Customer data security sharing management system

Abstract

The invention discloses a client data security sharing management system, and relates to the technical field of client security management, and the system comprises an identity registration module which is used for collecting multi-mode identity data of a client, extracting features, and carrying out the identity registration of the client according to the extracted features to generate an identity label; the authority distribution module is used for collecting network data and equipment data when the client logs in to generate a situation identifier, and distributing the client authority in combination with the client identity identifier; the data sharing module is used for acquiring client sharing data, encrypting the sharing data according to client authority, and synchronously embedding a dynamic watermark; the log recording module is used for recording and displaying client operation logs and recording the client operation logs to the database; and the central control module is used for remotely connecting with a client and comprehensively controlling operation of other modules. According to the invention, the security of client identity registration is greatly improved, the anti-counterfeiting difficulty is reduced, and the security of client shared data is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of customer security management, and in particular to a customer data security sharing management system. Background Art

[0002] With the rapid development of information technology, enterprises and individuals are increasingly relying on the sharing and transmission of digital information in their daily business and life. In particular, the management and sharing of customer data has become an important part of the core operations of enterprises. However, customer data usually contains a large amount of sensitive information, such as personal identity information, transaction records, behavioral habits, etc. Once these data are leaked, they will bring serious security risks to individuals and enterprises. In order to ensure the security of customer data, traditional technologies usually rely on a single identity authentication mechanism and static permission control. Although such technical solutions have been able to meet basic security needs in the past, with the complexity and frequency of network attacks, existing customer data sharing technologies have gradually exposed many shortcomings. Traditional single-modal identity authentication methods, such as relying only on single biometric features such as passwords and fingerprints, are easily cracked or counterfeited by malicious attackers, and cannot fully guarantee the security of customer identity registration, and lack real-time perception and dynamic adjustment of operating situations. Summary of the invention

[0003] In view of the above problems existing in the existing customer data security sharing management system, the present invention is proposed.

[0004] Therefore, the problem to be solved by the present invention is that the traditional single-modal identity recognition method, such as relying only on a single biometric feature such as a password or fingerprint, is easily cracked or counterfeited by malicious attackers, cannot fully guarantee the security of customer identity registration, and lacks real-time perception and dynamic adjustment of the operating scenario.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: A customer data security sharing management system, which includes an identity registration module, which is used to collect customer multimodal identity data and extract features, and register the customer's identity according to the extracted features to generate an identity identifier;

[0006] The permission allocation module is used to collect the network data and device data of the customer when logging in to generate a context identifier, and allocate customer permissions in combination with the customer identity identifier;

[0007] The data sharing module is used to obtain customer shared data, encrypt the shared data according to customer permissions, and embed dynamic watermarks synchronously;

[0008] The log recording module is used to record the customer operation log for display and record the customer operation log to the database;

[0009] The central control module is used to remotely connect with customers and comprehensively control the operation of other modules.

[0010] As a preferred solution of the customer data security sharing management system of the present invention, wherein: the collecting of customer multimodal identity data and extracting features refers to pre-processing the customer identity data collected by the customer terminal using a multimodal sensor, wherein the customer identity data includes fingerprint images, facial images and voiceprint data;

[0011] The fingerprint image is converted into a binary image, and the binary image is denoised using the median filter method. The fingerprint ridges are identified from the binary image, and the direction of each fingerprint ridge is identified using the ridge tracking algorithm.

[0012] Mark the focus and bifurcation points of each fingerprint ridge as feature points, calculate the local gradient of the fingerprint image at the feature points, and calculate the direction angle h of the feature points based on the gradient i ;

[0013] Divide the binary image into local images, and use Fourier transform to extract the frequency domain representation F(u, v) for each local image.

[0014] The frequency domain representation is converted into a feature vector as follows:

[0015]

[0016] where F p is the fingerprint feature vector, Z is the number of local images, F j (u, v) is the frequency domain representation of the jth local image, u j and v j is the frequency component of the jth local image in the x and y directions, r is the Gaussian kernel parameter;

[0017] Use short-time Fourier transform to extract the Mel frequency cepstral coefficients in the customer voiceprint data to generate the customer voiceprint feature vector F v ;

[0018] The customer fingerprint feature vector F p and voiceprint feature vector F v Splice to form fusion feature F pv .

[0019] As a preferred solution of the customer data security sharing management system of the present invention, wherein: the step of registering the customer's identity and generating an identity tag based on the extracted features includes:

[0020] Set the quantization threshold, perform binary quantization on the fusion features, and generate quantized fusion features And use Reed-Solomon to generate and quantize fusion features Codeword SR of the same length, codeword SR and quantization fusion features Perform XOR operation to generate the security sketch P:

[0021]

[0022] Perform dual-tree complex wavelet transform on the customer's facial image, decompose it to get high-frequency sub-bands, perform discrete cosine transform on the high-frequency sub-bands to get DCT coefficients, and embed the security sketch P into the customer's facial image as a watermark:

[0023] D w =D o +μP;

[0024] Where D o is the DCT coefficient, D w is the security DCT coefficient, μ is the gain factor;

[0025] Generate a chaotic sequence using a 3D chaotic map (x n ,y n , z n ), using chaotic sequences to encrypt secure DCT coefficients, using x n and n Perform pixel position replacement on the customer's facial image using z n Perform an XOR operation on the customer's facial image after pixel position replacement;

[0026] Use principal component analysis to extract the feature vector F of the processed customer facial image f And the fusion feature F pv Perform concatenation to generate a comprehensive feature vector F z , calculate the comprehensive feature vector F z The hash value U is used as the user identifier.

[0027] As a preferred solution of the customer data security sharing management system of the present invention, the collecting of network data and device data when the customer logs in to generate a context identifier refers to collecting device data and network data through the user logging in device for preprocessing, using feature engineering to extract device data features L and network data features R, and defining a weighted algorithm to generate a context identifier C:

[0028] C = w1L + w2R;

[0029] Where w1 and w2 are the weights of device data feature L and network data feature R respectively.

[0030] As a preferred solution of the customer data security sharing management system of the present invention, wherein: the allocation of customer rights in combination with the customer identity identifier refers to constructing a convolutional neural network model, setting the convolutional neural network input as the context identifier C and the customer identity identifier U, and the output as the customer rights;

[0031] The convolutional neural network model is trained using the training data set, and the cross entropy loss function and Adam optimizer are defined to iteratively optimize the model parameters. The context identifier C and customer identity identifier U are input into the trained convolutional neural network model to obtain customer permissions.

[0032] As a preferred solution of the customer data security sharing management system described in the present invention, the obtaining of customer shared data and encrypting the shared data according to customer permissions refers to obtaining the data that the customer needs to share, randomly dividing the shared data into data segments and marking the sequence, randomly shuffling the sequence of the data segments and reorganizing them into disordered shared data, and selecting an encryption algorithm based on customer permissions to encrypt the customer's disordered shared data.

[0033] As a preferred solution of the customer data security sharing management system of the present invention, wherein: the embedding of dynamic watermark means encrypting the customer's random shared data, recording the random number of the data segment, calculating the hash value H of the random number of the data segment, and obtaining the current time to generate the timestamp data T s , a dynamic watermark W is generated based on the customer context identifier C and the customer identity identifier U:

[0034]

[0035] The encrypted customer random shared data is decomposed into high-frequency and low-frequency sub-bands by discrete wavelet transform, and the dynamic watermark W is embedded in the high-frequency sub-band to reform the encrypted customer random shared data for sharing.

[0036] As a preferred solution of the customer data security sharing management system described in the present invention, wherein: the recording of customer operation logs for display refers to collecting the customer's operation records and operation time in real time through the customer login device to generate an operation log, and synchronously recording the customer identity identifier U and context identifier C in the operation log as the customer identification, displaying the generated operation log to the staff in real time, and forming a customer operation statistical report.

[0037] As a preferred solution of the customer data security sharing management system described in the present invention, wherein: recording the customer operation log to the database refers to classifying and storing the customer operation log according to the customer identity U after generating the customer operation log and the customer operation statistical report, regularly performing integrity checks on the data stored in the database, and uploading refers to backing up the data to the cloud.

[0038] As a preferred solution of the customer data security sharing management system described in the present invention, wherein: the remote connection with the customer and comprehensive control of the operation of the remaining modules refers to the central control module being remotely connected to the customer through the customer login device, the customer accesses the central control module through the login device and operates it, and the central control module generates control commands to control the operation of the remaining modules.

[0039] The beneficial effects of the present invention are as follows: the present invention collects multimodal identity data of customers for processing, extracts features based on customer fingerprint images and voiceprint data, generates a watermark, embeds it into the customer's facial image, and then performs chaotic encryption operations, and simultaneously extracts customer facial image features to construct a comprehensive feature vector to obtain a user identity identifier, thereby greatly improving the security of customer identity registration and reducing the difficulty of anti-counterfeiting. By generating a context identifier and then determining customer permissions to encrypt customer data, the accuracy and efficiency of customer data encryption are improved, and the security of customer shared data is guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0041] Figure 1 Flow chart of customer data security sharing management system. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0043] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0044] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0045] Example 1

[0046] Reference Figure 1, which is the first embodiment of the present invention, and provides a customer data security sharing management system, the customer data security sharing management system includes,

[0047] S1, identity registration module, used to collect multimodal identity data of customers, extract features, and register the identity of customers based on the extracted features to generate identity identification;

[0048] Specifically, collecting multimodal identity data of a customer and extracting features means collecting and preprocessing the customer identity data using a multimodal sensor according to a customer terminal, wherein the customer identity data includes fingerprint images, facial images, and voiceprint data;

[0049] The fingerprint image is converted into a binary image, and the binary image is denoised using the median filter method. The fingerprint ridges are identified from the binary image, and the direction of each fingerprint ridge is identified using the ridge tracking algorithm.

[0050] Mark the focus and bifurcation points of each fingerprint ridge as feature points, calculate the local gradient of the fingerprint image at the feature points, and calculate the direction angle h of the feature points based on the gradient i ;

[0051]

[0052] Among them I p is the pixel of feature point p, and is the gradient of the fingerprint image in the x and y directions;

[0053] Divide the binary image into local images, and use Fourier transform to extract the frequency domain representation F(u, v) for each local image.

[0054]

[0055] Where u and v are the frequency components of the local image in the x and y directions respectively, I(x, y) is the pixel at the point (x, y) in the local image, i is an imaginary number, and M and N are the width and height of the local image;

[0056] The frequency domain representation is converted into a feature vector as follows:

[0057]

[0058] where F p is the fingerprint feature vector, Z is the number of local images, F j (u, v) is the frequency domain representation of the jth local image, u j and v j is the frequency component of the jth local image in the x and y directions, r is the Gaussian kernel parameter;

[0059] Use short-time Fourier transform to extract the Mel frequency cepstral coefficients in the customer voiceprint data to generate the customer voiceprint feature vector F v ;

[0060] The customer fingerprint feature vector F p and voiceprint feature vector F v Splice to form fusion feature F pv .

[0061] By using multimodal sensors (such as fingerprint, face and voiceprint sensors), the system can collect customer identity data from multiple biometrics, thereby reducing the errors and security vulnerabilities that may be caused by single-modal data. Each modality of biometrics has different uniqueness. Through multimodal fusion, the robustness and accuracy of identity authentication can be enhanced to prevent attackers from impersonating a single biometric. After converting the fingerprint image into a binary image, the main ridge features of the fingerprint are retained, simplifying the subsequent image processing work. The median filter method can effectively remove noise in the image and ensure that the ridge information of the fingerprint will not be affected by external interference, thereby improving the accuracy of fingerprint recognition. The ridge tracking algorithm can automatically track the direction of the ridges in the fingerprint and mark the key points (endpoints) and bifurcation points of the fingerprint. These feature points are the unique key parts of the fingerprint. By extracting these feature points, a highly accurate fingerprint feature vector can be generated, which significantly improves the accuracy of fingerprint recognition. The fingerprint image is divided into multiple local areas, and the frequency domain representation is extracted for each area using Fourier transform, which can capture the periodic texture features in the fingerprint image. The frequency domain representation can enhance The detailed representation of fingerprint images, especially the accurate description of complex texture structures in fingerprints, can be achieved by converting the frequency domain representation of local images into feature vectors. The system can convert the complex spatial information of fingerprints into an efficient mathematical representation, which is convenient for subsequent matching with other fingerprint features in the database. After Gaussian kernel smoothing, the feature vector can eliminate some noise and further improve the accuracy of the feature. The Mel-frequency cepstral coefficients in the voiceprint data are extracted by short-time Fourier transform, which can effectively capture the key frequency information in the user's voice. These features can reflect the unique biometric features in the voice, making voiceprint recognition highly accurate and anti-counterfeiting. Compared with traditional speech recognition technology, MFCC is more sensitive and can capture tiny changes in sound waves. It has strong robustness. By splicing the fingerprint feature vector with the voiceprint feature vector to form a fusion feature, the system can combine multiple biometric features together to further enhance the accuracy of identity authentication. The fusion feature can simultaneously utilize the uniqueness of fingerprints and voiceprints, reduce the noise or recognition errors that may exist in a single feature modality, and thus improve the security of the overall recognition system.

[0062] Further, registering the identity of the customer based on the extracted features to generate an identity identifier includes:

[0063] Set the quantization threshold, perform binary quantization on the fusion features, and generate quantized fusion features And use Reed-Solomon to generate and quantize fusion features Codeword SR of the same length, codeword SR and quantization fusion features Perform XOR operation to generate the security sketch P:

[0064]

[0065] Perform dual-tree complex wavelet transform on the customer's facial image, decompose it to get high-frequency sub-bands, perform discrete cosine transform on the high-frequency sub-bands to get DCT coefficients, and embed the security sketch P into the customer's facial image as a watermark:

[0066] D w =D o +μP;

[0067] Where D o is the DCT coefficient, D w is the security DCT coefficient, μ is the gain factor;

[0068] Generate a chaotic sequence using a 3D chaotic map (x n ,y n , z n ),

[0069]

[0070] Where a, b and c are control parameters;

[0071] The secure DCT coefficients are encrypted using chaotic sequences, using x n and n Perform pixel position replacement on the customer's facial image, including n is an even number, the corresponding pixel is moved to the left. n is an odd number, move right. n If y is an even number, move the pixel upward. n If it is an odd number, move down and use z n Perform an XOR operation on the customer's facial image after pixel position replacement;

[0072] Use principal component analysis to extract the feature vector F of the processed customer facial image f And the fusion feature F pv Perform concatenation to generate a comprehensive feature vector F z , calculate the comprehensive feature vector F z The hash value U is used as the user identifier.

[0073] By setting the quantization threshold and performing binary quantization on the fusion features, the complexity of the data can be effectively reduced while ensuring the integrity of the information. On this basis, the Reed-Solomon code is used to generate codewords and the codewords are XORed with the quantized fusion features to generate a secure sketch, which enhances the redundancy and fault tolerance of the data. Even if some data is damaged during transmission or storage, the system can use the Reed-Solomon code to correct the error, thereby ensuring the reliability and stability of identity registration. The dual-tree complex wavelet transform decomposes the customer's facial image into multiple sub-bands, especially the high-frequency sub-bands, which can effectively capture the details and texture features of the image. By performing discrete residuals on the high-frequency sub-bands, Chord transform (DCT) can extract the frequency components of the image. The DCT coefficients are used for subsequent watermark embedding. Compared with traditional wavelet transform, dual-tree complex wavelet transform provides higher directionality and resolution, and can more accurately capture the features in facial images, ensuring that the watermark embedding process does not significantly affect the image quality. By embedding the generated security sketch into the customer's facial image as a watermark, each data sharing and operation is ensured to have a unique identifier, enhancing the traceability and anti-counterfeiting of the data. Using 3D chaotic mapping to generate a chaotic sequence and using the sequence to encrypt the DCT coefficients can effectively prevent the watermark from being maliciously extracted or tampered with. The chaotic sequence has a high degree of pseudo-randomness. The permutation operation of pixel positions makes the encrypted image more secure and difficult to crack. In addition, the permutation operation based on image pixels can further enhance the encryption effect of the image, ensuring that even during the image transmission process, attackers cannot restore the original data through simple reverse operations. Principal component analysis can reduce redundant information and improve processing efficiency by extracting the main feature vectors in facial images. In the feature extraction process, PCA can effectively reduce the dimension, ensuring that only the most distinguishing features in the facial image are retained, while reducing noise interference. Combining the aforementioned fingerprint and voiceprint feature vectors to generate a comprehensive feature vector can further improve the accuracy of user identity identification. Accuracy and uniqueness. In addition, the use of PCA simplifies the computational complexity, ensuring that the identity registration and verification system can respond quickly and adapt to the needs of large-scale data processing. After the extracted and processed customer facial image features are concatenated with the fusion features to generate a comprehensive feature vector, its hash value is calculated as the user identity identifier. The hash function is unidirectional and irreversible, ensuring the uniqueness and security of the identity identifier. Through this process, the generated identity identifier can not only uniquely identify the customer, but also effectively resist counterfeiting and tampering by malicious attackers. At the same time, the hash value calculation process is efficient and suitable for large-scale real-time computing, ensuring that the system maintains efficiency and stability when processing large amounts of user data.

[0074] S2, a permission allocation module, which is used to collect network data and device data when the customer logs in to generate a context identifier, and allocate customer permissions in combination with the customer identity identifier;

[0075] Specifically, collecting network data and device data when a customer logs in to generate a context identifier means collecting device data and network data through the user's login device for preprocessing, using feature engineering to extract device data features L and network data features R, and defining a weighted algorithm to generate a context identifier C:

[0076] C = w1L + w2R;

[0077] Where w1 and w2 are the weights of device data feature L and network data feature R respectively.

[0078] Through the device and network information when the customer logs in, the system can obtain the user's operating environment in real time. Device data includes device model, operating system version, processor status, memory usage, etc.; network data includes network connection status, encryption protocol, latency, bandwidth, etc. Preprocessing these data can filter noise and standardize various types of data, thereby providing high-quality input data for subsequent situational analysis. By extracting key features from device data and network data through feature engineering, the system can identify the main factors affecting operational security. Device data features include the security of the operating system, the hardware status of the device, etc.; network data features include the security of the network connection, the encryption protocol used, the IP address location, etc. By extracting these features, the system can effectively determine whether the user's operations are performed on secure devices and networks, reducing the risk of illegal access. By reasonably setting weights, security policies can be flexibly adjusted according to key elements in the operating scenario. For different application scenarios, weights can be dynamically adjusted. For example, in financial scenarios with high security requirements, network data (such as encryption protocols, security certificates) The situation identifier C, as a dynamic evaluation result of environmental security, can be directly used for permission allocation and management. Through real-time monitoring of C, the system can dynamically adjust access rights according to the user's operating context. For example, when the C value is high, it means that the user's operating environment is relatively safe, and the system can grant higher access rights; when the C value is low, it means that the user's operating environment is not safe enough, and the system restricts its access to sensitive data. Through this dynamic permission management, the system can effectively prevent users from accessing sensitive data in an unsafe environment. The generation of the situation identifier C is not only used for permission management, but also as an important indicator in security monitoring. Through continuous monitoring of the C value, the system can identify potential abnormal activities. When C fluctuates abnormally (such as sudden changes in equipment or unsafe connections in the network), the system can trigger a security alarm in real time to restrict or terminate the user's current operation. In addition, the system can also identify potential risks in users' long-term operations based on the historical change trend of C, thereby strengthening security protection.

[0079] Furthermore, assigning customer rights in combination with the customer identity identifier refers to constructing a convolutional neural network model, setting the convolutional neural network input as the context identifier C and the customer identity identifier U, and the output as the customer rights;

[0080] The convolutional neural network model is trained using the training data set, and the cross entropy loss function and Adam optimizer are defined to iteratively optimize the model parameters. The context identifier C and customer identity identifier U are input into the trained convolutional neural network model to obtain customer permissions.

[0081] Convolutional neural networks (CNNs) extract features of input data through layer-by-layer convolution operations, and can automatically learn complex patterns and relationships from context identifiers and customer identity identifiers. The convolution layer extracts local features in the data, while the pooling layer further reduces the data dimension and enhances the generalization ability of the model. In the output layer, through the fully connected layer, the network can generate corresponding customer permissions based on the input features. This method can effectively reduce the workload of manually designing features, automatically learn the optimal feature combination, and improve the accuracy and efficiency of permission allocation. Context identifiers and customer identity identifiers serve as inputs to convolutional neural networks, providing rich environmental and identity information. Context identifiers reflect the user's current operating environment, such as device status, network security, etc.; customer identity identifiers are the user's Unique identity identification. The combination of this information enables the convolutional neural network to consider environmental factors and identity characteristics at the same time, thereby generating more accurate and dynamic permission allocation. Compared with the traditional static permission allocation method, this method greatly improves the flexibility and security of the system in different operating environments. Through large-scale training data sets, the system can provide the convolutional neural network with enough customer operation data and situational data to ensure that the model can capture the permission allocation patterns under various operating environments. The training data set should include different device types, network environments, user identity characteristics, etc., to ensure that the model can be generalized to different usage scenarios. During the training process, with the iterative optimization of the Adam optimizer, the parameters in the network are gradually adjusted to the optimal state, so that the model can accurately predict customer permissions.

[0082] S3, data sharing module, is used to obtain customer shared data, encrypt shared data according to customer permissions, and embed dynamic watermarks synchronously;

[0083] Specifically, obtaining customer shared data and encrypting the shared data according to customer permissions means obtaining the data that the customer needs to share, randomly dividing the shared data into data segments and marking them in sequence, randomly shuffling the order of the data segments and then reorganizing them into random shared data, and selecting an encryption algorithm based on customer permissions to encrypt the customer's random shared data. The higher the customer's permissions, the more complex the selected encryption algorithm and the higher the encryption level.

[0084] By segmenting the customer's shared data, the security of the data transmission process can be greatly improved. Data segmentation technology can prevent the leakage of the entire data when a certain data segment is stolen or cracked. The content of each data segment is relatively independent, which means that even if an attacker obtains a certain data segment, he still cannot obtain the complete data content, thereby enhancing the data privacy protection capability. In addition, data segmentation can also improve the parallel processing efficiency of the system, because the segmented data segments can be encrypted or decrypted by multiple threads at the same time, reducing the overall processing time. After data segmentation, each data segment will be assigned a unique sequence tag, which is particularly important for data decryption and reorganization. The sequence tag ensures that even if the data segments are shuffled and encrypted, the data can still be correctly restored in the original order. This design prevents the risk of data content confusion or information loss after the order of the data segments is destroyed. By randomly disrupting the order of the data segments, the unpredictability of the data can be increased, thereby improving security. This process makes it difficult for an attacker to restore the original data in the correct order even if he successfully obtains certain data segments. The combination of disordered processing and subsequent encryption operations further enhances The ability to protect data increases the complexity of cracking. Dynamically selecting encryption algorithms based on customer permissions can achieve a balance between encryption complexity and processing efficiency. Customers with higher permissions usually require higher security. The system will select more complex encryption algorithms, such as AES-256, RSA, etc. These algorithms have strong anti-attack capabilities and can effectively prevent data from being cracked. For customers with lower permissions, the system can select relatively simple encryption algorithms, such as AES-128. Although the security is slightly lower, the processing speed is faster. It is suitable for scenarios with high performance requirements but less stringent security requirements. The encryption level is adjusted according to different customer permissions, so that the system can achieve a balance between security and processing efficiency. For sensitive data, such as financial information, personal medical records, etc., customers with high permissions will use more complex encryption algorithms to ensure that the data will not be easily cracked under any circumstances. For users with lower permissions, such as ordinary consumers or the transmission of low-sensitivity data, relatively simple encryption algorithms can be selected to reduce system overhead and increase data processing speed. This hierarchical encryption strategy based on permissions can customize security and performance according to user needs.

[0085] Furthermore, embedding a dynamic watermark means encrypting the random shared data of the customer, recording the random number of the data segment, calculating the hash value H of the random number of the data segment, and obtaining the current time to generate the timestamp data T s , a dynamic watermark W is generated based on the customer context identifier C and the customer identity identifier U:

[0086]

[0087] The encrypted customer random shared data is decomposed into high-frequency and low-frequency sub-bands by discrete wavelet transform, and the dynamic watermark W is embedded in the high-frequency sub-band to reform the encrypted customer random shared data for sharing.

[0088] In the process of encrypting customer data segments, the recording of random labels and the calculation of hash values ​​provide each data segment with a unique and tamper-proof identifier. The generation of hash values ​​can ensure that the random labels of data segments remain intact throughout the entire process of data sharing. Even if an attacker obtains part of the data, the order of the data cannot be changed or reassembled, preventing data tampering and reorganization attacks. Generating a timestamp and combining it with the customer context identifier and customer identity identifier can provide real-time and uniqueness for the generation of dynamic watermarks. The timestamp ensures that the watermark is unique in each operation or data sharing process, thereby enhancing the tamper-proof and security of the watermark. Traceability: If unauthorized modification or copying of data occurs, the system can quickly identify anomalies and take action based on timestamps and hash values. By combining customer context identifiers, customer identity identifiers, and timestamp data, dynamically generated watermarks are highly secure and dynamic. Context identifiers provide real-time data of the user's current operating environment, identity identifiers ensure that watermarks are associated with specific users, and timestamps provide unique identification for each operation. This multi-dimensional information fusion makes dynamic watermarks difficult to counterfeit or tamper with, improving the security of data sharing. Discrete wavelet transform (DWT) converts encrypted customer random sharing into Decomposing data into high-frequency and low-frequency sub-bands helps embed watermarks in the high-frequency sub-bands of the data. The multi-resolution analysis characteristics of DWT ensure that the embedded watermark will not significantly affect the original structure or quality of the data. In particular, embedding watermarks in high-frequency sub-bands can maximize the integrity of the data. This decomposition method can also effectively resist common image processing attacks, such as compression and cropping, and enhance the concealment and anti-attack capabilities of the watermark. Embedding dynamic watermarks in high-frequency sub-bands after DWT decomposition can ensure that the watermark is effectively hidden without affecting the quality of the original data. High-frequency sub-bands usually contain detailed parts of the data, and watermark embedding here can ensure It is concealed and difficult to be detected or removed by ordinary attack methods. Even if the data is compressed or attacked during transmission, the dynamic watermark can still be effectively maintained to ensure the traceability and security of the data. The encrypted data embedded with the dynamic watermark is recombined to form the final customer's disorderly shared data, and transmitted through a secure shared channel. By embedding watermarks in disordered shared data, the system can monitor the data flow process in real time to prevent unauthorized access or tampering. In addition, even if abnormal situations occur during the transmission process (such as interception or tampering), the system can quickly locate the problem and respond by detecting dynamic watermarks and hash values.

[0089] S4, a log recording module, used to record customer operation logs for display and record customer operation logs to a database;

[0090] Specifically, recording customer operation logs for display means collecting the customer's operation records and operation time in real time through the customer login device to generate an operation log, and synchronously recording the customer identity identifier U and context identifier C in the operation log as the customer identifier, displaying the generated operation log to the staff in real time, and forming a customer operation statistical report.

[0091] By collecting every operation record and operation time of the customer in real time, the system can monitor the customer's operation behavior throughout the process. This real-time collection not only ensures the continuity and integrity of the operation behavior, but also provides detailed data support for subsequent operation analysis and security management. The operation record includes information such as operation type, operation target, equipment status, etc., and the operation time is accurate to seconds, ensuring that the system can track the specific moment of each operation. Especially when detecting suspicious behavior or conducting audits, these data are crucial. By synchronously recording the customer identity identifier and context identifier in the operation log, the system can ensure that each operation can be clearly associated with a specific customer and its operation context. This synchronous record provides system administrators with comprehensive information about who performed which operations in what context, which not only improves the traceability of operations, but also improves the traceability of operations. It is traceable and provides multi-level data verification for system security. The addition of situational identifiers enables the system to make more intelligent judgments based on the customer's operating environment and help identify potential abnormal operations, such as login device or network anomalies. The operation log is not only recorded and displayed in real time, but the system also automatically generates customer operation statistical reports. By analyzing the customer operation log, the statistical report can display the customer's operation frequency, operation type, commonly used equipment and network environment and other information. The statistical report not only helps to evaluate the customer's usage habits, but also helps to identify potential abnormal behavior patterns. For example, if a customer suddenly operates a large number of different devices or networks in a short period of time, the system can mark this behavior as abnormal and notify the administrator in time. Report analysis can also provide data support for subsequent system optimization, permission management adjustment, etc.

[0092] Furthermore, recording the customer operation log to the database means classifying and storing the customer operation log according to the customer identity U after generating the customer operation log and the customer operation statistical report, regularly performing integrity checks on the data stored in the database, and uploading it to the cloud for data backup.

[0093] Through the customer identity identifier, the system can classify and store each customer's operation log. This classified storage not only improves the efficiency of data management, but also enhances the traceability and query speed of the log. Each user's operation log is stored and managed independently, which is convenient for subsequent analysis, query and security audit. For example, when it is necessary to review a user's operation history, the system can quickly locate the user's operation log without having to search one by one in a large number of operation records, thereby saving time and resources. The operation statistical report not only records all the customer's operations, but also classifies, summarizes and analyzes these operations. For example, the statistical report can show the customer's operation frequency, the most frequently performed operation type, the operation time distribution, etc. By storing these reports, the system can monitor the customer's operation behavior for a long time and discover potential security risks or abnormal behavior. At the same time, storing operation statistical reports helps subsequent decision-making analysis and provides data support for optimizing system authority allocation and security policies.

[0094] S5, central control module, used to remotely connect with customers and comprehensively control the operation of other modules;

[0095] Specifically, remotely connecting with customers and comprehensively controlling the operation of other modules means that the central control module is remotely connected to the customer through the customer login device, the customer accesses the central control module through the login device and operates it, and the central control module generates control commands to control the operation of other modules.

[0096] By remotely logging into devices (such as computers, mobile phones or tablets), customers can interact with the central control module anytime and anywhere. This remote connection method greatly improves the convenience and flexibility of the system, especially in cross-regional or time-constrained situations. Customers can easily access the system and operate it. Remote connection also supports access to multiple devices, ensuring that customers can choose the most suitable way to access according to their own needs. The central control module generates corresponding control commands based on the operation requests issued by the customer through the remote device. By understanding and parsing the customer's operations, the central control module can accurately trigger the various functions of the system to ensure that all operations are performed as expected. This process reduces the risk of customers directly operating the internal modules of the system. The central control module centrally processes all instructions, which not only simplifies the operation process, but also reduces the possibility of system errors. The centralized control mode improves the maintainability and scalability of the system.

[0097] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0098] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0099] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0100] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A customer data security sharing management system, characterized by: include, The identity registration module is used to collect multimodal identity data of customers, extract features, and register the customer's identity based on the extracted features to generate an identity tag; The permission allocation module is used to collect the network data and device data of the customer when logging in to generate a context identifier, and allocate customer permissions in combination with the customer identity identifier; The data sharing module is used to obtain customer shared data, encrypt the shared data according to customer permissions, and embed dynamic watermarks synchronously; The log recording module is used to record the customer operation log for display and record the customer operation log to the database; The central control module is used to remotely connect with customers and comprehensively control the operation of other modules.

2. The customer data security sharing management system according to claim 1, characterized in that: The collecting of multimodal customer identity data and extracting of features refers to preprocessing the customer identity data collected by the multimodal sensor according to the customer terminal, wherein the customer identity data includes fingerprint image, facial image and voiceprint data; The fingerprint image is converted into a binary image, and the binary image is denoised using the median filter method. The fingerprint ridges are identified from the binary image, and the direction of each fingerprint ridge is identified using the ridge tracking algorithm. Mark the focus and bifurcation points of each fingerprint ridge as feature points, calculate the local gradient of the fingerprint image at the feature points, and calculate the direction angle h of the feature points based on the gradient i ; Divide the binary image into local images, and use Fourier transform to extract the frequency domain representation F(u, v) for each local image. The frequency domain representation is converted into a feature vector as follows: Among them, F p is the fingerprint feature vector, Z is the number of local images, F j (u, v) is the frequency domain representation of the jth local image, u j and v j is the frequency component of the jth local image in the x and y directions, r is the Gaussian kernel parameter; Use short-time Fourier transform to extract the Mel frequency cepstral coefficients in the customer voiceprint data to generate the customer voiceprint feature vector F v ; The customer fingerprint feature vector F p and voiceprint feature vector F v Splice to form fusion feature F pv .

3. The customer data security sharing management system according to claim 2, characterized in that: The generating of identity identification by registering the identity of the customer according to the extracted features comprises: Set the quantization threshold, perform binary quantization on the fusion features, and generate quantized fusion features And use Reed-Solomon to generate and quantize fusion features Codeword SR of the same length, codeword SR and quantization fusion features Perform XOR operation to generate the security sketch P: Perform dual-tree complex wavelet transform on the customer's facial image, decompose it to get high-frequency sub-bands, perform discrete cosine transform on the high-frequency sub-bands to get DCT coefficients, and embed the security sketch P into the customer's facial image as a watermark: D w =D o +μP; Where D o is the DCT coefficient, D w is the security DCT coefficient, μ is the gain factor; Generate a chaotic sequence using a 3D chaotic map (x n ,y n , z n ), using chaotic sequences to encrypt secure DCT coefficients, using x n and n Perform pixel position replacement on the customer's facial image using z n Perform an XOR operation on the customer's facial image after pixel position replacement; Use principal component analysis to extract the feature vector F of the processed customer facial image f And the fusion feature F pv Perform concatenation to generate a comprehensive feature vector F z , calculate the comprehensive feature vector F z The hash value U is used as the user identifier.

4. The customer data security sharing management system according to claim 3, characterized in that: The collecting of network data and device data when the customer logs in to generate a context identifier refers to collecting device data and network data through the user's login device for preprocessing, using feature engineering to extract device data features L and network data features R, and defining a weighted algorithm to generate a context identifier C: C= w1 L+ w2 R; in w1 and w2 are the weights of device data feature L and network data feature R respectively.

5. The customer data security sharing management system according to claim 4, characterized in that: The allocating customer rights in combination with the customer identity identifier refers to constructing a convolutional neural network model, setting the convolutional neural network input as the context identifier C and the customer identity identifier U, and the output as the customer rights; The convolutional neural network model is trained using the training data set, and the cross entropy loss function and Adam optimizer are defined to iteratively optimize the model parameters. The context identifier C and customer identity identifier U are input into the trained convolutional neural network model to obtain customer permissions.

6. The customer data security sharing management system according to claim 5, characterized in that: The obtaining of customer shared data and encrypting the shared data according to customer permissions refers to obtaining the data that the customer needs to share, randomly dividing the shared data into data segments and marking the sequence, randomly shuffling the sequence of the data segments and reorganizing them into disordered shared data, and selecting an encryption algorithm based on customer permissions to encrypt the customer's disordered shared data.

7. The customer data security sharing management system according to claim 6, characterized in that: The embedding of dynamic watermark means encrypting the random shared data of the customer, recording the random number of the data segment, calculating the hash value H of the random number of the data segment, and obtaining the current time to generate the timestamp data T s , generate a dynamic watermark W based on the customer context identifier C and the customer identity identifier U: The encrypted customer random shared data is decomposed into high-frequency and low-frequency sub-bands by discrete wavelet transform, and the dynamic watermark W is embedded in the high-frequency sub-band to reform the encrypted customer random shared data for sharing.

8. The customer data security sharing management system according to claim 7, characterized in that: The recording of customer operation logs for display refers to collecting the customer's operation records and operation time in real time through the customer login device to generate an operation log, and synchronously recording the customer identity identifier U and context identifier C in the operation log as the customer identifier, displaying the generated operation log to the staff in real time, and forming a customer operation statistical report.

9. The customer data security sharing management system according to claim 8, characterized in that: The recording of customer operation logs to the database refers to classifying and storing the customer operation logs according to the customer identity U after generating the customer operation logs and customer operation statistical reports, regularly performing integrity checks on the data stored in the database, and uploading refers to backing up the data in the cloud.

10. The customer data security sharing management system according to claim 9, characterized in that: The remote connection with the customer and comprehensive control of the operation of the remaining modules refers to the remote connection between the central control module and the customer through the customer login device, the customer accesses the central control module through the login device and operates it, and the central control module generates control commands to control the operation of the remaining modules.

Images