A processing method and system for dynamic encryption of enterprise sensitive data

Abstract

This invention discloses a method and system for dynamically encrypting sensitive enterprise data, specifically relating to the fields of secure communication and data security. The method includes establishing a key management system responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys upon first use. The operating system or hardware layer within the device periodically checks the system's state vector, establishes an environment assessment level based on data sensitivity and the operating environment, and adjusts the encryption level in real time according to the environment assessment level, while simultaneously performing dynamic encryption on the data. When a device is scrapped or faces security risks, the administrator can remotely invalidate the key and assess the data erasure rate. By dynamically encrypting and assessing data in obsolete enterprise equipment, a erasure rate assessment index is generated, solving the key problem of traditional deletion operations' inability to quantify the data erasure effect.

Description

Technical Field

[0001] This invention relates to the fields of secure communication and data security technology, and more specifically, to a processing method and system for dynamic encryption of sensitive enterprise data. Background Technology

[0002] Sensitive data refers to critical information that should not be disclosed or shared without authorization. It typically includes personal information, trade secrets, customer data, financial information, product designs, intellectual property, and government confidential information. With the development of digitalization, the storage and transmission of sensitive data largely rely on electronic devices and network systems. Once this data is leaked, it may lead to privacy violations, economic losses, legal disputes, or a decline in corporate competitiveness. Existing technologies typically protect the security of sensitive data and prevent unauthorized access and use through encryption, access control, and data classification.

[0003] When enterprises scrap or face safety risks with their obsolete equipment, the secure handling of sensitive data is a critical issue. Traditional solutions often involve simple deletion, but a key problem with this approach is the inability to accurately measure the data erasure rate, especially in cases of highly sensitive data. The effectiveness of data erasure cannot be quantified or rated; therefore, the data erasure rate becomes an unknowable metric, preventing enterprises from accurately assessing the remaining data risks when disposing of obsolete equipment. This not only impacts data security but also increases the risk of data leakage. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a processing method and system for dynamic encryption of sensitive enterprise data. By dynamically encrypting and evaluating data in obsolete enterprise equipment, it ensures that residual data can be effectively cleared when equipment is scrapped or security risks arise, and generates a clearing rate evaluation index to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for dynamically encrypting sensitive enterprise data, comprising:

[0006] Establish a key management system. The key management system is responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time.

[0007] The operating system or hardware level within the device periodically checks the system status state vector, establishes an environment assessment level for the device based on data sensitivity and operating environment, adjusts the encryption level in real time based on the environment assessment level, and performs dynamic encryption processing on the data.

[0008] When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and assess the clearance rate of the device's remaining data.

[0009] The key management system acquires information on data residue, key retrieval efficiency, and data coverage depth, and generates a comprehensive evaluation index for clearing rate for rating.

[0010] In a preferred embodiment, the device is designed at each time point Collect and run-related status information, including operating environment information and data sensitivity information; convert the status information into a state vector. To indicate, Include There are 1,2,3 ...

[0011] ;

[0012] in, Representing the A state variable in time The value of is determined by analyzing the state information and using a multi-weighted distribution model to extract features from the state information. The distribution model reflects the change of state under different weights through a multi-component distribution function, which is expressed as follows:

[0013] ;

[0014] In the formula middle The probability density function is used to represent the state vector. In time The probability distribution at time t. It is the first The weight coefficients of each state component Indicates the first The probability distribution of each state component. It is the center point of this state component. It is the fluctuation range of the state component;

[0015] Based on the currently acquired state vector Conduct a risk assessment of the environment in which the equipment is located, and determine the risk assessment value. Used to indicate the time of the device To assess the risk level, a non-linear combination approach is used, where the contribution of each state variable is expressed as a product in the overall evaluation value. The calculation formula is:

[0016] ;

[0017] in, It is the first The influence coefficient of a state characteristic represents the weight of that characteristic in the environmental assessment; It is to define the state characteristics A nonlinear function mapped to risk factors;

[0018] In equipment risk assessment value Based on this, select encryption strategies to address different risk levels; define Indicates the device at time Encryption strategy adopted at that time The choice of encryption strategy is based on maximizing cumulative gains, aiming to obtain the greatest security benefit simultaneously in the current and future moments; the specific decision formula is:

[0019] ;

[0020] in, It is the set of all possible encryption strategies. The encryption strategy at the current moment In environmental assessment The immediate return function represents the adaptability of the encryption strategy to the current risk. It is a discount factor that determines the discount rate for future returns. It is the long-term return function at the next point in time.

[0021] In a preferred embodiment, the encryption strength is determined. Encryption strength This represents the device's time. The encryption level used at any given time is adjusted based on the device's current state and desired requirements. The encryption strength is optimized by minimizing the error in the encryption strength adjustment using a Lagrange optimization model.

[0022] ;

[0023] in, The amount of adjustment representing the encryption strength. It is the expected encryption strength, representing the current moment. Ideal encryption strength; It is the square of the rate of change of encryption strength. It is a regularization parameter that controls the rate of change of encryption strength;

[0024] A dynamic probability-based data destruction mechanism is introduced. The trigger condition for data destruction is calculated dynamically using a probability function to determine whether the device should destroy the data, and the destruction trigger probability is... Defined as:

[0025] ;

[0026] in, It is a growth coefficient that controls the rate of change of the probability of destruction triggering. It is the risk threshold of the destruction mechanism; when the risk assessment value of the equipment... When this threshold is exceeded, the probability of data destruction is triggered. Increased capability to destroy sensitive data in high-risk environments;

[0027] At each time point The encryption strategy and strength are optimized based on historical data, and a cumulative utility function is introduced. ,function Integrated and And adjust the current encryption strategy based on historical risk assessment values:

[0028] ;

[0029] in, It is the first The probability of destruction being triggered at any given moment. It is the encryption strength at that moment. This refers to the encryption strategy at that moment; the optimization objective is to maximize the cumulative utility. .

[0030] In a preferred embodiment, a data residue index is generated based on data residue information. The data residue index is used to assess the data erasure status of the device; the proposed device includes One data block, Indicates the first The residual state of each data block, if This indicates that the data block has not been cleared. This indicates that the process has been completely completed; the residual removal effect is captured by introducing a formula with non-linear adjustment.

[0031] ;

[0032] in This represents the total number of data blocks in the device, indicating how many data blocks need to be processed. For the first The residual state of each data block; For positional complexity, let the th The complexity of each data block in its physical or logical storage location; For data blocks Sensitivity coefficient; These are non-linear adjustment parameters used for control. The intensity of the residual impact; Indicates the threshold for residual data blocks; It is a natural constant;

[0033] Generate a key retrieval efficiency index based on key retrieval efficiency information. The key retrieval efficiency index is used to evaluate the retrieval efficiency of a device's encryption key after it has been remotely invalidated by an administrator. It simulates the key invalidation and retrieval process through time-dependent nonlinear feedback.

[0034] ;

[0035] in For the key state function, in time Time key valid If it fails ; The response time for the start of key eviction; This indicates the complexity of the system response, which in turn affects the difficulty of key retrieval; and It is a parameter that controls the key retrieval rate; It is a decay function that describes the rate at which key retrieval changes over time; To control the impact of the key's valid state on the time-dependent feedback function, A time-dynamic response to key validity has been introduced; This is the maximum time window for monitoring key eviction operations;

[0036] Generate a data coverage depth index based on data coverage depth information. The data coverage depth index is used to evaluate the coverage depth of a device when performing data erasure or overwrite operations. It is calculated by introducing the number of overwrite operations and a risk decay function.

[0037] ;

[0038] in Indicates the first Data blocks in time The risk attenuation coefficient; For the first Data blocks in time Number of times covered at that time; Used to adjust the magnitude of the coverage effect; This indicates the threshold for the overwrite operation.

[0039] In a preferred embodiment, based on the data residual index Key retrieval efficiency index and data coverage depth index Generation and Clearance Rate Comprehensive Evaluation Index The final comprehensive evaluation index for clearance rate is generated through nonlinear combination.

[0040] ;

[0041] in , and It is a weighting parameter that controls the impact of each index on the comprehensive assessment index of clearance rate; To control the data residual index The rate of change; The threshold for the data residual index; The square of the key retrieval efficiency; The logarithmic function representing the coverage depth.

[0042] In a preferred embodiment, based on state vectors and risk assessment value The system generates dynamic encryption keys. The key generation process is based on a nonlinear function of the device state and slices the key using different state parameters.

[0043] ;

[0044] in For dynamic keys, in time An encryption key generated based on state parameters; This is a slice of the key; and To control the nonlinear changes in the key slice;

[0045] Based on risk assessment value The encryption strategy is dynamically selected, and each layer of encryption strategy adaptively selects the encryption algorithm, dynamically nesting encryption formulas:

[0046] ;

[0047] in For data packets that need to be encrypted; and These are the inner encryption algorithm and the outer encryption algorithm, respectively. and These are the inner encryption key and the outer encryption key, respectively.

[0048] Risk assessment values ​​are categorized into low-risk, medium-risk, and high-risk levels to reflect the environmental assessment level; two risk level thresholds are proposed: threshold and threshold ;

[0049] Low risk level: When the equipment's risk assessment value Below the preset threshold The system selects a basic encryption method, which includes symmetric encryption algorithms;

[0050] Medium risk level: When the risk assessment value At two preset thresholds and threshold Intermediate encryption is used between layers; the inner layer uses AES-256 symmetric encryption, and the outer layer uses RSA-2048 asymmetric encryption for additional protection.

[0051] High risk level: When the risk assessment value Exceeding the threshold It employs advanced encryption strategies, where the inner layer performs multiple chain encryptions, the outer layer uses RSA-4096 encryption, and it combines multi-signature technology to ensure that data is protected in high-risk environments.

[0052] Based on the state vector of the transmitted data Generate a decryption path using the key model stored in the key management system:

[0053] ;

[0054] in and These are the inner decryption function and the outer decryption function, respectively;

[0055] The system employs a dynamic key eviction mechanism and a multi-layered data destruction strategy;

[0056] Key eviction mechanism: The key management system monitors risk assessment values. and key recovery efficiency index Determine whether the key needs to be reclaimed or invalidated.

[0057] Data destruction mechanism: If the device detects a physical attack or a high-risk state, the system will destroy sensitive data through a data overwrite mechanism. The specific data destruction formula is as follows:

[0058] ;

[0059] in This represents the coverage depth index of the clearing operation.

[0060] In a preferred embodiment, a processing system for dynamic encryption of sensitive enterprise data includes a key management system module, a device status monitoring and evaluation module, an encryption dynamic adjustment module, a remote key expiration and data evaluation module, and a data erasure rate evaluation and rating module.

[0061] Key Management System Module: Responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time.

[0062] Equipment Status Monitoring and Assessment Module: The operating system or hardware level within the equipment periodically checks the system status vector and establishes the equipment's environmental assessment level based on data sensitivity and operating environment;

[0063] Encryption dynamic adjustment module: Adjusts the encryption level in real time according to the environmental assessment level, and performs dynamic encryption processing on the data at the same time;

[0064] Remote Key Expiration and Data Evaluation Module: When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and evaluate the erasure rate of the device's remaining data.

[0065] Data cleanup rate assessment and rating module: It obtains data residue information, key recovery efficiency information and data coverage depth information through the key management system, and generates a comprehensive cleanup rate assessment index for rating.

[0066] The technical effects and advantages of this invention are as follows:

[0067] 1. This solution dynamically encrypts and evaluates the data in the company's obsolete equipment, ensuring that the residual data can be effectively cleared when the equipment is scrapped or there is a safety risk, and generates a clearing rate evaluation index, which solves the key problem that traditional deletion operations cannot quantify the data clearing effect.

[0068] 2. Adjust encryption strategies and match encryption levels in real time according to the operating environment and data sensitivity of the equipment to ensure data security under different risk conditions and improve the flexibility of encryption processing;

[0069] 3. When equipment is scrapped or a security risk occurs, the administrator can use remote commands to immediately invalidate the device's encryption key, preventing the leakage of sensitive data and achieving full-lifecycle security management of the equipment.

[0070] 4. This solution can dynamically encrypt data based on the current status of the equipment and the environment, adapt to changes in risk, and ensure data security in low, medium, and high-risk environments by automatically selecting appropriate encryption methods;

[0071] 5. This solution can not only assess data residue, but also combine key recovery efficiency and data coverage depth to generate a comprehensive erasure rate, fully assessing and ensuring the thoroughness of data erasure. Attached Figure Description

[0072] Figure 1This is a flowchart of the present invention. Detailed Implementation

[0073] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] Refer to the instruction manual appendix Figure 1 This invention relates to the fields of secure communication and data security, specifically to dynamic encryption and key management. One embodiment of this invention provides a method for dynamically encrypting sensitive enterprise data, comprising:

[0075] Establish a key management system. The key management system is responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time.

[0076] The operating system or hardware level within the device periodically checks the system status state vector, establishes an environment assessment level for the device based on data sensitivity and operating environment, adjusts the encryption level in real time based on the environment assessment level, and performs dynamic encryption processing on the data.

[0077] When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and assess the clearance rate of the device's remaining data.

[0078] The key management system acquires information on data residue, key retrieval efficiency, and data coverage depth, and generates a comprehensive evaluation index for clearing rate for rating.

[0079] Furthermore, the plan is to designate the equipment at each time point. Collect and process status information related to operation. This status information includes operating environment information and data sensitivity information. Operating environment information includes equipment temperature, network connection status, physical location, etc., reflecting the current external conditions of the equipment. Data sensitivity information includes the importance of the data, access frequency, data type, and potential risks. This status information is then expressed as a state vector. To indicate, Include There are 1,2,3 ...

[0080] ;

[0081] in, Representing the A state variable in time The value of is determined by analyzing the state information and using a multi-weighted distribution model to extract features from the state information. The distribution model reflects the change of state under different weights through a multi-component distribution function, which is expressed as follows:

[0082] ;

[0083] In the formula middle The probability density function is used to represent the state vector. In time The probability distribution at time t. It is the first The weight coefficients of each state component Indicates the first The probability distribution of each state component. It is the center point of this state component. This refers to the fluctuation range of the state component; through this process, the system extracts the features that best reflect the current state of the equipment, providing a basis for subsequent risk assessment.

[0084] Based on the currently acquired state vector Conduct a risk assessment of the environment in which the equipment is located, and determine the risk assessment value. Used to indicate the time of the device To assess the risk level, a non-linear combination approach is used, where the contribution of each state variable is expressed as a product in the overall evaluation value. The calculation formula is:

[0085] ;

[0086] in, It is the first The influence coefficient of a state characteristic represents the weight of that characteristic in the environmental assessment; It is to define the state characteristics By mapping risk factors to nonlinear functions, such as exponential or logarithmic functions, the system can capture nonlinear changes in state characteristics, thereby more accurately assessing the current environmental risks of the equipment; specifically, Its function is to map state features according to specific mapping rules. Convert to risk assessment value; for example It could be the current device temperature, and The temperature value is then converted into an equipment risk level using a function (such as a logarithmic function, exponential function, etc.); different mapping functions Different forms can be adopted based on the properties of the state characteristics; common choices include:

[0087] Exponential mapping: When changes in state characteristics have an exponential impact on risk, such as... It is suitable for situations where rapid changes in conditions bring high risks;

[0088] Logarithmic mapping: When the impact of state growth on risk gradually decreases, such as This is suitable for situations where the risk increases slowly due to changes in the state.

[0089] pass This allows for a more flexible association of different state characteristics with equipment risks, resulting in higher risk assessment values. To more accurately reflect the comprehensive risk impact of the operating environment and data sensitivity on equipment;

[0090] In equipment risk assessment value Based on this, select appropriate encryption strategies to address different risk levels; define Indicates the device at time Encryption strategy adopted at that time The choice of encryption strategy is based on maximizing cumulative gains, aiming to obtain the greatest security benefit simultaneously in the current and future moments; the specific decision formula is:

[0091] ;

[0092] in, It is the set of all possible encryption strategies. The encryption strategy at the current moment In environmental assessment The immediate return function represents the adaptability of the encryption strategy to the current risk. It is a discount factor that determines the discount rate for future returns. It is the long-term payoff function at the next time point, through which an optimal encryption strategy is selected.

[0093] Furthermore, to ensure that the encryption strategy has appropriate strength under different environments, we introduce the problem of optimizing the encryption strength; and formulate the encryption strength. Encryption strength This represents the device's time. The encryption level used at any given time is adjusted based on the device's current state and desired requirements. The encryption strength is optimized by minimizing the error in the encryption strength adjustment using a Lagrange optimization model.

[0094] ;

[0095] in, The amount of adjustment representing the encryption strength. It is the expected encryption strength, representing the current moment. Ideal encryption strength; This is the square of the rate of change of encryption strength, representing the rate at which encryption strength changes over time. During optimization, this term should be controlled to prevent it from becoming too large. It is a regularization parameter that controls the rate of change of encryption strength. By optimizing this function, it can be ensured that the change of encryption strength can be dynamically adjusted to follow the risk without being too drastic, thereby ensuring data security while improving system performance.

[0096] Data destruction mechanisms are typically triggered when a device detects an extremely high risk. To more flexibly address different risk scenarios, we introduce a dynamic probability-based destruction mechanism. The trigger condition for data destruction is no longer a simple fixed threshold judgment, but rather a dynamic probability function that calculates whether the device should destroy the data, and the destruction trigger probability. Defined as:

[0097] ;

[0098] in, It is a growth coefficient that controls the rate of change of the probability of destruction triggering. It is the risk threshold of the destruction mechanism; when the risk assessment value of the equipment... When this threshold is exceeded, the probability of data destruction is triggered. Gradually increase the amount of data to ensure that sensitive data can be destroyed in a timely manner in high-risk environments to prevent information leakage;

[0099] At each time point The encryption strategy and strength are optimized based on historical data to ensure the accuracy of future decisions, and a cumulative utility function is introduced. ,function Integrated and And adjust the current encryption strategy based on historical risk assessment values:

[0100] ;

[0101] in, It is the first The probability of destruction being triggered at any given moment. It is the encryption strength at that moment. This refers to the encryption strategy at that moment; the optimization objective is to maximize the cumulative utility. By optimizing historical data, we can make future encryption strategies and strength selections more accurate and effectively cope with the ever-changing risk environment. It is the current moment, and This is a variable used to represent a time index;

[0102] In this plan, it should be noted that:

[0103] Periodic checks: By collecting relevant information about the operating environment and data sensitivity, a state vector of the system state is formed. It reflects the current status of the equipment;

[0104] Environmental assessment: calculated using a nonlinear assessment function. Based on data sensitivity and operational environment information, describe the risk level at the current moment;

[0105] Encryption level adjustment: based on Choose the appropriate And adjust the encryption strength according to the optimization algorithm. This ensures that the encryption strength is dynamically adjusted as the environment changes;

[0106] Dynamic encryption processing: The system encrypts data in real time and flexibly adjusts the encryption strategy according to different operating environments and data sensitivity to ensure that data is more strongly encrypted in high-risk environments, while avoiding over-encryption in low-risk environments to improve performance.

[0107] As a further approach, a data residue index is generated based on data residue information. The data residue index is used to assess the data erasure status of the device; the proposed device includes One data block, Indicates the first The residual state of each data block, if This indicates that the data block has not been cleared. This indicates that the data has been completely removed. To accurately assess the extent of data residue, a formula with non-linear adjustment is introduced to capture the effect of residue removal.

[0108] ;

[0109] in This represents the total number of data blocks in the device, indicating how many data blocks need to be processed. For the first The residual state of each data block; For positional complexity, let the th The complexity of a data block in its physical or logical storage location can affect the ease of erasure. For data blocks The sensitivity coefficient reflects the importance or risk level of the data block; the higher the data sensitivity, the more important the block. These are non-linear adjustment parameters used for control. The strength of the residual effect determines how strongly the residual index responds to changes in sensitive data; This represents the threshold for the residual data block, when... Greater than The changes in residual effects are more pronounced at that time; It is the natural constant, appearing in exponential functions to describe the nonlinear relationship between sensitivity and inflection point. Its function is to simulate nonlinear changes, that is, when the data block is sensitive... Approaching or exceeding the threshold At that time, its residual effects will increase or decrease exponentially;

[0110] Generate a key retrieval efficiency index based on key retrieval efficiency information. The key retrieval efficiency index is used to evaluate the retrieval efficiency of a device's encryption key after it has been remotely invalidated by an administrator. It simulates the key invalidation and retrieval process through time-dependent nonlinear feedback.

[0111] ;

[0112] in For the key state function, in time Time key valid If it fails ; The response time for the start of key eviction indicates the moment when the administrator issues the key eviction command; This indicates the complexity of the system response, which in turn affects the difficulty of key retrieval; and It is a parameter that controls the key retrieval rate, affecting the degree to which the key retrieval time affects the retrieval efficiency; It is a decay function that describes the rate at which key retrieval changes over time; To control the impact of the key's valid state on the time-dependent feedback function, A time-dynamic response to key validity has been introduced; In calculus, a tiny time increment refers to a change in time. The variable to be integrated; It is the maximum time window for monitoring key eviction operations, during which the eviction operation will monitor whether the key has expired; this formula evaluates the dynamic behavior during the key expiration process, including response time, system complexity, etc., and then generates a key eviction efficiency index;

[0113] Generate a data coverage depth index based on data coverage depth information. The data coverage depth index is used to evaluate the coverage depth of a device when performing data erasure or overwrite operations. It is calculated by introducing the number of overwrite operations and a risk decay function.

[0114] ;

[0115] in Indicates the first Data blocks in time The risk attenuation coefficient indicates that covering operations will gradually reduce the risk. For the first Data blocks in time The number of times the device covered the data block indicates how many times the device performed a cover operation on that data block. Used to adjust the extent of the coverage effect, determining the specific degree to which the coverage depth affects the overall clearing effect; This represents the threshold for the cover operation, when the number of cover operations... Exceeding the threshold Over time, the marginal benefit of coverage gradually decreases; This formula is used to simulate the nonlinear relationship of data overlay operations, ensuring that the impact of overlay depth on data security varies exponentially. The formula accumulates the number of overlays for each data block and uses a nonlinear function to attenuate the overlay effect, so that the number of overlays and the overlay depth can effectively reflect the thoroughness of the clearing operation.

[0116] Based on data residual index Key retrieval efficiency index and data coverage depth index Generation and Clearance Rate Comprehensive Evaluation Index The final comprehensive evaluation index for clearance rate is generated through nonlinear combination.

[0117] ;

[0118] in , and It is a weighting parameter that controls the impact of each index on the comprehensive assessment index of clearance rate; To control the data residual index The rate of change affects the sensitivity of the clearance rate composite index; The threshold value for the data residue index is used to control the non-linear impact of data residue on the cleanup rate. The square of the key recovery efficiency reflects the impact of recovery efficiency on the cleanup rate; The logarithmic function representing coverage depth reflects the gain effect of coverage depth on the cleanup rate; finally, a comprehensive cleanup rate evaluation index is generated by combining data residue, key recovery efficiency, and data coverage depth through a non-linear relationship. This is used to accurately assess the cleaning effectiveness of the equipment;

[0119] It should be noted that the clearance rate comprehensive evaluation index The effectiveness of data erasure is evaluated by analyzing different dimensions of the device. A value close to 1 indicates thorough erasure; a low value requires administrators to take specific remedial measures. Based on the evaluation results of data residue, key retrieval, and overwrite depth, possible remedial measures include: For data residue issues, administrators can use more thorough overwrite algorithms, such as multiple random data overwrites or physical destruction of the storage medium, to ensure data is unrecoverable; for low key retrieval efficiency, the automation of the key management system can be enhanced to shorten the response time for key expiration, or the key expiration mechanism can be redesigned to prevent data leakage caused by unrecovered keys; for insufficient data overwrite depth, the number of overwrites can be increased to improve overwrite strength, or stronger erasure algorithms, such as multi-write technology, can be used to ensure complete and unrecoverable data erasure. Through these precise remedial measures, the device can further improve the security of data erasure and ensure the overall erasure rate evaluation index. To achieve the desired level; however, if the device cannot be powered on or turned on, conventional data erasure methods (such as software erasure, remote key retrieval, etc.) will not be able to be performed. In this case, the administrator should take physical remedial measures. First, physical destruction methods can be used, such as physically crushing, cutting, or physically destroying the storage medium using specialized equipment to ensure that the data cannot be recovered. Second, electromagnetic interference or demagnetizing equipment can be used to treat magnetic storage media such as hard drives and solid-state drives with a strong magnetic field to completely erase the data. In addition, high-temperature incineration or acid-base chemical treatment can be used to subject the storage device to high-temperature or chemical corrosion to completely destroy its internal storage units. These methods do not depend on the device's power supply or operating system and can effectively prevent data leakage when the device cannot be turned on.

[0120] Furthermore, based on state vectors and risk assessment value The system generates dynamic encryption keys. The key generation process is based on a nonlinear function of the device state and slices the key using different state parameters. This key generation method makes the key not only weighted but also dynamically adjusted as the state changes.

[0121] ;

[0122] in For dynamic keys, in time An encryption key generated based on state parameters; This refers to a slice of the key, representing a key fragment generated under a specific state. and To control the nonlinear changes in the key slice, the key generation should have a complex dynamic response; As a natural constant, this ensures that the nonlinear adjustment of the key slice can flexibly cope with rapid changes in state. This key generation method ensures the diversity and dynamism of the keys and prevents the keys from being statically cracked or exposed.

[0123] Based on risk assessment value The encryption strategy is dynamically selected, and each layer of encryption strategy adaptively selects the encryption algorithm, dynamically nesting encryption formulas:

[0124] ;

[0125] in For data packets that need to be encrypted; and These are the inner encryption algorithm and the outer encryption algorithm, respectively. and These are the inner encryption key and the outer encryption key, generated based on different operating environment information and data sensitivity information;

[0126] Risk assessment values ​​are categorized into low-risk, medium-risk, and high-risk levels to reflect the environmental assessment level; two risk level thresholds are proposed: threshold and threshold These are used to determine the switching standards for encryption strategies that the system should adopt when facing low, medium, and high risks, respectively.

[0127] Low risk level: When the equipment's risk assessment value Below the preset threshold The system selects basic encryption methods, including symmetric encryption algorithms such as AES-128. Symmetric encryption is a method that uses the same key for encryption and decryption, which is suitable for low-risk scenarios, has fast computation speed, and high performance.

[0128] Medium risk level: When the risk assessment value At two preset thresholds and threshold Intermediate encryption is used between the layers; the inner layer uses AES-256 symmetric encryption, and the outer layer uses RSA-2048 asymmetric encryption for additional protection; the asymmetric encryption uses two different keys for encryption and decryption, namely the public key and the private key, which increases the security of the data.

[0129] High risk level: When the risk assessment value Exceeding the threshold This indicates that the device is in a very dangerous environment and employs advanced encryption strategies. In this case, the inner layer performs multiple chain encryptions (e.g., applying the AES-256 algorithm multiple times), the outer layer uses RSA-4096 encryption, and combines it with multi-signature technology to ensure that the data receives the highest level of protection in high-risk environments. In summary, the system will dynamically select the most appropriate encryption method based on the results of the device risk assessment, from basic symmetric encryption to complex chain and multi-signature encryption, to ensure that the data is adequately protected under different risk conditions.

[0130] Based on the transmitted data state vector Generate a decryption path using the key model stored in the key management system:

[0131] ;

[0132] in and These are the inner decryption function and the outer decryption function, respectively. The decryption process adjusts the decryption path based on the state feedback during transmission to ensure correct and secure decryption even under different states.

[0133] To ensure long-term data security, the system employs a dynamic key eviction mechanism and a multi-layered data destruction strategy.

[0134] Key eviction mechanism: The key management system monitors risk assessment values. and key recovery efficiency index Determine whether the key needs to be reclaimed or invalidated; among which This is the key retrieval efficiency index, representing the dynamic relationship between key expiration and retrieval over time.

[0135] Data destruction mechanism: If the device detects a physical attack or a high-risk state, the system will destroy sensitive data through a data overwrite mechanism to prevent recovery. The specific data destruction formula is as follows:

[0136] ;

[0137] in This represents the coverage depth index of the cleanup operation, used to measure the thoroughness of data destruction; the higher the value, the better the data destruction effect. Indicates the first Data blocks in time The risk attenuation coefficient; For the first Data blocks in time Number of times covered at that time; Used to adjust the magnitude of the coverage effect; This indicates the threshold for the overwrite operation.

[0138] A processing system for dynamic encryption of sensitive enterprise data, comprising a key management system module, a device status monitoring and evaluation module, an encryption dynamic adjustment module, a remote key expiration and data evaluation module, and a data erasure rate evaluation and rating module;

[0139] Key Management System Module: Responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time.

[0140] Equipment Status Monitoring and Assessment Module: The operating system or hardware level within the equipment periodically checks the system status vector and establishes the equipment's environmental assessment level based on data sensitivity and operating environment;

[0141] Encryption dynamic adjustment module: Adjusts the encryption level in real time according to the environmental assessment level, and performs dynamic encryption processing on the data at the same time;

[0142] Remote Key Expiration and Data Evaluation Module: When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and evaluate the erasure rate of the device's remaining data.

[0143] Data cleanup rate assessment and rating module: It obtains data residue information, key recovery efficiency information and data coverage depth information through the key management system, and generates a comprehensive cleanup rate assessment index for rating.

[0144] It should be noted that this solution is a processing method and system for dynamic encryption of sensitive enterprise data, aiming to provide enterprise equipment with full lifecycle encryption management. First, the enterprise generates and assigns encryption keys to each device through a key management system. When an enterprise device is first activated, it needs to register with the system through a designated channel to obtain a unique encryption key. This process ensures that the encryption key for each device is secure and independent, avoiding security risks caused by multiple devices using the same key. During normal use of the equipment, the key management system is responsible for regularly updating and maintaining the keys to ensure their secure use. Furthermore, the key management system can remotely invalidate keys, especially when the equipment faces security risks or is about to be scrapped; this mechanism ensures effective control of the encryption keys.

[0145] Next, the device's operating system or hardware layer will periodically collect the device's operational status information, including operating environment information and data sensitivity information. Operating environment information includes the device's temperature, network connection status, physical location, etc., reflecting the device's current external conditions. Data sensitivity information involves the importance of the data, access frequency, data type, and potential risk assessment. This information is represented by multi-dimensional vectors. Based on this status information, the system analyzes the device's current environment and data characteristics, extracting the key features that best reflect the device's security risks. The system uses a multi-weight model to allocate different status information, extracting the status features that have the greatest impact on device security, providing a basis for subsequent encryption strategy adjustments.

[0146] After analyzing the device's status information, the system dynamically adjusts the encryption level in real time based on the device's current risk assessment level. Specifically, the system selects an appropriate encryption strategy for the device based on the device's environmental assessment results. If the device is in a low-risk state, the system will choose a relatively simple encryption method to reduce unnecessary encryption strength. If the device is in a medium-to-high-risk state, the system will automatically increase the encryption complexity, selecting more secure encryption algorithms and multi-layered encryption methods to ensure the security of data transmission and storage. Dynamic adjustment of the encryption level ensures that the device can maintain the best data security state under different usage scenarios, avoiding system performance degradation caused by over-encryption, while providing sufficient security in high-risk situations.

[0147] When an enterprise confirms that equipment needs to be scrapped or that a serious security risk has occurred, the administrator can remotely send a command through the key management system to immediately invalidate the device's encryption key, ensuring that the data within the device cannot be accessed further. At this time, the system will also initiate a data erasure assessment program to detect the amount of data remaining within the device. Through the key management system, the system can obtain information such as the device's residual data, key recovery efficiency, and data coverage depth, and generate a comprehensive erasure rate assessment index. The generation of the comprehensive erasure rate assessment index can help enterprises quantify the effectiveness of erasing residual data from the device, thereby assessing the thoroughness of data erasure and ensuring that sensitive data in the device is completely erased when it is scrapped or under security risk conditions.

[0148] In summary, through four core modules—key management, device status monitoring, dynamic encryption adjustment, and data erasure assessment—the system ensures the security of sensitive enterprise data throughout its entire lifecycle. Whether it's data encryption during normal device use or data erasure when the device is scrapped or faces security threats, the system provides comprehensive security protection. By dynamically adjusting encryption strategies and effective key management, the system can flexibly respond to real-time environmental and risk situations, ensuring that sensitive enterprise data is not leaked due to external threats or device malfunctions.

[0149] Sensitive data within enterprises typically includes trade secrets, customer information, financial data, intellectual property, and strategic plans. The leakage of this data can severely impact a company's competitiveness, reputation, and legal compliance. This solution ensures that sensitive data remains secure throughout the entire lifecycle of equipment through key management, dynamic encryption, and data erasure assessment. It effectively prevents unauthorized access or recovery of data, especially when equipment is abandoned or security risks arise. Abandoned equipment often still contains residual data; this solution can completely erase this residual data upon equipment disposal, avoiding the risk of data leakage.

[0150] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A processing method for dynamic encryption of sensitive enterprise data, characterized in that, include: Establish a key management system. The key management system is responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time. The operating system or hardware level within the device periodically checks the system status state vector, establishes an environment assessment level for the device based on data sensitivity and operating environment, adjusts the encryption level in real time based on the environment assessment level, and performs dynamic encryption processing on the data. When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and assess the clearance rate of the device's remaining data. The key management system acquires information on data residue, key retrieval efficiency, and data coverage depth, and generates a comprehensive evaluation index for clearing rate for rating.

2. The processing method for dynamic encryption of sensitive enterprise data according to claim 1, characterized in that: The proposed equipment at each time point Collect and run-related status information, including operating environment information and data sensitivity information; convert the status information into a state vector. To indicate, Include There are 1,2,3 ... ； in, Representing the A state variable in time The value of is determined by analyzing the state information and using a multi-weighted distribution model to extract features from the state information. The distribution model reflects the change of state under different weights through a multi-component distribution function, which is expressed as follows: ； In the formula middle The probability density function is used to represent the state vector. In time The probability distribution at time t. It is the first The weight coefficients of each state component Indicates the first The probability distribution of each state component. It is the center point of this state component. It is the fluctuation range of the state component; Based on the currently acquired state vector Conduct a risk assessment of the environment in which the equipment is located, and determine the risk assessment value. Used to indicate the time of the device To assess the risk level, a non-linear combination approach is used, where the contribution of each state variable is expressed as a product in the overall evaluation value. The calculation formula is: ； in, It is the first The influence coefficient of a state characteristic represents the weight of that characteristic in the environmental assessment; It is to define the state characteristics A nonlinear function mapped to risk factors; In equipment risk assessment value Based on this, select encryption strategies to address different risk levels; define Indicates the device at time Encryption strategy adopted at that time The choice of encryption strategy is based on maximizing cumulative gains, aiming to obtain the greatest security benefit simultaneously in the current and future moments; the specific decision formula is: ； in, It is the set of all possible encryption strategies. The encryption strategy at the current moment In environmental assessment The immediate return function represents the adaptability of the encryption strategy to the current risk. It is a discount factor that determines the discount rate for future returns. It is the long-term return function at the next point in time.

3. The processing method for dynamic encryption of sensitive enterprise data according to claim 2, characterized in that: Determine encryption strength Encryption strength This represents the device's time. The encryption level used at any given time is adjusted based on the device's current state and desired requirements. The encryption strength is optimized by minimizing the error in the encryption strength adjustment using a Lagrange optimization model. ； in, The amount of adjustment representing the encryption strength. It is the expected encryption strength, representing the current moment. Ideal encryption strength; It is the square of the rate of change of encryption strength. It is a regularization parameter that controls the rate of change of encryption strength; A dynamic probability-based data destruction mechanism is introduced. The trigger condition for data destruction is calculated dynamically using a probability function to determine whether the device should destroy the data, and the destruction trigger probability is... Defined as: ； in, It is a growth coefficient that controls the rate of change of the probability of destruction triggering. It is the risk threshold of the destruction mechanism; when the risk assessment value of the equipment... When this threshold is exceeded, the probability of data destruction is triggered. Increased capability to destroy sensitive data in high-risk environments; At each time point The encryption strategy and strength are optimized based on historical data, and a cumulative utility function is introduced. ,function Integrated and And adjust the current encryption strategy based on historical risk assessment values: ； in, It is the first The probability of destruction being triggered at any given moment. It is the encryption strength at that moment. This refers to the encryption strategy at that moment; the optimization objective is to maximize the cumulative utility. .

4. The processing method for dynamic encryption of sensitive enterprise data according to claim 3, characterized in that: Data Residual Index Generated Based on Data Residual Information The data residue index is used to assess the data erasure status of the device; the proposed device includes One data block, Indicates the first The residual state of each data block, if This indicates that the data block has not been cleared. This indicates that the process has been completely completed; the residual removal effect is captured by introducing a formula with non-linear adjustment. ； in This represents the total number of data blocks in the device, indicating how many data blocks need to be processed. For the first The residual state of each data block; For positional complexity, let the th The complexity of each data block in its physical or logical storage location; For data blocks Sensitivity coefficient; These are non-linear adjustment parameters used for control. The intensity of the residual impact; Indicates the threshold for residual data blocks; It is a natural constant; Generate a key retrieval efficiency index based on key retrieval efficiency information. The key retrieval efficiency index is used to evaluate the retrieval efficiency of a device's encryption key after it has been remotely invalidated by an administrator. It simulates the key invalidation and retrieval process through time-dependent nonlinear feedback. ； in For the key state function, in time Time key valid If it fails ; The response time for the start of key eviction; This indicates the complexity of the system response, which in turn affects the difficulty of key retrieval; and It is a parameter that controls the key retrieval rate; It is a decay function that describes the rate at which key retrieval changes over time; To control the impact of the key's valid state on the time-dependent feedback function, A time-dynamic response to key validity has been introduced; This is the maximum time window for monitoring key eviction operations; Generate a data coverage depth index based on data coverage depth information. The data coverage depth index is used to evaluate the coverage depth of a device when performing data erasure or overwrite operations. It is calculated by introducing the number of overwrite operations and a risk decay function. ； in Indicates the first Data blocks in time The risk attenuation coefficient; For the first Data blocks in time Number of times covered at that time; Used to adjust the magnitude of the coverage effect; This indicates the threshold for the overwrite operation.

5. The processing method for dynamic encryption of sensitive enterprise data according to claim 4, characterized in that: Based on data residual index Key retrieval efficiency index and data coverage depth index Generation and Clearance Rate Comprehensive Evaluation Index The final comprehensive evaluation index for clearance rate is generated through nonlinear combination. ； in , and It is a weighting parameter that controls the impact of each index on the comprehensive assessment index of clearance rate; To control the data residual index The rate of change; The threshold for the data residual index; The square of the key retrieval efficiency; The logarithmic function representing the coverage depth.

6. The processing method for dynamic encryption of sensitive enterprise data according to claim 5, characterized in that: Based on state vector and risk assessment value The system generates dynamic encryption keys. The key generation process is based on a nonlinear function of the device state and slices the key using different state parameters. ； in For dynamic keys, in time An encryption key generated based on state parameters; This is a slice of the key; and To control the nonlinear changes in the key slice; Based on risk assessment value The encryption strategy is dynamically selected, and each layer of encryption strategy adaptively selects the encryption algorithm, dynamically nesting encryption formulas: ； in For data packets that need to be encrypted; and These are the inner encryption algorithm and the outer encryption algorithm, respectively. and These are the inner encryption key and the outer encryption key, respectively. Risk assessment values ​​are categorized into low-risk, medium-risk, and high-risk levels to reflect the environmental assessment level; two risk level thresholds are proposed: threshold and threshold ; Low risk level: When the equipment's risk assessment value Below the preset threshold The system selects a basic encryption method, which includes symmetric encryption algorithms; Medium risk level: When the risk assessment value At two preset thresholds and threshold Intermediate encryption is used between layers; the inner layer uses AES-256 symmetric encryption, and the outer layer uses RSA-2048 asymmetric encryption for additional protection. High risk level: When the risk assessment value Exceeding the threshold It employs advanced encryption strategies, where the inner layer performs multiple chain encryptions, the outer layer uses RSA-4096 encryption, and it combines multi-signature technology to ensure that data is protected in high-risk environments. Based on the state vector of the transmitted data Generate a decryption path using the key model stored in the key management system: ； in and These are the inner decryption function and the outer decryption function, respectively; The system employs a dynamic key eviction mechanism and a multi-layered data destruction strategy; Key eviction mechanism: The key management system monitors risk assessment values. and key recovery efficiency index Determine whether the key needs to be reclaimed or invalidated. Data destruction mechanism: If the device detects a physical attack or a high-risk state, the system will destroy sensitive data through a data overwrite mechanism. The specific data destruction formula is as follows: ； in This represents the coverage depth index of the clearing operation.

7. A processing system for dynamic encryption of sensitive enterprise data, characterized in that: The processing method for dynamic encryption of sensitive enterprise data according to claim 6 includes a key management system module, a device status monitoring and evaluation module, an encryption dynamic adjustment module, a remote key expiration and data evaluation module, and a data erasure rate evaluation and rating module. Key Management System Module: Responsible for generating and distributing encryption keys. Enterprise devices register with the system and obtain encryption keys through channels when they are used for the first time. Equipment Status Monitoring and Assessment Module: The operating system or hardware level within the equipment periodically checks the system status vector and establishes the equipment's environmental assessment level based on data sensitivity and operating environment; Encryption dynamic adjustment module: Adjusts the encryption level in real time according to the environmental assessment level, and performs dynamic encryption processing on the data at the same time; Remote Key Expiration and Data Evaluation Module: When an enterprise confirms that a device is obsolete or that a security risk has occurred, the administrator can remotely send commands to the device through the key management system to immediately invalidate the device's encryption key and evaluate the erasure rate of the device's remaining data. Data cleanup rate assessment and rating module: It obtains data residue information, key recovery efficiency information and data coverage depth information through the key management system, and generates a comprehensive cleanup rate assessment index for rating.

Images