A data security computing method based on privacy computing

Abstract

The present invention relates to the field of data security technology, specifically to a data security computing method based on privacy computing, comprising the following steps: deploying sensing nodes at multiple data collection points, collecting real-time data streams, analyzing the real-time data streams to identify data points that do not match expected patterns, and marking them as abnormal data points, adjusting the encryption level of each data packet according to the abnormal data point marking results, encrypting all transmitted and stored data, and generating encrypted data streams. In the present invention, by deploying sensing nodes at data collection points to achieve direct monitoring and encryption processing of real-time data streams, it is possible to instantly identify and mark abnormal data, apply differentiated masks to different data types, and dynamically adjust mask density according to actual access requirements, thereby enhancing privacy protection of data during processing, and implementing automated audit tracking to ensure instant recording of key data operations and rapid identification of potential threats, thereby improving defense effects and transparency of data operations.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security computing method based on privacy computing. Background Art

[0002] The field of data security technology focuses on protecting data from unauthorized access, use, disclosure, destruction, modification, or loss. The field covers a variety of technologies and methods, including encryption, access control, data masking, and secure data storage and transmission. The practice of data security also includes the development of policies and procedures to manage the physical and digital security of data and ensure the integrity and availability of data. With the increase in data breaches and other forms of cyber attacks, the importance of data security has become increasingly prominent in corporate and government organizations and is a core part of modern IT security strategies.

[0003] Among them, data security computing methods involve how to effectively perform data computing while maintaining data privacy. They are usually used in scenarios where sensitive data needs to be processed but the data does not want to be exposed to the executors of the calculations. For example, in multi-party data cooperation and analysis projects, participants can encrypt and process data and perform calculations without sharing specific data content to ensure data security and privacy. They are widely used in finance, healthcare, public security and other fields, where data security and privacy protection are particularly important.

[0004] Although existing data security technologies cover encryption, access control, and data masking, slow processing speeds and untimely responses to abnormal behaviors are still common in actual operations. When processing large-scale or frequently accessed data, traditional technologies make it difficult to update security policies in real time, affecting data protection effectiveness. Lack of flexibility to respond to rapidly changing threat environments, such as delays in data masking and permission update processes, often lead to security vulnerabilities. Existing security policies rely too much on preset rules and delayed audits, and lack immediate response capabilities, which delays the handling of security incidents, increases the risk of data integrity, and makes it challenging for organizations to protect critical information. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and propose a data security calculation method based on privacy computing.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a data security calculation method based on privacy computing, comprising the following steps:

[0007] S1: Deploy sensing nodes at multiple data collection points to collect real-time data streams, analyze the real-time data streams to identify data points that do not match the expected pattern, and mark them as abnormal data points. According to the abnormal data point marking results, adjust the encryption level of each data packet, encrypt all transmitted and stored data, and generate encrypted data streams;

[0008] S2: Based on the encrypted data stream, apply a data mask of difference density to data of difference type, monitor data access requests, and adjust the mask in real time according to the request frequency and type, verify the integrity and correctness of the data according to the real-time mask adjustment result, detect the security of the data in an undecrypted state, and generate a data verification result;

[0009] S3: Using the data verification results, monitor all stages of data processing, track data modification and query operations, detect abnormal requests that do not comply with data operation rules, dynamically adjust user access rights to data based on abnormal request detection results, update access control lists in a timely manner, deny unauthorized access, and generate security policy adjustment results;

[0010] S4: Based on the security policy adjustment results, implement automated audit tracking, record all key data operations, identify potential threats, and immediately implement data locking and access restrictions to generate audit response results.

[0011] As a further solution of the present invention, the step of marking the abnormal data points is:

[0012] S111: Deploy perception nodes at data collection points, monitor data flow in real time by installing sensors and wide area network interfaces, and obtain real-time data flow collection results;

[0013] S112: Based on the real-time data stream collection result, the real-time data is compared with the preset mode, and the data points whose deviation from the standard mode exceeds the set threshold are screened by quantifying the degree of deviation, so as to obtain the screening result of the data points that do not match the expected mode;

[0014] S113: According to the screening result of the data points that do not match the expected pattern, the abnormal state of each data point is encoded, and the data is tracked and marked to generate abnormal data point marking results.

[0015] As a further solution of the present invention, the step of obtaining the encrypted data stream is:

[0016] S121: based on the abnormal data point marking result, extract the data packet information associated with each abnormal data point, analyze the source address, destination address, data packet size and timestamp in the data packet header information, and generate a complete association table between the abnormal data point and the data packet in combination with the marking type and severity of the abnormal data point;

[0017] S122: Based on the association table between the abnormal data points and the data packets, quantify the encryption level using the formula:

[0018]

[0019] Calculate the Encryption level of each packet , generate an encryption level setting scheme, where is the severity score of the associated exception data type, Score the sensitivity of the packet content, is the inverse proportional score of the abnormal frequency;

[0020] S123: Based on the encryption level setting scheme, a corresponding encryption strategy is selected for data packets with different encryption levels, the header information and content data segments of the data packets are encrypted one by one, and the encryption integrity is verified to generate an encrypted data stream.

[0021] As a further solution of the present invention, the real-time adjustment step of the mask is:

[0022] S211: Analyze the encrypted data stream, determine the difference data types, design an initial data mask for each type, call data type diversity analysis, and generate a data type initial mask scheme;

[0023] S212: Apply the data type initial masking scheme, monitor data access requests, collect request frequency and data type information in real time, and use the formula:

[0024]

[0025] Calculate and output the adjustment requirement index for each data type ,in Representative The request frequency of the type, and Represent the mean and standard deviation of all request frequencies, is the identifier of the data type;

[0026] S213: According to the data adjustment demand index, the data mask is updated in real time to ensure that the mask adaptability matches the data access mode, and a real-time adjusted data mask is obtained.

[0027] As a further solution of the present invention, the steps of obtaining the data verification result are:

[0028] S221: Based on the real-time updated data mask, extract the current mask rule, verify and compare the data before and after encryption, confirm that the data has not been tampered with or damaged during transmission or storage, and generate a preliminary data integrity verification result;

[0029] S222: Based on the preliminary data integrity verification result, perform a security check on the undecrypted data, analyze the data access mode and encryption strength, assess potential security threats, and generate a data security analysis result in an undecrypted state;

[0030] S223: Based on the preliminary data integrity verification result and the data security analysis result in the undecrypted state, a comprehensive data security assessment is performed to confirm the effectiveness of the data protection strategy and generate a data verification result.

[0031] As a further solution of the present invention, the abnormal request detection step is:

[0032] S311: calling the data verification result, monitoring each stage of the data processing flow, confirming that the operation process complies with the data security rules, and generating real-time monitoring records;

[0033] S312: Analyze the real-time monitoring records, record data modification and query operations, including operator information, timestamp and operation type, and generate an operation tracking log;

[0034] S313: According to the set data operation rules, the operation tracking log is analyzed to filter out illegal and abnormal requests, using the formula:

[0035]

[0036] Calculate the average violation score per request , analyze the overall violation level and generate an abnormal request report, where, Indicates The violation level of the request, Indicates the total number of requests.

[0037] As a further solution of the present invention, the step of obtaining the security policy adjustment result is:

[0038] S321: Analyze the abnormal request report, identify the illegal user account and illegal behavior content, adjust the user's data access rights according to the severity and frequency of the abnormal behavior, match the difference security requirements, and generate an adjusted user permission status;

[0039] S322: According to the adjusted user permission status, update the access rights of each user, add new access restrictions and remove invalid permissions, and generate an updated access control list;

[0040] S323: Implement the updated access control list, intercept and identify access requests, automatically reject all unauthorized access requests, and obtain security policy adjustment results.

[0041] As a further solution of the present invention, the steps of obtaining the audit response result are:

[0042] S411: According to the security policy adjustment result, configure the operation standard of automatic audit tracking, respond to security requirements in real time, and generate an audit operation configuration list;

[0043] S412: Using the audit operation configuration list, monitoring all data access and modification behaviors, automatically identifying and recording non-compliant key data operations, and generating key data operation exception records;

[0044] S413: Based on the abnormal operation records of the key data, data locking and access restriction measures are implemented, using the formula:

[0045]

[0046] Calculate the lock priority index value , generate audit response results, where Indicates the cumulative number of abnormal operations. Indicates the number of sensitive data types, is the duration of abnormal data operation, Indicates the number of users affected by the abnormal operation. The total number of action categories defined in the audit action configuration list.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, by deploying perception nodes at data collection points, direct monitoring and encryption processing of real-time data streams can be achieved, abnormal data can be instantly identified and marked, differentiated masks can be applied to different data types, and mask density can be dynamically adjusted according to actual access needs, thereby enhancing the privacy protection of data during processing. The implementation of automated audit tracking ensures the instant recording of key data operations and the rapid identification of potential threats, thereby improving the defense effect and the transparency of data operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a main step flow chart of the present invention;

[0050] Figure 2 is a flow chart for marking abnormal data points of the present invention;

[0051] Figure 3 The flowchart of obtaining the encrypted data stream of the present invention;

[0052] Figure 4 This is a real-time adjustment flow chart of the mask of the present invention;

[0053] Figure 5 The present invention is a flowchart for obtaining data verification results;

[0054] Figure 6 A flow chart of detecting abnormal requests of the present invention;

[0055] Figure 7 A flowchart for obtaining the security policy adjustment result of the present invention;

[0056] Figure 8 This is a flow chart for obtaining the audit response results of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0059] See also Figure 1 , a data security computing method based on privacy computing, comprising the following steps:

[0060] S1: Deploy sensing nodes at multiple data collection points to collect real-time data streams, analyze the real-time data streams to identify data points that do not match the expected pattern, and mark them as abnormal data points. According to the abnormal data point marking results, adjust the encryption level of each data packet, encrypt all transmitted and stored data, and generate encrypted data streams;

[0061] S2: Based on the encrypted data stream, apply data masks with different densities to data of different types, monitor data access requests, and adjust the masks in real time according to the request frequency and type. Verify the integrity and correctness of the data based on the real-time mask adjustment results, detect the security of the data in an undecrypted state, and generate data verification results.

[0062] S3: Use data verification results to monitor all stages of data processing, track data modification and query operations, detect abnormal requests that do not comply with data operation rules, dynamically adjust user access rights to data based on abnormal request detection results, update access control lists in a timely manner, deny unauthorized access, and generate security policy adjustment results;

[0063] S4: Combined with the security policy adjustment results, implement automated audit tracking, record all key data operations, identify potential threats and immediately implement data locking and access restrictions to generate audit response results.

[0064] The encrypted data stream includes abnormal marking results, transport layer encryption results and storage layer encryption results; the data verification results include integrity verification records, correctness confirmation results and security inspection records; the security policy adjustment results include authority level update records, access control adjustment records and unauthorized operation blocking records; the audit response results include key operation records, threat identification measures and emergency access restrictions.

[0065] See also Figure 2 , the steps for marking abnormal data points are:

[0066] S111: Deploy perception nodes at data collection points, monitor data flow in real time by installing sensors and wide area network interfaces, and obtain real-time data flow collection results;

[0067] By installing highly sensitive sensors and wide area network interfaces, the data flow of each deployment point is monitored in real time. The process involves the synchronous work of multiple data sensors and the efficient operation of data receiving nodes. The nodes are responsible for collecting data from different sensing nodes and performing preliminary screening and aggregation of the data. Any abnormalities in the collection process will be reported immediately and the information will be fed back to the central monitoring system. The monitoring system will further analyze the data based on the received data flow and its characteristics to ensure that the collected data is accurate. In addition, the collected data needs to be time-series analyzed to track any unexpected changes in the data flow. Real-time data monitoring and analysis ensure the real-time and accuracy of the data, providing reliable support for subsequent data processing and application.

[0068] S112: Based on the real-time data stream collection result, the real-time data is compared with the preset mode, and the data points whose deviation from the standard mode exceeds the set threshold are screened by quantifying the degree of deviation, so as to obtain the screening result of the data points that do not match the expected mode;

[0069] Based on the results of real-time data stream collection, the data stream is carefully compared with the preset pattern through the difference analysis method. First, the data stream is imported into the analysis platform, and the multidimensional data analysis technology is used on the platform to segment the data stream. Each segment of data is compared with the corresponding pattern in the preset pattern database, and the standard deviation and mean analysis methods are used to quantify the degree of deviation of each data point from the expected pattern. For data points whose deviation exceeds the set threshold, the system will automatically mark and classify them, including detailed records of the specific time, source, and type of the data points, to facilitate subsequent data review and problem tracking. It not only speeds up data processing, but also improves the accuracy of data monitoring, ensuring timely detection of potential data anomalies and obtaining data point results that do not match the expected pattern.

[0070] S113: filtering the results of the data points that do not match the expected pattern, encoding the abnormal state of each data point, and tracking and marking the data to generate abnormal data point marking results;

[0071] In the process of marking abnormal data points, each abnormal data point is encoded in detail, and each data point is assigned a unique error code according to its abnormal nature. The code records the abnormal information of the data point in detail, including the type, severity and possible cause of the abnormality. In addition, in order to further enhance the security and traceability of the data, all marked data points will be encrypted, and advanced encryption technology will be used to ensure the security of data during transmission and storage. At the same time, the system will generate a detailed abnormality report based on these marks. The report provides key information for data analysts to help quickly locate the source of the problem and formulate response measures. Through this precise and systematic marking process, the integrity and effectiveness of data monitoring are ensured, and the marking results of abnormal data points are generated.

[0072] See also Figure 3 , the steps to obtain the encrypted data stream are:

[0073] S121: based on the abnormal data point marking results, extract the data packet information associated with each abnormal data point, analyze the source address, destination address, data packet size and timestamp in the data packet header information, and generate a complete association table between the abnormal data point and the data packet in combination with the marking type and severity of the abnormal data point;

[0074] Based on the abnormal data point marking results, the abnormal data point marking content is first parsed to extract the characteristic information of the marking point such as the timestamp, marking category, abnormal source and abnormal level, and match it with the data packet header information. By retrieving the header field of each data packet one by one, its source address, destination address, timestamp, content length and other parameters are obtained, and it is verified whether the abnormal mark belongs to the data packet. By comparing the consistency between the abnormal mark time and the data packet generation time and the source and destination addresses, the contextual correlation between these matched abnormal data points and data packets is further refined and analyzed, and finally a complete association table of abnormal data points and data packets is established.

[0075] S122: Based on the association table between abnormal data points and data packets, quantify the encryption level using the formula:

[0076]

[0077] Calculate the Encryption level of each packet , generate an encryption level setting scheme, where is the severity score of the associated exception data type, Score the sensitivity of the packet content, is the inverse proportional score of the abnormal frequency;

[0078] : The severity score of the associated abnormal data type is assigned through the abnormal tag category and quantified according to the actual abnormal classification standard (e.g., the conventional abnormal tag score range is 1-10);

[0079] : The sensitivity score of the data packet content, which is a quantitative assessment of the security requirements of the data packet content type (e.g., a range of 1-10);

[0080] : The inverse proportional score of the abnormal frequency, calculated as ,in Indicates the total number of exceptions that occurred. Indicates the time interval during which the anomaly persists;

[0081] The parameters of a data packet are as follows: (Severity rating is 6), (sensitivity score is 8), , (the duration of the anomaly is 2 time units), calculate :

[0082]

[0083] Substituting the above values ​​into the formula:

[0084]

[0085]

[0086]

[0087] Calculation results It indicates that the encryption level of the data packet is medium-high strength. Based on this result, you can choose to allocate an encryption policy with higher strength to encrypt the data packet, and finally generate an encryption level setting plan to clarify the allocation rules of different encryption levels.

[0088] S123: Based on the encryption level setting scheme, a corresponding encryption strategy is selected for data packets with different encryption levels, the header information and content data segments of the data packets are encrypted one by one, and the encryption integrity is verified to generate an encrypted data stream;

[0089] Based on the encryption level setting scheme, the encryption level of the data packet is first classified, and different encryption methods and operation steps are selected according to the encryption level of each data packet. By extracting the header information and content segment of the data packet, the header field is encrypted separately to ensure the security of the data packet's transmission path and target address. The content data segment is processed in blocks, and encryption operations of different strengths are performed on important blocks and non-important blocks respectively. The integrity of the encryption process is further verified in combination with the timestamp. Finally, the encrypted data packet is reintegrated into a continuous data stream, and the transmission stability and consistency of the integrated data stream are tested to ultimately generate an encrypted data stream with improved security.

[0090] See also Figure 4 , the real-time adjustment steps of the mask are:

[0091] S211: Analyze the encrypted data stream, determine the difference data types, design an initial data mask for each type, call data type diversity analysis, and generate a data type initial mask scheme;

[0092] After an in-depth analysis of the encrypted data stream, various data features in the data stream, such as text, video, and audio, are clearly identified. Different levels of data masking measures are taken for each type according to its data sensitivity and processing requirements. For highly sensitive text data, high-density masking is implemented to enhance confidentiality. For larger video data, medium-density masking is used to optimize the balance between processing speed and security. In addition, low-density fast masking is selected for audio data due to its high real-time requirements. In this way, not only the hierarchical management of data security is ensured, but also the efficiency and real-time performance of data processing are guaranteed, aiming to provide the best security processing strategy for different types of data streams.

[0093] S212: Apply the data type initial masking scheme, monitor data access requests, and collect request frequency and data type information in real time, using the formula:

[0094]

[0095] Calculate and output the adjustment requirement index for each data type ,in Representative The request frequency of the type, and Represent the mean and standard deviation of all request frequencies, is the identifier of the data type;

[0096] collection Requests / minute, average request frequency Requests / minute, standard deviation , data type identifier First calculate , and then divided by the standard deviation to get , and finally multiply by ,get The result shows that the adjustment demand index is 0.596, which shows that a moderate adjustment strategy is needed for this data type to adapt to the change of request frequency and then adjust the data mask in real time.

[0097] S213: updating the data mask in real time according to the data adjustment demand index, ensuring that the mask adaptability matches the data access mode, and obtaining the data mask adjusted in real time;

[0098] According to the data adjustment demand index, the density of the data mask is adjusted in real time to respond to the changing data access patterns. During the adjustment process, the current data mask settings are first evaluated in detail, and then the index is adjusted based on the collected data types. The mask density is adjusted for each data type separately. For example, the mask density is increased for data types with a significant increase in request frequency, and the mask density is reduced for data types with a decrease in request frequency. This strategy not only improves the dynamic adaptability of data processing, but also optimizes the data protection mechanism, so that when facing data access peaks or diversified data types, data protection measures can quickly and effectively adjust themselves, thereby maintaining data integrity and security.

[0099] See also Figure 5 , the steps to obtain the data verification results are:

[0100] S221: Based on the real-time updated data mask, extract the current mask rule, verify and compare the data before and after encryption, confirm that the data has not been tampered with or damaged during transmission or storage, and generate a preliminary data integrity verification result;

[0101] Automatically extract the current data masking rules from the mask configuration system that is updated in real time, and apply the rules to check the integrity and correctness of the encrypted data that is constantly flowing in. This process requires checking and comparing the data before and after encryption. First, the checksum of the data is calculated, and then it is compared with the original checksum stored in the secure database. Any mismatch is recorded and reported for further investigation. It ensures that any data tampering or damage during data transmission or storage can be quickly discovered and handled, and the preliminary data integrity verification results generated provide a clear view of the effectiveness of current data protection measures.

[0102] S222: Based on the preliminary data integrity verification result, perform a security check on the undecrypted data, analyze the data access mode and encryption strength, assess potential security threats, and generate a data security analysis result in an undecrypted state;

[0103] By performing security checks on undecrypted data, analyzing data access patterns and evaluating encryption strength, and scanning stored data regularly, all access attempts are recorded and analyzed, especially those unauthorized or abnormal access behaviors. In addition, the strength of data encryption is evaluated, potential weaknesses or configuration errors are detected, and the analysis helps identify security threats that data may face in an undecrypted state, such as data leakage or unauthorized access. After each analysis, a detailed report containing all security issues found and their recommended solutions is generated, providing the necessary information for maintaining the confidentiality and integrity of the data.

[0104] S223: Comprehensively evaluate the data security by combining the preliminary data integrity verification results and the data security analysis results in the undecrypted state, confirm the effectiveness of the data protection strategy, and generate data verification results;

[0105] Based on the data integrity and security analysis results obtained from the above content, a comprehensive assessment is performed using an internally developed data analysis platform. The platform integrates various data processing tools, which can automatically collect the results of each test phase and summarize the results into a comprehensive report. During the analysis process, the platform identifies weaknesses and potential risks in the data security strategy by comparing data points in different test results. The assessment process is fully automated, ensuring the timeliness and accuracy of the assessment. The comprehensive assessment results directly affect the adjustment and optimization of data protection strategies, provide continuous support and improvement guidance for data protection, and ensure that organizations can fight against increasingly complex data security threats.

[0106] See also Figure 6 , the steps for detecting abnormal requests are:

[0107] S311: Call the data verification results, monitor each stage of the data processing flow, confirm that the operation process complies with data security rules, and generate real-time monitoring records;

[0108] Calling the verified data verification results and starting data processing monitoring is to ensure that each stage of the data processing process can strictly follow the established security rules. Through integrated data processing monitoring, each data processing activity is captured and recorded in real time, including detailed information such as data input, processing and output. This recording function verifies the legality and security of each data segment. Real-time monitoring records can show the flow and changes of data processing in detail, which not only helps the monitoring team quickly identify potential data leaks or misoperations, but also provides a basis for subsequent security audits, ensuring that all data activities are within the scope of safe monitoring and enhancing the transparency and security of data processing.

[0109] S312: Analyze the real-time monitoring records, record the data modification and query operations, including operator information, timestamp and operation type, and generate an operation tracking log;

[0110] Detailed analysis of real-time monitoring records, including detailed records of each data modification and query operation. The analysis process covers the verification of operator identity, timestamp records of operations, and classification of operation types. Detailed records enable any data activity to be accurately tracked and recorded, providing strong support for data security management. Each data operation recorded in detail in the operation tracking log has undergone strict security checks to ensure that no violations or abnormal operations are missed. In addition, operation logs are crucial for discovering abnormal behavior in data streams. The data security team can quickly locate and handle any data operations that do not comply with regulations, providing data support for subsequent security policy adjustments and risk management.

[0111] S313: According to the set data operation rules, the operation tracking log is analyzed to filter out illegal and abnormal requests using the formula:

[0112]

[0113] Calculate the average violation score per request , analyze the overall violation level and generate an abnormal request report, where, Indicates The violation level of the request, Indicates the total number of requests;

[0114] set up requests, each with a violation score They are , , , , , , , , , The calculation process of the formula is as follows:

[0115]

[0116] The results show that the average violation score for each request is 1.4, which reflects the overall compliance with the rules in the current data processing stage. This value can be used to evaluate areas or specific operations that require enhanced monitoring, helping management make decisions and optimize data security policies.

[0117] See also Figure 7 , the steps to obtain the security policy adjustment results are:

[0118] S321: Analyze the abnormal request report, identify the illegal user account and illegal behavior content, adjust the user's data access rights according to the severity and frequency of the abnormal behavior, match the difference security requirements, and generate the adjusted user permission status;

[0119] By reviewing the abnormal request reports in detail, we identify the user accounts and specific violations involved in the violations, and classify them according to the frequency and severity of the behaviors. For users who frequently or seriously violate the rules, we take dynamic permission adjustment measures. The specific method is to analyze the types of violations of users, such as data leakage, illegal access, etc., and use a points system to conduct risk assessment based on the degree of harm and frequency of the behavior. Each user accumulates a certain number of points based on their violations. Users who exceed the threshold will automatically reduce their access level or directly suspend their accounts to adjust the user's data access rights. The process is fully automated, ensuring the timeliness and fairness of the processing. In addition, all permission adjustments are recorded in the system log for easy auditing and backtracking, and to generate the adjusted user permission status.

[0120] S322: According to the adjusted user permission status, update the access rights of each user, add new access restrictions and remove invalid permissions, and generate an updated access control list;

[0121] The updated user permission status needs to be synchronized to the central access control system to ensure that the system's access control list reflects the latest permission settings in real time. This process includes comparing the user permission records in the database with the permission status generated in real time, detecting differences through automated scripts and updating the database. This operation involves rebuilding the access control list and updating the permission details, including the addition of new restrictions and the deletion of permissions that are no longer applicable. After the update operation, the system performs a complete permission verification run to ensure that all data correctly reflects the real-time permission status of each user. Finally, the system generates an update report that lists all changes and update times in detail, increases the transparency of the operation, and generates an updated access control list.

[0122] S323: Implement the updated access control list, intercept and identify access requests, automatically reject all unauthorized access requests, and obtain security policy adjustment results;

[0123] Implementing the latest access control lists involves strict permission verification for each data access request. During the verification process, each request must pass the permission verification gateway, which checks whether the request matches the user's permissions. If the requested operation exceeds the user's permissions, the system automatically denies it and logs the event. This automated denial mechanism not only reduces human error but also enhances data security. Each denial operation is recorded in detail in the security log for future security analysis and monitoring. In addition, administrators regularly check the efficiency and accuracy of the access control system and test the system's response by simulating unauthorized access attempts. In this way, the system effectively prevents data leakage and unauthorized access, and the resulting security policy adjustment results show the strict implementation and effective management of access control.

[0124] See also Figure 8 , the steps to obtain the audit response results are:

[0125] S411: According to the security policy adjustment results, configure the operation standards of automated audit tracking, respond to security requirements in real time, and generate an audit operation configuration list;

[0126] Based on the results of the new security policy adjustment, the existing audit operation standards need to be reviewed and adjusted. This involves integrating security requirements with current policies from multiple levels. First, collect and analyze the current patterns and frequencies of all data accesses. This step is completed through audit logs. The time, scope and type of data accessed must be recorded in detail. Then, based on the information, possible security vulnerabilities or operational behaviors that do not comply with the new policy are evaluated. Next, the operational standards are updated to ensure strict compliance with the latest security regulations and policies. Each updated operational standard will list in detail the allowed and prohibited data processing activities, and set corresponding monitoring trigger points. The final audit operation configuration list will be used to guide daily data monitoring and audit practices to ensure that each step of the operation complies with policy requirements.

[0127] S412: Use the audit operation configuration list to monitor all data access and modification behaviors, automatically identify and record key data operations that do not meet the standards, and generate key data operation exception records;

[0128] Use the audit operation configuration list to monitor all data access and modification activities in real time. This process not only relies on basic data capture technology, but also includes detailed activity records and dynamic analysis. First, the system captures all requests to access or modify data, including user identity, access time, and the type of data attempted to be accessed. The data is then imported into a dedicated analysis platform, which uses advanced data analysis technology to classify activities and assess their possible security risks. Any activity marked as suspicious will be immediately recorded and a detailed exception report will be generated. These reports list in detail the specific circumstances of the illegal operations and the type of data involved, providing a basis for further review and response measures to ensure timely response to potential security threats.

[0129] S413: Based on the abnormal records of key data operations, data locking and access restriction measures are implemented using the formula:

[0130]

[0131] Calculate the lock priority index value , generate audit response results, where Indicates the cumulative number of abnormal operations. Indicates the number of sensitive data types, is the duration of abnormal data operation, Indicates the number of users affected by the abnormal operation. The total number of operation categories defined in the audit operation configuration list;

[0132] Represents the cumulative number of abnormal operations, for example, the total number of monitored illegal operations is 30; Indicates the number of sensitive data types, such as 5 sensitive data types involved; is the time span of abnormal data operations, assuming that these illegal operations are distributed within 10 days; Indicates the number of users affected by the abnormal operation, for example, 20 users are affected; The total number of operation categories defined in the audit operation configuration list is set to 10 types.

[0133] First calculate the numerator:

[0134]

[0135] Take the absolute value:

[0136]

[0137] Calculate the denominator:

[0138]

[0139] Evaluate fractions within a square root:

[0140]

[0141] Calculate the square root expression:

[0142]

[0143] calculate:

[0144]

[0145]

[0146] Add the two results together:

[0147]

[0148] The calculation result is . This result indicates that based on the current number of abnormal operations, the type of sensitive data involved, the time span of the operation, and the number of affected users, the calculated lock priority index is 43.87. This value reflects the security level that requires immediate response and processing, and is a specific analysis result based on actual monitoring data. The result shows that there is a high priority need to immediately lock and restrict access to these abnormal operations to prevent data leakage or other security risks.

[0149] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A data security computing method based on privacy computing, characterized in that: The following steps are involved: S1: Deploy sensing nodes at multiple data collection points to collect real-time data streams, analyze the real-time data streams to identify data points that do not match the expected pattern, and mark them as abnormal data points. According to the abnormal data point marking results, adjust the encryption level of each data packet, encrypt all transmitted and stored data, and generate encrypted data streams; S2: Based on the encrypted data stream, apply a data mask of difference density to data of difference type, monitor data access requests, and adjust the mask in real time according to the request frequency and type, verify the integrity and correctness of the data according to the real-time mask adjustment result, detect the security of the data in an undecrypted state, and generate a data verification result; S3: Using the data verification results, monitor all stages of data processing, track data modification and query operations, detect abnormal requests that do not comply with data operation rules, dynamically adjust user access rights to data based on abnormal request detection results, update access control lists in a timely manner, deny unauthorized access, and generate security policy adjustment results; S4: Based on the security policy adjustment results, implement automated audit tracking, record all key data operations, identify potential threats, and immediately implement data locking and access restrictions to generate audit response results.

2. The data security computing method based on privacy computing according to claim 1 is characterized in that: The steps of marking the abnormal data points are: S111: Deploy perception nodes at data collection points, monitor data flow in real time by installing sensors and wide area network interfaces, and obtain real-time data flow collection results; S112: Based on the real-time data stream collection result, the real-time data is compared with the preset mode, and the data points whose deviation from the standard mode exceeds the set threshold are screened by quantifying the degree of deviation, so as to obtain the screening result of the data points that do not match the expected mode; S113: According to the screening result of the data points that do not match the expected pattern, the abnormal state of each data point is encoded, and the data is tracked and marked to generate abnormal data point marking results.

3. The data security computing method based on privacy computing according to claim 2 is characterized in that: The steps of obtaining the encrypted data stream are: S121: based on the abnormal data point marking result, extract the data packet information associated with each abnormal data point, analyze the source address, destination address, data packet size and timestamp in the data packet header information, and generate a complete association table between the abnormal data point and the data packet in combination with the marking type and severity of the abnormal data point; S122: Based on the association table between the abnormal data points and the data packets, quantify the encryption level using the formula: Calculate the Encryption level of each packet , generate an encryption level setting scheme, where is the severity score of the associated exception data type, Score the sensitivity of the packet content, is the inverse proportional score of the abnormal frequency; S123: Based on the encryption level setting scheme, a corresponding encryption strategy is selected for data packets with different encryption levels, the header information and content data segments of the data packets are encrypted one by one, and the encryption integrity is verified to generate an encrypted data stream.

4. The data security computing method based on privacy computing according to claim 3 is characterized in that: The real-time adjustment steps of the mask are: S211: Analyze the encrypted data stream, determine the difference data types, design an initial data mask for each type, call data type diversity analysis, and generate a data type initial mask scheme; S212: Apply the data type initial masking scheme, monitor data access requests, collect request frequency and data type information in real time, and use the formula: Calculate and output the adjustment requirement index for each data type ,in Representative The request frequency of the type, and Represent the mean and standard deviation of all request frequencies, is the identifier of the data type; S213: According to the data adjustment demand index, the data mask is updated in real time to ensure that the mask adaptability matches the data access mode, and a real-time adjusted data mask is obtained.

5. The data security computing method based on privacy computing according to claim 4 is characterized in that: The steps for obtaining the data verification result are: S221: Based on the real-time updated data mask, extract the current mask rule, verify and compare the data before and after encryption, confirm that the data has not been tampered with or damaged during transmission or storage, and generate a preliminary data integrity verification result; S222: Based on the preliminary data integrity verification result, perform a security check on the undecrypted data, analyze the data access mode and encryption strength, assess potential security threats, and generate a data security analysis result in an undecrypted state; S223: Based on the preliminary data integrity verification result and the data security analysis result in the undecrypted state, a comprehensive data security assessment is performed to confirm the effectiveness of the data protection strategy and generate a data verification result.

6. The data security computing method based on privacy computing according to claim 5 is characterized in that: The steps of detecting the abnormal request are: S311: calling the data verification result, monitoring each stage of the data processing flow, confirming that the operation process complies with the data security rules, and generating real-time monitoring records; S312: Analyze the real-time monitoring records, record data modification and query operations, including operator information, timestamp and operation type, and generate an operation tracking log; S313: According to the set data operation rules, the operation tracking log is analyzed to filter out illegal and abnormal requests, using the formula: Calculate the average violation score per request , analyze the overall violation level and generate an abnormal request report, where, Indicates The violation level of the request, Indicates the total number of requests.

7. The data security computing method based on privacy computing according to claim 6 is characterized in that: The steps for obtaining the security policy adjustment result are: S321: Analyze the abnormal request report, identify the illegal user account and illegal behavior content, adjust the user's data access rights according to the severity and frequency of the abnormal behavior, match the difference security requirements, and generate an adjusted user permission status; S322: According to the adjusted user permission status, update the access rights of each user, add new access restrictions and remove invalid permissions, and generate an updated access control list; S323: Implement the updated access control list, intercept and identify access requests, automatically reject all unauthorized access requests, and obtain security policy adjustment results.

8. The data security computing method based on privacy computing according to claim 7 is characterized in that: The steps for obtaining the audit response result are: S411: According to the security policy adjustment result, configure the operation standard of automatic audit tracking, respond to security requirements in real time, and generate an audit operation configuration list; S412: Using the audit operation configuration list, monitoring all data access and modification behaviors, automatically identifying and recording non-compliant key data operations, and generating key data operation exception records; S413: Based on the abnormal operation records of the key data, data locking and access restriction measures are implemented, using the formula: Calculate the lock priority index value , generate audit response results, where, Indicates the cumulative number of abnormal operations. Indicates the number of sensitive data types, is the duration of abnormal data operation, Indicates the number of users affected by the abnormal operation. The total number of action categories defined in the audit action configuration list.

Images