Enterprise internal data key encryption method and device

Abstract

The invention relates to an enterprise internal data key encryption method and device, and belongs to the technical field of data encryption, and the method comprises the steps: enabling each employee in an office to wear a radio frequency identifier, obtaining the position coordinates of the employees, continuously tracking the position coordinate changes of the employees, and obtaining the movement track data of the employees in the office; clustering the historical movement tracks of the employees to obtain a clustering model, judging whether the employees change positions or not according to the movement track data of the employees in the office and the clustering model, and if the judgment result is that the employees change positions, updating the information of the region where the employees are located, and determining whether to adjust a preset threshold value or not; generating employee moving state snapshots at two time points before and after transposition, and determining whether an abnormal transposition behavior exists or not; updating the clustering model; and if the determined result is the abnormal transposition behavior, dynamic key updating is triggered, and employee sensitive data needing to be encrypted and stored are encrypted. According to the invention, the position of the employee is continuously tracked, and the encryption key is dynamically generated according to the change rule of the position.

Description

Technical Field

[0001] The present invention belongs to the technical field of enterprise internal data encryption, and in particular, relates to an enterprise internal data key encryption method and device. Background Art

[0002] When deploying a radio frequency identification network in an office, there is a technical challenge of how to update dynamic keys in real time according to changes in employee mobility status. Employee mobility status includes multiple factors such as location coordinates, movement trajectory, and length of stay, and the weight of each factor is difficult to determine. It is common for employees to change positions in the office due to project adjustments, team reorganization, or work efficiency optimization. Especially when employees change positions, the original mobility pattern changes dramatically. It is necessary to generate keys bound to the new workstation in a timely manner and abolish the old keys, so as to ensure that the keys are bound to the actual workstations of employees and prevent the keys from being used incorrectly and causing data leakage. At the same time, the frequency of changes in mobility status must also be considered, and the key update frequency must be adjusted adaptively. In addition, when updating keys, how to achieve smooth replacement of new and old keys to avoid security vulnerabilities in the data encryption and decryption process is also a major challenge. In summary, how to design a dynamic key update mechanism that comprehensively utilizes multiple mobility status factors, adaptively updates frequency, and ensures data security is a technical problem that needs to be overcome. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the purpose of the invention is to provide a method and device for encrypting internal data keys in an enterprise, which realizes continuous and accurate tracking of employee locations, and dynamically generates high-strength encryption keys based on the changing patterns of location data, thereby significantly improving the office efficiency and data security of the enterprise.

[0004] The first aspect of the present invention provides a method for encrypting an internal data key of an enterprise, comprising:

[0005] Obtain a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates, and the RFID number;

[0006] Match the employee's location coordinates with the pre-established office RFID distribution map to determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office;

[0007] Cluster the historical movement trajectories of employees to obtain a clustering model. Based on the employee's movement trajectory data in the office and the clustering model, determine whether the employee has changed positions. If the judgment result is that the employee has changed positions, update the employee's area information and send an abnormal alarm information to the monitoring center. The staff of the monitoring center determines whether to adjust the pre-set threshold based on the employee's position and authority level information;

[0008] Generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior;

[0009] According to the key behavior indicators, the movement trajectory data before and after the change of position is segmented, the length of time employees stay at the original and new workstations is counted, the movement frequency and the stay frequency are calculated, the movement direction change rate indicator is introduced to update the feature vector, and the clustering model is updated according to the updated feature vector;

[0010] If the result is determined to be an abnormal position change, a dynamic key update is triggered. Based on the employee's mobile status snapshot after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and the old key associated with the original workstation is abolished.

[0011] Use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored;

[0012] Continuously monitor the movement trajectories and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency based on the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

[0013] The second aspect of the present invention further provides an enterprise internal data key encryption device, comprising:

[0014] Acquisition module: used to acquire a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates and the RFID number;

[0015] Continuous tracking module: used to match the employee's location coordinates with the pre-established office RFID distribution map, determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office;

[0016] Update module: used to cluster the historical movement trajectories of employees to obtain a clustering model. Based on the employee's movement trajectory data in the office and the clustering model, it is determined whether the employee has changed positions. If the judgment result is that the employee has changed positions, the employee's area information is updated and an abnormal alarm message is sent to the monitoring center. The staff of the monitoring center determines whether to adjust the preset threshold based on the employee's position and authority level information.

[0017] Determination module: used to generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior;

[0018] Clustering module: used to segment the movement trajectory data before and after the position change according to key behavioral indicators, count the length of time employees stay at the original and new workstations, calculate the movement frequency and stay frequency, introduce the movement direction change rate indicator to update the feature vector, and update the clustering model according to the updated feature vector;

[0019] Generation module: used to trigger dynamic key update if the result is determined to be abnormal position change behavior. According to the mobile status snapshot of the employee after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and abolish the old key associated with the original workstation;

[0020] Encryption module: used to use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored;

[0021] Dynamic adjustment module: used to continuously monitor the movement trajectory and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency according to the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

[0022] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor and a memory;

[0023] The processor calls the program or instruction stored in the memory to execute any one of the above-mentioned internal enterprise data key encryption methods.

[0024] The fourth aspect of the present invention further proposes a computer-readable storage medium, which stores a program or instruction, and the program or instruction enables a computer to execute any one of the above-mentioned methods for encrypting internal enterprise data keys.

[0025] The beneficial effects of the present invention are as follows: The present invention first establishes a distribution map of radio frequency identifiers in the office, obtains the coordinates of the employee's location in real time and determines the area in which they are located. When an employee changes positions, a snapshot of the movement status before and after the change is generated, key behavioral indicators are extracted, and the employee behavior pattern clustering model is updated. At the same time, a new key is generated based on the multi-factor dynamic password bound to the new workstation, which is used to encrypt the employee's sensitive data. The present invention also dynamically adjusts the key update strategy and frequency based on the employee's behavioral stability at the new workstation, thereby improving system efficiency while ensuring data security. This method of combining employee location awareness with dynamic key management effectively improves the security of sensitive data in an office environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0027] Figure 1 A diagram of a method for encrypting enterprise internal data keys provided by an embodiment of the present invention;

[0028] Figure 2 A method diagram for generating employee movement trajectory data in an office provided by an embodiment of the present invention;

[0029] Figure 3 A method diagram for determining whether to adjust a preset threshold value provided by an embodiment of the present invention;

[0030] Figure 4 A method diagram for determining whether there is abnormal transposition behavior provided by an embodiment of the present invention;

[0031] Figure 5 A diagram of a method for updating a clustering model provided by an embodiment of the present invention;

[0032] Figure 6 A diagram of a dynamic key update method provided by an embodiment of the present invention;

[0033] Figure 7 A diagram of an internal enterprise data key encryption device provided by an embodiment of the present invention;

[0034] Figure 8 A schematic block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.

[0036] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.

[0037] In the description of the present invention, the terms "first", "second", and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be internal communication between two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0038] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.

[0039] The present invention proposes a method, device, electronic device and storage medium for encrypting internal enterprise data keys, which realizes continuous and accurate tracking of employee locations and dynamically generates high-strength encryption keys based on the changing patterns of location data, significantly improving the office efficiency and data security of the enterprise.

[0040] K-means algorithm: K-means is an iterative clustering analysis algorithm. Its steps are to pre-divide the data into K groups, randomly select K objects as the initial cluster centers, and then calculate the distance between each object and each seed cluster center, and assign each object to the cluster center closest to it.

[0041] Method Embodiment

[0042] Figure 1 A diagram of an enterprise internal data key encryption method provided by an embodiment of the present invention.

[0043] The first aspect of the present invention provides a method for encrypting enterprise internal data keys. Figure 1 , including eight steps from S1 to S8:

[0044] S1: Obtain a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, each employee in the office wears an RFID, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates and the RFID number.

[0045] Specifically, in an embodiment of the present invention, a method for generating a two-dimensional digital indoor map, obtaining the location coordinates of an employee, and recording a timestamp of an employee's location change, the employee's location coordinates, and an RFID number is described in detail below.

[0046] In some embodiments, the moving speed is calculated based on the distance between two consecutive sampling positions. If the moving speed exceeds a preset speed threshold, the sampling frequency is increased; if the moving speed is lower than the preset speed threshold, the sampling frequency is reduced; based on the RFID network topology, the residence time of the RFID number in different RFID coverage areas is calculated, and the K-means algorithm is used to cluster the residence time data to obtain the frequent activity areas of the employees corresponding to the RFID numbers; the Floyd-Warshall algorithm is used to calculate the shortest path in the RFID network, and based on the shortest path and the actual movement trajectory of the RFID number, a network diagram of the common paths of the employees corresponding to the RFID number is obtained.

[0047] S2: Match the employee's location coordinates with the pre-established office RFID distribution map to determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office.

[0048] Specifically, in an embodiment of the present invention, a method for matching an employee's location coordinates with a pre-established office RFID distribution map, determining the employee's current office area, and continuously tracking the employee's location coordinate changes to obtain the employee's movement trajectory data in the office is described in detail below.

[0049] S3: Cluster the historical movement trajectories of employees to obtain a clustering model. Determine whether the employee has changed positions based on the employee's movement trajectory data in the office and the clustering model. If the judgment result is that the employee has changed positions, update the employee's area information and send an abnormal alarm message to the monitoring center. The staff of the monitoring center determines whether to adjust the pre-set threshold based on the employee's position and authority level information.

[0050] Specifically, in the embodiment of the present invention, the method of obtaining a clustering model, determining whether an employee has changed positions, updating the employee's area information, and adjusting a preset threshold value is described in detail below.

[0051] S4: Generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize the feature vector dimension through feature selection algorithm, extract key behavior indicators, and determine whether there is abnormal position change behavior.

[0052] Specifically, in an embodiment of the present invention, a method for generating a mobile state snapshot, extracting features from the mobile state snapshot, optimizing feature vector dimensions through a feature selection algorithm, extracting key behavior indicators, and determining whether there is abnormal transposition behavior is described in detail below.

[0053] S5: Segment the movement trajectory data before and after the position change according to the key behavioral indicators, count the length of time employees stay at the original and new workstations, calculate the movement frequency and stay frequency, introduce the movement direction change rate indicator to update the feature vector, and update the clustering model according to the updated feature vector.

[0054] Specifically, in an embodiment of the present invention, the movement trajectory data before and after the position change is segmented according to key behavioral indicators, the length of time employees stay at the original workstation and the new workstation is counted, the movement frequency and the stay frequency are calculated, and the movement direction change rate indicator is introduced to update the feature vector. The method for updating the clustering model according to the updated feature vector is described in detail below.

[0055] S6: If the result is determined to be an abnormal position change behavior, a dynamic key update is triggered. Based on the mobile status snapshot of the employee after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and the old key associated with the original workstation is abolished.

[0056] Specifically, in the embodiment of the present invention, the method for dynamic key updating is described in detail below.

[0057] S7: Use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored.

[0058] Specifically, in an embodiment of the present invention, a method for encrypting employee sensitive data that needs to be encrypted and stored is described in detail below.

[0059] S8: Continuously monitor the movement trajectories and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency based on the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

[0060] Specifically, in an embodiment of the present invention, if the employee's behavior pattern at the new workstation is stable and consistent with the pattern in the updated clustering model, the key update frequency is reduced; conversely, if the employee's behavior pattern fluctuates greatly or does not conform to the updated clustering model, the key update frequency is increased to ensure data security.

[0061] Furthermore, in the above-mentioned method for encrypting data keys within an enterprise, the pre-established distribution map of office radio frequency identifiers includes: the location coordinates of each radio frequency identifier, coverage parameters, and topological relationships between the identifiers;

[0062] The 2D digital indoor map includes: precise RFID coordinates, coverage radius and neighboring RFID numbers;

[0063] Obtaining the location coordinates of the employee, including: using the least square method to calculate the relative position of the radio frequency identifier in a pre-established distribution map of radio frequency identifiers in the office, and obtaining the location coordinates of the employee according to the relative position and a two-dimensional digital indoor map;

[0064] Recording the timestamp of employee location changes, the employee's location coordinates, and the radio frequency identifier number includes: using a time series database to record the timestamp of employee location changes, the employee's location coordinates, and the radio frequency identifier number.

[0065] Figure 2 A method diagram for generating employee movement trajectory data in an office is provided in an embodiment of the present invention.

[0066] Furthermore, in the above-mentioned enterprise internal data key encryption method, the employee's location coordinates are matched with a pre-established office RFID distribution map to determine the employee's current office area, and the employee's location coordinate changes are continuously tracked to obtain the employee's movement trajectory data in the office. Figure 2 , including five steps from S21 to S25:

[0067] S21: using an R-tree as a spatial index structure to store a radio frequency identifier distribution map, dividing the office area into grid units according to the radio frequency identifier distribution map, and establishing a mapping relationship between the grid units and the radio frequency identifiers;

[0068] S22: receiving the employee's location coordinates, and quickly locating the grid unit where the employee's location coordinates are located through the R-tree; and determining the employee's current office area based on the mapping relationship between the grid unit and the radio frequency identifier;

[0069] S23: Continuously collect employee location coordinates using a sliding time window method to obtain an employee location coordinate sequence;

[0070] S24: performing data smoothing processing on the employee position coordinate sequence;

[0071] S25: Fitting the smoothed coordinates using a cubic Bezier curve, where every four consecutive points of the cubic Bezier curve are used as a group of control points; and generating movement trajectory data of the employee in the office according to the cubic Bezier curve.

[0072] Exemplarily, an R-tree is used as a spatial index structure to store the RFID distribution map, and the office area is divided into 5m x 5m grid units. Each grid unit is associated with the corresponding RFID coverage range, and a mapping relationship between the grid unit and the RFID is constructed. After obtaining the employee's position coordinates, the grid unit is quickly located through the R-tree, and the employee's current office area is determined according to the mapping relationship between the grid unit and the identifier. If the employee's position falls on the boundary of multiple grid units, the office area corresponding to the identifier with the highest signal strength is selected. The sliding time window method is used to record the changes in the employee's position coordinates. A time window of 30 seconds is set, and it slides once every 5 seconds. The employee's position coordinates are continuously collected at intervals of 1 second in each time window to form a coordinate sequence. The coordinate sequence is smoothed, and the moving average method is used to take the average of the two points before and after as the smoothed coordinates to eliminate noise points. The coordinate sequence after the cubic Bezier curve fitting process is used, and every four consecutive points are used as a group of control points to generate the employee's movement trajectory data in the office. The final generated movement trajectory data contains timestamps, smoothed coordinate points, and corresponding Bezier curve parameters.

[0073] Figure 3 A method diagram for determining whether to adjust a preset threshold is provided in an embodiment of the present invention.

[0074] Furthermore, in the above-mentioned internal data key encryption method of an enterprise, the historical movement trajectory of the employees is clustered to obtain a clustering model, and whether the employees have changed positions is determined based on the movement trajectory data of the employees in the office and the clustering model. If the judgment result is that the employees have changed positions, the information of the area where the employees are located is updated, and an abnormal alarm information is sent to the monitoring center. The staff of the monitoring center determines whether to adjust the preset threshold according to the employee's position and authority level information, and combines Figure 3 , including six steps from S31 to S36:

[0075] S31: Based on the employee's historical trajectory data, a K-means clustering algorithm is used to perform cluster analysis to determine the center point of the main area of ​​the employee's daily activities. If the employee is a new employee or an employee who has just changed his / her workstation, the trajectory data of the first week is used for clustering. The clustering results are updated once a day until the clustering model is stable.

[0076] S32: Obtain employee movement trajectory data, and use a sliding time window method to segment the trajectory data to obtain the average movement speed and trajectory direction in each time window;

[0077] S33: Calculate the Euclidean distance between the employee's current location and the cluster center, and determine whether the employee has left the regular activity area based on the Euclidean distance;

[0078] S34: If the Euclidean distance exceeds a preset threshold, it is determined that the employee has left the regular activity area;

[0079] S35: For an employee who is determined to have left the regular activity area, the time he / she stays in the new area is calculated; if the time he / she stays in the new area exceeds a preset time threshold, it is determined that a position change has occurred, the employee's area information is updated, and an abnormal alarm message is sent to the monitoring center;

[0080] S36: Obtain the employee's position and authority level information, and the monitoring center staff determines whether to adjust the preset threshold and the preset time threshold according to the employee's position and authority level information.

[0081] Exemplarily, the sliding time window method is used to segment the employee movement trajectory data, and the window size is set to 5 minutes, sliding once every 30 seconds, and calculating the average movement speed and trajectory direction in each time window. The trajectory direction is determined by calculating the vector of the first and last two points in the window; the K-means clustering algorithm is used to perform cluster analysis on the employee historical trajectory data to obtain the center points of the main areas of employees' daily activities and establish an employee activity area model; for new employees or employees who have just changed their workstations, their trajectory data of the first week is used for clustering, and the clustering results are updated once a day until the model is stable; by calculating the Euclidean distance between the current position and the cluster center, it is determined whether the employee has left the regular activity area, and three thresholds of 1 meter, 3 meters, and 5 meters are set. Different levels of judgment measures are taken according to different distances, and potential relocation events are further verified. The employee's stay time in the new area is calculated. If it exceeds 5 minutes, it is confirmed that a relocation has occurred, the employee's area information is updated, and an abnormal alarm message is sent to the monitoring center. If the employee returns to the original area within 5 minutes, the relocation judgment is canceled. Adjust the judgment criteria according to the employee's position and authority level. For employees who need to move frequently, appropriately increase the preset threshold and preset time threshold.

[0082] Figure 4 A method diagram for determining whether abnormal transposition behavior exists is provided in an embodiment of the present invention.

[0083] Furthermore, in the above-mentioned enterprise internal data key encryption method, employee mobility status snapshots at two time points before and after the position change are generated, features are extracted from the mobility status snapshots, feature vector dimensions are optimized through feature selection algorithms, key behavior indicators are extracted, and it is determined whether there is abnormal position change behavior. Figure 4 , including four steps from S41 to S44:

[0084] S41: extracting employee location data in a time period before and after the position change from a time series database, and generating a mobile status snapshot including a timestamp, coordinates, speed, and direction;

[0085] S42: Using the sliding time window method, extract features from the employee's mobile status snapshot, calculate the average speed, dwell time, moving distance and direction change frequency to obtain the behavioral feature vectors of the original workstation and the new workstation;

[0086] S43: standardize each eigenvector, perform dimensionality reduction on the standardized eigenvector, calculate the eigenvalue and eigenvector, sort by eigenvalue, select the first few eigenvectors whose cumulative contribution rate exceeds a preset contribution rate threshold as principal components, and form an optimized eigenvector;

[0087] S44: Calculate the Euclidean distance of the optimized feature vectors before and after the transposition, and determine the difference between the Euclidean distance and a preset threshold. If the Euclidean distance is greater than the preset threshold, determine that the transposition behavior is abnormal;

[0088] Among them, the key behavioral indicator is the principal component eigenvector.

[0089] For example, according to the employee relocation detection results, the employee location data of 5 minutes before and after the relocation is obtained from the time series database to obtain a mobile state snapshot containing timestamp, coordinates, speed, and direction. The sliding time window method is used to extract features from the mobile state snapshot to determine the average speed, dwell time, moving distance, and direction change frequency; if the feature extraction is completed, the features are Z-score standardized; the standardized feature vector is reduced in dimension by the principal component analysis method to determine whether the cumulative contribution rate of the feature vector exceeds 95%. If the cumulative contribution rate exceeds 95%, the Euclidean distance of the optimized feature vector before and after the relocation is calculated; it is determined whether the Euclidean distance exceeds the preset threshold. If it exceeds, it is determined to be an abnormal relocation behavior.

[0090] Figure 5 A diagram of a method for updating a clustering model provided in an embodiment of the present invention.

[0091] Furthermore, in the above-mentioned enterprise internal data key encryption method, the movement trajectory data before and after the change of position is segmented according to the key behavior index, the employee's stay time at the original workstation and the new workstation is counted, the movement frequency and the stay frequency are calculated, the movement direction change rate index is introduced to update the feature vector, and the updated feature vector is clustered to obtain a clustering model. Figure 5 , including five steps from S51 to S55:

[0092] S51: segmenting the trajectory data before and after the transposition according to key behavioral indicators;

[0093] S52: Calculate the average speed, moving distance and number of direction changes in the sliding window to obtain the mean and variance of the three time scale features;

[0094] S53: using the quartile method to process the speed distribution of the employee's historical data, determining a speed threshold, and accumulating the stay time to obtain the speed if the speed is lower than the speed threshold; and accumulating the move time to obtain the speed if the speed is higher than the speed threshold;

[0095] S54: Calculate the number of direction changes per unit time and divide it by the moving distance to obtain a moving direction change rate indicator. If the moving distance is less than a preset distance value, use the time interval instead of the moving distance as the denominator.

[0096] S55: Use the Gaussian mixture model to perform cluster analysis on the updated feature vectors, use the expectation-maximization algorithm to iteratively optimize the model parameters, determine the optimal number of clusters based on the Bayesian information criterion, and obtain the updated cluster centers and covariance matrix.

[0097] Exemplarily, according to the extracted key behavioral indicators, three sliding windows of 1 minute, 5 minutes and 15 minutes are set, the trajectory data before and after the change of position are segmented, the average speed, moving distance and number of direction changes in each window are calculated, and then the mean and variance of the three time scale features are calculated as new comprehensive features; the employees' stay time at the original workstation and the new workstation are counted respectively, and the personalized speed threshold is determined by the speed distribution of the employees' historical data using the quartile method, the time periods with speeds lower than the speed threshold are accumulated to obtain the stay time, and the proportion of the stay time to the total observation time is calculated as the stay frequency; the movement frequency is calculated, the time periods with speeds greater than the speed threshold are accumulated to obtain the movement time, and the movement frequency is divided by The movement frequency is obtained by the total observation time, and the moving direction change rate indicator is introduced. It is obtained by calculating the number of direction changes per unit time and dividing it by the moving distance. When the moving distance is less than the preset distance value, the preset distance value here is a value close to zero, such as 0.5m, and the time interval is used instead of the moving distance as the denominator; the Gaussian mixture model is used to perform cluster analysis on the updated feature vectors. First, the K-means algorithm is used to obtain the initial cluster center, and the covariance matrix of each class is calculated as the initial value. Then, the expectation maximization algorithm is used to iteratively optimize the model parameters. The Bayesian information criterion is used to automatically select the optimal number of clusters to obtain the updated cluster center and covariance matrix for subsequent behavior pattern recognition and anomaly detection.

[0098] Figure 6 A diagram of a dynamic key update method provided by an embodiment of the present invention.

[0099] Furthermore, in the above-mentioned enterprise internal data key encryption method, a dynamic key update is triggered, and according to the mobile status snapshot of the employee after the position change, a new key bound to the new workstation is generated by a multi-factor dynamic password algorithm, and the old key associated with the original workstation is abolished. Figure 6 , including six steps from S61 to S66:

[0100] S61: Based on the employee ID, new workstation coordinates and timestamp, the SHA-256 hash algorithm is used to calculate the basic key seed, the speed and direction information in the movement trajectory data are quantified into a numerical value, and an XOR operation is performed with the basic key seed to generate a dynamic key through the HMAC-SHA256 algorithm;

[0101] S62: Encrypt the dynamic key using the RSA asymmetric encryption algorithm to obtain an encrypted ciphertext;

[0102] S63: Bind the encrypted ciphertext to the new workstation identifier and store it in the security key manager;

[0103] S64: Retrieving the old key identifier associated with the original workstation from the security key manager;

[0104] S65: Determine whether the old key identifier exists. If the determination result is that the old key identifier exists, mark the state of the old key identifier as revoked;

[0105] S66: Determine the expiration time of the old key identifier according to a preset security policy, and delete the old key identifier from the security key manager when the expiration time arrives.

[0106] Exemplarily, when an employee relocation event is detected, a snapshot of the employee's mobile status is obtained from the real-time positioning system, and the employee ID, new workstation coordinates, timestamp, and movement trajectory data are extracted as input parameters for key update, and the middle time between two consecutive position sampling points is used as the relocation time point. Using the SHA-256 hash algorithm, the employee ID, new workstation coordinates, and timestamp are concatenated and the hash value is calculated to obtain the basic key seed. The speed and direction information in the movement trajectory data are quantified into numerical values, and an XOR operation is performed with the basic key seed, and then the HMAC-SHA256 algorithm is used to generate a dynamic key. The generated dynamic key is encrypted using the system public key through the RSA asymmetric encryption algorithm, and the encrypted ciphertext is bound to the new workstation ID and stored in the secure key manager. At the same time, the encrypted new key is pushed to the employee terminal device, and the number of retries and intervals are set. If the push fails, a key reset instruction is sent through the backup channel. Retrieve the old key ID associated with the original workstation from the security key manager, mark its status as revoked, and set a random time between 1 hour and 24 hours as the expiration time according to the enterprise security policy. After the expiration time is reached, permanently delete the old key information from the security key manager.

[0107] In some embodiments, the execution status and results of each step are recorded in real time, and a detailed operation log is generated for subsequent auditing and troubleshooting.

[0108] In some embodiments, the above method is also used for internal data encryption in hospitals, schools, factories, etc.

[0109] Device Embodiment

[0110] Figure 7 A diagram of an enterprise internal data key encryption device provided in an embodiment of the present invention.

[0111] In a second aspect of the present invention, an enterprise internal data key encryption device is also proposed, combined with Figure 7 ,include:

[0112] Acquisition module 71: used to acquire a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, each employee in the office wears an RFID, acquire the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates and the RFID number;

[0113] Continuous tracking module 72: used to match the employee's location coordinates with a pre-established office RFID distribution map, determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office;

[0114] Update module 73: used to cluster the historical movement trajectories of employees to obtain a clustering model, and determine whether the employee has changed positions based on the employee's movement trajectory data in the office and the clustering model. If the judgment result is that the employee has changed positions, the employee's area information is updated, and an abnormal alarm information is sent to the monitoring center. The staff of the monitoring center determines whether to adjust the preset threshold according to the employee's position and authority level information;

[0115] Determination module 74: used to generate employee movement status snapshots at two time points before and after the position change, perform feature extraction on the movement status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior;

[0116] Clustering module 75: used to segment the movement trajectory data before and after the position change according to the key behavior indicators, count the employee's stay time at the original workstation and the new workstation, calculate the movement frequency and the stay frequency, introduce the movement direction change rate indicator to update the feature vector, and update the clustering model according to the updated feature vector;

[0117] Generating module 76: for triggering a dynamic key update if the result of the determination is that it is an abnormal position change behavior, and using a multi-factor dynamic password algorithm to generate a new key bound to the new workstation and abolish the old key associated with the original workstation according to the mobile status snapshot of the employee after the position change;

[0118] Encryption module 77: used to use the dynamic key as the key of the symmetric encryption algorithm to encrypt the employee sensitive data that needs to be encrypted and stored;

[0119] Dynamic adjustment module 78: used to continuously monitor the movement trajectory and behavior pattern of employees at the new workstation, and dynamically adjust the key update strategy and frequency according to the employee behavior pattern at the new workstation and the pattern in the updated clustering model.

[0120] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor and a memory;

[0121] The processor calls the program or instruction stored in the memory to execute any one of the above-mentioned internal enterprise data key encryption methods.

[0122] The fourth aspect of the present invention further proposes a computer-readable storage medium, which stores a program or instruction, and the program or instruction enables a computer to execute any one of the above-mentioned methods for encrypting internal enterprise data keys.

[0123] Figure 8 It is a schematic block diagram of an electronic device provided by an embodiment of the present invention.

[0124] like Figure 8As shown, the electronic device includes: at least one processor 801, at least one memory 802 and at least one communication interface 803. The various components in the electronic device are coupled together through a bus system 804. The communication interface 803 is used to transmit information between external devices. It can be understood that the bus system 804 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0125] It can be understood that the memory 802 in this embodiment can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0126] In some implementations, the memory 802 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system and application programs.

[0127] The operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. A program that implements any method of an enterprise internal data key encryption method provided in an embodiment of the present invention can be included in the application.

[0128] In an embodiment of the present invention, the processor 801 calls a program or instruction stored in the memory 802, specifically, a program or instruction stored in an application, and the processor 801 is used to execute the steps of each embodiment of an enterprise internal data key encryption method provided in an embodiment of the present invention.

[0129] Obtain a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates, and the RFID number;

[0130] Match the employee's location coordinates with the pre-established office RFID distribution map to determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office;

[0131] Cluster the historical movement trajectories of employees to obtain a clustering model. Based on the employee's movement trajectory data in the office and the clustering model, determine whether the employee has changed positions. If the judgment result is that the employee has changed positions, update the employee's area information and send an abnormal alarm information to the monitoring center. The staff of the monitoring center determines whether to adjust the pre-set threshold based on the employee's position and authority level information;

[0132] Generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior;

[0133] According to the key behavior indicators, the movement trajectory data before and after the change of position is segmented, the length of time employees stay at the original and new workstations is counted, the movement frequency and the stay frequency are calculated, the movement direction change rate indicator is introduced to update the feature vector, and the clustering model is updated according to the updated feature vector;

[0134] If the result is determined to be an abnormal position change, a dynamic key update is triggered. Based on the employee's mobile status snapshot after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and the old key associated with the original workstation is abolished.

[0135] Use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored;

[0136] Continuously monitor the movement trajectories and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency based on the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

[0137] Any method in the enterprise internal data key encryption method provided by the embodiment of the present invention can be applied to the processor 801, or implemented by the processor 801. The processor 801 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 801 or an instruction in the form of software. The above-mentioned processor 801 can be a general-purpose processor, a digital signal processor (DigitalSignal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0138] The steps of any method in the method for encrypting data keys within an enterprise provided by an embodiment of the present invention can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software units in the decoding processor. The software unit can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 802, and the processor 801 reads the information in the memory 802 and completes the steps of the method in combination with its hardware.

[0139] Those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present invention and to form different embodiments.

[0140] Those skilled in the art will appreciate that the description of each embodiment has its own emphasis, and for parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0141] Although the embodiments of the present invention are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims. The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed by the present invention, and these modifications or substitutions should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

[0142] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for encrypting enterprise internal data keys, characterized in that: include: Obtain a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates, and the RFID number; Match the employee's location coordinates with the pre-established office RFID distribution map to determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office; Cluster the historical movement trajectories of employees to obtain a clustering model. Based on the employee's movement trajectory data in the office and the clustering model, determine whether the employee has changed positions. If the judgment result is that the employee has changed positions, update the employee's area information and send an abnormal alarm information to the monitoring center. The staff of the monitoring center determines whether to adjust the pre-set threshold based on the employee's position and authority level information; Generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior; According to the key behavior indicators, the movement trajectory data before and after the change of position is segmented, the length of time employees stay at the original and new workstations is counted, the movement frequency and the stay frequency are calculated, the movement direction change rate indicator is introduced to update the feature vector, and the clustering model is updated according to the updated feature vector; If the result is determined to be an abnormal position change, a dynamic key update is triggered. Based on the employee's mobile status snapshot after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and the old key associated with the original workstation is abolished. Use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored; Continuously monitor the movement trajectories and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency based on the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

2. According to claim 1, a method for encrypting enterprise internal data keys is characterized in that: The pre-established office RFID distribution map includes: location coordinates of each RFID, coverage parameters, and topological relationships between RFIDs; The 2D digital indoor map includes: precise RFID coordinates, coverage radius and neighboring RFID numbers; Obtaining the location coordinates of the employee, including: using the least square method to calculate the relative position of the radio frequency identifier in a pre-established distribution map of radio frequency identifiers in the office, and obtaining the location coordinates of the employee according to the relative position and a two-dimensional digital indoor map; Recording the timestamp of employee location changes, the employee's location coordinates, and the radio frequency identifier number includes: using a time series database to record the timestamp of employee location changes, the employee's location coordinates, and the radio frequency identifier number.

3. The method for encrypting enterprise internal data keys according to claim 1, characterized in that: Match the employee's location coordinates with the pre-established office RFID distribution map to determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office, including: An R-tree is used as a spatial index structure to store the RFID distribution map. The office area is divided into grid units according to the RFID distribution map, and a mapping relationship between the grid units and the RFID is established. Receive the employee's location coordinates and quickly locate the grid unit where the employee's location coordinates are located through the R-tree; determine the employee's current office area based on the mapping relationship between the grid unit and the RFID; The sliding time window method is used to continuously collect employee location coordinates to obtain the employee location coordinate sequence; Perform data smoothing on employee location coordinate sequences; The smoothed coordinates are fitted using a cubic Bezier curve, where every four consecutive points are used as a group of control points; the movement trajectory data of employees in the office are generated based on the cubic Bezier curve.

4. The method for encrypting enterprise internal data keys according to claim 1, characterized in that: Cluster the historical movement trajectories of employees to obtain a clustering model. According to the employee's movement trajectory data in the office and the clustering model, determine whether the employee has changed positions. If the judgment result is that the employee has changed positions, update the employee's area information and send abnormal alarm information to the monitoring center. The staff of the monitoring center determines whether to adjust the preset threshold according to the employee's position and authority level information, including: Based on the employee's historical trajectory data, the K-means clustering algorithm is used to perform cluster analysis to determine the center points of the main areas of the employee's daily activities. If the employee is a new employee or an employee who has just changed his / her workstation, the trajectory data of the first week is used for clustering. The clustering results are updated once a day until the clustering model is stable. Obtain employee movement trajectory data, use the sliding time window method to segment the trajectory data, and obtain the average movement speed and trajectory direction in each time window; Calculate the Euclidean distance between the employee's current location and the cluster center, and determine whether the employee has left the regular activity area based on the Euclidean distance; If the Euclidean distance exceeds the preset threshold, it is determined that the employee has left the regular activity area; For employees who are determined to have left their regular activity area, their stay time in the new area is calculated; if the stay time exceeds the preset time threshold, it is determined that a change of position has occurred, the employee's area information is updated, and an abnormal alarm message is sent to the monitoring center; The position and authority level information of the employee is obtained, and the monitoring center staff determines whether to adjust the preset threshold and the preset time threshold according to the position and authority level information of the employee.

5. The method for encrypting enterprise internal data keys according to claim 1, characterized in that: Generate employee mobility status snapshots at two time points before and after the job change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal job change behavior: including: Extract employee location data in the time period before and after the position change from the time series database, and generate a mobile status snapshot containing timestamps, coordinates, speed, and direction; The sliding time window method is used to extract features from the employee's mobile status snapshots, and the average speed, dwell time, moving distance and direction change frequency are calculated to obtain the behavioral feature vectors of the original and new workstations. Each eigenvector is standardized, and the eigenvector after the standardization is subjected to dimensionality reduction processing, and the characteristic covariance matrix is ​​calculated, and the eigenvalues ​​and eigenvectors are solved, and the eigenvalues ​​are sorted, and the first few eigenvectors whose cumulative contribution rates exceed the preset contribution rate threshold are selected as principal components to form the optimized eigenvectors; Calculate the Euclidean distance of the optimized feature vectors before and after the transposition, and determine the difference between the Euclidean distance and the preset threshold. If the Euclidean distance is greater than the preset threshold, it is determined to be an abnormal transposition behavior. Among them, the key behavioral indicator is the principal component eigenvector.

6. The method for encrypting enterprise internal data keys according to claim 1, characterized in that: According to the key behavior indicators, the movement trajectory data before and after the change of position is segmented, the length of time employees stay at the original and new workstations is counted, the movement frequency and the stay frequency are calculated, and the movement direction change rate indicator is introduced to update the feature vector. The updated feature vector is clustered and analyzed to obtain a clustering model, including: The trajectory data before and after the transposition were segmented according to key behavioral indicators; Calculate the average speed, moving distance and number of direction changes within the sliding window to obtain the mean and variance of the three time scale characteristics; The quartile method is used to process the speed distribution of employee historical data and determine the speed threshold. If the speed is lower than the speed threshold, the dwell time is accumulated; if the speed is higher than the speed threshold, the moving time is accumulated. Calculate the number of direction changes per unit time divided by the moving distance to obtain the moving direction change rate indicator. If the moving distance is less than the preset distance value, use the time interval instead of the moving distance as the denominator; The Gaussian mixture model is used to perform cluster analysis on the updated feature vectors, and the expectation-maximization algorithm is used to iteratively optimize the model parameters. The optimal number of clusters is determined according to the Bayesian information criterion to obtain the updated cluster centers and covariance matrix.

7. The method for encrypting enterprise internal data keys according to claim 1, characterized in that: The triggering of dynamic key update, based on the mobile status snapshot of the employee after the position change, uses a multi-factor dynamic password algorithm to generate a new key bound to the new workstation and abolishes the old key associated with the original workstation, including: The basic key seed is calculated using the SHA-256 hash algorithm based on the employee ID, new workstation coordinates, and timestamp. The speed and direction information in the movement trajectory data is quantified into a numerical value, and an XOR operation is performed with the basic key seed to generate a dynamic key using the HMAC-SHA256 algorithm. The dynamic key is encrypted using the RSA asymmetric encryption algorithm to obtain an encrypted ciphertext; Bind the encrypted ciphertext to the new workstation ID and store it in the security key manager; Retrieving the old key identifier associated with the original workstation from the security key manager; Determine whether the old key identifier exists. If the determination result is that the old key identifier exists, mark the state of the old key identifier as revoked; According to the preset security policy, the expiration time of the old key identifier is determined, and when the expiration time is reached, the old key identifier is deleted from the security key manager.

8. An enterprise internal data key encryption device, characterized in that: include: Acquisition module: used to acquire a pre-established office RFID distribution map, generate a two-dimensional digital indoor map based on the pre-established office RFID distribution map, obtain the employee's location coordinates, and record the timestamp of the employee's location change, the employee's location coordinates and the RFID number; Continuous tracking module: used to match the employee's location coordinates with the pre-established office RFID distribution map, determine the employee's current office area, and continuously track the employee's location coordinate changes to obtain the employee's movement trajectory data in the office; Update module: used to cluster the historical movement trajectories of employees to obtain a clustering model. Based on the employee's movement trajectory data in the office and the clustering model, it is determined whether the employee has changed positions. If the judgment result is that the employee has changed positions, the employee's area information is updated and an abnormal alarm message is sent to the monitoring center. The staff of the monitoring center determines whether to adjust the preset threshold based on the employee's position and authority level information. Determination module: used to generate employee mobility status snapshots at two time points before and after the position change, extract features from the mobility status snapshots, optimize feature vector dimensions through feature selection algorithms, extract key behavior indicators, and determine whether there is abnormal position change behavior; Clustering module: used to segment the movement trajectory data before and after the position change according to key behavioral indicators, count the length of time employees stay at the original and new workstations, calculate the movement frequency and stay frequency, introduce the movement direction change rate indicator to update the feature vector, and update the clustering model according to the updated feature vector; Generation module: used to trigger dynamic key update if the result is determined to be abnormal position change behavior. According to the mobile status snapshot of the employee after the position change, a multi-factor dynamic password algorithm is used to generate a new key bound to the new workstation and abolish the old key associated with the original workstation; Encryption module: used to use the dynamic key as the key of the symmetric encryption algorithm to encrypt sensitive employee data that needs to be encrypted and stored; Dynamic adjustment module: used to continuously monitor the movement trajectory and behavior patterns of employees at new workstations, and dynamically adjust the key update strategy and frequency according to the employee behavior patterns at the new workstations and the patterns in the updated clustering model.

9. An electronic device, characterized in that: include: Processor and memory; The processor is used to execute an enterprise internal data key encryption method as described in any one of claims 1 to 7 by calling the program or instruction stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores programs or instructions, and the programs or instructions enable a computer to execute an enterprise internal data key encryption method as described in any one of claims 1 to 7.

Images