Sensitive data protection method and device

Abstract

The embodiment of the invention provides a sensitive data protection method and device, and the method comprises the steps: obtaining historical sensitive data, and determining a corresponding encryption strategy model, the historical sensitive data comprising a sensitive data access log and a user behavior mode; receiving sensitive data sent by the user side, determining a corresponding encryption strategy according to the sensitive data and the encryption strategy model, determining corresponding sensitive encrypted data according to the encryption strategy, and sending the sensitive encrypted data to the user side, so that the sensitive encrypted data is sent to the user side after the user side receives the sensitive encrypted data. And carrying out replacement operation on the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user side, carrying out data decryption operation on the sensitive encrypted data according to the data key of the encryption platform, and carrying out sensitive data access on the user side. And cloud loading and decryption are carried out, so that the protection efficiency and security of the sensitive data are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and specifically to a sensitive data protection method and device. Background Art

[0002] With the rapid development of information technology, data security has become one of the major challenges faced by enterprises and individuals. Once sensitive data, such as keys, certificates, configuration files, etc. (generally less than 4KB), are leaked or illegally accessed, it will cause serious losses to individuals and enterprises. Therefore, how to effectively protect the security of sensitive data and prevent data leakage and illegal access has become a research hotspot in the current information security field.

[0003] Traditional data encryption methods mainly rely on encryption algorithms and key management strategies. Although they can ensure data security to a certain extent, their limitations are gradually becoming apparent in the face of increasingly complex network environments and evolving attack methods. In particular, with the rise of cloud computing technology, cloud service providers help enterprises achieve centralized storage and efficient processing of data by providing powerful computing power and abundant storage resources. However, data security issues in cloud environments also arise. How to ensure that sensitive data is not illegally accessed and tampered with when used in the cloud has become a key issue that needs to be urgently addressed in the field of cloud computing.

[0004] In order to solve the above problems, this solution proposes a sensitive data protection method, which improves the protection efficiency of sensitive data by dynamically encrypting it locally, loading and decrypting it in the cloud, and not saving the decrypted data in the cloud. Summary of the invention

[0005] In response to the problems in the prior art, the present application provides a sensitive data protection method and device, which is based on local dynamic encryption and cloud loading and decryption to improve the protection efficiency and security of sensitive data.

[0006] In order to solve at least one of the above problems, the present application provides the following technical solutions: In a first aspect, the present application provides a sensitive data protection method, comprising: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine the corresponding behavior time series model and the behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine the corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Receive sensitive data sent by a user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, the original sensitive data is replaced according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it performs a data decryption operation on the sensitive encrypted data according to the encryption strategy, so as to access the sensitive data of the user terminal.

[0007] Furthermore, a labeling operation is performed on the historical sensitive data according to the set data access rule to determine the corresponding labeling label, including: Perform a labeling operation on the historical sensitive data according to a preset access frequency threshold rule to determine a corresponding access frequency labeling label; Perform a labeling operation on the historical sensitive data according to a preset user behavior consistency rule to determine a corresponding user behavior labeling label; Perform a labeling operation on the historical sensitive data according to the access mode rules of the preset time period, and determine the corresponding time period labeling label; According to the access frequency labeling label, the user behavior labeling label and the time period labeling label, a corresponding labeling label is determined, wherein the labeling label includes a normal access label and an abnormal access label.

[0008] Furthermore, the step of inputting the historical sensitive data with the annotated labels into a first initial model for model training to determine a corresponding behavior time series model and behavior time series features output by the behavior time series model includes: Inputting the historical sensitive data with the annotated labels into a time series model for model training to determine a corresponding loss function; The corresponding behavior timing model and the behavior timing features output by the behavior timing model are determined according to the minimum loss function, wherein the behavior timing model is used to analyze the user behavior pattern.

[0009] Furthermore, the step of inputting the historical sensitive data with the annotated labels into a time series model for model training and determining a corresponding loss function includes: Inputting the historical sensitive data with the annotated labels into the input layer of a time series model to determine corresponding time step features, and inputting the time step features into the output layer of the time series model to determine corresponding prediction features; The corresponding loss function is determined according to the predicted features and the real features in the preset validation set.

[0010] Furthermore, the step of inputting the time step feature into the output layer of the time series model to determine the corresponding prediction feature includes: Inputting the time step feature into the update gate of the time series model to determine the corresponding update time step feature, inputting the update time step feature into the reset gate of the time series model to determine the corresponding reset time step feature; The reset time step features are input into the output layer of the time series model to determine corresponding prediction features.

[0011] Furthermore, the behavior time series characteristics, preset historical encryption strength data, and preset user attribute data are input into a second initial model for model training to determine a corresponding encryption strategy model, including: Performing an average operation on the behavior time series features to determine corresponding fixed-length time series features; The fixed-length time series features, preset historical encryption strength data, and preset user attribute data are input into the random forest for model training to determine the corresponding encryption policy model, wherein the encryption policy model is used to select the encryption policy strength.

[0012] Further, determining the corresponding sensitive encrypted data according to the encryption policy includes: According to the encryption strategy, determine the corresponding data key; A data encryption operation is performed on the sensitive data according to the data key to determine corresponding sensitive encrypted data.

[0013] In a second aspect, the present application provides a sensitive data protection device, comprising: The encryption policy model determination module is used to obtain historical sensitive data, perform labeling operations on the historical sensitive data according to the set data access rules, determine the corresponding labeling labels, input the historical sensitive data with the labeling labels into the first initial model for model training, determine the corresponding behavior time series model and the behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data and preset user attribute data into the second initial model for model training, and determine the corresponding encryption policy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; The sensitive data encryption and decryption module is used to receive sensitive data sent by the user terminal, determine the corresponding encryption strategy according to the sensitive data and the encryption strategy model, determine the corresponding sensitive encrypted data according to the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the encryption strategy to access the sensitive data of the user terminal.

[0014] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the sensitive data protection method when executing the program.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the sensitive data protection method when executed by a processor.

[0016] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which implements the steps of the sensitive data protection method when executed by a processor.

[0017] It can be seen from the above technical scheme that the present application provides a sensitive data protection method and device, which obtains historical sensitive data and determines the corresponding encryption policy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receives sensitive data sent by the user end, determines the corresponding encryption policy according to the sensitive data and the encryption policy model, determines the corresponding sensitive encrypted data according to the encryption policy, and sends the sensitive encrypted data to the user end, so that after the user end receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user end, it decrypts the sensitive encrypted data according to the data key of the encryption platform, and accesses the sensitive data of the user end, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is one of the flowcharts of the sensitive data protection method in the embodiment of the present application; Figure 2 This is a second flow chart of the sensitive data protection method in the embodiment of the present application; Figure 3 The third flowchart of the sensitive data protection method in the embodiment of the present application; Figure 4 This is a fourth flowchart of the sensitive data protection method in an embodiment of the present application; Figure 5 This is a fifth flowchart of the sensitive data protection method in the embodiment of the present application; Figure 6 This is the sixth flow chart of the sensitive data protection method in the embodiment of the present application; Figure 7 FIG7 is a flowchart of a sensitive data protection method in an embodiment of the present application; Figure 8 is a structural diagram of a sensitive data protection device in an embodiment of the present application; Fig. 9 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0020] Reference numerals: Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0022] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0023] Considering the problem that traditional data encryption methods are not very secure and inefficient in cloud environments. The present application provides a sensitive data protection method and device, which obtains historical sensitive data and determines a corresponding encryption policy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receives sensitive data sent by a user terminal, determines a corresponding encryption policy based on the sensitive data and the encryption policy model, determines corresponding sensitive encrypted data based on the encryption policy, and sends the sensitive encrypted data to the user terminal, so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data based on the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data based on the data key of the encryption platform, and accesses the sensitive data of the user terminal, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption.

[0024] In order to improve the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption, the present application provides an embodiment of a sensitive data protection method, see Figure 1 , the sensitive data protection method specifically includes the following contents: Step S101: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine a corresponding behavior time series model and behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine a corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Optionally, in this embodiment, the purpose of this step is to train an intelligent model that selects a suitable encryption strategy based on user behavior patterns to improve encryption efficiency and increase cracking difficulty.

[0025] Optionally, in this embodiment, the technical means of this step is to first train a user behavior time series model, and then integrate the model with a neural network model, so that the encryption strategy model finally obtained can predict the most appropriate encryption strategy based on user behavior.

[0026] Optionally, before training the behavior time series model, the data needs to be cleaned and normalized and labeled according to set rules so that the behavior time series model can learn the relationship between the data set and the label.

[0027] Optionally, historical sensitive data includes sensitive data access logs and user behavior patterns. Specifically, access logs include collecting access records of all sensitive data, including access time, access users, access operations (such as reading, modifying, deleting), access results, etc. User behavior patterns include collecting historical user behavior data, such as login time, operating habits, device information, etc., to assist in analyzing user behavior patterns.

[0028] Optionally, in this embodiment, historical sensitive data is obtained, and a labeling operation is performed on the historical sensitive data according to set data access rules to determine a corresponding labeling label.

[0029] Specifically, by analyzing the normal and abnormal behavior patterns in historical sensitive data, corresponding rules are formulated, and then these rules are applied to new data instances to determine whether they are abnormal.

[0030] First, labeling is performed based on the access frequency threshold rule; Rule description: If a user's access times to a sensitive data set in the past 24 hours exceeds three times the average number of access times, the user's access behavior is considered abnormal.

[0031] Label marking: For access events that meet the above conditions, they are marked as "abnormal access", and for access events that do not meet the conditions, they are marked as "normal access".

[0032] Then, labeling is performed based on the user behavior consistency rules; Rule description: By analyzing historical data, it is found that a specific user has never accessed a sensitive data set in the past. If the user suddenly starts to access the data set frequently, this sudden change in behavior may be abnormal.

[0033] Label annotation: For users who have never accessed a specific dataset in the past, if they suddenly start to access it frequently, these access events are labeled as "abnormal access". Other users' access behaviors to the dataset are labeled as "normal access" if they are consistent with their usual behavior patterns.

[0034] Next, label the access pattern based on the time period; Rule description: Considering that a certain dataset is frequently accessed between 9 am and 6 pm on weekdays, and rarely accessed during non-working hours (such as 10 pm to 6 am the next day), if a user accesses the dataset multiple times during these non-working hours, these access behaviors are considered abnormal.

[0035] Label marking: For access events that occur during non-working hours, if the number of accesses exceeds the set threshold (for example, more than twice the average number of accesses during the time period), it is marked as "abnormal access", and other access events are marked as "normal access".

[0036] It can be understood that by fusing the above labels annotated according to different rules, a comprehensive dataset with annotated labels is obtained. This dataset is used to train the initial model, and the model can effectively and fully learn the relationship between labels and data features.

[0037] Optionally, the historical sensitive data with the annotated labels is input into a first initial model for model training to determine a corresponding behavior timing model and behavior timing features output by the behavior timing model.

[0038] Specifically, this step involves model training, in which the first initial model selects a variant of the recurrent neural network, GRU (Gated Recurrent Unit), to capture long-term dependencies in time series data.

[0039] First, the historical sensitive data with annotated labels are input into the input layer of the GRU model. The model receives the embedding vector of the current word as the time step feature input at each time step.

[0040] Secondly, the GRU model has two gates, the update gate and the reset gate. The update gate determines how much the hidden state is updated, while the reset gate determines how much information in the old hidden state should be ignored. The time step features of the input layer are sequentially input into the update gate and the reset gate, which determines what new information will be added to the cell state. At the same time, the model also calculates candidate hidden states, which are a set of new candidates that may be added to the cell state.

[0041] Next, GRU combines the update gate, reset gate, and candidate hidden states to update the hidden state. If the update gate output is close to 1, the new candidate hidden state will be considered more; if the reset gate output is close to 1, the old hidden state will be retained more.

[0042] Finally, the updated hidden state is output as the predicted feature of the model.

[0043] For example, suppose we have a sequence of user access logs that records the user's access behavior at different time points (such as visited pages, dwell time, etc.). In the GRU model, we input these behavior data into the model in chronological order. After processing the input of the first time step (such as the user's first visit), the model will output a vector, which can be regarded as the model's encoding representation of the user's first visit behavior. As the sequence progresses, the model will continuously update its internal state based on the new input and output a new vector at each time step. These vector sequences represent the model's understanding of the user's entire access behavior sequence, and ultimately obtain the model's overall prediction output.

[0044] It can be understood that the above process is the forward training process in the model training process. Next, it is necessary to compare the model's predicted feature output with the actual features in the validation set and calculate the loss function so that the model parameters can be adjusted according to the loss function to make the model output as accurate as possible.

[0045] After multiple iterations of training, we obtained the minimum loss function, and performed back propagation based on the parameters of the minimum loss function to reversely update the specific parameters of each layer of the model to obtain the optimal behavior timing model. It can be understood that the behavior timing model trained in the above manner is used to analyze whether the user's behavior pattern is normal based on the user's access pattern.

[0046] Optionally, the behavior time series characteristics, preset historical encryption strength data, and preset user attribute data are input into a second initial model for model training to determine a corresponding encryption policy model.

[0047] Specifically, this is the process of model integration. In order to improve the prediction accuracy of encryption strength decisions, an ensemble learning method is used to combine the output results of GRU (Gated Recurrent Unit) with the predictions of other machine learning models. Here, we use random forest as an ensemble learning framework to integrate the time series analysis capabilities of GRU with the feature processing capabilities of other models.

[0048] First, we obtain the output of the GRU (Gated Recurrent Unit) model for each time step. These outputs can be regarded as predictions or encodings of the user’s current behavior patterns.

[0049] Secondly, in addition to the output results of GRU, other types of features are also collected, including static attributes of users, historical encryption strength records, etc.

[0050] Next, we build a random forest model, which is good at processing multi-feature inputs and can effectively learn complex interactions between features.

[0051] When the output of the GRU model is fed into the random forest model along with other features for the final encryption strength decision, we first collect the output of the GRU model at each time step. These output vectors can then be transformed into fixed-length feature representations (e.g., by taking the average, maximum, minimum, etc.), or kept in sequence form and using a special version of random forest that can handle sequence data.

[0052] Finally, the obtained encryption policy model can effectively generate the most appropriate encryption policy based on user behavior and attributes.

[0053] For example, suppose we have an integrated model in which the GRU part is responsible for processing the user's recent access behavior sequence and outputting a series of vectors. We convert these vectors into fixed-length features (such as taking the average vector) and input them into the random forest model together with other features of the user (such as account type, whether there have been security incidents in the past, etc.). The random forest model will build and vote on the decision tree based on these features, and finally output a decision result on the encryption strength.

[0054] For example, the decision result may be a discrete encryption level (such as "low", "medium", "high"), or a continuous encryption strength indicator. Based on this decision result, the system can dynamically adjust the encryption policy for user data to achieve a balance between security and performance.

[0055] In the above steps, the improvement of encryption strength can be achieved by replacing a more secure encryption algorithm, increasing encryption rounds, introducing additional authentication steps, etc.

[0056] More secure encryption algorithms are those that have been proven over time and have higher security standards. These algorithms are often more difficult to crack and can provide stronger data protection. Some common more secure encryption algorithms include: AES (Advanced Encryption Standard): AES is one of the most widely used symmetric encryption algorithms, supporting multiple key lengths (such as 128 bits, 192 bits, and 256 bits). AES is designed to resist various known attack methods and has high implementation efficiency, making it suitable for most scenarios that require encryption.

[0057] RSA: Although RSA is mainly used for asymmetric encryption, it is also highly secure. The RSA algorithm is based on the problem of large number factorization and uses a pair of public and private keys to perform encryption and decryption operations. RSA is widely used in digital signatures, SSL / TLS handshake protocols and other fields.

[0058] ECC (Elliptic Curve Cryptography): ECC is an encryption algorithm based on the mathematical theory of elliptic curves. Compared with RSA, ECC can provide the same level of security with a shorter key length. This makes ECC particularly suitable in resource-constrained environments.

[0059] The real-world mapping of encryption rounds, encryption rounds (or iterations) refers to the number of times the encryption algorithm is repeated when processing data. Increasing encryption rounds can improve encryption security, but it will also increase computational complexity and processing time.

[0060] An additional authentication step refers to the introduction of additional authentication mechanisms during the encryption or decryption process to ensure that only legitimate users or systems can access the encrypted data.

[0061] For example, multi-factor authentication: before decryption, in addition to requiring the user to provide the correct key or password, the user can also be required to authenticate through other channels (such as mobile phone verification code, fingerprint recognition, hardware token, etc.). Decryption is allowed only when all authentication steps are passed.

[0062] Challenge-response mechanism: The system can send a random challenge (such as a random number or a specific calculation problem) to the user, and the user needs to use his private key (or secret information related to it) to generate a response and send it back to the system. The system verifies the correctness of the response before allowing subsequent decryption operations. This method can effectively prevent man-in-the-middle attacks and other forms of fraud.

[0063] By using the above encryption strength methods as feature data sets to train the random forest model with behavioral time series features, the final encryption strategy model can be obtained, thereby triggering the encryption strength improvement mechanism through the encryption strategy model to protect the security of sensitive data.

[0064] It is understandable that by combining the time series analysis capabilities of GRU and the feature processing capabilities of random forests, a more accurate and robust encryption policy model can be constructed. This integrated learning method can fully utilize the advantages of different types of data to improve the prediction accuracy and generalization ability of the model. In practical applications, this model can provide users with more personalized and secure encryption services.

[0065] Step S102: Receive sensitive data sent by the user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data based on the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data based on the encryption strategy, so as to access the sensitive data of the user terminal.

[0066] Optionally, the purpose of this embodiment is to improve the security of sensitive data access by saving locally and loading in the cloud.

[0067] Optionally, the technical means adopted in this embodiment is that the user transmits sensitive data to the encryption platform, the encryption platform encrypts it according to the most appropriate encryption strategy, and transmits the encrypted sensitive encrypted data back to the user end so that the user end can save it locally; subsequently, when the cloud service end needs to access the sensitive data, it obtains the sensitive encrypted data, decrypts it using the same strategy through the encryption platform, and obtains the sensitive data.

[0068] Optionally, the corresponding sensitive encrypted data is determined according to the encryption policy. In this process, according to the encryption policy, the encryption platform can generate the corresponding data key, so that the encryption and decryption end can use the same data key for encryption and decryption to obtain the final result. That is, the user end encrypts according to this data key, and the cloud service end decrypts according to this data key, ensuring that the encryption and decryption operations can be completed.

[0069] For example: User side: Smartphone APP, used to input and store sensitive data including user’s personal information.

[0070] Encryption platform: A system that provides encryption services, including encryption policy models and data key management.

[0071] Cloud server: A remote server that stores user data and is responsible for persistent storage and access to data.

[0072] Flow example: First, the user sends sensitive data. The user enters sensitive data in the mobile application, and the user sends the sensitive data to the encryption platform through a secure channel (such as HTTPS).

[0073] Secondly, after receiving the sensitive data, the encryption platform determines to use the AES-256 encryption algorithm based on the sensitivity level of the data and the current security policy. At the same time, the encryption platform generates a unique session key for this encryption process.

[0074] Next, the encryption platform uses the AES-256 encryption algorithm and the generated session key to encrypt the sensitive data. The encrypted data (ciphertext) is securely stored, and the encryption platform records the session key and encryption algorithm information used for encryption.

[0075] Then, the encrypted sensitive data (ciphertext) and related information of the encryption policy (such as the encryption algorithm and session key identifier) ​​are sent back to the client. After receiving this information, the client stores it locally and replaces the original plaintext sensitive data.

[0076] Then, when the client needs to synchronize data with the cloud server, it will upload the encrypted sensitive data (ciphertext) along with the encryption policy information. The upload process is carried out through a secure channel to ensure that the data is not stolen or tampered with during transmission.

[0077] Finally, the cloud server receives the encrypted sensitive data (ciphertext) and encryption policy information. The cloud server interacts with the encryption platform to obtain the session key required for decryption (if the cloud server does not have it cached). The ciphertext is decrypted using the session key and the specified AES-256 encryption algorithm to restore the original sensitive data. The cloud server can now safely access and use the decrypted sensitive data.

[0078] It is worth noting that cloud data is decrypted in the cache instead of being stored locally, thus reducing the risk of data leakage.

[0079] It can be understood that the above process demonstrates how to receive sensitive data sent by the user end, determine the encryption policy through the encryption policy model, encrypt the sensitive data, and then send the encrypted data back to the user end for replacement, and finally decrypt and access it on the cloud server.

[0080] This example shows how sensitive data is securely transmitted and processed between the user end, the encryption platform, and the cloud server. The encryption platform plays a key role in this process, ensuring the security of sensitive data during transmission and storage.

[0081] From the above description, it can be seen that the sensitive data protection method provided in the embodiment of the present application can determine the corresponding encryption policy model by obtaining historical sensitive data, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receive sensitive data sent by the user terminal, determine the corresponding encryption policy according to the sensitive data and the encryption policy model, determine the corresponding sensitive encrypted data according to the encryption policy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the data key of the encryption platform, and accesses the sensitive data of the user terminal, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption.

[0082] In one embodiment of the sensitive data protection method of the present application, see Figure 2 , and can also include the following: Step S201: performing a labeling operation on the historical sensitive data according to a preset access frequency threshold rule to determine a corresponding access frequency labeling label; Step S202: performing a labeling operation on the historical sensitive data according to a preset user behavior consistency rule to determine a corresponding user behavior labeling label; Step S203: performing a labeling operation on the historical sensitive data according to the access mode rule of the preset time period, and determining a corresponding time period labeling label; Step S204: Determine a corresponding annotation tag according to the access frequency annotation tag, the user behavior annotation tag, and the time period annotation tag, wherein the annotation tag includes a normal access tag and an abnormal access tag.

[0083] Optionally, in this embodiment, by analyzing normal behavior and abnormal behavior patterns in historical sensitive data, corresponding rules are formulated, and then these rules are applied to new data instances to determine whether they are abnormal.

[0084] First, labeling is performed based on the access frequency threshold rule; Rule description: If a user's access times to a sensitive data set in the past 24 hours exceeds three times the average number of access times, the user's access behavior is considered abnormal.

[0085] Label marking: For access events that meet the above conditions, they are marked as "abnormal access", and for access events that do not meet the conditions, they are marked as "normal access".

[0086] Then, labeling is performed based on the user behavior consistency rules; Rule description: By analyzing historical data, it is found that a specific user has never accessed a sensitive data set in the past. If the user suddenly starts to access the data set frequently, this sudden change in behavior may be abnormal.

[0087] Label annotation: For users who have never accessed a specific dataset in the past, if they suddenly start to access it frequently, these access events are labeled as "abnormal access". Other users' access behaviors to the dataset are labeled as "normal access" if they are consistent with their usual behavior patterns.

[0088] Next, label the access pattern based on the time period; Rule description: Considering that a certain dataset is frequently accessed between 9 am and 6 pm on weekdays, and rarely accessed during non-working hours (such as 10 pm to 6 am the next day), if a user accesses the dataset multiple times during these non-working hours, these access behaviors are considered abnormal.

[0089] Label marking: For access events that occur during non-working hours, if the number of accesses exceeds the set threshold (for example, more than twice the average number of accesses during the time period), it is marked as "abnormal access", and other access events are marked as "normal access".

[0090] It can be understood that by fusing the above labels annotated according to different rules, a comprehensive dataset with annotated labels is obtained. This dataset is used to train the initial model, and the model can effectively and fully learn the relationship between labels and data features.

[0091] Through step S204, this embodiment obtains a comprehensive data set with annotated labels. By using this data set to train the initial model, the model can effectively and fully learn the relationship between the labels and data features.

[0092] In one embodiment of the sensitive data protection method of the present application, see Figure 3 , and can also include the following: Step S301: inputting the historical sensitive data with the annotated labels into a time series model for model training to determine a corresponding loss function; Step S302: determining a corresponding behavior timing model and behavior timing features output by the behavior timing model according to the minimum loss function, wherein the behavior timing model is used to analyze user behavior patterns.

[0093] Optionally, in this embodiment, the time series model selects a variant of the recurrent neural network, GRU (Gated Recurrent Unit), to capture long-term dependencies in the time series data.

[0094] Optionally, in this embodiment, the above-mentioned labeled data set is input into the time series model for model training to obtain the trained model prediction, and the prediction is compared with the true label of the verification set to obtain the loss function, and the training is iterated multiple times. After multiple iterative training, we obtain the minimum loss function, and back propagate according to the parameters of the minimum loss function, and reversely update the specific parameters of each layer of the model to obtain the optimal behavior timing model. It can be understood that the behavior timing model trained in the above manner is used to analyze whether the user's behavior pattern is normal based on the user's access pattern.

[0095] Through step S302, this embodiment obtains a behavior time series model, which can discover user behavior patterns and lay a foundation for providing behavior time series features for subsequent model integration.

[0096] In one embodiment of the sensitive data protection method of the present application, see Figure 4 , and can also include the following: Step S401: inputting the historical sensitive data with the annotated label into the input layer of the time series model to determine the corresponding time step feature, and inputting the time step feature into the output layer of the time series model to determine the corresponding prediction feature; Step S402: Determine a corresponding loss function according to the predicted features and the real features in a preset validation set.

[0097] Optionally, time step features, the model receives the embedding vector of the current word at each time step as the time step feature input.

[0098] Optionally, the output of a time step is usually an encoded representation of the model's understanding of the input data at the current time step. This output can be seen as an abstraction or summary of the user's behavior or state at the current time step. Specifically, GRU processes and memorizes information in sequence data through its internal gating mechanism, and the output of each time step is calculated based on the information of all previous time steps and the input of the current time step.

[0099] Optionally, when training the model, the model's predicted feature output is compared with the actual features in the validation set to calculate a loss function so that the model parameters can be adjusted according to the loss function to make the model output as accurate as possible.

[0100] Through step S402, this embodiment successfully obtains the loss function after the model forward training, laying the foundation for subsequent reverse parameter adjustment based on the loss function.

[0101] In one embodiment of the sensitive data protection method of the present application, see Figure 5 , and can also include the following: Step S501: inputting the time step feature into the update gate of the time series model to determine the corresponding update time step feature, inputting the update time step feature into the reset gate of the time series model to determine the corresponding reset time step feature; Step S502: input the reset time step feature into the output layer of the time series model to determine the corresponding prediction feature.

[0102] Optionally, first, the historical sensitive data with annotated labels is input into the input layer of the GRU model, and the model receives the embedding vector of the current word as the time step feature input at each time step.

[0103] Secondly, the GRU model has two gates, the update gate and the reset gate. The update gate determines how much the hidden state is updated, while the reset gate determines how much information in the old hidden state should be ignored. The time step features of the input layer are sequentially input into the update gate and the reset gate, which determines what new information will be added to the cell state. At the same time, the model also calculates candidate hidden states, which are a set of new candidates that may be added to the cell state.

[0104] Next, GRU combines the update gate, reset gate, and candidate hidden states to update the hidden state. If the update gate output is close to 1, the new candidate hidden state will be considered more; if the reset gate output is close to 1, the old hidden state will be retained more.

[0105] Finally, the updated hidden state is output as the predicted feature of the model.

[0106] For example, suppose we have a sequence of user access logs that records the user's access behavior at different time points (such as visited pages, dwell time, etc.). In the GRU model, we input these behavior data into the model in chronological order. After processing the input of the first time step (such as the user's first visit), the model will output a vector, which can be regarded as the model's encoding representation of the user's first visit behavior. As the sequence progresses, the model will continuously update its internal state based on the new input and output a new vector at each time step. These vector sequences represent the model's understanding of the user's entire access behavior sequence, and ultimately obtain the model's overall prediction output.

[0107] Through step S502, this embodiment successfully obtains the prediction output, laying a foundation for the subsequent determination of the loss function.

[0108] In one embodiment of the sensitive data protection method of the present application, see Figure 6 , and can also include the following: Step S601: taking an average value of the behavior time series feature to determine a corresponding fixed-length time series feature; Step S602: Input the fixed-length time series features, preset historical encryption strength data, and preset user attribute data into the random forest for model training to determine the corresponding encryption policy model, wherein the encryption policy model is used to select the encryption policy strength.

[0109] Optionally, in this embodiment, this is a model integration process. In order to improve the prediction accuracy of encryption strength decisions, an integrated learning method is used to combine the output results of GRU (Gated Recurrent Unit) with the predictions of other machine learning models. Here, we use random forest as an integrated learning framework to integrate the time series analysis capabilities of GRU with the feature processing capabilities of other models.

[0110] First, we obtain the output of the GRU (Gated Recurrent Unit) model for each time step. These outputs can be regarded as predictions or encodings of the user’s current behavior patterns.

[0111] Secondly, in addition to the output results of GRU, other types of features are also collected, including static attributes of users, historical encryption strength records, etc.

[0112] Next, we build a random forest model, which is good at processing multi-feature inputs and can effectively learn complex interactions between features.

[0113] When the output of the GRU model is fed into the random forest model along with other features for the final encryption strength decision, we first collect the output of the GRU model at each time step. These output vectors can then be transformed into fixed-length feature representations (e.g., by taking the average, maximum, minimum, etc.), or kept in sequence form and using a special version of random forest that can handle sequence data.

[0114] Finally, the obtained encryption policy model can effectively generate the most appropriate encryption policy based on user behavior and attributes.

[0115] For example, suppose we have an integrated model in which the GRU part is responsible for processing the user's recent access behavior sequence and outputting a series of vectors. We convert these vectors into fixed-length features (such as taking the average vector) and input them into the random forest model together with other features of the user (such as account type, whether there have been security incidents in the past, etc.). The random forest model will build and vote on the decision tree based on these features, and finally output a decision result on the encryption strength.

[0116] For example, the decision result may be a discrete encryption level (such as "low", "medium", "high"), or a continuous encryption strength indicator. Based on this decision result, the system can dynamically adjust the encryption policy for user data to achieve a balance between security and performance.

[0117] In the above steps, the improvement of encryption strength can be achieved by replacing a more secure encryption algorithm, increasing encryption rounds, introducing additional authentication steps, etc.

[0118] More secure encryption algorithms are those that have been proven over time and have higher security standards. These algorithms are often more difficult to crack and can provide stronger data protection. Some common more secure encryption algorithms include: AES (Advanced Encryption Standard): AES is one of the most widely used symmetric encryption algorithms, supporting multiple key lengths (such as 128 bits, 192 bits, and 256 bits). AES is designed to resist various known attack methods and has high implementation efficiency, making it suitable for most scenarios that require encryption.

[0119] RSA: Although RSA is mainly used for asymmetric encryption, it is also highly secure. The RSA algorithm is based on the problem of large number factorization and uses a pair of public and private keys to perform encryption and decryption operations. RSA is widely used in digital signatures, SSL / TLS handshake protocols and other fields.

[0120] ECC (Elliptic Curve Cryptography): ECC is an encryption algorithm based on the mathematical theory of elliptic curves. Compared with RSA, ECC can provide the same level of security with a shorter key length. This makes ECC particularly suitable in resource-constrained environments.

[0121] The real-world mapping of encryption rounds, encryption rounds (or iterations) refers to the number of times the encryption algorithm is repeated when processing data. Increasing encryption rounds can improve encryption security, but it will also increase computational complexity and processing time.

[0122] An additional authentication step refers to the introduction of additional authentication mechanisms during the encryption or decryption process to ensure that only legitimate users or systems can access the encrypted data.

[0123] For example, multi-factor authentication: before decryption, in addition to requiring the user to provide the correct key or password, the user can also be required to authenticate through other channels (such as mobile phone verification code, fingerprint recognition, hardware token, etc.). Decryption is allowed only when all authentication steps are passed.

[0124] Challenge-response mechanism: The system can send a random challenge (such as a random number or a specific calculation problem) to the user, and the user needs to use his private key (or secret information related to it) to generate a response and send it back to the system. The system verifies the correctness of the response before allowing subsequent decryption operations. This method can effectively prevent man-in-the-middle attacks and other forms of fraud.

[0125] By using the above encryption strength methods as feature data sets to train the random forest model with behavioral time series features, the final encryption strategy model can be obtained, thereby triggering the encryption strength improvement mechanism through the encryption strategy model to protect the security of sensitive data.

[0126] Through step S602, this embodiment successfully obtains a strengthened policy model through integration, and can provide users with more personalized and secure encryption services.

[0127] In one embodiment of the sensitive data protection method of the present application, see Figure 7 , and can also include the following: Step S701: Determine the corresponding data key according to the encryption strategy; Step S702: Perform a data encryption operation on the sensitive data according to the data key to determine corresponding sensitive encrypted data.

[0128] Optionally, in this embodiment, the corresponding sensitive encrypted data is determined according to the encryption policy. In this process, according to the encryption policy, the encryption platform can generate a corresponding data key for the encryption and decryption end to use the same data key for encryption and decryption to obtain the final result. That is, the user end encrypts according to the data key, and the cloud service end decrypts according to the data key, ensuring that the encryption and decryption operations can be completed.

[0129] For example: User side: Smartphone APP, used to input and store sensitive data including user’s personal information.

[0130] Encryption platform: A system that provides encryption services, including encryption policy models and data key management.

[0131] Cloud server: A remote server that stores user data and is responsible for persistent storage and access to data.

[0132] Flow example: First, the user sends sensitive data. The user enters sensitive data in the mobile application, and the user sends the sensitive data to the encryption platform through a secure channel (such as HTTPS).

[0133] Secondly, after receiving the sensitive data, the encryption platform determines to use the AES-256 encryption algorithm based on the sensitivity level of the data and the current security policy. At the same time, the encryption platform generates a unique session key for this encryption process.

[0134] Next, the encryption platform uses the AES-256 encryption algorithm and the generated session key to encrypt the sensitive data. The encrypted data (ciphertext) is securely stored, and the encryption platform records the session key and encryption algorithm information used for encryption.

[0135] Then, the encrypted sensitive data (ciphertext) and related information of the encryption policy (such as the encryption algorithm and session key identifier) ​​are sent back to the client. After receiving this information, the client stores it locally and replaces the original plaintext sensitive data.

[0136] Then, when the client needs to synchronize data with the cloud server, it will upload the encrypted sensitive data (ciphertext) along with the encryption policy information. The upload process is carried out through a secure channel to ensure that the data is not stolen or tampered with during transmission.

[0137] Finally, the cloud server receives the encrypted sensitive data (ciphertext) and encryption policy information. The cloud server interacts with the encryption platform to obtain the session key required for decryption (if the cloud server does not have it cached). The ciphertext is decrypted using the session key and the specified AES-256 encryption algorithm to restore the original sensitive data. The cloud server can now safely access and use the decrypted sensitive data.

[0138] Through step S702, this embodiment successfully generates a data key according to the enhanced strategy, laying a foundation for the encryption and decryption required for subsequent communication between the cloud service end and the user end.

[0139] In order to improve the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption, the present application provides an embodiment of a sensitive data protection device for implementing all or part of the sensitive data protection method, see Figure 8 , the sensitive data protection device specifically includes the following contents: The encryption policy model determination module 10 is used to obtain historical sensitive data, perform labeling operations on the historical sensitive data according to the set data access rules, determine the corresponding labeling labels, input the historical sensitive data with the labeling labels into the first initial model for model training, determine the corresponding behavior time series model and the behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data and preset user attribute data into the second initial model for model training, and determine the corresponding encryption policy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; The sensitive data encryption and decryption module is used to receive sensitive data sent by the user terminal, determine the corresponding encryption strategy according to the sensitive data and the encryption strategy model, determine the corresponding sensitive encrypted data according to the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the encryption strategy to access the sensitive data of the user terminal.

[0140] From the above description, it can be seen that the sensitive data protection device provided in the embodiment of the present application can determine the corresponding encryption policy model by acquiring historical sensitive data, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receive sensitive data sent by the user terminal, determine the corresponding encryption policy according to the sensitive data and the encryption policy model, determine the corresponding sensitive encrypted data according to the encryption policy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the data key of the encryption platform, and accesses the sensitive data of the user terminal, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption.

[0141] From the hardware level, in order to improve the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption, the present application provides an embodiment of an electronic device for implementing all or part of the content of the sensitive data protection method, and the electronic device specifically includes the following content: Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between the sensitive data protection method and related devices such as the core business system, user terminal and related database; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the sensitive data protection method in the embodiment and the embodiment of the sensitive data protection method, and the contents thereof are incorporated herein and the repeated parts are not repeated.

[0142] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0143] In practical applications, part of the sensitive data protection method can be executed on the electronic device side as described above, or all operations can be completed in the client device. The specific selection can be based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0144] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0145] Fig. 9 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig. 9 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig. 9 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0146] In one embodiment, the sensitive data protection method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control: Step S101: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine a corresponding behavior time series model and behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine a corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Step S102: Receive sensitive data sent by the user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data based on the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data based on the encryption strategy, so as to access the sensitive data of the user terminal.

[0147] From the above description, it can be seen that the electronic device provided in the embodiment of the present application determines the corresponding encryption policy model by acquiring historical sensitive data, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receives sensitive data sent by the user terminal, determines the corresponding encryption policy according to the sensitive data and the encryption policy model, determines the corresponding sensitive encrypted data according to the encryption policy, and sends the sensitive encrypted data to the user terminal, so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the data key of the encryption platform, and accesses the sensitive data of the user terminal, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption.

[0148] In another embodiment, the sensitive data protection method may be configured separately from the central processing unit 9100. For example, the sensitive data protection method may be configured as a chip connected to the central processing unit 9100, and the function of the sensitive data protection method may be implemented through the control of the central processing unit.

[0149] like Fig. 9As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig. 9 In addition, the electronic device 9600 may also include Fig. 9 For components not shown, reference may be made to the prior art.

[0150] like Fig. 9 As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0151] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0152] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0153] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0154] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0155] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0156] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the machine through the microphone 9132, and the sound stored on the machine can be played through the speaker 9131.

[0157] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the sensitive data protection method in the above embodiments, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all steps of the sensitive data protection method in the above embodiments, where the execution subject is a server or a client, are implemented. For example, when the processor executes the computer program, the following steps are implemented: Step S101: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine a corresponding behavior time series model and behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine a corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Step S102: Receive sensitive data sent by the user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data based on the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data based on the encryption strategy, so as to access the sensitive data of the user terminal.

[0158] From the above description, it can be seen that the computer-readable storage medium provided in the embodiment of the present application determines the corresponding encryption policy model by acquiring historical sensitive data, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receives sensitive data sent by the user terminal, determines the corresponding encryption policy according to the sensitive data and the encryption policy model, determines the corresponding sensitive encrypted data according to the encryption policy, and sends the sensitive encrypted data to the user terminal, so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it performs a data decryption operation on the sensitive encrypted data according to the data key of the encryption platform, and performs sensitive data access on the user terminal, thereby enabling local dynamic encryption and cloud loading and decryption to improve the protection efficiency and security of sensitive data.

[0159] The embodiments of the present application also provide a computer program product capable of implementing all steps of the sensitive data protection method in the above embodiments, where the execution subject is a server or a client. When the computer program / instruction is executed by a processor, the steps of the sensitive data protection method are implemented. For example, the computer program / instruction implements the following steps: Step S101: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine a corresponding behavior time series model and behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine a corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Step S102: Receive sensitive data sent by the user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data based on the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data based on the encryption strategy, so as to access the sensitive data of the user terminal.

[0160] From the above description, it can be seen that the computer program product provided in the embodiment of the present application determines the corresponding encryption policy model by acquiring historical sensitive data, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; receives sensitive data sent by the user terminal, determines the corresponding encryption policy according to the sensitive data and the encryption policy model, determines the corresponding sensitive encrypted data according to the encryption policy, and sends the sensitive encrypted data to the user terminal, so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the data key of the encryption platform, and accesses the sensitive data of the user terminal, thereby improving the protection efficiency and security of sensitive data based on local dynamic encryption and cloud loading and decryption.

[0161] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0165] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A sensitive data protection method, characterized in that: Applied to an encryption platform, the method comprises: Acquire historical sensitive data, perform labeling operations on the historical sensitive data according to set data access rules, determine corresponding labeling labels, input the historical sensitive data with the labeling labels into a first initial model for model training, determine the corresponding behavior time series model and the behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data, and preset user attribute data into a second initial model for model training, and determine the corresponding encryption strategy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; Receive sensitive data sent by a user terminal, determine a corresponding encryption strategy based on the sensitive data and the encryption strategy model, determine corresponding sensitive encrypted data based on the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, the original sensitive data is replaced according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it performs a data decryption operation on the sensitive encrypted data according to the encryption strategy, so as to access the sensitive data of the user terminal.

2. The sensitive data protection method according to claim 1, characterized in that: The tagging operation is performed on the historical sensitive data according to the set data access rule to determine the corresponding tag, including: Perform a labeling operation on the historical sensitive data according to a preset access frequency threshold rule to determine a corresponding access frequency labeling label; Perform a labeling operation on the historical sensitive data according to a preset user behavior consistency rule to determine a corresponding user behavior labeling label; Perform a labeling operation on the historical sensitive data according to the access mode rules of the preset time period, and determine the corresponding time period labeling label; According to the access frequency labeling label, the user behavior labeling label and the time period labeling label, a corresponding labeling label is determined, wherein the labeling label includes a normal access label and an abnormal access label.

3. The sensitive data protection method according to claim 1, characterized in that: The step of inputting the historical sensitive data with the annotated label into a first initial model for model training, and determining a corresponding behavior time series model and behavior time series features output by the behavior time series model, includes: Inputting the historical sensitive data with the annotated labels into a time series model for model training to determine a corresponding loss function; The corresponding behavior timing model and the behavior timing features output by the behavior timing model are determined according to the minimum loss function, wherein the behavior timing model is used to analyze the user behavior pattern.

4. The sensitive data protection method according to claim 3, characterized in that: The step of inputting the historical sensitive data with the annotated labels into a time series model for model training and determining a corresponding loss function includes: Inputting the historical sensitive data with the annotated labels into the input layer of a time series model to determine corresponding time step features, and inputting the time step features into the output layer of the time series model to determine corresponding prediction features; The corresponding loss function is determined according to the predicted features and the real features in the preset validation set.

5. The sensitive data protection method according to claim 4, characterized in that: The step of inputting the time step feature into the output layer of the time series model to determine the corresponding prediction feature includes: Inputting the time step feature into the update gate of the time series model to determine the corresponding update time step feature, inputting the update time step feature into the reset gate of the time series model to determine the corresponding reset time step feature; The reset time step features are input into the output layer of the time series model to determine corresponding prediction features.

6. The sensitive data protection method according to claim 1, characterized in that: The step of inputting the behavior time series characteristics, the preset historical encryption strength data, and the preset user attribute data into a second initial model for model training to determine a corresponding encryption strategy model includes: Performing an average operation on the behavior time series features to determine corresponding fixed-length time series features; The fixed-length time series features, preset historical encryption strength data, and preset user attribute data are input into the random forest for model training to determine the corresponding encryption policy model, wherein the encryption policy model is used to select the encryption policy strength.

7. The sensitive data protection method according to claim 1, characterized in that: The determining corresponding sensitive encrypted data according to the encryption policy includes: According to the encryption strategy, determine the corresponding data key; A data encryption operation is performed on the sensitive data according to the data key to determine corresponding sensitive encrypted data.

8. A sensitive data protection device, characterized in that: The device comprises: The encryption policy model determination module is used to obtain historical sensitive data, perform labeling operations on the historical sensitive data according to the set data access rules, determine the corresponding labeling labels, input the historical sensitive data with the labeling labels into the first initial model for model training, determine the corresponding behavior time series model and the behavior time series features output by the behavior time series model; input the behavior time series features, preset historical encryption strength data and preset user attribute data into the second initial model for model training, and determine the corresponding encryption policy model, wherein the historical sensitive data includes sensitive data access logs and user behavior patterns; The sensitive data encryption and decryption module is used to receive sensitive data sent by the user terminal, determine the corresponding encryption strategy according to the sensitive data and the encryption strategy model, determine the corresponding sensitive encrypted data according to the encryption strategy, and send the sensitive encrypted data to the user terminal so that after the user terminal receives the sensitive encrypted data, it replaces the original sensitive data according to the sensitive encrypted data, and after the cloud server obtains the sensitive encrypted data sent by the user terminal, it decrypts the sensitive encrypted data according to the encryption strategy to access the sensitive data of the user terminal.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the sensitive data protection method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the sensitive data protection method described in any one of claims 1 to 7 are implemented.

Images