Security gateway efficient data transmission method and system based on sensitive data identification

Abstract

The present invention relates to a security gateway efficient data transmission method and system based on sensitive data identification, and belongs to the field of network security technology. The present invention includes the steps of: pre-processing the plaintext to be transmitted to obtain plaintext features; using the plaintext features as the input of the sensitive information classification model to output the sensitive information classification; according to the output of the sensitive information classification model, the data is divided into different sensitivity levels, and after signing the data, it is encrypted and transmitted using encryption algorithms of different levels according to the sensitivity classification; the receiving end receives the encrypted data, digital signature and encryption type information, decrypts according to the encryption type and the corresponding encryption algorithm, and performs signature verification, data integrity verification, identity authentication, access control and security audit operations, and performs corresponding exception processing. The method of the present invention can effectively improve the security and efficiency of data transmission.

Description

Technical Field

[0001] The invention relates to a security gateway efficient data transmission method and system based on sensitive data identification, and belongs to the technical field of network security. Background Art

[0002] In modern society, with the rapid development of information technology and the widespread popularity of network applications, data transmission has become an indispensable part of daily life and work. The security of data during transmission has become increasingly prominent, especially the protection of sensitive information has become the focus of attention in the field of network security. Traditional data transmission methods often ignore the differences in the sensitivity of data content and use consistent encryption measures, which to a certain extent causes a waste of resources and reduces transmission efficiency.

[0003] Traditional data transmission systems often only focus on data transmission efficiency, but ignore data security. Although some encryption technologies can ensure data security, they often reduce data transmission efficiency. In addition, for different types of data (such as text, pictures, audio and video, etc.), their sensitivity and encryption requirements are also different. Existing data transmission systems often use a unified encryption standard and do not perform graded processing based on the sensitivity of the data, which leads to problems such as uneven resource allocation and low efficiency in the encryption process.

[0004] Therefore, the present invention provides a method and system for efficient data transmission of a security gateway based on sensitive data identification, which addresses the problem that different types of data have different security requirements. For example, sensitive data such as personal identity information and financial records require high-intensity security protection, while some non-sensitive data (such as public reports, ordinary communication information, etc.) have relatively low security requirements. Performing sensitivity analysis on the data and taking differentiated security measures accordingly can not only enhance the protection of sensitive data, but also improve the operating efficiency of the system. Summary of the invention

[0005] In view of the above problems, the present invention provides a security gateway efficient data transmission method and system based on sensitive data identification. The method of the present invention can effectively improve the security and efficiency of data transmission.

[0006] The technical solution of the present invention is: a security gateway efficient data transmission method based on sensitive data identification, the method comprising:

[0007] Step 1: pre-process the plaintext to be transmitted to obtain plaintext features;

[0008] Step 2: Use the plaintext features as the input of the sensitive information classification model and output the sensitive information classification;

[0009] Step 3: According to the output of the sensitive information classification model, the data is classified into different sensitivity levels. After the data is signed, it is encrypted and transmitted using encryption algorithms of different levels according to the sensitivity classification.

[0010] Step 4: The receiving end receives the encrypted data, digital signature, and encryption type information, decrypts it according to the encryption type and the corresponding encryption algorithm, and performs signature verification, data integrity check, identity authentication, access control, and security audit operations, and performs corresponding exception handling.

[0011] Furthermore, the step 1 includes performing the following corresponding preprocessing on different types of data in the plaintext:

[0012] Step 1.1: For the text information in the plain text, use the cross-language text pre-training model to extract features and obtain text semantic features;

[0013] Step 1.2: For the image information in the plaintext, use the deep image convolution pre-training model to extract features and obtain the image semantic features;

[0014] Step 1.3: For the audio information in the plaintext, use the cross-language audio pre-training model to extract features and obtain audio semantic features;

[0015] Step 1.4: For the video information in the plain text, split it into pictures and audio, and process them according to the methods of steps 1.2 and 1.3 respectively;

[0016] Step 1.5: Concatenate the features obtained in the above process in order to obtain the plaintext features.

[0017] Furthermore, in step 2, the sensitive information classification model adopts a sparse hybrid expert model, which includes a plurality of hybrid expert layers and a single classification layer; the hybrid expert layer includes a gating module and an expert module.

[0018] Furthermore, the step 2 comprises:

[0019] Step 2.1: Define plaintext features The semantic features output by the hybrid expert layer are :

[0020] ;

[0021] ;

[0022] ;

[0023] ;

[0024] in, represents the mixed expert layer, i is the number of mixed expert layers;

[0025] Step 2.2: For any mixed expert layer in step 2.1 , whose gating module distributes the features input to the next module, the formula is as follows:

[0026] ;

[0027] in, is the output expert gating feature, whose final dimension size is the number of expert networks in the expert module, , , , are all learnable parameters of the gating module in the i-th hybrid expert layer, is the Sigmoid activation function, * used to calculate the ordinary product of features, Used to calculate the Hadamard product between features;

[0028] Step 2.3: Perform feature screening, specifically using the expert gating features obtained in step 2.2 The input features are screened using the following formula:

[0029] ;

[0030] ;

[0031] ;

[0032] ;

[0033] in represents the value of the jth element in the last dimension of the expert gating feature, is the expert threshold hyperparameter set, is the jth hyperparameter, For input features Feature elements whose gated values ​​are greater than the threshold;

[0034] Step 2.4: For any mixed expert layer in step 2.1 , which includes an expert module, which is composed of several expert networks, including semantic expert networks, text expert networks, audio expert networks, image expert networks, cross-language expert networks, and cross-modal expert networks for sensitive information characteristics. The network structure of the expert module is a feedforward network structure, and the calculation formula is as follows:

[0035] ;

[0036] represents the jth expert network in the i-th mixed expert layer, Output for expert network;

[0037] Step 2.5: Weighted integration of the inputs of each expert network to obtain a hybrid expert layer Output semantic features , the calculation formula is as follows:

[0038] ;

[0039] In the formula is the number of expert networks, are the learnable parameters for the output of the expert network;

[0040] Step 2.6: The final mixed expert layer output is graded using a single graded network layer to finally obtain the sensitive information category probability feature corresponding to each feature. , calculated as follows:

[0041] ;

[0042] Among them, GradeLayer represents a single graded network layer;

[0043] For the entire plaintext or a fragment of the plaintext, based on the probability characteristics of the sensitive information category The calculation formula for classification is as follows:

[0044] ;

[0045] in, represents the feature location, represents the characteristic length, T is the corresponding serial number of the final category of the data, Used to calculate the maximum value of each category position vector in the feature vector, is a hyperparameter used to control the impact of the probability of high encryption level categories in plaintext on the entire plaintext feature classification. ( ) is used to calculate the location of the maximum value in the feature.

[0046] Furthermore, in step 2, the training method of the sensitive information classification model is multi-stage step-by-step training. First, all trainable parameters except a certain type of expert network layer are frozen, and training is performed using the data of the corresponding expert network. After the training is completed, the unfrozen expert network layer is changed to another type of expert network, and training is performed in sequence until all expert networks are trained. Afterwards, the expert network layer is frozen, and the remaining trainable parameters are trained using all types of data.

[0047] Furthermore, in step 3, encryption using encryption algorithms of different levels according to sensitivity classification includes:

[0048] The sensitive information classification model in step 2 divides the data to be encrypted into level 1, level 2, level 3, and level 4 data according to the sensitivity from high to low in the GB / T 43697-2024 standard. For different levels of sensitive features, the encryption method is as follows:

[0049] S31. For level 1 sensitive data, use AES-256 encryption algorithm for encryption;

[0050] S32: For Level 2 sensitive data, use the AES-192 encryption algorithm for encryption;

[0051] S33. For level 3 sensitive data, use AES-128 encryption algorithm for encryption;

[0052] S34. For Level 4 sensitive data, use plain text directly for transmission.

[0053] The present invention also provides a security gateway efficient data transmission system based on sensitive data identification, including: a module for executing the above-mentioned security gateway efficient data transmission method based on sensitive data identification.

[0054] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security gateway efficient data transmission method based on sensitive data identification when executing the program.

[0055] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the security gateway efficient data transmission method based on sensitive data identification is implemented.

[0056] The present invention also provides a computer program product, including a computer program, which implements the security gateway efficient data transmission method based on sensitive data identification when executed by a processor.

[0057] The beneficial effects of the present invention are:

[0058] 1. The present invention first pre-processes the plaintext to be transmitted and extracts the semantic features of different types of data;

[0059] 2. The present invention uses a sparse hybrid expert model based on sensitive information classification design to classify sensitive information of the data to be transmitted, which improves the reasoning speed while ensuring the classification quality. Each model layer includes expert networks for semantics, text, audio, pictures and cross-modality, and improves the classification accuracy through multi-stage step-by-step training;

[0060] 3. Based on the classification results of sensitive information, the present invention adopts encryption algorithms corresponding to security levels for encryption protection to optimize transmission speed and ensure data security;

[0061] 4. The present invention designs an expert network system for different modal data to decouple the multimodal encryption grading tasks, thereby reducing the difficulty of model training;

[0062] 5. The number of expert network parameters in a single network layer of the present invention is significantly smaller than that of the network layer parameters in the traditional model. Combined with the proposed feature extraction preprocessing, feature allocation and feature screening mechanism, the reasoning speed of the hierarchical model under multimodal data is effectively improved;

[0063] 6. The receiving end of the present invention performs operations such as decryption, signature verification, data integrity check and security audit to ensure the integrity and security of the information; the method of the present invention can effectively improve the security and efficiency of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a flow chart of the present invention;

[0065] Figure 2 Flowcharts are provided for use of the present invention;

[0066] Figure 3 It is a structural diagram of the expert layer in the hierarchical model of the present invention. DETAILED DESCRIPTION

[0067] Example 1: Figure 1-Figure 3 As shown, a security gateway efficient data transmission method based on sensitive data identification includes:

[0068] Step 1: Preprocess the plaintext to be transmitted to obtain plaintext features; perform the following corresponding preprocessing on different types of data in the plaintext:

[0069] Step 1.1: For the text information in the plain text, read the text data and clean it: remove irrelevant characters, perform word segmentation, remove stop words, etc. Use a cross-language text pre-training model such as BERT, XLM-RoBERTa) to extract features, extract the semantic feature vector of the text through the middle layer or output layer of the model, and obtain the text semantic features;

[0070] Step 1.2: For the image information in the plaintext, first adjust the image size to the size required by the pre-trained model, normalize the pixel values, and use the deep image convolution pre-trained model (such as Resnet, VGG) to extract features and obtain the image semantic features;

[0071] Step 1.3: For the audio information in plain text, after reading the audio data, transcode the audio format to ensure that the audio sampling rate and encoding format are unified, and use a cross-language audio pre-training model (such as wav2vec2, Hubert) to extract features and obtain audio semantic features;

[0072] Step 1.4: For the video information in the plain text, split it into pictures and audio, and process them according to the methods of steps 1.2 and 1.3 respectively;

[0073] Step 1.5: Concatenate the features obtained in the above process in order to obtain the plaintext features.

[0074] Step 2: Use the plaintext features as the input of the sensitive information classification model and output the sensitive information classification;

[0075] Furthermore, in step 2, the sensitive information classification model adopts a sparse hybrid expert model, which includes a plurality of hybrid expert layers and a single classification layer; the hybrid expert layer includes a gating module and an expert module.

[0076] Furthermore, the step 2 comprises:

[0077] Step 2.1: Define plaintext features The semantic features output by the hybrid expert layer are :

[0078] ;

[0079] ;

[0080] ;

[0081] ;

[0082] in, represents the mixed expert layer, i is the number of mixed expert layers;

[0083] Step 2.2: For any mixed expert layer in step 2.1 , whose gating module distributes the features input to the next module, the formula is as follows:

[0084] ;

[0085] in, is the output expert gating feature, whose final dimension size is the number of expert networks in the expert module, , , , are all learnable parameters of the gating module in the i-th hybrid expert layer, is the Sigmoid activation function, * used to calculate the ordinary product (matmul product) of the features, Used to calculate the Hadamard product between features (matmul product);

[0086] Step 2.3: Perform feature screening, specifically using the expert gating features obtained in step 2.2 The input features are screened using the following formula:

[0087] ;

[0088] ;

[0089] ;

[0090] ;

[0091] in represents the value of the jth element in the last dimension of the expert gating feature, is the expert threshold hyperparameter set, is the jth hyperparameter, For input features Feature elements whose gated values ​​are greater than the threshold;

[0092] Step 2.4: For any mixed expert layer in step 2.1 , which includes an expert module, which is composed of several expert networks, including semantic expert networks, text expert networks, audio expert networks, image expert networks, cross-language expert networks, and cross-modal expert networks for sensitive information characteristics. The network structure of the expert module is a feedforward network structure, and the calculation formula is as follows:

[0093] ;

[0094] represents the jth expert network in the i-th mixed expert layer, Output for expert network;

[0095] Step 2.5: Weighted integration of the inputs of each expert network to obtain a hybrid expert layer Output semantic features , the calculation formula is as follows:

[0096] ;

[0097] In the formula is the number of expert networks, are the learnable parameters for the output of the expert network;

[0098] Step 2.6: The final mixed expert layer output is graded using a single graded network layer to finally obtain the sensitive information category probability feature corresponding to each feature. , calculated as follows:

[0099] ;

[0100] Among them, GradeLayer represents a single graded network layer;

[0101] For the entire plaintext or a fragment of the plaintext, based on the probability characteristics of the sensitive information category The calculation formula for classification is as follows:

[0102] ;

[0103] in, represents the feature location, represents the characteristic length, T is the corresponding serial number of the final category of the data, Used to calculate the maximum value of each category position vector in the feature vector, is a hyperparameter used to control the impact of the probability of high encryption level categories in plaintext on the entire plaintext feature classification. ( ) is used to calculate the location of the maximum value in the feature.

[0104] Furthermore, in step 2, the training method of the sensitive information classification model is multi-stage step-by-step training. First, all trainable parameters except a certain type of expert network layer are frozen, and training is performed using the data of the corresponding expert network. After the training is completed, the unfrozen expert network layer is changed to another type of expert network, and training is performed in sequence until all expert networks are trained. Afterwards, the expert network layer is frozen, and the remaining trainable parameters are trained using all types of data.

[0105] Step 3: According to the output of the sensitive information classification model, the data is divided into different sensitivity levels. After the data is signed, it is encrypted and transmitted using different levels of encryption algorithms according to the sensitivity classification to optimize the transmission speed;

[0106] Furthermore, in step 3, encryption using encryption algorithms of different levels according to sensitivity classification includes:

[0107] The sensitive information classification model in step 2 divides the data to be encrypted into level 1, level 2, level 3, and level 4 data according to the sensitivity from high to low in the GB / T 43697-2024 standard. For different levels of sensitive features, the encryption method is as follows:

[0108] S31. For level 1 sensitive data, use AES-256 encryption algorithm for encryption;

[0109] S32: For Level 2 sensitive data, use the AES-192 encryption algorithm for encryption;

[0110] S33. For level 3 sensitive data, use AES-128 encryption algorithm for encryption;

[0111] S34. For Level 4 sensitive data, use plain text directly for transmission.

[0112] Step 4: The receiving end receives the encrypted data, digital signature, and encryption type information, decrypts it according to the encryption type and the corresponding encryption algorithm, and performs signature verification, data integrity check, identity authentication, access control, and security audit operations, and performs corresponding exception handling.

[0113] The present invention also provides a security gateway efficient data transmission system based on sensitive data identification, comprising:

[0114] The module is used to pre-process the plaintext to be transmitted and obtain the plaintext features;

[0115] A classification module, used to use plaintext features as input to a sensitive information classification model and output a sensitive information classification;

[0116] The encryption transmission module is used to classify data into different sensitivity levels according to the output of the sensitive information classification model. After the data is signed, it is encrypted and transmitted using encryption algorithms of different levels according to the sensitivity classification.

[0117] The decryption module is used to receive encrypted data, digital signatures and encryption type information through the receiving end, decrypt according to the encryption type and the corresponding encryption algorithm, and perform signature verification, data integrity check, identity authentication, access control and security audit operations, and perform corresponding exception handling.

[0118] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security gateway efficient data transmission method based on sensitive data identification when executing the program.

[0119] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the security gateway efficient data transmission method based on sensitive data identification is implemented.

[0120] The present invention also provides a computer program product, including a computer program, which implements the security gateway efficient data transmission method based on sensitive data identification when executed by a processor.

[0121] At the receiving end, the data packet is first decrypted. Based on the type of data received and the encryption level, the receiving system uses the corresponding decryption algorithm to restore the data to its original state. After that, the system verifies the digital signature to ensure that the data has not been tampered with during transmission. If the signature verification passes, the data is further checked for integrity and authenticated to ensure data consistency and reliability. Finally, a fine-grained security audit is performed to record all data transmission activities in order to track and monitor possible security threats.

[0122] The invention provides a method and system for efficient data transmission based on sensitive data identification for a secure gateway, which realizes efficient and secure data transmission by performing careful preprocessing and accurate sensitivity analysis on the data. This not only improves the security of data transmission, but also improves the transmission efficiency, and is particularly suitable for modern network environments that process large amounts of diverse data.

[0123] The current sensitive information classification model is difficult to model information under multimodal data. The present invention designs an expert network system for different modal data to decouple the multimodal encryption classification tasks, thereby reducing the difficulty of model training.

[0124] The expert network parameters in a single network layer of the present invention are significantly smaller than those in the traditional model. Combined with the proposed feature extraction preprocessing, feature allocation and feature screening mechanism, the inference speed of the hierarchical model under multimodal data is effectively improved.

[0125] The present invention pre-processes the plaintext to be transmitted and extracts the semantic features of different types of data; uses a sparse hybrid expert model based on sensitive information classification design to classify sensitive information of the data to be transmitted, while ensuring the quality of classification, the reasoning speed is improved, and each model layer includes expert networks for semantics, text, audio, pictures and cross-modality, and the classification accuracy is improved through multi-stage step-by-step training; then based on the sensitive information classification result, an encryption algorithm corresponding to the security level is used for encryption protection to optimize the transmission speed and ensure data security; finally, the receiving end performs decryption, signature verification, data integrity verification and security audit operations to ensure the integrity and security of the information. The method of the present invention can effectively improve the security and efficiency of data transmission.

[0126] The specific implementation modes of the present invention are described in detail above in conjunction with the accompanying drawings, but the present invention is not limited to the above implementation modes, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

Claims

1. A security gateway efficient data transmission method based on sensitive data identification, characterized by: The method comprises: Step 1: pre-process the plaintext to be transmitted to obtain plaintext features; Step 2: Use the plaintext features as the input of the sensitive information classification model and output the sensitive information classification; The sensitive information classification model adopts a sparse hybrid expert model, which includes a plurality of hybrid expert layers and a single classification layer; the hybrid expert layer includes a gating module and an expert module; Step 3: According to the output of the sensitive information classification model, the data is classified into different sensitivity levels. After the data is signed, it is encrypted and transmitted using encryption algorithms of different levels according to the sensitivity classification. Step 4: The receiving end receives the encrypted data, digital signature, and encryption type information, decrypts it according to the encryption type and the corresponding encryption algorithm, and performs signature verification, data integrity check, identity authentication, access control, and security audit operations, and performs corresponding exception processing; The step 2 comprises: Step 2.1: Define plaintext features The semantic features output by the hybrid expert layer are : ； ； ； ； in, represents the mixed expert layer, i is the number of mixed expert layers; Step 2.2: For any mixed expert layer in step 2.1 , whose gating module distributes the features input to the next module, the formula is as follows: ； in, is the output expert gating feature, whose final dimension size is the number of expert networks in the expert module, , , , are all learnable parameters of the gating module in the i-th hybrid expert layer, is the Sigmoid activation function, * used to calculate the ordinary product of features, Used to calculate the Hadamard product between features; Step 2.3: Perform feature screening, specifically using the expert gating features obtained in step 2.2 The input features are screened using the following formula: ； ； ； ； in represents the value of the jth element in the last dimension of the expert gating feature, is the expert threshold hyperparameter set, is the jth hyperparameter, For input features Feature elements whose gated values ​​are greater than the threshold; Step 2.4: For any mixed expert layer in step 2.1 , which includes an expert module, which is composed of several expert networks, including semantic expert networks, text expert networks, audio expert networks, image expert networks, cross-language expert networks, and cross-modal expert networks for sensitive information characteristics. The network structure of the expert module is a feedforward network structure, and the calculation formula is as follows: ； represents the jth expert network in the i-th mixed expert layer, Output for expert network; Step 2.5: Weighted integration of the inputs of each expert network to obtain a hybrid expert layer Output semantic features , the calculation formula is as follows: ； In the formula is the number of expert networks, are the learnable parameters for the output of the expert network; Step 2.6: The final mixed expert layer output is graded using a single graded network layer to finally obtain the sensitive information category probability feature corresponding to each feature. , calculated as follows: ； Among them, GradeLayer represents a single graded network layer; For the entire plaintext or a fragment of the plaintext, based on the probability characteristics of the sensitive information category The calculation formula for classification is as follows: ； in, represents the feature position, represents the characteristic length, T is the corresponding serial number of the final category of the data, Used to calculate the maximum value of each category position vector in the feature vector, is a hyperparameter used to control the impact of the probability of high encryption level categories in plaintext on the overall plaintext feature classification. ( ) is used to calculate the position of the maximum value in the feature; In step 2, the training method of the sensitive information classification model is multi-stage step-by-step training. First, all trainable parameters except a certain type of expert network layer are frozen, and training is performed using the data of the corresponding expert network. After the training is completed, the unfrozen expert network layer is changed to another type of expert network, and training is performed in sequence until all expert networks are trained. After that, the expert network layer is frozen, and the remaining trainable parameters are trained using all types of data.

2. The method for efficient data transmission via a secure gateway based on sensitive data identification according to claim 1 is characterized in that: The step 1 includes performing the following corresponding preprocessing on different types of data in the plaintext: Step 1.1: For the text information in the plain text, use the cross-language text pre-training model to extract features and obtain text semantic features; Step 1.2: For the image information in the plaintext, use the deep image convolution pre-training model to extract features and obtain the image semantic features; Step 1.3: For the audio information in the plaintext, use the cross-language audio pre-training model to extract features and obtain audio semantic features; Step 1.4: For the video information in the plain text, split it into pictures and audio, and process them according to the methods of steps 1.2 and 1.3 respectively; Step 1.5: Concatenate the features obtained in the above process in order to obtain the plaintext features.

3. The method for efficient data transmission via a secure gateway based on sensitive data identification according to claim 1 is characterized in that: In step 3, encryption using encryption algorithms of different levels according to sensitivity classification includes: The sensitive information classification model in step 2 divides the data to be encrypted into level 1, level 2, level 3, and level 4 data according to the sensitivity from high to low in the GB / T 43697-2024 standard. For different levels of sensitive features, the encryption method is as follows: S31. For level 1 sensitive data, use AES-256 encryption algorithm for encryption; S32: For Level 2 sensitive data, use the AES-192 encryption algorithm for encryption; S33. For level 3 sensitive data, use AES-128 encryption algorithm for encryption; S34. For Level 4 sensitive data, use plain text directly for transmission.

4. A secure gateway efficient data transmission system based on sensitive data identification, characterized in that: include: A module for executing the security gateway efficient data transmission method based on sensitive data identification as described in any one of claims 1-3.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the security gateway efficient data transmission method based on sensitive data identification as described in any one of claims 1 to 3 is implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security gateway efficient data transmission method based on sensitive data identification as described in any one of claims 1 to 3 is implemented.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the security gateway efficient data transmission method based on sensitive data identification as described in any one of claims 1 to 3 is implemented.

Images