Electrical data level-to-level management method and related product

Abstract

The invention relates to the technical field of electrical data management, in particular to an electrical data level-to-level management method and related products, and the method comprises the steps: constructing a multi-level database, distributing an initial authority level for each user, adjusting the real-time authority level of the user, and then establishing an encryption communication mechanism between the user and the corresponding database; according to the method, the multi-dimensional dynamic authority control model is adopted, the access authority is automatically adjusted according to the operation scene and the authority level of the user, the unauthorized operation is avoided, and the flexibility and the safety of the system are improved; through combined application of AES encryption and homomorphic encryption, the multi-modal identity authentication model can monitor behaviors and environment characteristics of a user in real time, detect abnormal operation in time, effectively deal with potential security threats through two-factor authentication, and ensure continuity and security of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of electrical data management, and in particular to an electrical data hierarchical management method and related products. Background Art

[0002] With the widespread application and increasing complexity of electrical equipment data, how to effectively manage and secure electrical data has become an urgent problem to be solved. In the prior art, most electrical data management systems mainly rely on fixed permission control mechanisms. User access rights are often set once during system initialization and cannot be dynamically adjusted according to actual operation scenarios. This fixed permission control method is too rigid when facing complex and changeable application scenarios, and is prone to problems such as unauthorized operations and data leakage.

[0003] At the same time, current data encryption technology is mostly used to ensure the security of static data transmission, but is still insufficient for data security protection during dynamic operations. Especially in cases involving highly sensitive data (such as confidential data), although traditional encryption methods (such as AES) are excellent in efficiency, they cannot support data operations in an encrypted state, limiting their application in scenarios with high security requirements.

[0004] In addition, existing user identity authentication mostly uses single-factor authentication or two-factor authentication, which mainly relies on one-time authentication at login, lacking real-time monitoring of user operations and timely handling of abnormal behaviors. Once an attacker enters the system through legitimate initial authentication, existing technologies are difficult to effectively identify and handle subsequent abnormal operations, increasing the risk of security threats to the system.

[0005] Therefore, the existing technology still has a lot of room for improvement in dynamic permission management, encrypted communication and real-time identity authentication. There is an urgent need for an innovative solution that can perform hierarchical management of electrical data, which can not only dynamically adjust user permissions, but also ensure the encrypted transmission and processing of data in high-security scenarios, and effectively respond to abnormal user behavior. Summary of the invention

[0006] The technical problem to be solved by the present invention is the rigid authority control mechanism, insufficient data encryption security, and lack of real-time monitoring and abnormal response capabilities in the existing electrical data management system. The purpose is to provide an electrical data hierarchical management method and related products, which realizes electrical data hierarchical management based on multi-dimensional dynamic authority control, multi-modal identity authentication and encrypted communication, can dynamically adjust user permissions according to different scenarios, ensure the security of sensitive data transmission, monitor user operations in real time, handle abnormal behaviors in a timely manner, and ensure the overall security and flexibility of the system.

[0007] The present invention is achieved through the following technical solutions:

[0008] An electrical data hierarchical management method, comprising:

[0009] Build a multi-level database and determine the initial permission level of each user. Each initial permission level is adapted to the corresponding level of the database.

[0010] Verify the processed username and password received. If the verification is successful, the login request is approved; if the verification is unsuccessful, the login request is rejected;

[0011] Determine the initial permission level of the logged-in user and determine the real-time permission level of the logged-in user through a multi-dimensional permission control model;

[0012] Establishing encrypted communication between users and databases of corresponding levels;

[0013] When a user operates on the database, the user's identity is monitored in real time based on the multimodal identity authentication model. If abnormal behavior is triggered, the encrypted communication between the user and the database is interrupted and two-factor authentication is performed;

[0014] If the authentication is successful, the encrypted communication between the user and the database of the corresponding level is re-established; if the authentication is not successful, the connection with the user is disconnected.

[0015] Specifically, the user name and password are processed on the user side, and the processing method includes:

[0016] The client verifies whether the username and password format is as expected, introduces security checks to prevent SQL injection attacks and XSS cross-site scripting attacks, and escapes the input characters;

[0017] Use a hash algorithm to perform salted hashing on the escaped password to obtain the encrypted password;

[0018] Methods for verifying usernames and passwords include:

[0019] Receive the escaped username and encrypted password through the encrypted channel, and check whether the corresponding username exists in the database; if not, return an error message; if so, obtain the salted hash password of the username stored in the database, perform secondary hashing on the encrypted password, and compare the secondary hash result with the hash value of the encrypted password in the database;

[0020] If the comparison results are consistent, the verification is successful; if the comparison results are inconsistent, a password error message is returned.

[0021] Specifically, the method of constructing a multi-level database includes:

[0022] Set up level 1 database, level 2 database, ..., level N database according to access permissions;

[0023] Configure an independent username for each user and configure the initial permission level for each username based on the user permissions. 0 , n 0 ≤N; Different initial permission levels correspond to different levels of databases;

[0024] Determine the status of operation scenarios, including working hours operation scenarios, non-working hours operation scenarios and unauthorized operation scenarios;

[0025] Build a permission rule library. If the user is in the working hours operation scenario, the real-time permission level n = n 0 ; If the user is in non-working hours, the real-time permission level n = n 0 -n′≥0; if the user is in an unauthorized operation scenario, the user will be subject to two-factor authentication;

[0026] If two-factor authentication is passed, the real-time permission level n = n 0 +n″≤N, if two-factor authentication fails, the real-time permission level n=n 0 ; n′ and n″ are set natural numbers;

[0027] The method for determining that the user is in an unauthorized operation scenario includes:

[0028] Receive unauthorized requests initiated by users;

[0029] Determine the user's initial permission level coefficient

[0030] Determine the operation type coefficient of the unauthorized request O t ∈[0, 1], 0 represents normal operation, 1 represents high-risk operation;

[0031] Determine the user's credibility score U s ∈[0, 1];

[0032] Calculate the override score S e =γ 1 ·U s +γ 2 ·O t +γ 3 ·N 0 , where γ 1 , γ 2 , γ 3 is the corresponding weight coefficient;

[0033] Set the over-authorization threshold T e , if S e ≥Te , it is determined that the unauthorized operation scenario has been entered; otherwise, it is determined that the unauthorized operation scenario has not been entered.

[0034] Specifically, the method for establishing encrypted communication between a user and a database of a corresponding level includes:

[0035] According to the sensitivity of the data in the database, N databases in the multi-level database are divided into ordinary databases and confidential databases;

[0036] AES encryption technology is used for communication with common databases, and homomorphic encryption technology is used for communication with confidential databases.

[0037] Optionally, the method of using AES encryption technology to perform encrypted communication includes:

[0038] Generate dynamic key Among them, K base is the predefined basic key, D meta is the data element information, f 1 (·) is a hash function for extracting or processing data metadata, and H(·) is a secure hash function;

[0039] Determine the nonlinear dynamic S-box, Nonlinear Dynamic Inverse S-Box Among them, S dyn (x) is the dynamic S-box replacement value, S(x) is the traditional fixed S-box replacement value, is the dynamic inverse S-box replacement value, S -1 (x) is the traditional fixed inverse s-box replacement value, H(K base ) is the hash value of the base key;

[0040] Determine the encryption round Among them, R base is the basic round set, L data is the length of the data to be encrypted, M 1 To control the adjustment coefficient of the round change range, M 2 The modulus value of the round to limit the range of round changes;

[0041] The transmission data is encrypted by performing R rounds of encryption using a dynamic key and a nonlinear dynamic S-box to obtain encrypted data; the data is encrypted and decrypted by performing R rounds of encryption and decryption using a dynamic key and a nonlinear dynamic inverse S-box to obtain transmission data.

[0042] Optionally, the method of using homomorphic encryption technology to perform encrypted communication includes:

[0043] Generate a multi-layer Paillier key pair, where the i-th layer key pair is is the public key of the i-th layer, is the private key of the i-th layer, and distributes the public keys of all key pairs;

[0044] The data will be transmitted sum Divide into m segments, and perform Paillier encryption on each ciphertext to obtain the encrypted ciphertext Wherein, k = 1, 2, 3 ... m, r is the random number during encryption, g and q are public key parameters; and the real-time noise value in the process of encrypting the transmission data using the i-th layer key is determined. If the noise value is greater than the set threshold, the transmission data is re-encrypted by switching to the i+1-th layer key;

[0045] Perform homomorphic addition operations on all encrypted ciphertexts to obtain the combined ciphertext

[0046] Decrypt the combined ciphertext to obtain the transmission data m sum , Among them, λ is the private key parameter, and L(·) is the decryption function of Paillier encryption.

[0047] Specifically, the method based on multimodal identity authentication model monitoring includes:

[0048] Obtain user behavior characteristics and user environment characteristics. User behavior characteristics include: typing speed feature vector, click frequency feature vector, screen sliding feature vector, mouse movement feature vector; user environment characteristics include: device IP address vector, device geographic location vector, access time feature vector;

[0049] Standardize user behavior characteristics and user environment characteristics;

[0050] Determine the bias score for each feature Among them, S feature is the current eigenvalue, μ norm is the historical characteristic mean, σ norm is the historical standard deviation;

[0051] Building a dynamic scoring model Among them, S mod For dynamic scoring, S feature，j is the deviation score of the jth feature, α j is the weight parameter of the jth feature, J is the total number of user behavior features and user environment features;

[0052] Set a safety threshold. If the dynamic score is less than the safety threshold, abnormal behavior is triggered.

[0053] Specifically, two-factor authentication methods include:

[0054] When building a multi-level database, the user's biometric data is entered and a biometric template is generated. The biometric data includes fingerprints, face or voice;

[0055] When requesting authentication, capture the current user's biometric data;

[0056] Calculate the matching degree between the biometric data of the input user and the biometric data of the current user Where X is the number of verified biometric data, Sim(·) is the similarity calculation function, To enter the user's vth biometric data, To capture the vth biometric data of the user;

[0057] Set the verification threshold. If the matching degree is greater than the verification threshold, the verification passes; if the matching degree is not greater than the verification threshold, the verification fails.

[0058] An electrical data hierarchical management terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electrical data hierarchical management method as described above is implemented.

[0059] A computer program product comprises a computer program / instruction, which implements the electrical data hierarchical management method as described above when executed by a processor.

[0060] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0061] The present invention constructs a multi-level database and assigns an initial permission level to each user. The real-time permission level of the user is dynamically adjusted through a multi-dimensional permission control model to ensure the user's permission adaptation in different operation scenarios. At the same time, an encrypted communication mechanism is established between the user and the corresponding database. AES encryption is used for ordinary data, and homomorphic encryption is used for sensitive data, which enhances the security of data transmission and processing. Finally, the system also adopts a multimodal identity authentication model to monitor the user's behavioral characteristics and environmental characteristics in real time, such as typing speed, IP address, geographic location, etc. When abnormal behavior is detected, two-factor authentication is automatically triggered to ensure the legitimacy of the user. If the two-factor authentication is passed, the encrypted connection is re-established, otherwise the connection is disconnected.

[0062] The present invention adopts a multi-dimensional dynamic permission control model, which realizes automatic adjustment of access rights according to the user's operation scenario and permission level, avoids unauthorized operation, and improves the flexibility and security of the system; through the combined application of AES encryption and homomorphic encryption, it not only improves the encryption transmission efficiency of ordinary data, but also provides higher security for the processing of sensitive data. In addition, the multimodal identity authentication model can monitor the user's behavior and environmental characteristics in real time, detect abnormal operations in time, and effectively respond to potential security threats through two-factor authentication to ensure the continuity and security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings illustrate exemplary embodiments of the present invention and, together with the description thereof, are used to explain the principles of the present invention. These drawings are included to provide a further understanding of the present invention, and the accompanying drawings are included in and constitute a part of this specification and do not constitute a limitation of the embodiments of the present invention.

[0064] Figure 1 It is a flow chart of an electrical data hierarchical management method according to the present invention. DETAILED DESCRIPTION

[0065] To make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and implementation methods. It is understood that the specific implementation methods described herein are only used to explain the relevant content, rather than to limit the present invention.

[0066] It should also be noted that, for the convenience of description, only the parts related to the present invention are shown in the drawings.

[0067] In the absence of conflict, the embodiments and features of the embodiments of the present invention may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0068] Embodiment 1

[0069] like Figure 1 As shown, a method for hierarchical management of electrical data includes:

[0070] Build a multi-level database and determine the initial permission level for each user. Each initial permission level is adapted to the corresponding level of the database.

[0071] The system has built multiple databases for users with different permissions, and each database stores data of corresponding sensitivity. When each user logs into the system, an initial permission level is assigned according to their identity information (such as user role, position, responsibilities, etc.), which corresponds to a certain level of database access rights. Through this multi-level database design, high-privilege users can access more sensitive data, while low-privilege users can only access relatively public or ordinary data.

[0072] The initial permission level refers to the access rights that are pre-set by the system when the user logs in to the system. The system determines the confidentiality level of the data that the user can access based on the user's position in the enterprise, such as general data, confidential data, top-secret data, etc. At the same time, it can also be divided into different attributes, for example, HR can access personnel data, engineers can access corresponding R&D data, etc.), and then assigns the user an initial permission level to adapt to the database level that he can access.

[0073] The received processed username and password are verified. If the verification passes, the login request is approved; if the verification fails, the login request is rejected.

[0074] After the user enters the username and password, the information is first processed. The purpose of the processing is to ensure the security of the input (for example, to prevent SQL injection and cross-site scripting attacks). Next, the system verifies the validity of the username and password through an encrypted channel. If the system finds the corresponding username in the database and the password matches, the login is successful and the user obtains the initial permission level; if the verification fails, the login is denied to prevent unauthorized users from entering the system.

[0075] Determine the initial permission level of the logged-in user and determine the real-time permission level of the logged-in user through a multi-dimensional permission control model.

[0076] After the user successfully logs in, the system dynamically adjusts the user's real-time permissions based on the user's initial permission level and the multi-dimensional permission control model. The multi-dimensional permission control model not only considers the user's initial permissions, but also combines factors such as the operation scenario (such as working hours, unauthorized requests, etc.), the sensitivity of access data, and the user's credibility score to determine the user's real-time permissions. This dynamic adjustment mechanism ensures that the user's permissions can be adjusted in a timely manner in different operation scenarios to prevent unauthorized access or misoperation.

[0077] Establish encrypted communication between the user and the database of the corresponding level; once the system determines the real-time permissions of the user, it will establish a secure encrypted communication channel between the user and the database of the corresponding permission level. Encrypted communication ensures that the data transmission of the user when interacting with the database is secure and cannot be intercepted or tampered with by a third party. For ordinary data, the system may use AES encryption for fast and efficient encrypted communication; for confidential data, homomorphic encryption is used to support data operations in an encrypted state, further improving the security of sensitive data.

[0078] When a user operates on the database, the user's identity is monitored in real time based on the multimodal identity authentication model. If abnormal behavior is triggered, the encrypted communication between the user and the database is interrupted and two-factor authentication is performed.

[0079] During the interaction between the user and the database, the system monitors the user's operation behavior in real time through a multimodal identity authentication model. The model combines the user's behavioral characteristics (such as typing speed, mouse track, click frequency, screen sliding speed, etc.) and environmental characteristics (such as IP address, geographic location, etc.) to determine the legitimacy of the user's identity. If the system detects abnormalities in the user's behavior or environment (such as sudden changes in behavior patterns), the system will immediately interrupt the encrypted communication with the database to prevent data leakage or illegal operations, and trigger two-factor authentication to further verify the user's identity.

[0080] If the authentication is successful, the encrypted communication between the user and the database of the corresponding level is re-established; if the authentication is not successful, the connection with the user is disconnected.

[0081] When two-factor authentication is triggered, the system will require the user to provide additional verification information (such as fingerprints, biometrics, or a one-time verification code). If the user passes the two-factor authentication, the system will resume encrypted communication and allow the user to continue to operate the database; if the user fails to pass the verification, the system will disconnect the user from the database to prevent potential security threats.

[0082] Embodiment 2

[0083] This embodiment provides a method for a user to log in using a user name and password.

[0084] The user name and password are processed on the user side. The processing methods include:

[0085] The user end verifies whether the format of the user name and password meets the expected format requirements. The user end first checks whether the input user name and password meet the expected format requirements, such as character length and character type (letters, numbers, special symbols, etc.) to ensure the rationality of the input data. For passwords, certain complexity standards can also be required, such as including uppercase and lowercase letters, numbers and special symbols, etc., to enhance the strength of the password.

[0086] And introduce security checks to prevent SQL injection attacks and XSS cross-site scripting attacks, and escape the input characters. The client performs security checks on the input username and password, identifies and filters out characters that may cause security vulnerabilities. The input characters will be escaped, for example, special characters (such as ', ", <, >, etc.) are converted into safe character representations to avoid the execution of malicious code.

[0087] The escaped password is hashed with salt using a hash algorithm to obtain an encrypted password; on the user side, the escaped password is hashed with salt. The hash algorithm is an irreversible encryption algorithm that converts a password into a hash value of fixed length. To prevent rainbow table attacks, the system generates a random "salt" for each user's password, combines the salt with the password, and hashes it to obtain the encrypted password.

[0088] Methods for verifying usernames and passwords include:

[0089] The processed username and encrypted password are transmitted to the server through an encrypted channel (such as SSL / TLS encryption) to ensure the security of data during transmission and prevent the data from being intercepted or tampered with by a third party.

[0090] Receive the escaped username and encrypted password through the encrypted channel, and check whether the corresponding username exists in the database; if not, return an error message.

[0091] If it exists, obtain the salted hash password of the user name stored in the database, perform a secondary hash on the encrypted password, and compare the secondary hash result with the hash value of the encrypted password in the database;

[0092] If the comparison results are consistent, the verification is successful; if the comparison results are inconsistent, a password error message is returned.

[0093] Embodiment 3

[0094] Methods for building a multi-level database include:

[0095] According to the access rights, set up level 1 database, level 2 database, ..., N level database; each level database stores the data of corresponding permissions. The higher the level, the higher the sensitivity and security requirements of the data. This multi-level database design can ensure that high-privilege users can access more sensitive data, while low-privilege users can only access relatively public or ordinary data, forming an effective hierarchical protection mechanism.

[0096] Configure an independent username for each user and configure the initial permission level for each username based on the user permissions.0 , n 0 ≤N; Different initial permission levels correspond to different levels of databases; The initial permission level indicates the level of database that the user can initially access, and different permission levels correspond to different levels of databases. For example, managers may have higher permissions, while ordinary personnel may only have level 1 permissions.

[0097] Determine the status of operation scenarios, including working hours operation scenarios, non-working hours operation scenarios and unauthorized operation scenarios;

[0098] Build a permission rule library. If the user is in the working hours operation scenario, the real-time permission level n = n 0 ; If the user is in non-working hours, the real-time permission level n = n 0 -n′≥0; if the user is in an unauthorized operation scenario, two-factor authentication will be performed on the user; the system will determine which operation scenario the user is in based on the user's current status. Working hours scenario refers to the user performing legal operations during normal working hours; non-working hours scenario refers to the user performing operations during non-working hours, and the system usually imposes certain restrictions on their permissions; unauthorized operation scenario refers to the user requesting an operation that exceeds the scope of their permissions.

[0099] That is, the user's permissions are reduced during non-working hours. The specific reduction can be flexibly adjusted, and can even be reduced to level 0 (users cannot log in to the system and perform any operations after get off work hours), ensuring that users cannot access highly sensitive data during non-working hours.

[0100] If two-factor authentication is passed, the real-time permission level n = n 0 +n″≤N, if two-factor authentication fails, the real-time permission level n=n 0 ; n′ and n″ are set natural numbers; that is, if an unexpected situation occurs, the user can apply for a temporary increase in authority to query some information that exceeds his authority.

[0101] The method for determining that the user is in an unauthorized operation scenario includes:

[0102] Receive unauthorized requests initiated by users;

[0103] Determine the user's initial permission level coefficient Calculate the ratio of the user's initial permissions to the maximum permissions to quantify the proportion of the user's current permissions.

[0104] Determine the operation type coefficient of the unauthorized request O t ∈[0, 1 ], 0 represents a normal operation (such as viewing general data), and 1 represents a high-risk operation (such as modifying sensitive data); the coefficient is scored according to the type of operation requested by the user.

[0105] Determine the user's credibility score U s ∈[0, 1]; Based on the user's historical behavior and operation records, the system assigns a credibility score to the user. A higher score indicates that the user's behavior is more credible and may be approved for higher permissions.

[0106] Calculate the override score S e =γ 1 ·U s +γ 2 ·O t +γ 3 ·N 0 , where γ 1 , γ 2 , γ 3 is the corresponding weight coefficient; ensure that the impact of each coefficient on the overriding score is reasonably set according to the needs. The specific value of the weight coefficient can be adjusted according to the actual situation.

[0107] Set the over-authorization threshold T e , if S e ≥T e , it is determined that the unauthorized operation scenario has been entered; otherwise, it is determined that the unauthorized operation scenario has not been entered.

[0108] Embodiment 4

[0109] Methods for establishing encrypted communication between a user and a database of a corresponding level include:

[0110] According to the sensitivity of the data in the database, the N databases in the multi-level database are divided into ordinary databases and confidential databases; ordinary databases contain relatively insensitive data, and the access and processing of these data usually do not require high security. Confidential databases store sensitive or high-risk data, which may have a serious impact on system security or business operations once leaked or accessed without authorization. Therefore, the protection of confidential data requires a higher level of security measures.

[0111] AES encryption technology is used for communication with common databases, and homomorphic encryption technology is used for communication with confidential databases.

[0112] The advantages of AES are fast encryption and decryption speed, low computational overhead, and suitable for fast transmission of large amounts of data. For insensitive data in ordinary databases, AES encryption can provide sufficient security to prevent data from being intercepted or tampered with during transmission.

[0113] Homomorphic encryption allows operations to be performed directly on encrypted data while the data is encrypted, without having to decrypt the data first. This is critical for highly sensitive data in confidential databases. Using homomorphic encryption can avoid exposing data to a decrypted state during data transmission or processing, maximizing the confidentiality of the data. With homomorphic encryption, even if an attacker intercepts the encrypted data, they cannot obtain useful information without decrypting it.

[0114] The following is a detailed explanation of AES encryption and homomorphic encryption.

[0115] Methods for encrypting communications using AES encryption include:

[0116] Generate dynamic key Among them, K base is the predefined basic key, D meta is the data element information, f 1 (·) is a hash function for extracting or processing data metadata, and H(·) is a secure hash function. By introducing dynamic metadata, the key is different in each encryption process, which improves security and prevents key reuse attacks.

[0117] Determine the nonlinear dynamic S-box, Among them, S dyn (x) is the dynamic S-box replacement value, S(x) is the traditional fixed S-box replacement value, H(K base ) is the hash value of the base key, which disturbs the replacement value of the S-box, making the replacement rule of the S-box no longer fixed, increasing the complexity and unpredictability.

[0118] Nonlinear Dynamic Inverse S-Box in, is the dynamic inverse S-box replacement value, S -1 (x) is the traditional fixed inverse S-box replacement value.

[0119] Determine the encryption round Among them, R base is the basic round set, L data is the length of the data to be encrypted, M 1 To control the adjustment coefficient of the round change range, M 2 The modulus value of the round is used to limit the range of round changes; the rounds of AES encryption are dynamically adjusted according to the data length to ensure that the encryption strength matches the data size, thereby optimizing the efficiency and security of encryption.

[0120] The encrypted data is obtained by performing R rounds of encryption on the transmitted data using a dynamic key and a nonlinear dynamic S-box; in each round of encryption, the dynamic S-box is used to replace the byte value in the data to ensure that the encryption results of different data are different, while increasing the complexity and anti-attack capability of the ciphertext.

[0121] The data is encrypted and decrypted for R rounds using a dynamic key and a nonlinear dynamic inverse S-box to obtain the transmitted data. The system uses the same dynamic key and nonlinear dynamic inverse S-box as used for encryption to perform multiple rounds of decryption operations. The decryption steps correspond to the encryption process, and the plaintext of the data is restored through the inverse S-box in each round to ensure the symmetry of the encryption and decryption operations.

[0122] The method in this embodiment enhances the security and flexibility of AES encryption technology through dynamic keys, nonlinear dynamic S-boxes and round adjustment. The use of dynamic keys and dynamic S-boxes ensures that each encryption process is different, and round adjustment flexibly controls the encryption strength according to the amount of data, thereby optimizing the efficiency of encryption while ensuring data security.

[0123] Methods for encrypted communication using homomorphic encryption techniques include:

[0124] Generate a multi-layer Paillier key pair, where the i-th layer key pair is is the public key of the i-th layer, is the private key of the i-th layer, and the public keys of all key pairs are distributed; the key is used for hierarchical encryption, and key pairs at different levels are switched according to the changes in noise during data transmission.

[0125] The data will be transmitted sum Divide into m segments, and perform Paillier encryption on each ciphertext to obtain the encrypted ciphertext Among them, k = 1, 2, 3...m, r is the random number used for encryption, g and q are public key parameters; each data segment is encrypted through Paillier encryption to ensure that even if the data is intercepted, it cannot be deciphered.

[0126] And determine the real-time noise value in the process of encrypting the transmission data using the i-th layer key. If the noise value is greater than the set threshold, switch to the i+1-th layer key to re-encrypt the transmission data; in the process of homomorphic encryption, the noise value of the ciphertext will increase with the encryption operation and homomorphic operation. In order to ensure that the noise does not exceed the acceptable range during decryption, the system monitors the real-time noise generated during the encryption process. If the noise value of a certain layer of keys exceeds the preset threshold, the system will switch to the next layer of keys.

[0127] Perform homomorphic addition operations on all encrypted ciphertexts to obtain the combined ciphertext

[0128] Decrypt the combined ciphertext to obtain the transmission data m sum , Among them, λ is the private key parameter, and L(·) is the decryption function of Paillier encryption.

[0129] Embodiment 5

[0130] Methods based on multimodal identity authentication model monitoring include:

[0131] Obtain user behavior characteristics and user environment characteristics. User behavior characteristics include: typing speed feature vector, click frequency feature vector, screen sliding feature vector, mouse movement feature vector, etc. User environment characteristics include: device IP address vector, device geographic location vector, access time feature vector, etc.

[0132] For example: Typing speed feature vector - records the speed and rhythm of the user's typing. Click frequency feature vector - records the frequency and pattern of the user's clicks. Sliding screen feature vector - if it is a touch screen device, records the speed, direction and strength of the user's sliding screen. Mouse movement feature vector - records the trajectory, speed, dwell time, etc. of the mouse movement. Device IP address vector - records the IP address of the device used by the user to identify whether the user operation occurs in a regular location. Device geographic location vector - determines the user's physical location through GPS or IP location. Access time feature vector - records the time period when the user accesses the system to determine whether the operation is performed within a reasonable time.

[0133] Standardize user behavior features and user environment features: In order to make various features comparable within a unified range, the system standardizes the collected user behavior and environment features. This step converts feature values ​​of different magnitudes into a standardized range (such as [0, 1]) for unified calculation and analysis.

[0134] Determine the bias score for each feature Among them, S feature is the current eigenvalue, μ norm is the historical characteristic mean, σ norm is the historical standard deviation; it is used to measure the degree of deviation between the current characteristics and the historical characteristics. The smaller the deviation, the closer the score is to 1; the larger the deviation, the closer the score is to 0.

[0135] Building a dynamic scoring model Among them, S mod For dynamic scoring, S feature，j is the deviation score of the jth feature, α j is the weight parameter of the jth feature, J is the total number of user behavior features and user environment features;

[0136] Set a security threshold, which is the lowest permissible score for user behavior within a reasonable range. If the dynamic score is less than the security threshold, abnormal behavior is triggered, and it is considered that the user behavior or environment is abnormal, triggering a security alert or further identity verification (such as two-factor authentication). If the user's dynamic score meets the security standard, the user's behavior is considered legal and the operation continues.

[0137] Embodiment 6

[0138] Two-factor authentication methods include:

[0139] When building a multi-level database, the user's biometric data is entered and a biometric template is generated. The biometric data includes fingerprints, face, voice and other possible biometric features;

[0140] When requesting authentication, the biometric data of the current user is captured; when fingerprint verification is performed, the system obtains the user's current fingerprint data through the fingerprint scanning device. Facial recognition obtains the user's current facial image through the camera. Voice verification collects the current user's voice through the microphone.

[0141] Calculate the matching degree between the biometric data of the input user and the biometric data of the current user Where X is the number of biometric data to be verified. For example, fingerprint data may contain multiple scanning positions, facial data may contain multiple angles, and voice data may contain different syllable segments. Sim(·) is the similarity calculation function. To enter the user's vth biometric data, To capture the vth biometric data of the user;

[0142] Set the verification threshold, which is the minimum standard that the match needs to meet, and is usually adjusted according to the system safety requirements and error tolerance.

[0143] If the matching degree is greater than the verification threshold, the system considers that the current user's biometrics match the entered data sufficiently and the verification is passed. If the matching degree is not greater than the verification threshold, the system considers that the current user's identity does not match, the verification fails, and the user is prevented from further operations.

[0144] Embodiment 7

[0145] An electrical data hierarchical management terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electrical data hierarchical management method as described above is implemented.

[0146] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an execution program required for at least one function, etc.

[0147] The data storage area can store data created according to the use of the terminal, etc. In addition, the memory may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0148] A computer program product comprises a computer program / instruction, which implements the electrical data hierarchical management method as described above when executed by a processor.

[0149] A computer program product includes a computer program or set of instructions for performing specific tasks or implementing specific functions. These programs or instructions are designed to be executed by a processor to implement a series of predefined steps or operations. The program product may be stored in various forms of computer storage media, such as memory, hard disk, solid-state drive, optical disk or other forms of digital storage devices. It may exist in the form of compiled binary code or in the form of scripts or bytecodes that can be executed by an interpreter. The program product uses carefully designed algorithms and logical instructions to enable the processor to process data in a specific order and manner to complete various functions such as data analysis, user interaction, device control, etc.

[0150] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments / methods or examples described in this specification and the features of the different embodiments / methods or examples, unless they are contradictory.

[0151] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0152] It should be understood by those skilled in the art that the above embodiments are only for the purpose of clearly illustrating the present invention, and are not intended to limit the scope of the present invention. For those skilled in the art, other changes or modifications may be made based on the above invention, and these changes or modifications are still within the scope of the present invention.

Claims

1. A method for hierarchical management of electrical data, characterized in that: include: Build a multi-level database and determine the initial permission level of each user. Each initial permission level is adapted to the corresponding level of the database. Verify the processed username and password received. If the verification is successful, the login request is approved; if the verification is unsuccessful, the login request is rejected; Determine the initial permission level of the logged-in user and determine the real-time permission level of the logged-in user through a multi-dimensional permission control model; Establishing encrypted communication between users and databases of corresponding levels; When a user operates on the database, the user's identity is monitored in real time based on the multimodal identity authentication model. If abnormal behavior is triggered, the encrypted communication between the user and the database is interrupted and two-factor authentication is performed; If the authentication is successful, the encrypted communication between the user and the database of the corresponding level is re-established; if the authentication is not successful, the connection with the user is disconnected.

2. The electrical data hierarchical management method according to claim 1, characterized in that: The user name and password are processed on the user side. The processing methods include: The client verifies whether the username and password format is as expected, introduces security checks to prevent SQL injection attacks and XSS cross-site scripting attacks, and escapes the input characters; Use a hash algorithm to perform salted hashing on the escaped password to obtain the encrypted password; Methods for verifying usernames and passwords include: Receive the escaped username and encrypted password through the encrypted channel, and check whether the corresponding username exists in the database; if not, return an error message; if so, obtain the salted hash password of the username stored in the database, perform secondary hashing on the encrypted password, and compare the secondary hash result with the hash value of the encrypted password in the database; If the comparison results are consistent, the verification is successful; if the comparison results are inconsistent, a password error message is returned.

3. The electrical data hierarchical management method according to claim 1, characterized in that: Methods for building a multi-level database include: Set up level 1 database, level 2 database, ..., level N database according to access permissions; Configure an independent username for each user, and configure an initial permission level n0 for each username based on the user's permissions, where n0≤N; different initial permission levels correspond to different levels of databases; Determine the status of operation scenarios, including working hours operation scenarios, non-working hours operation scenarios and unauthorized operation scenarios; Build a permission rule library. If the user is in the operating scenario during working hours, the real-time permission level n = n0; if the user is in the operating scenario during non-working hours, the real-time permission level n = n0-n′≥0; if the user is in an unauthorized operation scenario, perform two-factor authentication on the user; If the two-factor authentication is passed, the real-time permission level n=n0+n″≤N; if the two-factor authentication is not passed, the real-time permission level n=n0; n′ and n″ are set natural numbers; The method for determining that the user is in an unauthorized operation scenario includes: Receive unauthorized requests initiated by users; Determine the user's initial permission level coefficient Determine the operation type coefficient of the unauthorized request O t ∈[0, 1], 0 represents normal operation, 1 represents high-risk operation; Determine the user's credibility score U s ∈[0, 1]; Calculate the override score S e =γ1·U s +γ2·O t +γ3·N0, where γ1, γ2, and γ3 are corresponding weight coefficients; Set the over-authorization threshold T e , if S e ≥T e , it is determined that the unauthorized operation scenario has been entered; otherwise, it is determined that the unauthorized operation scenario has not been entered.

4. The electrical data hierarchical management method according to claim 1, characterized in that: Methods for establishing encrypted communication between a user and a database of a corresponding level include: According to the sensitivity of the data in the database, N databases in the multi-level database are divided into ordinary databases and confidential databases; AES encryption technology is used for communication with common databases, and homomorphic encryption technology is used for communication with confidential databases.

5. The electrical data hierarchical management method according to claim 4, characterized in that: Methods for encrypting communications using AES encryption include: Generate dynamic key Among them, K base is the predefined basic key, D meta is the data meta-information, f1(·) is the hash function for extracting or processing the data meta-information, and H(·) is the secure hash function; Determine the nonlinear dynamic S-box, Nonlinear Dynamic Inverse S-Box Among them, S dyn (x) is the dynamic S-box replacement value, S(x) is the traditional fixed S-box replacement value, is the dynamic inverse S-box replacement value, S -1 (x) is the traditional fixed inverse S-box replacement value, H(K base ) is the hash value of the base key; Determine the encryption round Among them, R base is the basic round set, L data is the length of the data to be encrypted, M1 is the adjustment coefficient for controlling the range of round changes, and M2 is the round modulus value for limiting the range of round changes; The transmission data is encrypted by performing R rounds of encryption using a dynamic key and a nonlinear dynamic S-box to obtain encrypted data; the data is encrypted and decrypted by performing R rounds of encryption and decryption using a dynamic key and a nonlinear dynamic inverse S-box to obtain transmission data.

6. The electrical data hierarchical management method according to claim 4, characterized in that: Methods for encrypted communication using homomorphic encryption techniques include: Generate a multi-layer Paillier key pair, where i The layer key pair is is the public key of the i-th layer, is the private key of the i-th layer, and distributes the public keys of all key pairs; The data will be transmitted sum Divide into m segments, and perform Paillier encryption on each ciphertext to obtain the encrypted ciphertext Wherein, k=1, 2, 3…m, r is the random number during encryption, g and q are public key parameters; and the real-time noise value in the process of encrypting the transmission data using the i-th layer key is determined. If the noise value is greater than the set threshold, the transmission data is re-encrypted by switching to the i+1-th layer key; Perform homomorphic addition operations on all encrypted ciphertexts to obtain the combined ciphertext Decrypt the combined ciphertext to obtain the transmission data m sum , in, λ is the private key parameter, and L(·) is the decryption function of Paillier encryption.

7. The electrical data hierarchical management method according to claim 1, characterized in that: Methods based on multimodal identity authentication model monitoring include: Obtain user behavior characteristics and user environment characteristics; Standardize user behavior characteristics and user environment characteristics; Determine the bias score for each feature Among them, S feature is the current eigenvalue, μ norm is the historical characteristic mean, σ norm is the historical standard deviation; Building a dynamic scoring model Among them, S mod For dynamic scoring, s feature，j is the deviation score of the jth feature, α j is the weight parameter of the jth feature, J is the total number of user behavior features and user environment features; Set a safety threshold. If the dynamic score is less than the safety threshold, abnormal behavior is triggered.

8. The electrical data hierarchical management method according to claim 1, characterized in that: Two-factor authentication methods include: When building a multi-level database, the user's biometric data is entered and a biometric template is generated. The biometric data includes fingerprints, face or voice; When requesting authentication, capture the current user's biometric data; Calculate the matching degree between the biometric data of the input user and the biometric data of the current user Where X is the number of verified biometric data, Sim(·) is the similarity calculation function, To enter the user's first biometric data, To capture the user's first biometric data; Set the verification threshold. If the matching degree is greater than the verification threshold, the verification passes; if the matching degree is not greater than the verification threshold, the verification fails.

9. An electrical data hierarchical management terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the electrical data hierarchical management method according to any one of claims 1 to 8 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the electrical data hierarchical management method as described in any one of claims 1 to 8 is implemented.

Images