Data isolation and privacy protection method and system for large data security model

Abstract

The invention discloses a data isolation and privacy protection method and system for a data security large model, and relates to the technical field of artificial intelligence, the method comprises the following steps: setting an independent storage area for each enterprise in an external knowledge base in advance, and transmitting encrypted data to the corresponding storage area based on an enterprise identifier, setting corresponding access authority for the encrypted data of each storage area; judging whether the user identity information and the user access permission information are compliant or not, extracting a keyword corresponding to the user demand information under the compliant condition, and performing similarity retrieval in an external knowledge base based on the keyword to obtain corpus data with the highest similarity with the keyword; the corpus data and the user requirements are jointly input into the large data security model to generate the data security document, and the problems that in the prior art, data security isolation and privacy protection cannot be achieved, and security and compliance use of data in the whole process cannot be guaranteed are solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a data isolation and privacy protection method and system for a large data security model. Background Art

[0002] With the rapid advancement of digitalization, large language models (LLMs) are widely used in scenarios such as intelligent writing, code generation, and information retrieval, becoming a key technology driver for enterprises to improve efficiency and innovate their businesses. However, if you want the results generated by large language models to fit the business logic of the enterprise itself, you must input private data into the large language model for training. If the large language model is attacked by external malicious attacks or violated by internal personnel, private data will be leaked.

[0003] At the same time, existing technologies lack an effective data isolation mechanism, and private data from different companies may be mixed during model training, which not only violates the principle of data privacy protection, but may also lead to inaccurate results generated by large language models.

[0004] In addition, current access control relies solely on a username and password combination that is extremely easy to hack as the only line of defense. Faced with the escalation of cybercrime methods, it is easy for cybercriminals to break through the defense line and illegally obtain high permissions to retrieve data at will.

[0005] Therefore, there is an urgent need for a method that can achieve data security isolation and privacy protection, and ensure the security and compliance of data throughout the entire process. Summary of the invention

[0006] In view of this, the present invention proposes a data isolation and privacy protection method and system for a large data security model, which can achieve data security isolation and privacy protection, and ensure the security and compliance of data in the entire process.

[0007] To achieve the above object, the present invention provides the following technical solutions: A data isolation and privacy protection method for a large data security model, comprising: Analyze the knowledge data of multiple enterprises to obtain the enterprise identification corresponding to each knowledge data; Based on the enterprise identification, the knowledge data is isolated to obtain private data corresponding to different enterprises, and the private data is encrypted to obtain encrypted data; Pre-set an independent storage area for each enterprise in the external knowledge base, transfer the encrypted data to the corresponding storage area based on the enterprise identification, and set corresponding access rights for the encrypted data in each storage area; In response to a request to generate a data security document, obtaining user requirement information, user identity information, and user access permission information; Determine whether the user identity information and user access permission information are compliant. If compliant, extract keywords corresponding to the user demand information, perform similarity search in the external knowledge base based on the keywords, and obtain corpus data with the highest similarity to the keywords. If not compliant, deny access to the external knowledge base. The corpus data and the user requirements are input into a data security model to generate a data security document.

[0008] On the basis of the above technical solution, the present invention can also be improved as follows: Optionally, before the step of parsing the knowledge data of multiple enterprises, the method further includes: Collect knowledge data from multiple enterprises; Removing duplicate data records from the knowledge data by using a deduplication algorithm to ensure the uniqueness of the data; Identify and remove noise information in the knowledge data through denoising technology to eliminate noise interference; Converting the knowledge data in different formats into a preset standard format; Identify missing values ​​in the knowledge data and fill in the missing values ​​to ensure the integrity and availability of the data.

[0009] Optionally, the isolating the processed knowledge data based on the enterprise identification to obtain private data corresponding to different enterprises or institutions includes: Acquire attribute information and access permission requirement information corresponding to the knowledge data; Dividing the knowledge data into different logical partitions based on the attribute information and the access permission requirement information to ensure effective isolation of the knowledge data at the logical level; Based on the enterprise identity of knowledge data, the knowledge data is divided into different physical storage devices to ensure the effective isolation of knowledge data at the physical level.

[0010] Optionally, the encrypting the private data to obtain encrypted data includes: Different key pairs are generated for the private data corresponding to different enterprises through encryption algorithms, the private data is encrypted based on the encryption key of the key pair to form encrypted data, and the encrypted data is associated with the decryption key to obtain the association relationship between the encrypted data and the decryption key.

[0011] Optionally, pre-setting an independent storage area for each enterprise in the external knowledge base, transmitting the encrypted data to the corresponding storage area based on the enterprise identification, and setting corresponding access rights for the encrypted data in each storage area include: After receiving the access request for the encrypted data, based on the association relationship between the encrypted data and the decryption key, obtaining the decryption key corresponding to the encrypted data from the external knowledge base; Decrypt the encrypted data using an adapted decryption algorithm based on the decryption key. During decryption, the check value of the current decrypted data is recalculated in real time and compared with the original check value retained during encryption. If a mismatch is found, an alarm prompt message is generated; Generate access logs to external knowledge bases.

[0012] Optionally, in the case of compliance, the method further comprises: Receive data operations performed by users, and based on the data operations, update corresponding stored data in the external knowledge base, and generate an operation log recording the external knowledge base.

[0013] Optionally, after generating the operation log recording the external knowledge base, the method further comprises: Detect abnormal access behaviors based on access logs and operation logs, and generate warning signals when abnormal access behaviors occur; Collecting historical behavior data of each user based on the access log and the operation log, and generating a user behavior profile for each user based on the historical behavior data of each user; Adjust user access rights based on the user behavior profile.

[0014] A data isolation and privacy protection system for a large data security model, comprising: The data collection and processing module is used to analyze the knowledge data of multiple enterprises and obtain the enterprise identification corresponding to each knowledge data; A data isolation and security protection module, used to isolate the knowledge data based on the enterprise identification to obtain private data corresponding to different enterprises, and encrypt the private data to obtain encrypted data; A data storage module, used to pre-set an independent storage area for each enterprise in an external knowledge base, transfer the encrypted data to the corresponding storage area based on the enterprise identification, and set corresponding access rights for the encrypted data in each storage area; A user interaction module, for obtaining user demand information, user identity information and user access permission information in response to a request for generating a data security document; A RAG search enhancement module is used to determine whether the user identity information and user access permission information are compliant. If compliant, the keywords corresponding to the user demand information are extracted, and similarity search is performed in the external knowledge base based on the keywords to obtain the corpus data with the highest similarity to the keywords. If not compliant, access to the external knowledge base is denied; The data security document generation module is used to input the corpus data and the user requirements into the data security model to generate a data security document.

[0015] An electronic device comprises a memory, a processor and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method when executing the computer program.

[0016] A non-transitory computer-readable storage medium stores a computer program, which implements the steps of the method when executed by a processor.

[0017] The present invention has the following advantages: The data isolation and privacy protection method for the data security big model in the present invention collects knowledge data of multiple enterprises and parses the enterprise identification corresponding to the knowledge data, laying the foundation for the subsequent accurate distinction of data from different sources, facilitating the targeted management and protection of the data of each enterprise, avoiding data confusion, and clarifying the data ownership from the source. It is an important starting link in the entire data isolation and privacy protection process, and is helpful to carry out the corresponding data security protection work in an orderly manner.

[0018] The data isolation and privacy protection method for the data security big model in the present invention can effectively separate the private data of different enterprises based on enterprise identification isolation data, strictly follow the data privacy protection principle, prevent the data of each enterprise from being mixed with each other during storage and processing, and ensure the independence and exclusive rights of each enterprise data. The encryption processing is a layer of "security armor" for private data. Even if the data encounters the risk of accidental leakage, such as the storage medium is stolen or the transmission process is intercepted, the encryption method can make the data exist in ciphertext form, so that unauthorized persons cannot obtain the real content, which greatly enhances the confidentiality and security of the data.

[0019] The data isolation and privacy protection method for the data security large model in the present invention sets up an independent storage area for each enterprise, so that the data can be clearly isolated at the physical level (storage level), further strengthening the exclusive control of data and avoiding data security risks caused by storage chaos. The transmission and storage of encrypted data based on the enterprise identification can ensure that the data enters the corresponding area accurately and manages massive data in an orderly manner. At the same time, setting corresponding access rights can accurately control which personnel can access and operate the corresponding data, eliminate illegal data access behaviors from the access level, and ensure the security and compliance of data in the storage and access stages in multiple dimensions, so that enterprises can have more assured and detailed control over their own data.

[0020] The data isolation and privacy protection method for the data security big model in the present invention obtains user demand information, user identity information and user access permission information when responding to a document generation request, so as to determine whether the user is allowed to access the data and how to provide corresponding services based on user needs. It controls the data usage scenarios from the source to avoid arbitrary call and abuse of data, and ensures that data usage is carried out in accordance with security requirements and enterprise expectations.

[0021] The data isolation and privacy protection method for the data security big model in the present invention strictly screens out legitimate user access behaviors through compliance judgment, firmly rejects access that does not meet the requirements, builds a solid line of defense for data security, and prevents unauthorized access and data leakage risks. For compliant users, the corpus data with the highest similarity is obtained through keyword retrieval, which can accurately mine existing data resources that are highly consistent with user needs, providing strong data support for the subsequent generation of high-quality data security documents that meet user expectations, while ensuring security and taking into account the effectiveness and accuracy of data use.

[0022] The data isolation and privacy protection method for the data security big model in the present invention utilizes the screened corpus data combined with the actual needs of the user to input the data security big model, giving full play to the powerful data analysis and text generation capabilities of the big model, so that the finally generated data security document can not only meet the specific needs of the user, but also ensure the legitimacy, security and relevance of the data source due to the early data screening link, thereby ensuring that the generated document is accurate and reliable in content. At the same time, the whole process also strictly complies with the requirements of data isolation and privacy protection, so that the data can be safely, compliantly and efficiently circulated and used in the link of document generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] For the purpose of illustration and not limitation, the present invention is now described in conjunction with the embodiments of the present invention and the accompanying drawings, in which: Figure 1It is a flow chart of a data isolation and privacy protection method for a large data security model in an embodiment of the present invention; Figure 2 A schematic diagram of the main components of a data isolation and privacy protection system for a large data security model in an embodiment of the present invention; Figure 3 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution in the implementation of the present invention will be clearly and completely described below in conjunction with the drawings in the implementation of the present invention. Obviously, the described implementation is only a part of the implementation of the present invention, not all of the implementations. Based on the implementation of the present invention, all other implementations obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0027] Figure 1 FIG. 1 is a flow chart of a data isolation and privacy protection method for a large data security model in an embodiment of the present invention. Figure 1 As shown, the data isolation and privacy protection method for a large data security model provided by an embodiment of the present invention includes the following steps S101 to S106.

[0028] S101, analyzing the knowledge data of multiple enterprises to obtain the enterprise identification corresponding to each knowledge data.

[0029] The above-mentioned data processing includes, specifically, the following: Deduplication algorithms are used to remove duplicate data records in knowledge data to ensure the uniqueness of the data. Duplicate data not only takes up valuable storage space, but also interferes with the accuracy of subsequent data analysis and processing. After removing duplicate records, data storage costs can be effectively reduced.

[0030] De-noising technology is used to identify and remove noise information in knowledge data to eliminate noise interference; after removing the noise, the data analysis algorithm can focus on real and effective data features to avoid triggering false alarms or formulating unreasonable data security policies due to misleading noise. For example, in an intrusion detection system, the denoised data can accurately present the real network access mode, improve the accuracy of identifying malicious intrusion behaviors, and ensure the stable operation of the system security protection mechanism.

[0031] Convert knowledge data in different formats into a preset standard format; data in the field of data security comes from a wide range of sources and in various formats, such as structured database tables, semi-structured JSON files, plain text logs, etc. The unified format lays the foundation for the standardization of data processing procedures. In the future, whether it is data storage, analysis and mining based on specific algorithms, or data interaction and sharing between different modules, they can be seamlessly connected without the need to frequently adapt to the compatibility problems caused by different formats, greatly improving the overall data processing efficiency, accelerating the data circulation cycle from collection to application, and ensuring timely response to data security work.

[0032] Identify missing values ​​in knowledge data and fill in missing values ​​to ensure data integrity and availability. Data missingness may be caused by a variety of reasons, such as interruption of the collection process, restricted access to certain fields by some data sources, etc. If missing values ​​are not processed, a large number of data analysis algorithms will not be able to operate normally, resulting in numerous loopholes in data security situation assessment. After filling in missing values, the data set is restored to integrity, and complex analyses such as time series-based security trend analysis and multi-dimensional association rule mining can be carried out smoothly. From the perspective of data integrity, security decisions are fully considered to maximize data availability and uncover potential security risks and opportunities hidden behind complete data.

[0033] The data source information corresponding to the knowledge data obtained after data processing may specifically include: Parse the identification fields in the knowledge data and confirm the corporate identity based on the identification fields. The algorithm carefully scans the data at the byte level to accurately locate the position of the identification fields. Then, it uses complex character conversion, decoding rules and semantic parsing models to convert obscure codes into clear corporate identity details, and confirms the corporate identity based on these identification fields.

[0034] In this step, knowledge data is first collected from multiple enterprises. These knowledge data may cover various valuable contents such as business processes, technical information, customer information, etc. of the enterprises. After collecting the knowledge data, these original knowledge data will be processed such as data cleaning (removing duplicate, erroneous, incomplete data, etc.) and format unification, so that the data can reach a standardized state that can be used in subsequent processes. On this basis, the processed knowledge data is further parsed, and the specific fields, features or related information in the data are analyzed to accurately identify the specific enterprise to which each knowledge data belongs, that is, to label it with the corresponding enterprise identification label, and to clarify the enterprise to which each knowledge data belongs, so as to provide basic support for the subsequent precise isolation, protection and on-demand call of different enterprise data, so as to avoid confusion among the subsequent enterprise data and ensure the orderliness and pertinence of data management.

[0035] S102, isolating the knowledge data based on the enterprise identification to obtain private data corresponding to different enterprises, and encrypting the private data to obtain encrypted data.

[0036] The above-mentioned isolation processing of the knowledge data after data processing based on the enterprise identification to obtain private data corresponding to different enterprises or institutions specifically includes: Obtaining attribute information and access permission requirement information corresponding to the knowledge data after data processing; Dividing the knowledge data into different logical partitions based on the attribute information and the access permission requirement information to ensure effective isolation of the knowledge data at the logical level; Based on the enterprise identity of knowledge data, the knowledge data is divided into different physical storage devices to ensure the effective isolation of knowledge data at the physical level.

[0037] The above-mentioned encryption processing of the private data to obtain encrypted data specifically includes: Different key pairs are generated for the private data corresponding to different enterprises through encryption algorithms, the private data is encrypted based on the encryption key of the key pair to form encrypted data, and the encrypted data is associated with the decryption key to obtain the association relationship between the encrypted data and the decryption key.

[0038] Encrypted data storage can ensure that sensitive information is highly confidential when it is statically stored. Even if the database is subject to physical illegal intrusion or accidental leakage, encryption makes the data like a solid lock, which is difficult for attackers to crack and steal. This maintains the security of the core data assets of enterprises or institutions, and effectively resists external illegal intrusions in scenarios such as financial institutions storing customer financial details and enterprises keeping trade secrets.

[0039] In this step, the processed knowledge data is divided according to the enterprise identification, so that the data of each enterprise is independent and forms a private data set exclusive to different enterprises. For example, physical or logical isolation is achieved by creating different logical partitions or using data classification algorithms. After that, encryption algorithms (such as symmetric encryption algorithms, asymmetric encryption algorithms, etc.) are used to encrypt the private data of each divided enterprise, and the original plaintext data is converted into encrypted data in ciphertext form. In this way, even if unexpected situations occur during the storage and transmission of the data, others cannot easily obtain the real content. Realizing data isolation can fully guarantee the independence and privacy of each enterprise's data, follow the basic requirements of data privacy protection, and prevent data from different enterprises from interfering with each other, leaking or being improperly mixed. Encryption processing further enhances the security of data, builds a "protective wall" for data assets, greatly reduces the risk of data theft and tampering, and effectively protects the core confidential information of the enterprise.

[0040] S103, pre-setting an independent storage area for each enterprise in the external knowledge base, transferring the encrypted data to the corresponding storage area based on the enterprise identification, and setting corresponding access rights for the encrypted data in each storage area.

[0041] In this step, in the unified storage platform of the external knowledge base, an independent storage area is specially opened for each participating enterprise. These areas are physically or logically isolated from each other, and each becomes the "exclusive territory" of enterprise data. Then, according to the previously determined enterprise identification, through data transmission, routing and other technical means, the encrypted data of the corresponding enterprise is accurately guided and stored in the corresponding independent storage area to ensure the accuracy of data storage. Finally, for the encrypted data in each enterprise storage area, according to the enterprise's own management requirements, data sensitivity, and the division of responsibilities of relevant personnel, different levels of access rights are carefully set for it, such as which personnel can read data, which can be modified, which can be deleted, etc., and the operation behavior of data is strictly limited through permission control. The setting of independent storage areas further strengthens the isolation effect of data from the storage architecture level, so that the data of each enterprise has clear boundaries in the storage environment, which is convenient for management and maintenance, and also reduces the data security risks caused by storage chaos. The transmission storage based on identification ensures the standardization and accuracy of data storage, and avoids problems such as data storage in the wrong location. The setting of access permissions controls the security of data from the usage level, eliminates illegal and unauthorized access, and ensures that data can only be operated by people with corresponding permissions within the scope of law and compliance, thus fully guaranteeing the security of data and the company's control over data.

[0042] After receiving the access request for the encrypted data, based on the association relationship between the encrypted data and the decryption key, obtaining the decryption key corresponding to the encrypted data from the external knowledge base; Based on the decryption key, an adapted decryption algorithm is selected to decrypt the encrypted data. During decryption, the check value of the current decrypted data is recalculated in real time and compared with the original check value retained during encryption. If a mismatch is found, the operation is terminated and an alarm prompt message is generated; an access log for the external knowledge base is generated.

[0043] By generating different key pairs for the private data of different companies and obtaining the keys based on the association between the encrypted data and the decryption key, it is possible to ensure that the data of different companies are isolated from each other at the encryption level. Even if the external knowledge base is partially accessed, since the decryption key for each data is independent and targeted, attackers cannot easily obtain the data of other companies, thus ensuring the independence of the data during storage and processing.

[0044] This method of obtaining decryption keys based on associations ensures that the corresponding keys can be obtained from the knowledge base only under legitimate access requests. This helps to strictly control access rights to data, prevent unauthorized personnel from obtaining decryption keys, and thus ensure data security.

[0045] During the decryption process, the checksum of the current decrypted data is recalculated in real time and compared with the original checksum retained during encryption, which can effectively detect whether the data has been tampered with during storage and transmission. If the checksum does not match, it means that the data may have been maliciously modified or an error occurred during the transmission process. This mechanism can detect data integrity problems in a timely manner. Once the checksum mismatch is found, an alarm prompt message is immediately generated, which can let the data administrator or relevant security personnel know the occurrence of data security incidents in a timely manner. This helps to quickly take countermeasures, such as preventing further data access, investigating the cause of data tampering, etc., to minimize the losses caused by data security incidents.

[0046] S104, in response to the request for generating a data security document, obtaining user demand information, user identity information and user access authority information.

[0047] When receiving a request to generate a data security document, the system will automatically start the information collection mechanism to obtain multiple key information from the source of the request. Among them, user demand information mainly refers to the specific content, format requirements, application scenarios and other detailed requirements that the user expects to be reflected in the document; user identity information covers the basic identity characteristics of the requesting user, such as the department, position and other content that can indicate their identity attributes; user access permission information records the relevant scope of permissions granted to the user in the system, such as which data can be accessed and what operations can be performed. Comprehensive collection of this information can lay the foundation for subsequent accurate judgment of whether the user is qualified to access data and how to provide effective data support according to their needs. It is equivalent to building a rigorous pre-audit link to avoid the situation where data is arbitrarily called and abused, and to ensure that each use of data is carried out under the premise of complying with security requirements and corporate management regulations, to ensure the standardization and security of data use.

[0048] S105, determining whether the user identity information and user access permission information are compliant. If compliant, extracting keywords corresponding to the user demand information, performing similarity search in an external knowledge base based on the keywords, and obtaining corpus data with the highest similarity to the keywords. If not compliant, denying access to the external knowledge base.

[0049] The obtained user identity information and user access rights information are reviewed and judged for legality and compliance. By comparing and checking this information with the system's pre-set authorization rules, identity authentication mechanisms, etc., it is confirmed whether the user meets the conditions for accessing the data. If the judgment result is compliance, it means that the user has the corresponding authority to obtain data to generate documents. Further analyze the user's demand information, extract the key content, core vocabulary, etc. as keywords, and then use search engines, text matching and other technical means to perform similarity searches in the massive data stored in the external knowledge base (data encrypted and stored in the previous steps and isolated by enterprise), and select the corpus data with the highest matching degree and the strongest correlation with these keywords to provide basic materials for subsequent document generation. On the contrary, if it is judged to be non-compliant, the system will directly deny the user access to the external knowledge base, block the way to obtain data, and prevent illegal data access. The compliance judgment link is like a "gatekeeper" of data security, strictly controlling the entrance to data access, resolutely eliminating unauthorized access, effectively preventing the risk of data leakage, and maintaining the security of the entire data storage and use environment. As for keyword searches and corpus data acquisition operations performed by compliant users, on the basis of ensuring security, we will try our best to mine data resources that meet the actual needs of users, improve the accuracy and effectiveness of subsequent data security document generation, and ensure that the final data security document can not only meet the personalized needs of users, but also ensure the legitimacy and relevance of the data source.

[0050] The RAG search enhancement module uses vector databases (such as Faiss, Milvus, etc.) to achieve efficient data retrieval. The RAG search enhancement module receives data from private data security repositories and user requirements from user interaction terminals.

[0051] When obtaining keywords corresponding to user needs, the RAG retrieval enhancement module will use semantic analysis technology (such as BERT, GPT, etc.) to convert the keywords into vector representations and search in the vector database. The RAG retrieval enhancement module will find data related to user needs based on semantic similarity calculations and send these data to LLM for data security document generation.

[0052] The RAG search enhancement module also provides real-time update function for search results to ensure the timeliness and accuracy of data. When the search keywords are obtained again, the RAG search enhancement module will re-search and return the latest data results.

[0053] S106, input the corpus data and user requirements into the data security model to generate a data security document.

[0054] Specifically, a large language model (such as GPT-3, T5, etc.) technology is used to generate data security documents. The large language model will receive relevant data retrieved from the RAG retrieval enhancement module and generate preliminary content of the document. The generated content will be optimized by grammar checking, spelling checking, format adjustment, etc. Natural language processing tools (such as NLTK, SpaCy, etc.) are used to verify and modify data security documents to ensure the accuracy and readability of data security documents. The processed data security documents will be sent to the user interaction terminal for display and download. Users can view the preview effect of the data security document on the interaction terminal, and perform editing and saving operations. The export function of data security documents is provided, and data security documents can be exported to PDF, Word and other formats to meet the different needs of users.

[0055] The data isolation and privacy protection method for the data security large model also includes: Receive data operations performed by users, and based on the data operations, update corresponding stored data in the external knowledge base, and generate an operation log recording the external knowledge base.

[0056] By strictly judging whether the user identity information and user access permission information are compliant when responding to data operation requests, it can effectively prevent unauthorized users from performing illegal operations on data. Only legal users who meet the regulations can perform corresponding data operations. This controls the security of data access from the source, avoids risks such as data leakage and tampering, and ensures that data is always in a state of compliance. This verification mechanism makes data operations follow established permission rules. Users with different permission levels can only perform data activities within the corresponding permission range, making the entire data management and use process more standardized and orderly, helping to maintain the reasonable storage and correct update of data in the external knowledge base, and improving the overall efficiency of data resource management.

[0057] Detect abnormal access behaviors based on access logs and operation logs, and generate warning signals when abnormal access behaviors occur; When data operations are performed to update data stored in external knowledge bases, operation logs are generated, which can record the specific circumstances of each data operation in detail, such as the time of operation, operator, operation content and other key information. When any data-related problems arise or data usage needs to be audited, these operation logs can be used for accurate tracing, and the entire process of data changes can be clearly restored, which is convenient for locating the source of the problem and verifying the responsibility. By using access logs and operation logs to detect abnormal access behaviors and generate early warning signals when abnormalities exist, real-time monitoring and rapid response to data security threats can be achieved. Behaviors such as abnormal frequent access and unauthorized access that may indicate data security risks can be discovered in a timely manner, so that the security management team can take corresponding measures to respond in the first place, such as restricting access and investigating the cause, etc., to minimize the possibility of data damage or leakage, and effectively protect data security and privacy. Overall, these measures have comprehensively improved the level of data isolation and privacy protection for large data security models, taking into account the standardization and orderliness of data operation processes and the timely early warning and prevention of potential security risks, and ensuring the security, integrity and privacy of data.

[0058] Overall, these measures have comprehensively improved the level of data isolation and privacy protection for large data security models, taking into account the standardization and orderliness of data operation processes and timely warning and prevention of potential security risks, ensuring the security, integrity and privacy of data.

[0059] The data isolation and privacy protection method for the data security large model also includes: Based on the access log and the operation log, historical behavior data of each user is collected, and based on the historical behavior data of each user, a user behavior portrait is generated for each user; and based on the user behavior portrait, user access rights are adjusted.

[0060] By collecting each user's historical behavior data to generate a user behavior portrait, we can comprehensively and meticulously grasp the operating habits, preferences, and regular behavior patterns of different users in the process of interacting with data. For example, understanding in which time periods a user frequently accesses a specific type of data, or what kind of data operations he or she is more inclined to perform, can help to form an accurate and three-dimensional understanding of the user's behavioral characteristics. User behavior portraits are not simple descriptions of a single dimension, but are integrated from multiple aspects of historical behavior data, covering many elements such as access frequency, operation type, and data scope involved, making the portrayal of users in data usage scenarios richer and more comprehensive, and providing a detailed basis for subsequent related management work based on portraits. Adjusting user access rights based on user behavior portraits breaks the limitations of traditional static and fixed permission allocation. According to the user's actual behavior performance, the most appropriate permission range can be flexibly matched to the user to achieve personalized and dynamic permission management. For example, for users who have always abided by the rules, have stable behavior, and only involve low-risk operations, some permissions can be maintained or appropriately relaxed to improve their work efficiency; for users who have suspected abnormal behavior or whose operating habits have suddenly changed, permissions can be tightened in a timely manner to reduce security risks. This dynamic adjustment of permissions can make data security policies better fit actual usage and make permission configuration more scientific and reasonable. It avoids data security risks caused by excessively loose permissions, and also prevents the occurrence of situations where users' normal work is affected by too tight permissions. While ensuring data security, it also takes into account the convenience of user use, which helps to create a more efficient and secure data usage environment. Timely adjustment of permissions according to changes in behavioral profiles can prevent potential data security risks in advance. If a user's behavior begins to deviate from the normal profile trajectory, it is likely to indicate a security threat. Through permission adjustment, possible abnormal behavior can be quickly blocked from further development, and risks can be effectively curbed at the budding stage, further strengthening the protection of data security and privacy.

[0061] To sum up, with the help of user behavior profiling and the corresponding permission adjustment mechanism, we can more accurately grasp the interaction between users and data, manage user access rights in a flexible and scientific manner, and comprehensively improve the security, rationality and overall management efficiency of data use.

[0062] Figure 2 Schematic diagram of the main components of the data isolation and privacy protection system for the data security big model in the embodiment of the present invention. Figure 2 As shown, the data isolation and privacy protection system 1 for the data security big model provided by the embodiment of the present invention includes a data acquisition and processing module 10, a data isolation and security protection module 20, a data storage module 30, a user interaction module 40, a RAG retrieval enhancement module 50 and a data security document generation module 60.

[0063] The data collection and processing module 10 is used to analyze the knowledge data of multiple enterprises and obtain the enterprise identification corresponding to each knowledge data; The data isolation and security protection module 20 is used to isolate the knowledge data based on the enterprise identification to obtain the private data corresponding to different enterprises, and encrypt the private data to obtain encrypted data; The data storage module 30 is used to pre-set an independent storage area for each enterprise in the external knowledge base, transfer the encrypted data to the corresponding storage area based on the enterprise identification, and set corresponding access rights for the encrypted data in each storage area; The user interaction module 40 is used to obtain user demand information, user identity information and user access permission information in response to a request for generating a data security document; The RAG search enhancement module 50 is used to determine whether the user identity information and the user access permission information are compliant. If compliant, the keywords corresponding to the user demand information are extracted, and similarity search is performed in the external knowledge base based on the keywords to obtain the corpus data with the highest similarity to the keywords. If not compliant, access to the external knowledge base is denied; The data security document generation module 60 is used to input the corpus data and user requirements into the data security model to generate a data security document.

[0064] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as Figure 3 As shown, the electronic device 70 includes: a processor 701 (processor), a memory 702 (memory) and a bus 703; The processor 701 and the memory 702 communicate with each other via the bus 703; The processor 701 is used to call the program instructions in the memory 702 to execute the methods provided by the above-mentioned method embodiments, so as to execute the methods provided by the implementation mode of the present invention.

[0065] This embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions. The computer instructions enable a computer to execute the method provided by the embodiment of the present invention.

[0066] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various storage media that can store program codes.

[0067] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data isolation and privacy protection method for a large data security model, characterized in that: include: Analyze the knowledge data of multiple enterprises to obtain the enterprise identification corresponding to each knowledge data; Based on the enterprise identification, the knowledge data is isolated to obtain private data corresponding to different enterprises, and the private data is encrypted to obtain encrypted data; Pre-set an independent storage area for each enterprise in the external knowledge base, transfer the encrypted data to the corresponding storage area based on the enterprise identification, and set corresponding access rights for the encrypted data in each storage area; In response to a request to generate a data security document, obtaining user requirement information, user identity information, and user access permission information; Determine whether the user identity information and user access permission information are compliant. If compliant, extract keywords corresponding to the user demand information, perform similarity search in the external knowledge base based on the keywords, and obtain corpus data with the highest similarity to the keywords. If not compliant, deny access to the external knowledge base. The corpus data and the user requirements are input into a data security model to generate a data security document.

2. The data isolation and privacy protection method for a large data security model according to claim 1 is characterized in that: Before the step of parsing the knowledge data of multiple enterprises, the method further includes: Collect knowledge data from multiple enterprises; Removing duplicate data records from the knowledge data by using a deduplication algorithm to ensure the uniqueness of the data; Identify and remove noise information in the knowledge data through denoising technology to eliminate noise interference; Converting the knowledge data in different formats into a preset standard format; Identify missing values ​​in the knowledge data and fill in the missing values ​​to ensure the integrity and availability of the data.

3. The data isolation and privacy protection method for a large data security model according to claim 1 is characterized in that: The method of isolating the processed knowledge data based on the enterprise identification to obtain private data corresponding to different enterprises or institutions includes: Acquire attribute information and access permission requirement information corresponding to the knowledge data; Dividing the knowledge data into different logical partitions based on the attribute information and the access permission requirement information to ensure effective isolation of the knowledge data at the logical level; Based on the enterprise identity of knowledge data, the knowledge data is divided into different physical storage devices to ensure the effective isolation of knowledge data at the physical level.

4. The data isolation and privacy protection method for a large data security model according to claim 1 is characterized in that: The step of encrypting the private data to obtain encrypted data includes: Different key pairs are generated for the private data corresponding to different enterprises through encryption algorithms, the private data is encrypted based on the encryption key of the key pair to form encrypted data, and the encrypted data is associated with the decryption key to obtain the association relationship between the encrypted data and the decryption key.

5. The data isolation and privacy protection method for a large data security model according to claim 1 is characterized in that: The step of pre-setting an independent storage area for each enterprise in the external knowledge base, transmitting the encrypted data to the corresponding storage area based on the enterprise identification, and setting corresponding access rights for the encrypted data in each storage area includes: After receiving the access request for the encrypted data, based on the association relationship between the encrypted data and the decryption key, obtaining the decryption key corresponding to the encrypted data from the external knowledge base; Decrypt the encrypted data using an adapted decryption algorithm based on the decryption key. During decryption, the check value of the current decrypted data is recalculated in real time and compared with the original check value retained during encryption. If a mismatch is found, an alarm prompt message is generated; Generate access logs to external knowledge bases.

6. The data isolation and privacy protection method for a large data security model according to claim 5 is characterized in that: In the case of compliance with the method, the method further comprises: Receive data operations performed by users, and based on the data operations, update corresponding stored data in the external knowledge base, and generate an operation log recording the external knowledge base.

7. The data isolation and privacy protection method for a large data security model according to claim 6 is characterized in that: After generating the operation log recording the external knowledge base, the method further comprises: Detect abnormal access behaviors based on access logs and operation logs, and generate warning signals when abnormal access behaviors occur; Collecting historical behavior data of each user based on the access log and the operation log, and generating a user behavior profile for each user based on the historical behavior data of each user; Adjust user access rights based on the user behavior profile.

8. A data isolation and privacy protection system for a large data security model, characterized in that: include: The data collection and processing module is used to analyze the knowledge data of multiple enterprises and obtain the enterprise identification corresponding to each knowledge data; A data isolation and security protection module, used to isolate the knowledge data based on the enterprise identification to obtain private data corresponding to different enterprises, and encrypt the private data to obtain encrypted data; A data storage module, used to pre-set an independent storage area for each enterprise in an external knowledge base, transfer the encrypted data to the corresponding storage area based on the enterprise identification, and set corresponding access rights for the encrypted data in each storage area; A user interaction module, for obtaining user demand information, user identity information and user access permission information in response to a request for generating a data security document; A RAG search enhancement module is used to determine whether the user identity information and user access permission information are compliant. If compliant, the keywords corresponding to the user demand information are extracted, and similarity search is performed in the external knowledge base based on the keywords to obtain the corpus data with the highest similarity to the keywords. If not compliant, access to the external knowledge base is denied; The data security document generation module is used to input the corpus data and the user requirements into the data security model to generate a data security document.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A non-transitory computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images