Data grading protection method and system based on trusted data space

Abstract

The invention discloses a data grading protection method and system based on trusted data space, and the method comprises the following steps: S1, predefining a data grading standard which comprises a sensitivity grade, a data type and an access authority; s2, constructing a data grading information list; s3, extracting and grading data features; s4, data encryption processing; s5, data distributed storage; according to the method, the sensitive data are subjected to grading processing to ensure that the sensitive data are protected at a higher level, and distributed storage is performed according to grading of the data, so that the storage pressure can be effectively dispersed, the access speed of the data is increased, rapid positioning and data retrieval are facilitated, unnecessary search time and resource consumption are reduced, and the efficiency of data storage is improved. The grading processing condition is managed through the service lock, it is ensured that data of different grades cannot be mistakenly added to the current batch, and the access control logic is simplified.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data hierarchical protection method and system based on a trusted data space. Background Art

[0002] With the development of information technology, data has become one of the core assets of enterprises and organizations. Data leakage may not only lead to economic losses, but also damage the reputation of the enterprise and even violate laws and regulations. Especially in the fields of finance, medicine, etc., data security is particularly important.

[0003] Data classification is a method of classifying data according to its sensitivity and importance. Through data classification, data can be managed and protected more effectively. Data classification usually includes defining standards such as sensitivity level, data type and access rights.

[0004] Existing data protection technologies are as follows:

[0005] Encryption technology: Encrypt data using encryption algorithms to prevent unauthorized access.

[0006] Access control: Control who can access specific data through permission management.

[0007] Data desensitization: Deform or replace sensitive data so that real personal information cannot be identified when used in non-production environments.

[0008] The shortcomings are as follows: 1. Lack of flexibility in data classification: Existing data classification methods often fix the classification standards of data, and it is difficult to flexibly adjust the classification standards according to actual conditions. There is a lack of dynamic evaluation mechanism for data sensitivity, and it cannot adapt well to the situation where data sensitivity changes over time; 2. Encryption strategy is not smart enough: Traditional encryption methods usually use a single encryption algorithm and fail to select appropriate encryption strategies according to the sensitivity levels of different data. The lack of the ability to dynamically adjust encryption strategies according to the number of bytes of data leads to unreasonable resource allocation; 3. Data consistency issues in storage: In the storage environment, data consistency issues are more prominent, especially when data is frequently written and updated. There is a lack of effective mechanisms to ensure the integrity and consistency of data in the storage environment; 4. Access control is too simple: Existing access control mechanisms often only focus on static access permission configuration, while ignoring the dynamic nature of access requests. There is a lack of context awareness of access requests, and it is impossible to perform flexible access control based on the real-time situation of access requests. Summary of the invention

[0009] The technical problem to be solved by the present invention is to overcome the defects of the prior art, such as lack of flexibility in data classification, insufficient intelligence in encryption strategy, lack of consistency in stored data, and overly simple access control, and to provide a data classification protection method and system based on a trusted data space.

[0010] The technical solution adopted by the present invention to solve the technical problem is a data hierarchical protection method and system based on a trusted data space, comprising the following steps:

[0011] S1. Predefine data classification standards, including sensitivity level, data type and access rights;

[0012] S2. Build a data classification information list;

[0013] S3, data feature extraction and classification;

[0014] S4, data encryption processing;

[0015] S5, distributed data storage;

[0016] S6. Access control.

[0017] Further, in step S1, the sensitivity level divides the data into three levels according to the sensitivity of the data, and the access rights include viewing, editing or deleting the data.

[0018] Further, in step S2, the node is started to extract attributes for determining the security level from the data, form a data classification information list, and create a list containing all classification attributes;

[0019] When a node receives data, it starts to obtain the data type and related information; it processes the data in a graded manner according to the extracted related information and attributes;

[0020] Each data item is checked to see if it matches any of the sensitivity level classifications and the matching data is placed into the corresponding classification list.

[0021] Further, in step S3, data feature extraction and classification include:

[0022] S3.1. Data feature extraction: using a pre-trained data classification model, input the feature information of sensitive data, including data type, sensitivity, and access frequency, into the data classification model;

[0023] S3.2. The model outputs classification probability and data classification; sorts the data classification probability vectors from large to small, selects the data classification corresponding to the maximum classification probability, and marks it as the first data classification;

[0024] S3.3. Further refine the data classification through sensitivity difference analysis; select the highest sensitivity data among the highly sensitive data as the initial point, analyze the difference in sensitivity between the adjacent data and the initial point, and calculate the sensitivity difference value.

[0025] Further, in step S4, different encryption strategies are adopted for the classified data according to whether the privacy level of the data and the number of bytes reach a critical value;

[0026] Calculate the total number of bytes B of sensitive data at each level, and determine whether the number of bytes B reaches the critical value Bmax;

[0027] When the data privacy level is infinite: if the number of bytes does not reach the critical value, the symmetric encryption algorithm DES is used to encrypt the data directly; if the number of bytes reaches the critical value, the data is divided into two parts, each part is B / 2 bytes, and each part is encrypted using the DES encryption algorithm;

[0028] When the data privacy level is constant or infinite: If the number of bytes does not reach the critical value, the asymmetric encryption algorithm RSA is used to encrypt the data directly; if the number of bytes reaches the critical value, for data with a constant data privacy level, DES is used to encrypt B / 2 bytes of data;

[0029] For data with a data privacy level of infinity, the first B / 2 bytes are encrypted using RSA and the remaining B / 2 bytes are encrypted using DES.

[0030] Further, in step S5, the data is divided into three categories according to the result of the first data classification, and stored in different storage modules.

[0031] Further, in step S6, the hierarchical processing is managed using a business lock to ensure that data of different levels will not be added to the current batch by mistake; after extracting the hierarchical information, the current processing hierarchical status is obtained to determine whether the current hierarchical processing is the current hierarchical level; if so, all data in the hierarchical level is extracted;

[0032] Extract the data in the current classification state and obtain the lock status of the data queue, determine whether the account involved in the data has been locked, if the account involved in the data has been locked, skip processing the data, if not, continue processing;

[0033] Determine whether other data that may affect the data in the unlocked state is being processed. If so, skip processing the data. If not, process the data to complete the data classification processing. The loop operation completes the classification processing of all data.

[0034] The technical solution adopted by the present invention to further solve its technical problem is a system for implementing a data hierarchical protection method based on a trusted data space, comprising a database management module, a machine learning module, an encryption module, a distributed storage module, an access control module and a Web server;

[0035] Database management module: used to store data and metadata;

[0036] Machine learning module: used for data feature extraction and classification processing;

[0037] Encryption module: used to encrypt data using symmetric encryption and asymmetric encryption;

[0038] Distributed storage module: used for distributed storage of hierarchical data;

[0039] Access control module: used to manage different levels of data access permissions;

[0040] Web server: provides a user interface, inputs user requests, and outputs user interface responses.

[0041] In summary, the present invention has the following beneficial technical effects:

[0042] 1. The present invention ensures that sensitive data is protected at a higher level by performing hierarchical processing on sensitive data; different encryption strategies are selected according to the sensitivity level and number of bytes of the data, which can not only ensure the security of the data, but also reasonably allocate encryption resources, avoiding the waste of resources caused by excessive encryption of low-sensitivity data.

[0043] 2. The present invention performs distributed storage according to data classification, which can effectively disperse storage pressure, improve data access speed, help quickly locate and retrieve data, and reduce unnecessary search time and resource consumption; the design of the distributed storage module supports the horizontal expansion of the system, and more storage nodes can be easily added as the amount of data grows.

[0044] 3. The present invention manages hierarchical processing through business locks, ensuring that data of different levels will not be erroneously appended to the current batch, thereby simplifying the access control logic; performing access control according to the sensitivity level of the data can more flexibly respond to access requirements in different scenarios, and can more meticulously control data access rights. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flow chart of an embodiment of a data hierarchical protection method based on a trusted data space of the present invention;

[0046] Figure 2 It is a module diagram of a system embodiment of a data hierarchical protection method based on a trusted data space of the present invention;

[0047] Figure 3 It is a data classification processing flow chart of a data classification protection method and system embodiment based on a trusted data space of the present invention. DETAILED DESCRIPTION

[0048] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0049] Reference Figure 1 The data hierarchical protection method based on the trusted data space in this embodiment includes the following steps:

[0050] Step 1: Predefine data classification standards.

[0051] Classification criteria include sensitivity level, data type, and access rights.

[0052] Sensitivity level: Data is divided into different levels according to its sensitivity, and divided into level one, level two, and level three according to the degree of sensitivity.

[0053] Data Type: Defines different types of data, such as personally identifiable information, health information, financial records, etc.

[0054] Access permissions: Specify different levels of access permissions for data, including the permission to view, edit, or delete data.

[0055] Step 2: Build a data classification information list.

[0056] Start the node, extract the attributes or features used to determine the security level from the data, form a data classification information list, and create a list containing all classification attributes; when the node receives the data, it starts to obtain the type of data and related information; classify the data according to the extracted attributes; check whether each data item matches any of the sensitivity level classifications, and put the matching data into the corresponding classification list.

[0057] Step 3: Data feature extraction and classification.

[0058] First, data feature extraction.

[0059] Using the pre-trained data classification model, sensitive data feature information, including data type, sensitivity, and access frequency, is input into the data classification model;

[0060] The data types include but are not limited to personal identity information, financial data, and health records; the sensitivity includes whether it contains personal privacy information and whether it involves business secrets; the access frequency includes the daily access volume and historical access statistics of the data;

[0061] Second, the model outputs classification probability and data classification; sorts the data classification probability vectors from large to small, selects the data classification corresponding to the maximum classification probability, and marks it as the first data classification;

[0062] According to the result of the first data classification, the data is divided into three categories and stored in different storage modules; the data ranked from 1st to xth is marked as high-sensitivity data and stored in storage module 1; the data ranked from x+1st to yth is marked as medium-sensitivity data and stored in storage module 2; the data ranked from y+1st to the last is marked as low-sensitivity data and stored in storage module 3;

[0063] Third, further refine the data classification through sensitivity difference analysis;

[0064] Select the highest sensitivity data in storage module 1 as the initial point, analyze the difference between the sensitivity of adjacent data and the sensitivity of the initial point, and calculate the sensitivity difference value;

[0065] Analyze the relationship between the minimum sensitivity difference value and the sensitivity difference threshold: Determine the classification of data according to the sensitivity difference value: When the sensitivity difference value is greater than the set sensitivity difference threshold, the data is judged to belong to different sensitivity levels; when the sensitivity difference value is less than or equal to the set sensitivity difference threshold, the data can be judged to belong to the same sensitivity level;

[0066] Continue to select new reference points, gradually filter down to the lowest sensitivity data, until all data have been graded, and output the graded data.

[0067] Step 4: Data encryption processing.

[0068] Different encryption strategies are adopted for the classified data according to the privacy level of the data and whether the number of bytes reaches the critical value;

[0069] Calculate the total number of bytes B of sensitive data at each level, and determine whether the number of bytes B reaches the critical value Bmax;

[0070] When the data privacy level is infinite: if the number of bytes does not reach the critical value, the symmetric encryption algorithm DES is used to encrypt the data directly; if the number of bytes reaches the critical value, the data is divided into two parts, each part is B / 2 bytes, and each part is encrypted using the DES encryption algorithm;

[0071] When the data privacy level is constant or infinite: If the number of bytes does not reach the critical value, the asymmetric encryption algorithm RSA is used to encrypt the data directly; if the number of bytes reaches the critical value, for data with a constant data privacy level, DES is used to encrypt B / 2 bytes of data;

[0072] For data with a data privacy level of infinity, the first B / 2 bytes are encrypted using RSA and the remaining B / 2 bytes are encrypted using DES.

[0073] Step 5: Distributed data storage.

[0074] According to the results of the first data classification, the data is divided into three categories and stored in different storage modules; the highly sensitive data ranked from 1st to xth is stored in storage module 1; the medium sensitive data ranked from x+1 to yth is stored in storage module 2; and the low sensitive data ranked from y+1 to the last is stored in storage module 3.

[0075] Step 6: Access control.

[0076] Use business locks to manage the hierarchical processing to ensure that data of different levels will not be incorrectly appended to the current batch; after extracting the hierarchical information, obtain the current processing hierarchical status to determine whether the current hierarchical processing is the current hierarchical level; if so, extract all data in the hierarchical level;

[0077] Extract the data in the current classification state and obtain the lock status of the data queue, determine whether the account involved in the data has been locked, if the account involved in the data has been locked, skip processing the data, if not, continue processing;

[0078] Determine whether other data that may affect the data in the unlocked state is being processed. If so, skip processing the data. If not, process the data to complete the data classification process. The cycle operation completes the classification process of all data.

[0079] Reference Figure 3 ,The processed data is divided into three levels, namely the first level, the second level and the third level;

[0080] 1. Start processing the first level data;

[0081] All data belonging to the first level enters the processing queue;

[0082] Restriction: After processing is completed, no more first-level data is allowed to be appended to the current batch;

[0083] Ensure that after the first level of data processing is completed, new data will not affect the data batches that have already been processed;

[0084] 2. Start processing the second level data;

[0085] Allows appending of data types belonging to the second level;

[0086] Restrictions: Data at other levels except the first level can be appended to the current batch, but data at the first level cannot be appended to the current batch and can only be appended to the next batch;

[0087] When the first-level data processing is completed, the second-level data can be appended, but the third-level data cannot be appended to the current batch to ensure that the data is processed correctly according to the level order and the higher-level data will not affect the processing results of the lower-level data;

[0088] 3. Start processing the third level data;

[0089] Allows appending of data types belonging to the third level;

[0090] Restrictions: Data at levels other than the first and second levels can be appended to the current batch, but data at the first and second levels cannot be appended to the current batch and can only be appended to the next batch.

[0091] Reference Figure 2 In an embodiment of the present invention, a data hierarchical protection system based on a trusted data space includes a database management module, a machine learning module, an encryption module, a distributed storage module, an access control module and a Web server.

[0092] Database management module: used to store data and metadata. The specific workflow is that when the user uploads data to the system, the database management module receives the original data and stores the data and its metadata.

[0093] Machine learning module: used for data feature extraction and classification processing. The specific workflow is that when the database management module provides data to the machine learning module, the machine learning module extracts data features and classifies the data, and the classified data is sent back to the database management module for updating.

[0094] Encryption module: used to encrypt data using symmetric encryption and asymmetric encryption. The specific workflow is that when the database management module provides the classified data to the encryption module, the encryption module selects an appropriate encryption strategy based on the privacy level and number of bytes of the data, and the encrypted data is sent back to the database management module.

[0095] Distributed storage module: used for distributed storage of graded data. The specific workflow is that when the database management module provides encrypted data to the distributed storage module, the distributed storage module stores the data in the corresponding storage module according to the sensitivity level of the data.

[0096] Access control module: used to manage different levels of data access rights. The specific workflow is that when the database management module provides the access control module with classified data and its access rights information, the access control module manages different levels of data access rights according to the sensitivity level of the data. When a user tries to access the data, the access control module verifies the user's access rights.

[0097] Web server: provides a user interface, inputs user requests, and outputs user interface responses. The specific workflow is that when a user submits a data access request through the Web server, the Web server forwards the request to the access control module, the access control module verifies the request and returns an access decision, and the Web server displays the data or denies access based on the access decision.

[0098] The data hierarchical protection system based on the trusted data space can significantly improve data security and management efficiency, reduce the risk of data leakage, and better protect the organization's data assets by dynamically adjusting encryption strategies to adapt to different security needs.

[0099] The above are all preferred embodiments of the present invention, and the protection scope of the present invention is not limited thereby. Among them, the same parts are represented by the same figure numerals. It should be noted that the words "front", "rear", "left", "right", "up" and "down" used in the following description refer to the directions in the drawings, and the words "inside" and "outside" refer to the directions toward or away from the geometric center of a specific component, respectively. Therefore: All equivalent changes made according to the structure, shape, and principle of the present invention should be covered within the protection scope of the present invention.

Claims

1. A data hierarchical protection method and system based on a trusted data space, characterized in that: The following steps are involved: S1. Predefine data classification standards, including sensitivity level, data type and access rights; S2. Build a data classification information list; S3, data feature extraction and classification; S4, data encryption processing; S5, data distributed storage; S6. Access control.

2. According to the method and system for data hierarchical protection based on trusted data space of claim 1, it is characterized in that: In step S1, the sensitivity level divides the data into three levels according to the sensitivity of the data, and the access rights include viewing, editing or deleting the data.

3. According to the method and system for data hierarchical protection based on trusted data space of claim 1, it is characterized in that: In step S2, the node is started to extract attributes used to determine the security level from the data, form a data classification information list, and create a list containing all classification attributes; When a node receives data, it starts to obtain the data type and related information; it processes the data in a graded manner according to the extracted related information and attributes; Each data item is checked to see if it matches any of the sensitivity level classifications and the matching data is placed into the corresponding classification list.

4. A data hierarchical protection method and system based on a trusted data space according to claim 1, characterized in that: In step S3, data feature extraction and classification include: S3.

1. Data feature extraction: using a pre-trained data classification model, input the feature information of sensitive data, including data type, sensitivity, and access frequency, into the data classification model; S3.

2. The model outputs classification probability and data classification; sorts the data classification probability vectors from large to small, selects the data classification corresponding to the maximum classification probability, and marks it as the first data classification; S3.

3. Further refine the data classification through sensitivity difference analysis; select the highest sensitivity data among the highly sensitive data as the initial point, analyze the difference in sensitivity between the adjacent data and the initial point, and calculate the sensitivity difference value.

5. The data hierarchical protection method and system based on a trusted data space according to claim 1, characterized in that: In step S4, different encryption strategies are adopted for the classified data according to the privacy level of the data and whether the number of bytes reaches a critical value; Calculate the total number of bytes B of sensitive data at each level, and determine whether the number of bytes B reaches the critical value Bmax; When the data privacy level is infinite: if the number of bytes does not reach the critical value, the symmetric encryption algorithm DES is used to encrypt the data directly; if the number of bytes reaches the critical value, the data is divided into two parts, each part is B / 2 bytes, and each part is encrypted using the DES encryption algorithm; When the data privacy level is constant or infinite: If the number of bytes does not reach the critical value, the asymmetric encryption algorithm RSA is used to encrypt the data directly; if the number of bytes reaches the critical value, for data with a constant data privacy level, DES is used to encrypt B / 2 bytes of data; For data with a data privacy level of infinity, the first B / 2 bytes are encrypted using RSA and the remaining B / 2 bytes are encrypted using DES.

6. A data hierarchical protection method and system based on a trusted data space according to claim 1, characterized in that: In step S5, the data is divided into three categories according to the result of the first data classification, and stored in different storage modules.

7. The data hierarchical protection method and system based on a trusted data space according to claim 1, characterized in that: In step S6, the business lock is used to manage the hierarchical processing to ensure that data of different levels will not be added to the current batch by mistake; after extracting the hierarchical information, the current processing hierarchical status is obtained to determine whether the current hierarchical processing is the current hierarchical level; if so, all data in the hierarchical level are extracted; Extract the data in the current classification state and obtain the lock status of the data queue, determine whether the account involved in the data has been locked, if the account involved in the data has been locked, skip processing the data, if not, continue processing; Determine whether other data that may affect the data in the unlocked state is being processed. If so, skip processing the data. If not, process the data to complete the data classification processing. The loop operation completes the classification processing of all data.

8. A system for implementing a data hierarchical protection method based on a trusted data space, characterized in that: It includes database management module, machine learning module, encryption module, distributed storage module, access control module and Web server; Database management module: used to store data and metadata; Machine learning module: used for data feature extraction and classification processing; Encryption module: used to encrypt data using symmetric encryption and asymmetric encryption; Distributed storage module: used for distributed storage of hierarchical data; Access control module: used to manage different levels of data access permissions; Web server: provides a user interface, inputs user requests, and outputs user interface responses.

Images