 5, characterized in that: In step S303, the triggering condition formula of the intelligent encryption algorithm is specifically expressed as: ； Among them, the Indicates the sensitivity of product information. represents the user behavior feature value, Indicates the set threshold value, the Indicates the encryption level.

7. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 6, characterized in that: In step S303, the encryption level is defined by the triggering condition formula of the intelligent encryption algorithm, specifically including: When the calculation result is less than or equal to the set threshold, no further encryption requirement is triggered; When the calculated result is greater than the set threshold, further encryption requirements are triggered, and an ECC or HMAC layer is added to the encrypted data module.

8. The one-object-one-code multiple encryption method based on data security architecture as claimed in claim 1, characterized in that: The step S4 specifically includes the following sub-steps: S401. For access requests, the system performs preliminary verification of the user through a role-based permission control model, where each user is associated with one or more roles, and the system determines the user's preliminary access rights based on the user's role; S402. Verify the user's attributes through an attribute-based permission control model; S403. Dynamically evaluate the user's environmental attributes, including time, geographic location and device type; S404. Through the joint permission verification model, role permissions, attribute permissions and environmental attributes are comprehensively evaluated, and based on the dynamic permission evaluation results, the user's decryption access to the data is allowed or denied.

9. A one-object-one-code multiple encryption system based on a data security architecture, the system being implemented based on the one-object-one-code multiple encryption method based on a data security architecture as claimed in any one of claims 1 to 8, characterized in that: include: An initial encryption module is used to divide data into independent modules according to different types of data, perform initial encryption on each data module using a symmetric encryption algorithm, and encrypt the symmetric encryption key using an asymmetric encryption algorithm; Chaos encryption module, which is used to add random parameters in chaos theory after symmetric encryption, further encrypt the data according to the chaos encryption algorithm, and use timestamp to add a time mark to each data module; Hierarchical encryption module, which is used to intelligently determine the level of encryption algorithm based on the sensitivity of product information and user access behavior; The access request decryption judgment module is used to jointly verify the access request to encrypted data through the attribute-based permission control model and the role-based permission control model, and dynamically evaluate the access rights through the attribute-based access control model combined with the user's environmental attributes to further perform permission control. According to the dynamic permission evaluation results, the user's decryption access to the data is allowed or denied; The one-to-one code generation module is used to package the encrypted data and generate a dynamic QR code containing a timestamp and a digital signature, and embed the encrypted data module into the generated dynamic QR code.

Images