Human resource data security guarantee method and device, medium and equipment

Abstract

The invention discloses a human resource data security guarantee method and device, a medium and equipment, and the method comprises the steps: carrying out the classification of obtained human resource data, so as to obtain different types of human resource data; preprocessing different types of human resource data; encrypting the preprocessed different types of human resource data; transmitting the encrypted different types of human resource data; performing security verification on the transmitted different types of human resource data; and performing security storage on the different types of human resource data after security verification. According to the method, the human resource data are classified, so that the safety of the human resource data can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a human resources data security assurance method, device, medium and equipment. Background Art

[0002] With the development of information technology and the increasing reliance of enterprises on human resources data, how to ensure the security of this data has become particularly important. The existing human resources information security protection methods are not detailed enough for the processing of sensitive information, so there are risks such as data leakage and exposure of commercial secrets. Therefore, it is necessary to design a new human resources data security protection method to overcome the above shortcomings. Summary of the invention

[0003] In view of the deficiencies in the prior art, the purpose of the present disclosure is to provide a method, device, medium and equipment for ensuring the security of human resources data. The present disclosure can improve the security of human resources data by classifying and processing the human resources data.

[0004] To achieve the above objectives, the present disclosure provides the following technical solutions:

[0005] A method for ensuring the security of human resources data, the method comprising: classifying acquired human resources data to obtain human resources data of different categories; preprocessing the human resources data of different categories; encrypting the preprocessed human resources data of different categories; transmitting the encrypted human resources data of different categories; performing security verification on the transmitted human resources data of different categories; and securely storing the human resources data of different categories after security verification.

[0006] Optionally, the classifying of the acquired human resources data includes: identifying different categories of human resources data and marking the different categories of human resources data; and grading the different categories of human resources data based on data sensitivity.

[0007] Optionally, the preprocessing of human resource data of different categories includes: cleaning the classified human resource data; filling missing values ​​in the cleaned human resource data; and standardizing the human resource data after missing value filling.

[0008] The present disclosure also provides a human resources data security assurance system, wherein the system applies the method described in any of the preceding items.

[0009] The present disclosure also provides a human resources data security protection device, the device comprising: a classification module, used to classify the acquired human resources data to obtain human resources data of different categories; a preprocessing module, used to preprocess the human resources data of different categories; an encryption module, used to encrypt the human resources data of different categories after preprocessing; a transmission module, used to transmit the encrypted human resources data of different categories;

[0010] The verification module is used to perform security verification on different categories of human resource data after transmission; the storage module is used to securely store different categories of human resource data after security verification.

[0011] The present disclosure also provides a human resources data security assurance system, which includes the device as described above.

[0012] The present disclosure also provides a storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method as described in any one of the preceding items.

[0013] The present disclosure also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any of the preceding items when executing the program.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] This disclosure effectively improves the security and privacy protection level of human resources data through classification, preprocessing, encryption, secure transmission and storage, reduces the risk of data leakage and unauthorized access, and at the same time ensures that data of different levels receive corresponding protection measures through hierarchical management of data sensitivity, thereby providing organizations with a more reliable information security protection mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a human resources data security assurance method provided by an embodiment of the present application;

[0017] Figure 2 It is a structural diagram of a human resources data security protection device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will refer to the attached Figure 1 to Figure 2Specific embodiments of the present disclosure are described in detail. Although specific embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0019] It should be noted that certain words are used in the specification and claims to refer to specific components. Those skilled in the art should understand that technicians may use different nouns to refer to the same component. This specification and claims do not use the difference in nouns as a way to distinguish components, but use the difference in the functions of the components as the criterion for distinction. As mentioned throughout the specification and claims, "including" or "comprising" is an open term, so it should be interpreted as "including but not limited to". The subsequent description of the specification is a preferred embodiment of the present disclosure, but the description is based on the general principles of the specification and is not used to limit the scope of the present disclosure. The scope of protection of the present disclosure shall be determined by the attached claims.

[0020] To facilitate understanding of the embodiments of the present disclosure, further explanation will be given below using specific embodiments as examples in conjunction with the accompanying drawings, and each of the accompanying drawings does not constitute a limitation on the embodiments of the present disclosure.

[0021] Figure 1 FIG. 1 is a flow chart of a method for ensuring the security of human resources data provided by an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0022] S100: classifying the acquired human resource data to obtain human resource data of different categories;

[0023] S200: pre-processing different categories of human resource data;

[0024] S300: encrypting the pre-processed human resource data of different categories;

[0025] S400: transmitting encrypted human resources data of different categories;

[0026] S500: Perform security verification on different categories of human resource data after transmission;

[0027] S600: Safely store different categories of human resource data after security verification.

[0028] In another exemplary embodiment, in step S100, classifying the acquired human resources data includes:

[0029] S101: Identify different categories of human resource data and mark the different categories of human resource data, wherein the human resource data includes, for example, employee personal information, performance records, salary information, etc.;

[0030] In this step, n user IDs are randomly selected from the human resources database, marked and classified, for example:

[0031] User ID 1001: Zhang San, male, born on February 14, 1985, ID number 11010119850214xxxx

[0032] User ID 1002: Li Si, female, born on June 1, 1988, ID number 33010219880601yyyy

[0033] User ID 1003: Wang Wu, male, born on October 5, 1975, ID number 22010319751005zzzz

[0034] Taking user ID 1001 as an example, the human resources data of this user after being marked is as follows:

[0035] Employee personal information: Name - Zhang San, Gender - Male, Date of Birth - February 14, 1985, ID Number - 11010119850214xxxx.

[0036] Performance record: For example, Zhang San scored 90 points in the annual assessment in 2023 and completed three key projects in the most recent quarter.

[0037] Salary information: For example, Zhang San’s basic monthly salary is 15,000 yuan, and his year-end bonus is two months’ salary.

[0038] S102: Classifying the different categories of human resources data based on data sensitivity.

[0039] In this step, the human resources data is classified based on the sensitivity model constructed below, and the sensitivity model is specifically expressed as:

[0040]

[0041] in, Indicates the classification result of the model; represents the prediction of the i-th decision tree for the input feature vector x; n represents the number of decision trees; w i represents the weight of the i-th decision tree, I(T i (x)=c) represents the indicator function, when the decision tree T i When the prediction result is equal to category c, the function value is 1, otherwise it is 0; It means finding the category c with the largest weighted vote in the category set c as the final classification result.

[0042] In the model shown above, each decision tree is trained based on different feature subsets and sample subsets, so it can provide views on the sensitivity level of the same data point from different angles, which helps to more comprehensively understand the sensitivity of the data. Furthermore, the prediction results of all decision trees are summarized according to their respective weights to obtain the final grading results. This method not only takes into account the opinions of a single decision tree, but also reflects the importance or reliability of each decision tree through weights, thereby improving the accuracy of the grading. In summary, the sensitivity model mechanism constructed by the present disclosure can generally provide more accurate and stable prediction results than a single decision tree because it comprehensively considers the opinions of multiple decision trees.

[0043] Based on the above model, the classified human resources data can be divided into different levels, for example, it can be divided into public level, internal use level, sensitive level and highly sensitive level. Among them, public level data generally does not involve privacy issues and can be shared externally; internal use level data is only for internal company personnel to view and must not be leaked; sensitive level data contains more private content, but it is not the most core secrets; highly sensitive level data involves very important personal privacy or business secrets.

[0044] The specific classification example of the data shown in step S101 based on the sensitivity model is as follows:

[0045] 1. Employee Personal Information

[0046] Example: Zhang San, male, born on February 14, 1985, ID number 11010119850214xxxx.

[0047] Sensitivity analysis:

[0048] Name: Relatively non-sensitive and public information.

[0049] Gender: Generally considered public information.

[0050] Date of Birth: Moderately sensitive because it can be used to infer a person's age and is sometimes associated with privacy concerns.

[0051] ID number: Highly sensitive because the ID card is a unique identifier that can be used for identity verification and other important purposes.

[0052] Rating suggestions:

[0053] Name and gender can be classified as public.

[0054] Date of Birth should be classified as Internal Use or Sensitive, depending on company policy.

[0055] ID numbers must be classified as highly sensitive and subject to additional security measures, such as encrypted storage and strict control of access rights.

[0056] 2. Performance Records

[0057] Example: Zhang San scored 90 points in the annual assessment in 2023 and completed three key projects in the most recent quarter.

[0058] Sensitivity analysis:

[0059] Annual appraisal score: Moderately sensitive, reflects the employee's work performance and personal ability.

[0060] Completed key projects: Moderately sensitive, especially when these projects involve the company's core business.

[0061] Rating suggestions:

[0062] Annual assessment scores and completed key projects are usually classified as internal use or sensitive and are only visible to direct supervisors and relevant HR personnel.

[0063] 3. Salary Information

[0064] Example: Zhang San’s basic monthly salary is 15,000 yuan, and his year-end bonus is two months’ salary.

[0065] Sensitivity analysis:

[0066] Basic monthly salary: Highly sensitive because salary level is part of personal privacy and may cause comparison and dissatisfaction among colleagues.

[0067] Year-end bonus: Also highly sensitive because it involves additional financial benefits.

[0068] Rating suggestions:

[0069] Basic monthly salary and year-end bonus are classified as highly sensitive and are only known to directly related personnel (such as the employee himself and his direct supervisor).

[0070] In summary, the final classification results of the above data are as follows:

[0071] Public level: Name, gender.

[0072] Internal use and sensitivity levels: Date of birth, annual assessment scores, key projects completed.

[0073] Highly sensitive level: ID number, basic monthly salary, year-end bonus.

[0074] The present disclosure uses a sensitivity model to classify human resource data, and can formulate corresponding security measures based on the specific content of the data and its potential risk level, thereby significantly improving the security and privacy of the data. This classification method not only ensures that different types of data can be protected according to their sensitivity, but also brings many technical effects: First, the model allows organizations to adopt differentiated encryption strategies, for example, using simple and efficient symmetric encryption algorithms for public-level data, and applying more complex transparent data encryption or field-level encryption to highly sensitive data, thereby optimizing computing resources while ensuring security. Secondly, hierarchical management makes access control more refined, and different user roles can only access the data level they need, reducing the risk of internal data leakage. In addition, the method also supports more effective backup and recovery strategies. Highly sensitive data can be backed up more frequently and stored in a cloud service with a high security level, enhancing the availability and disaster recovery capabilities of the data. In short, the application of the sensitivity model not only improves the pertinence and effectiveness of data protection, but also improves the overall data management efficiency and user experience. In another exemplary embodiment, in step S200, the pre-processing of different categories of human resource data includes:

[0075] S201: Cleaning the classified human resources data;

[0076] In this step, cleaning the classified human resources data may include:

[0077] De-duplicate data to ensure that no employee data is entered twice;

[0078] Outlier handling, checking and handling data points that are outside of a reasonable range, such as impossible salary amounts;

[0079] Invalid data cleaning: remove obviously erroneous or meaningless data entries.

[0080] S202: Filling missing values ​​in the cleaned human resource data;

[0081] In this step, for example, if the missing data is numerical data (such as "age"), the mean or median of all non-null values ​​of the feature can be used to replace it; if the missing data is categorical data (such as "department"), the number of occurrences of all known departments can be counted, and then the department with the largest number of occurrences can be used to replace the missing value.

[0082] S203: Standardizing the human resource data after the missing values ​​are filled.

[0083] In this step, the human resource data after missing value filling can be standardized by using Min-Max Scaling to map the data to [0,1].

[0084] In another exemplary embodiment, in step S300, encrypting the pre-processed human resource data of different categories includes:

[0085] In the present disclosure, different encryption methods are adopted for data of different sensitivities. Among them, public-level data usually does not contain sensitive information, so symmetric encryption (using a symmetric encryption algorithm (such as AES-256) to encrypt data) or hash function can be selected for encryption; internal-use level and sensitive-level data usually contain some sensitive information, so higher encryption security is required, and column-level encryption (enabling column-level encryption function in the database and encrypting only specific fields, for example, transparent data encryption (TDE) can be used in Oracle Database) or data masking (for example, displaying the year of birth date and hiding the specific date) can be selected; highly sensitive-level data usually includes very sensitive information, so the highest level of encryption security is required, and transparent data encryption (TDE) can be selected (enabling transparent data encryption at the database level to automatically encrypt data stored on the disk. For example, TDE can be enabled in SQL Server) or field-level encryption (encrypting specific fields at the application level and then storing them in the database) can ensure that the data is still encrypted even if the database is illegally accessed.

[0086] The present disclosure adopts different encryption methods for different categories of data. First, it can manage and maintain keys more clearly; second, it can reduce the consumption of computing resources and improve the overall performance of the system. For example, for internal-use and sensitive-level data, the use of column-level encryption ensures security while maintaining a high processing speed; third, it can improve user experience. For example, for public-level data, the use of symmetric encryption, a simple and efficient encryption method, can speed up data processing and enhance user experience.

[0087] In another exemplary embodiment, in step S400, transmitting the encrypted human resources data of different categories includes:

[0088] S401: Establishing a secure connection between the human resources data sending end and the data receiving end, specifically including:

[0089] S4011: Before transmitting human resource data, it is necessary to select a suitable security protocol to ensure the security of human resource data transmission. The security protocols include, for example, TLS / SSL (Transport Layer Security / SecureSockets Layer) and IPsec (Internet Protocol Security). TLS / SSL is used to securely transmit data in the network. The protocol can ensure the confidentiality, integrity and authentication of data. For example, when transmitting sensitive data such as basic information of employees and salary records, using TLS / SSL can prevent such information from being intercepted or tampered by unauthorized parties. IPsec provides data encryption and authentication services at the IP network level, which is suitable for protecting the entire network communication.

[0090] S4012: Generate digital certificates and corresponding keys for the human resources data sender and receiver;

[0091] In this step, when human resources data (such as employee personal information, salary records, etc.) needs to be transmitted from the sender (such as the HR management system) to the receiver (such as the financial system or external audit agency), digital certificates need to be generated for the sender and receiver first. Digital certificates are issued by a trusted third-party certification authority (CA, Certificate Authority). Each system will obtain a certificate containing its public key, identity information, and CA signature. For example, when the HR management system is about to send a human resources file containing highly sensitive data (such as ID number, basic monthly salary) to the financial system, both systems need to hold a valid digital certificate to verify each other's identity.

[0092] Furthermore, the sending end and the receiving end will also generate corresponding private keys for decrypting human resources data encrypted with the corresponding public keys. For example, before sending information about an employee's year-end bonus, the sending end (HR management system) will use its own private key to sign the information. The receiving end (such as the financial system) can use the sender's public key to verify the signature to confirm that the information does come from the sender and has not been tampered with.

[0093] It should be noted that for private keys, strict access control measures need to be implemented to limit access to private keys to authorized personnel only. At the same time, there should be a backup strategy in case the private key is lost.

[0094] For example, when processing internal-use and sensitive data (such as annual assessment scores and completed key projects), it is necessary not only to ensure the security of the data during transmission, but also to ensure that the relevant certificates and keys are effectively managed and protected.

[0095] S4013: Establishing a handshake process for the human resources data sending end and receiving end, specifically including the following steps:

[0096] First, the sender (such as the HR management system) sends an initial message to the receiver (such as the financial system or external audit agency) to request a secure connection. This initial message usually contains a list of encryption algorithms supported by the sender, random numbers, and other necessary information. For example, when the HR management system is ready to send employee salary records to the financial system, the HR management system will initiate a handshake request, which contains the encryption algorithms it supports (such as AES-256) and other parameters.

[0097] Secondly, after receiving the initial message sent by the sender, the receiver responds to the sender by providing its own digital certificate, the selected encryption algorithm and other parameters. Both parties verify each other's identity by exchanging digital certificates. For example, the HR management system will use the digital certificate it holds to prove its identity, and the financial system will also provide its digital certificate for verification by the HR management system.

[0098] Secondly, once the identities of both parties are verified, they begin to negotiate the session key. This process is usually based on the Diffie-Hellman key exchange or other similar protocols, with the goal of generating a shared secret session key. For example, when transmitting highly sensitive data such as an employee's basic monthly salary or year-end bonus, the two parties will generate a temporary session key through the key negotiation process for encryption of subsequent data transmission.

[0099] Finally, the sender and receiver confirm all the negotiated parameters and the handshake process is complete. At this point, the handshake process between the sender and receiver is established.

[0100] By establishing a handshake process, not only can the authenticity of the identities of the sender and receiver of human resources data be ensured, but also security can be provided for subsequent data transmission.

[0101] S402: Monitoring the transmission of human resources data based on the establishment of a secure connection;

[0102] In this step, the abnormal points in the human resources data can be detected by the abnormal data detection model shown below, and the abnormal data detection model is expressed as:

[0103]

[0104]

[0105]

[0106] in, Indicates the abnormal value score, Representation sample The average path length over all trees, t represents the number of trees, Representation sample The path length in the i-th tree, According to the sample size The average path length is calculated, and H represents the harmonic number.

[0107] The above-mentioned abnormal data detection model constructs multiple trees by randomly selecting features and randomly splitting data points, which can efficiently "isolate" abnormal points. The core advantage of this method lies in its unsupervised learning characteristics, that is, no pre-labeled training data is required, which is particularly important in many practical application scenarios, especially in the absence of historical abnormal samples. In addition, the model is highly robust to noise, and it can still effectively identify abnormal points even if there is a certain degree of noise or inaccurate data in the data set. This robustness makes the model more reliable when processing complex and changeable human resources data, and can detect potential problems in a timely manner, thereby helping organizations improve data quality and security. In this way, the abnormal data detection model not only simplifies the need for data preprocessing, but also enhances its applicability and accuracy in actual operations. Below, the abnormal data detection model described in the present disclosure is exemplarily described for anomaly detection of human resources data.

[0108] This disclosure collects a set of human resources data, including employees' age, service years, and annual assessment scores, as shown in Table 1:

[0109] Table 1

[0110]

[0111] The data described in Table 1 are detected based on the abnormal data detection model. The specific detection process is as follows:

[0112] 1) Initialization:

[0113] The number of decision trees is determined to be 100, and the maximum depth of each tree is set to log2(n), where n is the number of samples. For 5 samples, the maximum depth is about 3.

[0114] 2) Build a decision tree:

[0115] First, a subsample is randomly selected from the human resources data shown in Table 1. For example, the first tree extracts employee IDs 1, 2, and 4 from n random human resources data, and randomly selects a feature (such as "age") and a split value (such as 38 years old). The human resources data is divided into two child nodes according to the split value, and similar operations are recursively performed on each child node until the maximum depth is reached or the child node cannot be divided any further.

[0116] Exemplary:

[0117] First tree:

[0118] Randomly select subsample: employee ID 1, 2, 4

[0119] Select the feature "age" and set the split value to 38 years old

[0120] After segmentation:

[0121] Left child node (age <= 38): employee ID 1, 4

[0122] Right child node (age > 38): employee ID 2

[0123] Continue to split the left child node, select the feature "Service Years", and the split value is 4 years

[0124] Left child node (service years <= 4): employee ID 4

[0125] Right child node (years of service > 4): employee ID 1

[0126] Path of employee ID 3 (age=65, service years=2): root node -> right child node (age>38) -> right child node (service years>4) -> leaf node, path length = 3

[0127] Second tree:

[0128] Randomly select subsample: employee ID 1, 3, 5

[0129] Select the feature "Service Length" and the split value is 5 years

[0130] After segmentation:

[0131] Left child node (service years <= 5): employee ID 1, 3

[0132] Right child node (years of service > 5): employee ID 5

[0133] Continue to split the left child node, select the feature "age", and the split value is 40 years old

[0134] Left child node (age <= 40): employee ID 1

[0135] Right child node (age > 40): employee ID 3

[0136] Path of employee ID 3 (age=65, service years=2): root node -> left child node (service years <=5) -> right child node (age>40) -> leaf node, path length = 3

[0137] The third tree:

[0138] Randomly select subsample: employee ID 2, 3, 4

[0139] Select the feature "Annual Assessment Score" and the split value is 85 points

[0140] After segmentation:

[0141] Left child node (annual assessment score <= 85): employee ID 2, 4

[0142] Right child node (annual assessment score > 85): employee ID 3

[0143] Path of employee ID 3 (age=65, service years=2, annual assessment score=90): root node -> right child node (annual assessment score>85) -> leaf node, path length = 2

[0144] Assuming that similar partitioning is performed on all 100 trees, the path length distribution of employee ID 3 on these trees is finally obtained. To simplify the description, this disclosure only considers three trees, and then calculates the average path length.

[0145] 3) Calculate the path length:

[0146] Based on the three tree examples above, the path lengths for employee ID 3 are 3, 3, and 2. If we assume that similar path lengths are found in the other 97 trees, the distribution is as follows:

[0147] There are 10 trees with a path length of 2

[0148] There are 50 trees with a path length of 3

[0149] There are 40 trees with a path length of 4

[0150] Then the average path length of employee ID 3 is:

[0151]

[0152] Then the average path length of employee ID 3 is:

[0153] For 5 samples, the average path length is calculated for:

[0154]

[0155]

[0156] Then the anomaly score of employee ID3 is:

[0157]

[0158] 4) Define the threshold:

[0159] Suppose 100 decision trees have been built and all normal samples have been run on these trees. Now we need to calculate the average path length distribution of these samples. For example, we can get the following data:

[0160] Average path length of a normal sample: μ = 1.5

[0161] Standard deviation of a normal sample: σ = 0.8

[0162] Set a threshold and assume that the following information is obtained through the model:

[0163] Average anomaly score of normal samples:

[0164] Standard deviation of a normal sample:

[0165] constant

[0166] The threshold is expressed as:

[0167]

[0168] 5) If the outlier score is lower than the set threshold, it is considered an outlier.

[0169] Since the abnormal value score of employee ID3 Greater than threshold , therefore, the data of employee ID 3 is considered to be abnormal.

[0170] Through the above steps, anomalies in human resources data can be effectively detected. The above method is particularly suitable for processing sensitive human resources data, such as employee age, years of service, annual assessment scores, etc., and can ensure the accuracy and completeness of the data.

[0171] Furthermore, when the third sample (employee ID is 3) is marked as an outlier, the following measures can be taken to deal with it:

[0172] The first step is to confirm the abnormality;

[0173] The detected anomalies need to be manually reviewed or further analyzed to ensure that the anomalies are detected correctly to avoid possible false positives from automatic detection methods.

[0174] The second step is recording and auditing;

[0175] Record the details of the anomaly and mark it in the system for subsequent tracking and review. At the same time, it is necessary to retain the data log of the anomaly, including the detection time, detection results, and any relevant contextual information.

[0176] The third step is data correction;

[0177] If data entry errors are found, such as errors caused by typos or system failures, the data should be corrected and the anomaly detection model rerun; if the anomalies are due to special circumstances and these circumstances are reasonable, these circumstances can be marked in the data so that they can be considered in future analyses.

[0178] Step 4: Access control;

[0179] For highly sensitive data, such as salary information or other personal privacy information containing anomalies, strict access control measures should be implemented to ensure that only authorized personnel can access this data. For example, employee salary information tables containing anomalies are only accessible to designated HR specialists and senior managers, and they need to pass multi-factor authentication to access them.

[0180] Step 5: Backup and restore.

[0181] Ensure that abnormal data is properly backed up to prevent data loss or damage. The appropriate backup strategy should be selected based on the sensitivity level of the abnormal data. For example, highly sensitive data should be fully backed up daily, and the backup files should be encrypted and stored in a high-security cloud storage service with multiple copies for redundancy.

[0182] Through the above steps, human resources data marked as abnormal can be effectively processed and the security and accuracy of the data can be ensured.

[0183] In another exemplary embodiment, in step S500, the security verification of the transmitted human resources data of different categories includes:

[0184] S501: Perform consistency verification on the human resources data of different categories;

[0185] In this step, for public-level data, a hash function (such as SHA-256) can be used to generate a hash value for the data and compared with the hash value before transmission. If the hash values ​​are consistent, it indicates that the data has not been tampered with. For internal-use and sensitive-level data, a public key infrastructure (PKI) can be used to sign the data. The receiving end verifies the validity of the signature through the public key to ensure that the data source is reliable and has not been tampered with. For highly sensitive data, other verification mechanisms, such as timestamps or one-time passwords (OTPs), can be combined with digital signatures to increase data security.

[0186] S502: Perform integrity verification on the human resources data after consistency verification.

[0187] In this step, the integrity verification is to ensure that the data is not missing or damaged and all necessary parts have been transmitted correctly. For different types of data, the following methods can be used for integrity verification:

[0188] For public-level data, you need to check whether the number of records before and after the transfer is consistent. In addition, you need to ensure that the key fields in each record (such as name, gender) exist and are in the correct format.

[0189] For internal use / sensitive data, in addition to the public data verification method, logical verification is also required, such as checking whether the date of birth is reasonable, whether the annual assessment score is within a reasonable range, and whether the completed key projects are logically consistent.

[0190] For highly sensitive data, redundancy check and log audit are required. Redundancy check refers to the use of redundant data (such as checksum) to verify the integrity of the data. Specifically, the checksum can be attached during data transmission and recalculated and compared at the receiving end. The log audit needs to record the logs of all data operations and regularly review the logs to ensure that there is no unauthorized access or modification.

[0191] The present disclosure uses a differentiated verification method to verify the consistency and integrity of different categories of human resources data. First, it can build a multi-level security defense system. Even if a certain category of data is breached, other categories of data can still be protected. Second, through differentiated verification, it is possible to avoid using the same high-complexity verification method for all data, thereby improving the efficiency of data processing in the case of large amounts of data. Furthermore, by adopting different verification strategies, computing resources can be reasonably allocated, unnecessary computing overhead can be reduced, and at the same time, false positives and false negatives of data can be reduced, thereby reducing the cost of subsequent manual review.

[0192] In another exemplary embodiment, in step S600, securely storing different types of human resource data after security verification includes:

[0193] S601: Classify and store different categories of human resources data that have passed security verification;

[0194] In this step, public-level data can be stored in a relatively open database, such as the relational database MySQL. Internal-use and sensitive-level data can be stored in a more protected database, such as the relational database PostgreSQL with access control function to limit access rights. Highly sensitive-level data can be stored in a high-level database, such as the database system Oracle Database with Advanced Security with advanced security features to implement the strictest access control.

[0195] By storing data in categories with different sensitivity levels, more effective management and protection can be achieved.

[0196] S602: adopt different backup strategies for the human resources data stored in different categories;

[0197] In this step, the present disclosure has formulated different backup strategies for each database mentioned above, including backup frequency, backup scope and backup storage location. For example: for public-level data, daily incremental backup and weekly full backup are adopted, and the backup files are stored in the local server; for internal-use and sensitive-level data, daily full backup is adopted, and the backup files are stored in the local server and cloud storage service; for highly sensitive-level data, daily full backup is adopted, and the backup files are encrypted and stored in a high-security cloud storage service, and multiple copies are set for redundancy.

[0198] The present disclosure sets different backup strategies for different databases. First, it can achieve layered defense. Even if the backup of a database is destroyed or leaked, the data of other databases can still be protected. Second, it can improve data recovery efficiency. For example, for highly sensitive data (such as employee salary records, ID card numbers, etc.), more frequent full backups and multi-copy redundancy can be used to restore data faster when data is lost or damaged, thereby reducing business interruption time. Third, by storing backup files in multiple locations (such as local servers and cloud storage services), data availability and disaster recovery capabilities can be improved, so that even if a location fails, data can still be recovered from other locations, ensuring the integrity and accessibility of key human resources information. In short, this multi-level backup strategy not only improves data security and recovery speed, but also enhances the overall resilience and reliability of the system, providing solid data protection for human resources management.

[0199] S603: Implement different access controls on different categories of backed-up human resources data.

[0200] In this step, the disclosure defines different user roles according to different categories of data and user responsibilities, and assigns corresponding access rights to each role. For example: for public-level data, all employees can access it, but can only view it and cannot modify it; for internal-use and sensitive-level data, only HR specialists and direct supervisors can access it, set read and write permissions, and limit the scope of write operations; for example, suppose there is a table performance_records containing employee performance records, and HR specialists are required to read and write data, but can only update specific fields (such as annual assessment scores) and cannot modify other fields (such as employee ID). The specific examples are as follows:

[0201] 1. Create roles and users:

[0202] -- Create a character

[0203] CREATE ROLE hr_specialist;

[0204] -- Create a user and assign roles

[0205] CREATE USER hr_user WITH PASSWORD 'securepassword';

[0206] GRANT hr_specialist TO hr_user;

[0207] 2. -- Grant read permission

[0208] GRANT SELECT ON performance_records TO hr_specialist;

[0209] -- Grant write permission, but limit the scope of the write operation

[0210] GRANT UPDATE (annual_score) ON performance_records TO hr_specialist;

[0211] 3. Verify permissions

[0212] -- HR specialist logs in and tries to update the annual assessment score

[0213] \c - hr_user

[0214] UPDATE performance_records SET annual_score = 95 WHERE employee_id =1001;

[0215] -- Try to update other fields (should fail)

[0216] UPDATE performance_records SET employee_id = 1002 WHERE employee_id = 1001; -- should fail

[0217] For highly sensitive data, only designated HR specialists and senior managers can access it, and they must pass multi-factor authentication to access it, and set more stringent read and write permissions. For example, suppose there is a table salary_records containing employee salary information, which can only be accessed by designated HR specialists and senior managers, and they must pass multi-factor authentication. The specific example is as follows:

[0218] 1. Create roles and users

[0219] -- Create a role

[0220] CREATE ROLE senior_hr;

[0221] -- Create users and assign roles

[0222] CREATE USER hr_admin IDENTIFIED BY 'securepassword';

[0223] GRANT senior_hr TO hr_admin;

[0224] 2. Set table-level permissions

[0225] -- Grant read and write permissions

[0226] GRANT SELECT, INSERT, UPDATE, DELETE ON salary_records TO senior_hr;

[0227] 3. Enable multi-factor authentication

[0228] Oracle Database supports a variety of multi-factor authentication methods, such as using Oracle Advanced Security Option (ASO) and third-party authentication tools (such as Radius, LDAP, etc.). The following is a simple example to configure Oracle ASO for multi-factor authentication:

[0229] 1) Configure multi-factor authentication

[0230] Edit the sqlnet.ora file and add multi-factor authentication related configuration:

[0231] # Configure the authentication service used by Oracle Net Services. Here, BEQ (Bequeath) and TCPS (Transport Layer Security over TCP) are enabled.

[0232] SQLNET.AUTHENTICATION_SERVICES = (BEQ, TCPS)

[0233] # Configure method data and disable source routing (SOURCE_ROUTE=NO) to prevent potential security risks.

[0234] SQLNET.METHOD_DATA = (SOURCE_ROUTE=NO)

[0235] 2) Configure user authentication

[0236] Configure the connection string in tnsnames.ora, making sure to use a secure connection method (such as SSL / TLS).

[0237] # Define a connection descriptor named ORCL.

[0238] ORCL =

[0239] (DESCRIPTION =

[0240] # Specify the address information of the database server.

[0241] (ADDRESS =

[0242] # Use TCP protocol for communication.

[0243] (PROTOCOL = TCP)

[0244] # The host name or IP address of the database server.

[0245] (HOST = your_host)

[0246] # The port number that the database server listens on.

[0247] (PORT = 1521) )

[0249] # The connection data section specifies how to connect to the database instance.

[0250] (CONNECT_DATA =

[0251] #Specifies the use of dedicated server mode.

[0252] (SERVER = DEDICATED)

[0253] # The service name of the database.

[0254] (SERVICE_NAME = orcl) )

[0256] #Security configuration section, specify the wallet directory path for storing certificates and keys.

[0257] (SECURITY =

[0258] (MY_WALLET_DIRECTORY = / path / to / wallet) ) )

[0261] The following is a detailed description of the above procedure:

[0262] 1) SQLNET.AUTHENTICATION_SERVICES = (BEQ, TCPS)

[0263] BEQ: Bequeath protocol, allowing clients and servers to communicate through shared memory on the same machine.

[0264] TCPS: Transport Layer Security protocol, providing encrypted communication based on SSL / TLS.

[0265] 2) SQLNET.METHOD_DATA = (SOURCE_ROUTE=NO)

[0266] SOURCE_ROUTE=NO: Disable the source routing function to prevent malicious users from attacking through intermediate nodes.

[0267] 3) ORCL = (DESCRIPTION = ...)

[0268] ORCL: Defines the name of a connection descriptor by which the client can connect to the database.

[0269] 4) (ADDRESS = (PROTOCOL = TCP)(HOST = your_host)(PORT = 1521))

[0270] PROTOCOL = TCP: Specifies to use the TCP protocol for communication.

[0271] HOST = your_host: Specifies the host name or IP address of the database server.

[0272] PORT = 1521: Specifies the port number that the database server listens on. The default is 1521.

[0273] 5) (CONNECT_DATA=(SERVER= DEDICATED)(SERVICE_NAME = orcl))

[0274] SERVER = DEDICATED: Specifies the use of dedicated server mode, where each client connection has a separate server process.

[0275] SERVICE_NAME = orcl: Specifies the service name of the database, which is the unique identifier of the database instance.

[0276] 6) (SECURITY = (MY_WALLET_DIRECTORY = / path / to / wallet))

[0277] MY_WALLET_DIRECTORY = / path / to / wallet: Specifies the path to the wallet directory, which contains the certificate and key files required for authentication between the client and the server.

[0278] With the above configuration, you can ensure the security and reliability of your database connection, especially when dealing with highly sensitive data.

[0279] The disclosure can significantly enhance the security and privacy protection of human resources data by implementing different access controls on different categories of human resources data that have been backed up. By setting differentiated access rights for human resources data of different sensitivity levels, it is ensured that only authorized users can access data of the corresponding level, thereby reducing the risk of internal data leakage. For example, public-level data can be viewed by all employees but cannot be modified, while highly sensitive data (such as salary information) is only accessible to designated HR specialists and senior management, and requires multi-factor authentication. This fine-grained access control not only prevents unauthorized data access, but also improves the overall security of the system and ensures the integrity and confidentiality of human resources data in backup storage. In addition, strict access control also helps meet compliance requirements and reduce legal and regulatory risks.

[0280] In another exemplary embodiment, the present disclosure further provides a human resources data security assurance system, wherein the system applies the method described in any of the preceding items.

[0281] In another exemplary embodiment, Figure 2 As shown, the present disclosure also provides a human resources data security assurance device, which includes: a classification module 100, used to classify the acquired human resources data to obtain human resources data of different categories; a preprocessing module 200, used to preprocess the human resources data of different categories; an encryption module 300, used to encrypt the human resources data of different categories after preprocessing; a transmission module 400, used to transmit the encrypted human resources data of different categories; a verification module 500, used to perform security verification on the human resources data of different categories after transmission; and a storage module 600, used to securely store the human resources data of different categories after security verification.

[0282] In another exemplary embodiment, the present disclosure further provides a human resources data security assurance system, the system comprising the device as described above.

[0283] In another exemplary embodiment, the present disclosure further provides a storage medium, which includes instructions, and when the instructions are executed on a computer, the computer executes the method as described in any of the preceding items.

[0284] In another exemplary embodiment, the present invention discloses an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any of the preceding items when executing the program.

[0285] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for ensuring the security of human resources data, characterized in that: The method comprises: Classify the acquired human resource data to obtain different categories of human resource data; Pre-process different categories of human resource data; Encrypt different categories of pre-processed human resources data; Transmit encrypted human resources data of different categories; Conduct security verification on different categories of human resources data after transmission; Safely store different categories of human resources data after security verification.

2. The method according to claim 1, characterized in that Preferably, the categorizing of the acquired human resources data includes: Identify different categories of human resources data and label different categories of human resources data; The different categories of human resources data are graded based on data sensitivity.

3. The method according to claim 1, characterized in that The pre-processing of different types of human resources data includes: Cleaning the classified human resources data; Filling missing values ​​in the cleaned human resources data; The human resource data after missing value filling is standardized.

4. A human resources data security system, characterized in that: The system applies the method according to any one of claims 1 to 3.

5. A human resources data security protection device, characterized in that: The device comprises: A classification module, used for classifying the acquired human resource data to obtain human resource data of different categories; Preprocessing module, used to preprocess different categories of human resource data; An encryption module, used for encrypting different categories of pre-processed human resource data; A transmission module, used for transmitting encrypted human resources data of different categories; Verification module, used to perform security verification on different categories of human resource data after transmission; The storage module is used to securely store different categories of human resources data after security verification.

6. A human resources data security system, characterized in that: The system comprises the device of claim 5.

7. A storage medium, characterized in that: The method comprises instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 3.

8. An electronic device, characterized in that: The electronic device comprises: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 3 is implemented.

Images