Data security management and control method and device based on classification and grading, medium and product

Abstract

The invention discloses a data security management and control method and device based on classification and grading, a medium and a product, and relates to the technical field of data security management, and the method comprises the steps: obtaining a data confidentiality grade labeling strategy; performing grade labeling on the data stored in each local computer and the data center according to a grade labeling strategy; establishing a data classification grading and security control model based on a neural network by adopting a transverse federated learning architecture; performing data set division based on the desensitized data, different from the data confidentiality level of the local computer, in the data center and the data in the local computer to obtain a training set and a test set; according to the training set and the test set, training the data classification and grading and security management and control model to obtain a trained model; and based on the trained data classification and grading and security management and control model, carrying out classification and grading on data with unknown confidentiality levels. According to the invention, accurate classification and security control can be carried out on the data with unknown confidentiality levels.

Description

Technical Field

[0001] The present application relates to the field of data security management technology, and in particular to a data security management method, device, medium and product based on classification and grading. Background Art

[0002] In the era of big data, data management faces severe challenges. The explosive growth of data requires processors to not only store and process data efficiently, but also ensure the security and privacy of data. Traditional data management methods are unable to cope with large-scale, high-dimensional data, especially in data classification and grading, which requires more intelligent and automated solutions.

[0003] As a revolutionary machine learning technology, deep learning has achieved remarkable results in image recognition, natural language processing and other fields. It can automatically learn complex features from large amounts of data, providing new ideas for data management. Deep learning models, especially neural networks, can learn the inherent laws of data through training and achieve efficient classification and grading of data. However, the training of deep learning models usually requires a large amount of data and computing resources, which brings challenges in terms of data privacy protection and data processing efficiency. Summary of the invention

[0004] The purpose of this application is to provide a data security management method, device, medium and product based on classification and grading, which can accurately classify and securely manage data of unknown confidentiality level.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a data security management method based on classification and grading, including:

[0007] Obtain data confidentiality level labeling strategy;

[0008] According to the data confidentiality level labeling strategy, the data stored in each local computer and data center are labeled with a level; the labeled levels include confidential and ordinary;

[0009] A horizontal federated learning architecture is adopted to establish a data classification and grading and security control model based on a neural network; the data classification and grading and security control model based on a neural network is deployed on each local computer;

[0010] Based on the desensitized data in the data center that is different from the confidentiality level of the local computer data and the grade-labeled data in the local computer, the data set is divided into training sets and test sets;

[0011] For each local computer, the neural network-based data classification and grading and security control model is trained according to the training set and the test set to obtain a trained data classification and grading and security control model; the training of the data classification and grading and security control model includes using the data in the training set to calculate the predicted value of the model, calculating the loss between the predicted value and the actual label, and calculating the gradient according to the loss function to update the model parameters;

[0012] Based on the trained data classification and grading and security management model, data of unknown confidentiality level is classified and graded.

[0013] In a second aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any one of the above-mentioned data security management and control methods based on classification and grading.

[0014] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any one of the above-mentioned data security management and control methods based on classification and grading.

[0015] In a fourth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements any one of the above-mentioned data security management and control methods based on classification and grading.

[0016] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0017] The present application provides a data security management method, device, medium and product based on classification and grading. The method includes, first, by obtaining a data confidentiality level labeling strategy, it can ensure that the data is properly classified according to its sensitivity. Subsequently, these strategies are used to label the data stored in the local computer and the data center, and distinguish between confidential and ordinary data. A horizontal federated learning architecture is adopted to build a data classification, grading and security management model based on a neural network to ensure the efficiency and accuracy of the model. The model is deployed on each local computer so that it can process data in real time. By using desensitized data in the data center that is different from the confidentiality level of the local computer data and the data with grade annotation in the local computer, the data set is divided to obtain a training set and a test set. The model is trained using these data sets, including calculating the predicted value, loss and gradient updating model parameters, so as to obtain a trained data classification, grading and security management model. Finally, the trained model is used to accurately classify and securely control data of unknown confidentiality level to ensure the security and accuracy of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is a schematic diagram of an application environment of a data security management and control method based on classification and grading in one embodiment of the present application;

[0020] Figure 2 A flowchart of a data security management method based on classification and grading provided in an embodiment of the present application;

[0021] Figure 3 A diagram of an overall architecture of data security management and control based on classification and grading provided in one embodiment of the present application;

[0022] Figure 4 A structural diagram of a data security management method based on classification and grading provided in one embodiment of the present application;

[0023] Figure 5 A schematic diagram of horizontal federated learning provided for an embodiment of the present application;

[0024] Figure 6 A Paillier semi-homomorphic encryption and decryption flow chart provided for an embodiment of the present application;

[0025] Figure 7 A global model training flow chart of a data center provided in one embodiment of the present application;

[0026] Figure 8 A model training flow chart of a local computer provided in one embodiment of the present application;

[0027] Fig. 9 A data classification and security management flow chart provided for an embodiment of the present application;

[0028] Fig.10 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0030] As a revolutionary machine learning technology, deep learning has achieved remarkable results in image recognition, natural language processing and other fields. It can automatically learn complex features from large amounts of data, providing new ideas for data management. Deep learning models, especially neural networks, can learn the inherent laws of data through training and achieve efficient classification and grading of data. For example, convolutional neural networks (CNNs) perform well in image classification tasks, while recurrent neural networks (RNNs) are suitable for processing sequence data, such as text or time series data.

[0031] However, the training of deep learning models usually requires a large amount of data and computing resources, which brings challenges in data privacy protection. To solve this problem, federated learning technology came into being. Federated learning allows multiple devices or data centers to collaboratively train models while keeping data localized and not directly sharing data. This method can protect user privacy while also utilizing decentralized data resources for model training, improving the generalization ability of the model. Federated learning technology has been applied in many fields such as medicine and finance, showing its great potential in data management and privacy protection.

[0032] The common data management methods are as follows:

[0033] 1) ETL (Extract, Transform, Load) Process: ETL is a key process in data management that involves extracting data from different data sources, transforming it into a format suitable for analysis, and then loading it into a data warehouse or data lake.

[0034] 2) Data backup and recovery: Traditional data management methods also include regular data backup to prevent data loss or corruption and to be able to restore data when needed.

[0035] 3) Data classification and grading: Classify and grade data so that different protection measures can be taken according to the sensitivity and importance of the data.

[0036] 4) Data encryption: Data encryption is the use of encryption technology to protect data, prevent unauthorized access and leakage, and ensure data security.

[0037] Among the common data management methods, the management standards are usually based on national standards, or the enterprises formulate their own rules. When implemented in specific management, most of them rely on manual processing, which increases the human and material output of data management.

[0038] Compared with the above data management methods, the data management method based on data classification and grading based on federated learning has the following advantages in the field of data security management:

[0039] 1) Data privacy protection: Federated learning allows model training without sharing original data, which has significant advantages in protecting user privacy. Since data does not need to leave the local device, the risk of data leakage is reduced.

[0040] 2) Distributed computing: Federated learning supports distributed computing and can perform model training in parallel on multiple devices, helping to improve the efficiency and speed of data processing.

[0041] 3) Solving the problem of data silos: Federated learning can achieve joint modeling without connecting the data, solving the problem of data silos and allowing different institutions and departments to share the results of model training instead of directly sharing data.

[0042] 4) Model generalization ability: Since federated learning can train models on a variety of different data sources, it can improve the generalization ability of the model, enabling it to maintain good performance in different application scenarios.

[0043] 5) Security: Federated learning is often combined with encryption technology to further protect data security, such as through homomorphic encryption or secure multi-party computing, to ensure that data will not be leaked even during model updates.

[0044] The purpose of this application is to propose a data security management method, equipment, medium and product based on classification and grading by utilizing federated learning, which can accurately classify and securely manage data of unknown confidentiality level.

[0045] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0046] The data security management method based on classification and grading provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be set up separately, integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send the acquired data confidentiality level labeling strategy to the server 104. The server 104 receives the acquired data confidentiality level labeling strategy. The server 104 labels the data stored in each local computer and data center according to the data confidentiality level labeling strategy. The labeled levels include confidential and ordinary. A horizontal federated learning architecture is adopted to establish a data classification and grading and security control model based on a neural network. The data classification and grading and security control model based on the neural network is deployed on each local computer. Based on the desensitized data in the data center that is different from the confidentiality level of the local computer data and the data with level labeling in the local computer, the data set is divided to obtain a training set and a test set. For each local computer, the data classification and grading and security control model based on the neural network is trained according to the training set and the test set to obtain a trained data classification and grading and security control model. The training of the data classification and grading and security control model includes using the data in the training set to calculate the predicted value of the model, calculating the loss between the predicted value and the actual label, and calculating the gradient according to the loss function to update the model parameters. Based on the trained data classification and grading and security control model, data of unknown confidentiality level is classified and graded. The server 104 can feedback the classification level of the obtained data to the terminal 102. In addition, in some embodiments, a data security management method based on classification and grading can also be implemented independently by the server 104 or the terminal 102. For example, the terminal 102 can directly process the data confidentiality level labeling strategy to be processed, or the server 104 can obtain the data confidentiality level labeling strategy to be processed from the data storage system and process the data confidentiality level labeling strategy to be processed.

[0047] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0048] In an exemplary embodiment, Figure 2As shown, a data security management method based on classification and grading is provided. The method is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps 201 to 206. Among them:

[0049] Step 201: Obtain data confidentiality level labeling strategy;

[0050] Step 202: According to the data confidentiality level labeling strategy, the data stored in each local computer and data center is labeled with a level; the labeled levels include confidential and ordinary;

[0051] Step 203: Adopting a horizontal federated learning architecture, establishing a data classification and grading and security management model based on a neural network; the data classification and grading and security management model based on a neural network is deployed on each local computer;

[0052] Step 204: Based on the desensitized data in the data center that is different from the confidentiality level of the local computer data and the grade-labeled data in the local computer, the data set is divided to obtain a training set and a test set;

[0053] Step 205: for each local computer, the neural network-based data classification and grading and security control model is trained according to the training set and the test set to obtain a trained data classification and grading and security control model; the training of the data classification and grading and security control model includes using the data in the training set to calculate the predicted value of the model, calculating the loss between the predicted value and the actual label, and calculating the gradient according to the loss function, and updating the model parameters;

[0054] Step 206: Based on the trained data classification and security management model, classify and grade data of unknown confidentiality level.

[0055] In an exemplary embodiment, before executing step 201, the method further includes:

[0056] Get historical data from the data center and each local computer;

[0057] A long short-term memory network model is selected, and data confidentiality levels are classified for the historical data to obtain a data confidentiality level labeling strategy.

[0058] Specifically, in view of the diversity and complexity of enterprise data types, the long short-term memory network (LSTM) model is selected to classify the confidentiality levels of data and obtain the data confidentiality level labeling strategy.

[0059] Enterprise data covers a variety of information such as videos and texts. By converting the voice information in the video into text, a unified text semantic analysis method is used to determine whether the data is confidential, ensuring the efficiency and consistency of data processing.

[0060] As an efficient recurrent neural network (RNN), the LSTM model is good at processing dependencies in long sequence data and is particularly suitable for tasks that require understanding the context of the data, such as determining confidentiality levels. The LSTM model precisely controls the flow of information through a combination of input gates, forget gates, and output gates, allowing the model to flexibly remember or forget key information in the data. This gating mechanism allows the LSTM model to maintain information coherence when processing long sequence data, helps identify semantic clues, and accurately classifies the confidentiality level of the data.

[0061] In an exemplary embodiment, when executing step 202, the specific steps may be as follows:

[0062] Taking into account the diversity and complexity of enterprise data, data labeling software is used to manually label data stored on local computers and data centers as "confidential" or "normal" confidentiality levels, and ensure that the labeling process meets data security compliance requirements.

[0063] Specifically, data labeling software is used to label the data in different local computers to distinguish their confidentiality level Y, and encryption sample alignment is performed at the system level, so that non-cross-users will not be exposed at the enterprise perception level.

[0064] As shown in Table 1, consider two different types of local computers, which are data owners with two different confidentiality levels. Each data set can be represented by a rectangle, where each row of the rectangle represents an object ID (i) and each column represents a feature of the ID (x). Based on this, the corresponding label (y) can be predicted according to the features of each ID.

[0065] Among them, Figure 5 As shown, the local computers have different sets of clients (u1, u2, ... n ) and feature set (x1,x2,…x n ). Due to different confidentiality requirements of enterprises, the data content stored on local computers does not overlap. However, due to the similarity of the data types they process, the feature sets of the two are the same in many fields. Figure 5 The data differences and commonalities between non-confidential local computers and confidential local computers are demonstrated.

[0066] Table 1 Data collected by different types of local computers

[0067]

[0068]

[0069] The parameter relationship is as follows:

[0070]

[0071] In an exemplary embodiment, when executing step 203, the specific steps may be as follows:

[0072] Build a horizontal federated learning framework to implement a neural network-based data classification, grading, and security control model. The model will be deployed on each local computer, allowing each computer to use its private dataset to train the global model. Figure 3 As shown, the overall architecture includes an aggregated global classification model, several local computers, several data sets, classification models, and data centers.

[0073] In an exemplary embodiment, when executing step 204, the specific steps may be as follows:

[0074] According to the confidentiality level of the local computer and the data set, the data is added to the local computer, the local computer training samples are expanded, and the data is divided into training set and test set.

[0075] Specifically, the data center will transfer desensitized data with a confidentiality level different from that of the local computer to the local computer, and divide it into training sets and test sets according to a predetermined data sample ratio to ensure that the data processed by each party strictly complies with their security level permissions.

[0076] In an exemplary embodiment, when executing step 205, the specific steps may be as follows:

[0077] Taking the local data in the local computer and the desensitized data in the data center with a confidentiality level different from that of the local computer data as input, and the grade-annotated data in the local computer as labels, the data classification and grading and security management model is trained based on the neural network algorithm to obtain a trained data classification and grading and security management model.

[0078] Specifically, the local computer uses the data set to train and test the local classification model. The data set contains both the local computer's data and the data sent by the data center that does not match the confidentiality level of the local computer. Among them, local computers of different levels independently calculate the intermediate results of features to ensure that sensitive data is not leaked; during the training process, local computers of different confidentiality levels exchange encrypted data and calculate their respective training gradients and losses.

[0079] Specifically, each local computer uses its own data to train the global model. This process usually involves the following steps:

[0080] 1) Forward propagation: Use local data to calculate the model's prediction value.

[0081] 2) Loss calculation: Calculate the loss between the predicted value and the actual label.

[0082] 3) Back propagation: Calculate the gradient according to the loss function and update the model parameters.

[0083] This application uses a neural network model with initialized parameters to train two local computer data sets D1 and D2, sets the neural network parameter set to be optimized of the training result to ω, introduces the loss function J(ω), and the gradient descent rule is as follows:

[0084] ω=ω-α·▽J(ω).

[0085] Among them, α is the learning rate, which is used to control the step size of parameter update; ▽J(ω) is the gradient of the loss function J(ω) with respect to the parameter ω.

[0086] After the calculation is completed, the parameter value is updated with a certain step size (learning rate) in the opposite direction of the gradient to gradually reduce the loss function.

[0087] Among them, the local data in the local computer and the desensitized data in the data center with a different confidentiality level from the local computer data are used as input, and the grade-annotated data in the local computer is used as a label. Based on the neural network algorithm, the data classification and grading and security control model is trained to obtain the trained data classification and grading and security control model, which specifically includes:

[0088] Paillier, a semi-homomorphic encryption method, is used to encrypt the training weight parameters of the data classification and security control model.

[0089] Specifically, Figure 6 As shown, a pair of public and private keys is generated based on the Paillier encryption method of semi-homomorphic encryption; the public key in the public and private keys is used to encrypt data, and the private key is used to decrypt data;

[0090] For each training round of the data classification and security control model, obtain the training weight parameters at the end of the current training round;

[0091] The training weight parameters are encrypted using the public key to obtain the encrypted weight parameters.

[0092] Specifically, a pair of public and private keys is generated based on the Paillier encryption method based on semi-homomorphic encryption, which includes:

[0093] Select two different large prime numbers p and q, and calculate n = p × q;

[0094] Choose any integer g such that g<n 2 ,

[0095] According to n and g, determine the public key (n, g) and the private key (λ, μ) in the public and private keys;

[0096] Where x = 1 + n·m (modn 2 ), λ=lcm(p-1,q-1), μ=[L(g λ mod n 2 )] -1 mod n, lcm represents the least common multiple, and m represents the plaintext message to be encrypted.

[0097] When encrypting parameters, select a random number r and calculate the ciphertext formula as follows:

[0098] c=(g m ·r n )modn 2 .

[0099] Among them, m is the plaintext message that needs to be encrypted.

[0100] When performing an addition operation, given two ciphertexts and Calculate the new ciphertext:

[0101] c=(c1·c2)mod n 2 .

[0102]

[0103] When decrypting, given the ciphertext c = (g m ,y r ,s) and private key (λ,μ), calculated as follows:

[0104] m=[L(c λ mod n 2 )·μ]mod n.

[0105] Through the above calculations, the local computer uploads the calculated gradients and losses to the data center, which is responsible for aggregating and updating the global model. According to the data classification results and accuracy of the local computer, the model training weights are dynamically adjusted to perform multiple rounds of iterative optimization.

[0106] Specifically, during multiple rounds of iterative optimization, the data center uses the secure aggregation method of the federated learning algorithm to operate on the neural network parameter weights for data classification that have been homomorphically encrypted in the previous steps.

[0107] Assume there are K local computers, each local computer k has its own data set D k and model parameters ω k In each round of training of the federated average algorithm, the data center will set the global model parameter ω t Send to each local computer; through multiple rounds of iterations, each local computer uses local data to update the model parameters to obtain The data center collects the model parameters of all local computers and updates the global model parameters ω according to the weighted average formula t+1 .

[0108] The specific formula is as follows:

[0109] 1) Local computer model update:

[0110] In the tth iteration, assume that the global model parameter is ω t The data center will set the global model parameter ω t Distribute to all local computers, and then each local computer trains on its own local data. For local computer k, the update formula in the tth iteration is:

[0111]

[0112] Where: η is the learning rate; is the parameter ω on the local computer k t The gradient of the loss function.

[0113] 2) Model aggregation after local update:

[0114] After each local computer completes the local model update, the updated model parameters The data center performs a weighted average of the model parameters of all local computers to obtain a global model update.

[0115] The update formula of the global model parameters is:

[0116]

[0117] Among them, n k is the number of data samples on local computer k; is the total number of data samples from all local computers; is the weight of the local computer k, indicating the proportion of the data volume of the local computer to the total data volume.

[0118] 3) The recursive relationship of the overall process:

[0119] Substituting the local update of the local computer into the global model update formula, we get the recursive relation formula of the federated average algorithm:

[0120]

[0121] After simplification, we get the following formula:

[0122]

[0123] like Figure 7 and Figure 8 As shown, the training process of the data center and local computer during model training is demonstrated.

[0124] Data center operations: Figure 7 As shown in the figure, the global model is first initialized and the initial model parameters are broadcast to all local computers. During the training process, the coordinator randomly selects some local computers, receives the updated model parameters and aggregates them, updates the global model, and then rebroadcasts the updated model parameters to the local computers for the next round of training.

[0125] Local computer operation: Figure 8 As shown, local computers use their local data to train the received global model while preserving the privacy of their respective data. Each local computer calculates model parameter updates based on local data, encrypts the parameter updates and sends them back to the data center. After each round of training, the local computer receives a new round of global model parameters from the coordinator for further local training.

[0126] In addition, this application not only focuses on data security control and compliance verification, but also takes a number of measures to ensure the security and legality of the data processing process. First, the local computer will obtain the test data that does not match the confidentiality level from the data center for data security control verification. This process ensures that data processing meets the established security standards and prevents sensitive information leakage. In addition, compliance audits are conducted regularly to ensure that all operations strictly comply with relevant data protection laws and regulations. Through these audits, any potential compliance issues can be discovered and corrected in a timely manner, thereby reducing the risk of violations. After the model training and data verification are completed, the results will be collected and analyzed to provide feedback and improvement suggestions for subsequent data security control strategies. Through continuous evaluation and improvement, it can be ensured that data security measures are always in the best state. Finally, the security risks of the system are regularly evaluated to ensure that the level of data security and privacy protection continues to improve. By identifying potential threats and vulnerabilities, necessary precautions can be taken to ensure the security and integrity of data during storage, transmission and processing.

[0127] Specifically, Fig. 9As shown in the figure, after the global model training is completed, in order to verify the effectiveness of the method, effectively prevent the local computer from illegally and unauthorizedly processing data that does not match its confidentiality level, prevent user privacy leakage and enterprise data security risks, it is necessary to add data classification and security management links before data processing.

[0128] The process is as follows:

[0129] 1) Permission isolation:

[0130] For the purpose of privacy protection and permission control, local computers with "confidential" permissions are not allowed to access and process "normal" level data; similarly, local computers with "normal" permissions are not allowed to access and process "confidential" level data.

[0131] 2) Data confidentiality level determination:

[0132] When a local computer obtains data of unknown level from a data center, it first uses a local classification and grading model to determine the confidentiality level of the data, and then completes the data classification through manual confirmation of the determination result.

[0133] 3) Data security control feedback mechanism:

[0134] During the determination process, if the confidentiality level of the data does not match the permission level of the local computer, the local computer will automatically feedback the confidentiality level determination result of the data to the data center and restrict local processing operations. The local computer cannot process data that does not meet its permission level locally, thereby achieving data security management and control.

[0135] This process ensures that data classification, grading and security comply with strict permission management requirements, and effectively prevents unauthorized data processing through multi-level permission isolation and security feedback mechanisms.

[0136] In an exemplary embodiment, the present application selects local computers storing data as participants for data classification and grading tasks. Although the intersection between local computer users may be small, the data is highly similar, so the present application adopts a horizontal federated learning framework based on client-data center to process the data stored in the local computer and the data center.

[0137] This application uses federated learning to establish a data classification and security management model based on neural networks at the system level:

[0138] First, to ensure data security and compliance, a data confidentiality level labeling and preprocessing strategy is adopted. Through manual and automated tools, the data stored in local computers and data centers are labeled as "confidential" or "normal". In addition, the data center will transfer desensitized data with a different confidentiality level from the local computer to the local computer, and divide it into training sets and test sets according to the predetermined data sample ratio to ensure that the data processed by each party strictly complies with its security level authority. Under the horizontal federated learning architecture, each local computer uses the distributed neural network model to encrypt the data locally and independently perform model training. Figure 4 As shown in the figure, during this process, the Paillier encryption algorithm is used to protect the security of data during the exchange process and avoid the leakage of sensitive information. The calculation results of each local computer are shared with the data center in encrypted form to aggregate and update the global model.

[0139] After multiple rounds of iterative optimization, the model will be deployed and verified in the actual environment. The local computer will use the final model to classify data of unknown confidentiality level to verify the effectiveness of the model. The data center regularly collects feedback and conducts system security risk assessment to continuously optimize data security strategies and improve the effectiveness of overall security management.

[0140] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig.10 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data confidentiality level labeling strategy label processing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data security management and control method based on classification and grading is implemented.

[0141] Those skilled in the art will understand that Fig.10The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0142] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0143] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0144] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0145] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0146] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0147] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0148] In summary, this application has the following technical effects:

[0149] This application uses federated learning to build a data security management and control method based on classification and grading, which realizes the systematization and intelligence of data security management. This technology allows the data center and local computers to divide the data stored in the data center and local computers into different confidentiality levels of "confidential" and "ordinary" according to the confidentiality level. The data center will transfer data with different confidentiality levels from the local computer to the local computer, and divide the local computer data into training sets and test sets according to the determined sample ratio, which enhances the accuracy and security of data processing.

[0150] At the operational level, the data center assigns corresponding permissions to local computers of different confidentiality levels and issues adapted data processing models. In multiple rounds of iterative updates, local computers use data sets to train models, independently calculate features and intermediate results, upload training gradients and loss information to the data center, and continuously optimize the performance of system-level data processing models.

[0151] Finally, after the model training was completed and officially deployed, the local computer was able to use the model to accurately classify and securely manage data of unknown confidentiality levels, verifying the effectiveness and practicality of this technical approach.

[0152] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0153] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A data security management and control method based on classification and grading, characterized in that: The data security management and control method based on classification and grading includes: Obtain data confidentiality level labeling strategy; According to the data confidentiality level labeling strategy, the data stored in each local computer and data center are labeled with a level; the labeled levels include confidential and ordinary; A horizontal federated learning architecture is adopted to establish a data classification and grading and security control model based on a neural network; the data classification and grading and security control model based on a neural network is deployed on each local computer; Based on the desensitized data in the data center that is different from the confidentiality level of the local computer data and the grade-labeled data in the local computer, the data set is divided into training set and test set; For each local computer, the neural network-based data classification and grading and security control model is trained according to the training set and the test set to obtain a trained data classification and grading and security control model; the training of the data classification and grading and security control model includes using the data in the training set to calculate the predicted value of the model, calculating the loss between the predicted value and the actual label, and calculating the gradient according to the loss function to update the model parameters; Based on the trained data classification and grading and security management model, data of unknown confidentiality level is classified and graded.

2. According to the data security management method based on classification and grading according to claim 1, it is characterized in that: Before obtaining the data confidentiality level labeling strategy, it also includes: Get historical data from the data center and each local computer; A long short-term memory network model is selected, and data confidentiality levels are classified for the historical data to obtain a data confidentiality level labeling strategy.

3. According to the data security management method based on classification and grading according to claim 1, it is characterized in that: For each local computer, the neural network-based data classification and grading and security control model is trained according to the training set and the test set. The trained data classification and grading and security control model specifically includes: Taking the local data in the local computer and the desensitized data in the data center with a confidentiality level different from that of the local computer data as input, and the grade-annotated data in the local computer as labels, the data classification and grading and security management model is trained based on the neural network algorithm to obtain a trained data classification and grading and security management model.

4. According to the data security management method based on classification and grading according to claim 3, it is characterized in that: The loss function of the neural network-based data classification and security control model is as follows: Among them, α is the learning rate; is the gradient of the loss function J(ω) with respect to the parameter ω.

5. According to claim 3, a data security management and control method based on classification and grading is characterized in that: Taking the local data in the local computer and the desensitized data in the data center with a different confidentiality level from the local computer data as input, and the grade-annotated data in the local computer as labels, the data classification and grading and security control model is trained based on the neural network algorithm to obtain a trained data classification and grading and security control model, which specifically includes: Paillier, a semi-homomorphic encryption method, is used to encrypt the training weight parameters of the data classification and security control model.

6. A data security management and control method based on classification and grading according to claim 5, characterized in that: The Paillier semi-homomorphic encryption method is used to encrypt the training weight parameters of the data classification and security control model, including: Generate a pair of public and private keys based on the Paillier encryption method of semi-homomorphic encryption; the public key in the public and private keys is used to encrypt data, and the private key is used to decrypt data; For each training round of the data classification and security control model, obtain the training weight parameters at the end of the current training round; The training weight parameters are encrypted using the public key to obtain the encrypted weight parameters.

7. A data security management and control method based on classification and grading according to claim 6, characterized in that: The encryption method Paillier based on semi-homomorphic encryption generates a pair of public and private keys, including: Select two different large prime numbers p and q, and calculate n = p × q; Choose any integer g that satisfies According to n and g, determine the public key (n, g) and the private key (λ, μ) in the public and private keys; Where x = 1 + n·m (modn 2 ), λ=lcm(p-1,q-1), μ=[L(g λ modn 2 )] -1 modn, lcm represents the least common multiple, and m represents the plaintext message to be encrypted.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a data security management and control method based on classification and grading as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements a data security management and control method based on classification and grading as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, it implements a data security management and control method based on classification and grading as described in any one of claims 1-7.

Images