Data cross-industry sharing method, system and device, storage medium and program product

Abstract

The invention discloses a data cross-industry sharing method, system and device, a storage medium and a program product, and the method comprises the steps: carrying out the recognition and encryption of sensitive information in to-be-shared data, and obtaining sensitive data encryption; the sensitive data and dense data leakage risk is analyzed to configure the access permission level of the user, and a user dynamic access control strategy is formulated in combination with analysis of a current data access request; analyzing a shared service demand based on a user dynamic access control strategy, constructing hidden query requests of a plurality of query items, and performing hidden optimization on each hidden query request to generate an encrypted query request; performing data item identifier matching, data item screening and data item priority ranking based on the encrypted query request and sensitive data densification to obtain a matching result data set; and performing security layer encryption on the data items in the matching result data set and transmitting the data items to the requester, and decrypting the received encrypted data by the requester to obtain decrypted shared data.

Description

Technical Field

[0001] The present invention relates to the field of data sharing technology, and in particular to a method, system, device, storage medium and program product for cross-industry data sharing. Background Art

[0002] The development of data sharing technology is driven by privacy protection regulations and data security needs, and is committed to optimizing data circulation and resource utilization efficiency without exposing personal privacy and sensitive information.

[0003] Data sharing technologies include but are not limited to data desensitization, encryption, permission control and compliance auditing. However, traditional sharing methods lack analysis of data attributes and behavior patterns, as well as real-time response mechanisms. Such static security measures are insufficient when the data environment or access requirements change. Once the security environment changes, the original data protection measures are no longer fully effective.

[0004] Therefore, there is an urgent need for a secure cross-industry sharing method for civil aviation passenger data that ensures the privacy and security of passenger data, allowing related industries such as airlines, hotels, car rental services and tourist attractions to obtain and use passenger information to provide more personalized services while strengthening the compliance use and security supervision of data. Summary of the invention

[0005] The purpose of the present invention is to provide a method, system, device, storage medium and program product for cross-industry data sharing, so as to improve the privacy protection and security of data during the sharing process and reduce the risk of shared data leakage.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for cross-industry data sharing, the method comprising:

[0008] Identify and encrypt sensitive information in the shared data to obtain a sensitive data encryption set;

[0009] Analyze the data leakage risk of sensitive data encryption sets to configure user access rights levels, and formulate user dynamic access control policies based on the analysis of current data access requests;

[0010] Analyze shared business needs based on user dynamic access control policies, construct hidden query requests for multiple query items, and perform hidden optimization on each hidden query request to generate an encrypted query request;

[0011] Based on the encrypted query request and the encrypted set of sensitive data, perform data item identification matching, data item screening, and data item priority sorting to obtain a matching result data set;

[0012] The data items in the matching result data set are encrypted by the security layer and transmitted to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

[0013] In a second aspect, an embodiment of the present invention provides a data cross-industry sharing system, the system comprising:

[0014] An identification and encryption unit is used to identify and encrypt sensitive information in the shared data to obtain an encrypted set of sensitive data;

[0015] A formulation unit, which is used to analyze the data leakage risk of the sensitive data encryption set to configure the user's access permission level, and formulate a user dynamic access control policy in combination with the analysis of the current data access request;

[0016] A concealment unit, used to analyze shared business requirements based on a user's dynamic access control policy, construct concealed query requests for multiple query items, and perform concealment optimization on each concealed query request to generate an encrypted query request;

[0017] A data item processing unit, configured to perform data item identification matching, data item screening, and data item priority sorting based on the encrypted query request and the encrypted set of sensitive data to obtain a matching result data set;

[0018] The transmission decryption unit is used to perform security layer encryption on the data items in the matching result data set and transmit the data to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

[0019] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program or instructions to implement the aforementioned cross-industry data sharing method.

[0020] In a fourth aspect, an embodiment of the present invention further provides a computer storage medium, in which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the aforementioned method for cross-industry data sharing is implemented.

[0021] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the aforementioned method for cross-industry data sharing.

[0022] The technical effects and advantages of the present invention are as follows: the present invention improves the privacy protection level of shared data during the exchange process through sensitive information identification and attribute type encryption processing; encrypts data items according to attribute types to ensure that the data content is uninterpretable in the event of unauthorized access; reduces the risk of data leakage by adding obfuscation items, automatically adjusts permissions according to user behavior and roles, enhances the real-time response capability of permission management, and reduces the risk of data abuse or leakage caused by improper permission settings; the application of hidden query prevents any sensitive information from being exposed during data processing, and enhances the security of the entire data query and sharing through encryption and hashing of query items, so that data users can obtain necessary information under the premise of fully protecting personal privacy.

[0023] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flowchart of a method for cross-industry data sharing according to an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram of the structure of a data cross-industry sharing system according to an embodiment of the present invention;

[0027] Figure 3 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] To address the deficiencies of the prior art, an embodiment of the present invention discloses a method for cross-industry data sharing, comprising the following steps:

[0030] Step S1: Identify and encrypt sensitive information in the shared data to obtain a sensitive data encryption set;

[0031] Step S2: Analyze the data leakage risk of the sensitive data encryption set to configure the user basic access permission rules, and formulate the user dynamic access control strategy in combination with the analysis of the current data access request;

[0032] Step S3: Analyze the shared service requirements based on the user's dynamic access control policy, construct hidden query requests for multiple query items, and perform hidden optimization on each hidden query request to generate an encrypted query request;

[0033] Step S4: Based on the encrypted query request and the encrypted set of sensitive data, data item identification matching, data item screening, and data item priority sorting are performed to obtain a matching result data set;

[0034] Step S5: The data items in the matching result data set are encrypted by the security layer and transmitted to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

[0035] In some specific embodiments, step S1: identifying and encrypting sensitive information in the shared data to obtain a sensitive data encryption set includes the following contents:

[0036] Step S11: using rule matching technology to identify various sensitive fields in the data to be shared, and generating a sensitive field identification list; specifically including:

[0037] Based on the data to be shared (e.g., civil aviation passenger data to be shared), all data sets related to personal information are extracted from the database; all data sets are scanned using a text analysis tool to obtain text fields related to personal information, wherein the text fields include passenger name, ID number, flight information, etc.

[0038] Various sensitive fields in the text field are identified using rule matching technology, and the sensitivity of each data set is calculated based on the number of sensitive fields in each data set, that is, the proportion of sensitive information in each data set is obtained; based on the various sensitive fields and the proportion of sensitive information in each data set, a sensitive field identification list is generated.

[0039] Among them, the sensitivity of each data set is calculated by the following formula:

[0040] The sensitivity of each data set = (the number of sensitive fields in the data set / the total number of fields in the data set) × 100%. This formula can be used to quantify the proportion of sensitive information and obtain the proportion of sensitive information in each data set.

[0041] Step S12: annotate each sensitive field in the sensitive field identification list with an attribute type to obtain an attribute annotation result; specifically, the step includes:

[0042] According to the content and context information of each sensitive field in the sensitive field identification list, each sensitive field is classified; and through an automated labeling tool, attribute type labels are performed on each classified sensitive field according to predefined classification rules to obtain attribute labeling results.

[0043] Among them, the classification of each sensitive field includes: personal identification information, certificate information and itinerary information.

[0044] The accuracy of sensitive field attribute type annotation is evaluated by the following formula:

[0045] Attribute labeling matching accuracy = (number of correctly matched fields / total number of sensitive fields) × 100%. This formula is used to optimize the sensitive field attribute type labeling to ensure that the attribute labeling of each field is both accurate and appropriate.

[0046] Step S13: Based on the attribute labeling result, the sensitive fields of different attribute types are encrypted using a key to restrict access by unauthorized users, and obtain a sensitive data encryption set; specifically including:

[0047] Based on the attribute labeling results, a suitable encryption algorithm is selected for sensitive fields of different attribute types, and the sensitive fields are converted into an encrypted format using the encryption algorithm and key to implement sensitive data encryption, so as to restrict access by unauthorized users, improve the privacy security of sensitive data during processing and transmission, and obtain a sensitive data encryption set.

[0048] Exemplarily, selecting appropriate encryption algorithms for sensitive fields of different attribute types includes:

[0049] A more secure asymmetric encryption is used for personal identification information, while a more efficient symmetric encryption is used for travel information.

[0050] Among them, the efficiency of sensitive field encryption is evaluated by the following formula:

[0051] Encryption efficiency = (number of sensitive fields successfully encrypted / total number of sensitive fields to be encrypted) × 100%; this formula can help monitor the encryption efficiency of sensitive fields and ensure that encryption operations are optimized without sacrificing security to obtain an encrypted set of sensitive data.

[0052] In some specific embodiments, step S2: analyzing the data leakage risk of the sensitive data encryption set to configure the user basic access permission rules, combined with the analysis of the current data access request, formulate a user dynamic access control policy, including the following contents:

[0053] Step S21: Evaluate the sensitivity level of each sensitive field in the sensitive data encryption set and calculate the potential risk of data leakage of each sensitive field in combination with the historical data access records of the sensitive field, and obtain the data sensitivity and risk assessment information of each sensitive field; specifically including:

[0054] Using data analysis tools, a sensitivity level is assigned to each sensitive field according to the sensitivity of the content of each sensitive field in the sensitive data encryption set and the degree of personal information involved, thereby obtaining the sensitivity level of each sensitive field.

[0055] The sensitivity level of each sensitive field is combined with historical data access records, and statistical analysis methods are used to analyze the access frequency and abnormal access patterns of each field to calculate the potential risk of data leakage for each sensitive field.

[0056] The sensitivity level of each sensitive field and the potential risk of data leakage of each sensitive field are obtained, that is, the data sensitivity and risk assessment information of each sensitive field are obtained; that is, the data sensitivity and risk assessment information of each sensitive field includes the sensitivity level and potential risk of data leakage of each sensitive field.

[0057] Among them, the potential risk of data leakage of each sensitive field is calculated by the following formula:

[0058] Potential risk of data leakage = (access frequency of sensitive fields / total number of accesses) × sensitivity level of sensitive fields. This formula takes into account the sensitivity and access pattern of sensitive fields.

[0059] Step S22: Based on the data sensitivity and risk assessment information of each sensitive field, formulate access rights levels for different users to limit the access of different users to sensitive data and implement the configuration of user access rights.

[0060] Among them, the establishment of access rights levels for different users includes: based on the basic permission level, according to the work requirements and responsibility scope of different user roles (such as employees, management and partners), setting corresponding data access levels for different user roles;

[0061] For example, a higher level of data access permissions are provided to management so that they can conduct decision-making analysis; and a lower level of data access permissions are provided to ordinary employees (eg, only necessary sensitive data can be accessed).

[0062] The access permission levels of different users are optimized through the following formula:

[0063] User access permission level = basic permission level + (user role weight × sensitivity level of sensitive field), which can ensure that the access permissions of each user role meet work requirements without exceeding the scope of their responsibilities, thereby reducing unnecessary data leakage risks and realizing the configuration of user access permissions.

[0064] Step S23: Based on the access rights levels of different users, analyze the current data access requests and related risk assessment information of the sensitive data encryption set, and dynamically adjust the user access rights using the Bayesian network algorithm to implement the formulation of dynamic user access control strategies.

[0065] Among them, the Bayesian network algorithm is used to dynamically adjust user access rights, including:

[0066] A Bayesian network model with multiple factors is constructed to calculate the conditional probability of each access to the encrypted set of sensitive data and the probability of obtaining permission adjustment based on the user's access permission level, user behavior and environmental variables; and the user's access permissions are dynamically adjusted according to the permission adjustment probability; thereby ensuring the security of civil aviation passenger data while also ensuring the availability of civil aviation passenger data and the flexibility of the business, and realizing the formulation of user dynamic access control strategies.

[0067] Among them, the permission adjustment probability is calculated by the following formula:

[0068]

[0069] Where P(A|B,C,D) represents the posterior probability that the user should have permission level A under the conditions of current user behavior C and environmental variables D given a risk state B; P(B|A,C,D) represents the probability of being in risk state B under the conditions of user permission level A, user behavior C and environmental variables D; P(A|C,D) represents the probability that the user should have permission level A under the conditions of user behavior C and environmental variables D; P(C,D) represents the joint probability of user behavior C and environmental variables D; P(B,C,D) represents the joint probability of being in risk state with reference to user behavior C and environmental factors.

[0070] The specific implementation process of the above formula is as follows:

[0071] Collect data about user behavior C and environmental variables D (i.e., data related to user activities in the system and data related to environmental factors), such as user login frequency, user behavior patterns for accessing specific data, network status, and physical access control. Calculate the joint probability P(C, D) of user behavior C and environmental variables D based on the collected data to evaluate the frequency of occurrence given user behavior and environmental conditions.

[0072] Assess the probability of occurrence of risk state B (including monitoring of system security threats, such as unauthorized access attempts), using the Bayesian formula to calculate the conditional probability P(B|A,C,D) of being in risk state B given the user permission level A, user behavior C, and environmental variables D;

[0073] Combine all probabilities and update the posterior probability P(A|B,C,D) of user permission level A under the given risk state B, user behavior C, and environmental variable D. Finally, dynamically adjust user access rights according to the posterior probability P(A|B,C,D) to respond to current security needs.

[0074] In some specific embodiments, step S3: analyzing the shared service requirements based on the user dynamic access control policy, constructing a hidden query request of multiple query items, and performing hidden optimization on each hidden query request to generate an encrypted query request, including:

[0075] Step S31: Analyze the shared business needs based on the user dynamic access control policy to design a hidden query request and its corresponding viewing scope and query conditions to generate hidden query information; specifically including:

[0076] (1) Analyze the data query requirements and data access levels of different users based on the user dynamic access control policy, that is, obtain business demand analysis information; specifically, include:

[0077] Analyze the data query needs of different users based on the user dynamic access control policy to identify the data types queried by different users; identify the data access level of the user query request based on the user dynamic access control policy, and verify whether the user data access is compliant and secure; that is, obtain business demand analysis information.

[0078] The data types queried by different users include personal information and itinerary information; the business demand analysis information includes the data types queried by users and the data access level requested by users.

[0079] The verification process of user data access includes: comparing the user's access rights and the user's data sensitivity level (where the data sensitivity level includes the sensitivity level of sensitive fields) to ensure that the type of data queried by the user does not exceed the authorized scope of the user's access rights; the verification score of user data access is calculated by the following formula:

[0080] Verification score = (user's access permission level / data sensitivity level) × security factor,

[0081] In the formula, the safety factor is adjusted according to the type of data and query frequency of the user's query; this formula ensures the compliance of data access and strengthens the monitoring of data security.

[0082] (2) Based on the business needs analysis information, a semi-homomorphic encryption algorithm is used to design hidden query requests to meet different data access requirements, and the data fields and corresponding query conditions that each hidden query request matches are defined to generate hidden query information; specifically, the following are included:

[0083] Based on the business demand analysis information, a semi-homomorphic encryption algorithm is used to generate the same encryption public key and private key; based on the public key and the private key, data masking and partial field anonymization technology are used to design a hidden query request including data access and information extraction instructions to cope with different data access and information extraction needs; and matching data fields and corresponding query conditions are defined for each hidden query request to generate hidden query information.

[0084] Among them, the efficiency of generating hidden query information is calculated by the following formula:

[0085] The efficiency of generating hidden query information = (the number of original data fields - the number of hidden fields) / the number of original data fields × 100%. This formula can be used to measure the coverage and effectiveness of the hidden operation.

[0086] Exemplarily, the steps of designing an anonymous query request based on semi-homomorphic encryption and implementing the anonymous query process are as follows:

[0087] The user end generates a homomorphic encryption public key pk and private key sk;

[0088] It is known that the server has n pieces of data. If the user wants to retrieve the tth piece of data, an n-dimensional ciphertext vector vector = {v1,…,v t ,…,v n}; Among them, the tth item is the ciphertext after the public key pk encrypts the number 1, and the other items are the ciphertext after the public key pk encrypts the number 0;

[0089] The n-dimensional ciphertext vector vector and the public key pk are sent to the server. The third feature of the Paillier algorithm ensures that the n ciphertexts in the n-dimensional ciphertext vector vector are not repeated, that is, the server cannot guess which ciphertext is the number 1.

[0090] The server performs vector inner product operation on the n-dimensional ciphertext vector vector and the n plaintext data sets to obtain the ciphertext result en_result and send it to the client; the ciphertext calculation result of homomorphic encryption is equal to the plaintext calculation result after decryption, which is equivalent to en_result=E(m1*0+…+m t-1 *0+m t *1+m t+1 *0+…+m n *0,pk)=E(m t ,pk);

[0091] The client uses the private key sk to decrypt the ciphertext result en_result and obtains the tth original plaintext message m that it wants to retrieve. t .

[0092] In this step, by using data masking and partial field anonymization technology, the risk of data leakage during transmission and processing can be reduced. For example, for data access requests to query personal information, only necessary identifiers can be provided instead of complete personal information; for data access requests for itinerary information, itinerary information can be limited by time period and area code to ensure the minimum necessary principle of data.

[0093] Step S32: constructing a concealed query request of multiple query items based on the concealed query information, and performing concealed encryption on each query request to obtain an encrypted query request.

[0094] The concealed query request for multiple query items is constructed based on the concealed query information, specifically including:

[0095] The query conditions in the hidden query information are encrypted, and the data fields in the hidden query information (that is, the data fields matched by each hidden query request) are hashed. Obfuscation items are added to the real query items (referring to the data items in the sensitive data encryption set, such as mobile phone numbers, ID cards, etc.), and a hidden query request containing multiple query items is constructed to strengthen data privacy protection during the query process.

[0096] Among them, the query conditions in the hidden query information are encrypted by a high-strength encryption algorithm to ensure that the encrypted query conditions cannot be parsed even if they are intercepted during data transmission.

[0097] The data field is hashed, that is, the original data field is converted into a hash value of fixed length, making the original information irreversible.

[0098] Before a user initiates a query request, the querying party (i.e., the user) will generate a certain number of obfuscation items; the obfuscation items are false data randomly generated and related to real data, or redundant data from public data sources; the number and generation method of the obfuscation items can be adjusted according to actual needs; the obfuscation items are similar to the real query items in data structure, format, and semantics.

[0099] The overall efficiency of encryption and hashing is optimized by:

[0100] Processing efficiency = (number of processed fields / total number of fields) × 100%.

[0101] This step protects each hidden query request to form an encrypted query request to reduce the risk of data leakage and illegal access.

[0102] In some specific embodiments, step S4: performing data item identification matching, data item screening, and data item priority sorting based on the encrypted query request and the encrypted set of sensitive data to obtain a matching result data set includes:

[0103] Step S41: According to the encrypted query request, identifier matching and screening are performed on the data items in the sensitive data encryption set through the homomorphically encrypted public key, the data items that meet the query identifier are identified, and the basic matching data set is obtained.

[0104] Among them, in the identifier matching process, the encrypted identifier is compared with the encrypted identifier of the data item in the sensitive data encryption set to ensure that only the data items with the matching encrypted identifier are selected, thereby ensuring the security of the data and the accuracy of the data query.

[0105] The identifier matching process is optimized by:

[0106] Identifier matching score = (number of matching identifiers / total number of query identifiers) × 100%. This formula can be used to quantitatively evaluate the effect of identifier matching.

[0107] Step S42: Verify and refine each data item in the basic matching data set according to the query conditions in the encrypted query request, so that the screened data items meet the query conditions, thereby obtaining an optimized matching data set; at the same time, it is also verified whether the basic matching data set meets the encrypted query request, and the accuracy of the basic matching data set is optimized.

[0108] Among them, each data item in the basic matching data set is verified, including time range, location, specific attributes, etc.

[0109] The score of the data item refinement screening process is calculated by the following formula:

[0110] Refined screening score = (number of eligible data items / number of data items in the basic matching data set) × 100%; this formula can improve the targeting of data screening and ensure the relevance and accuracy of the data set.

[0111] Step S43: Prioritize the data items in the optimized matching data set to obtain a matching result data set; specifically, the step includes:

[0112] Based on the matching degree between each data item in the optimized matching data set and the query requirements, a weighted sorting algorithm is used to calculate the weight score of each data item in the optimized matching data set; wherein, the weighted sorting algorithm takes various factors into consideration, such as the newness of the data, the matching degree of the query keywords, and user preferences.

[0113] According to the weight score of each data item, the display order of each data item in the matching data set is adjusted and optimized to obtain the matching result data set. By adjusting the order according to the weight score, the data that the user cares about most can be put in the front, so that the matching result data set is more in line with the user's actual needs and usage habits.

[0114] Among them, the weight score of each data item in the optimized matching data set is calculated by the following formula:

[0115]

[0116] In the formula, Score(D i ) represents the weight score of the i-th data item in the optimized matching data set, D i represents the i-th data item in the optimized matching data set; r i Represents the i-th data item D i The matching degree with the query requirements, s i represents the additional score of the ith data item, w1 and w2 represent the weight coefficients of the matching degree and the additional score respectively; w3 represents the normalization constant used to adjust the impact of time sensitivity; |t i -c i | represents the absolute difference between the data item timestamp and the current timestamp, t i Represents the timestamp of the i-th data item, c i Indicates the current timestamp corresponding to the i-th data item.

[0117] The specific execution process of the above formula is as follows:

[0118] Collect each data item D i , including its matching degree r i , additional points i And the timestamp t of the data i ; Calculate the timestamp t of each data item i With the current time c i The absolute difference between the two reflects the timeliness of the data; the weighted sorting formula is used to sort the matching degree r i , additional points i , time sensitivity is combined with preset weights w1, w2 and w3; the weight score of each data item is calculated according to the formula, all data items are prioritized according to the weight score of each data item, and the sorted matching result data set is obtained.

[0119] In some specific embodiments, step S5: encrypting the data items in the matching result data set with a security layer and transmitting the data to the requesting party, wherein the requesting party decrypts the received encrypted data to obtain the decrypted shared data, includes:

[0120] Step S51: Perform security layer encryption and vector inner product operation on each data item in the matching result data set to obtain the ciphertext result. This step can ensure that the data is not easily stolen or tampered with even when transmitted in a public network, optimize the confidentiality and resistance of the data during transmission; and effectively prevent the data from being accessed by unauthorized third parties during transmission, thereby improving the overall data security management level.

[0121] Step S52: The ciphertext result is securely transmitted to the requesting party using the transport layer security protocol and a secure network channel. The requesting party uses the homomorphically encrypted private key to decode the received ciphertext result data and eliminate the obfuscated query requirements to obtain the target query result.

[0122] The requesting party is the querying party that has the private key of the ciphertext result;

[0123] The transport layer security protocol can provide transmission encryption and integrity protection for the ciphertext result data, ensuring that the content of the ciphertext result data packet is kept confidential during transmission and preventing the ciphertext result data from being tampered with during transmission.

[0124] During the transmission of the ciphertext results, integrity checks and encryption verification are performed on the ciphertext result data to ensure that the transmission of each ciphertext result data packet meets the predetermined security standards. The transmission security of the ciphertext results is calculated by the following formula:

[0125] Transmission security = (number of successfully transmitted encrypted data packets / total number of transmitted data packets) × 100%; this formula ensures high security and integrity of all data during transmission.

[0126] The decoding operation includes converting the ciphertext result data back to the original format, and verifying the data integrity (during the decoding process) and security (after decoding) of the ciphertext result data; through data integrity and security verification, it is ensured that the decoded ciphertext result data meets the expected security standards and integrity requirements. Among them, the success rate of the decoding operation is calculated by the following formula:

[0127] Decoding success rate = (number of successfully decoded data items / number of received encrypted data items) × 100%. This formula can be used to optimize the decoding process of the ciphertext result data to ensure that the decrypted civil aviation passenger information meets all security and business requirements.

[0128] Step S53: The data provider feeds back the target query result to the requester, and the requester parses and filters the target query result to obtain the real query result, that is, the decrypted shared data; in this process, the queryer needs to be able to accurately distinguish the real query items from the confusing items, and eliminate the influence of the confusing items on the results.

[0129] In some specific embodiments, the method further includes: step S6: based on the sensitive data encryption set, the user dynamic access control policy, the encrypted query request and the matching result data set, recording the user data access process and the user authority usage and performing security checks and authority verification to obtain access and use audit records, including:

[0130] Step S61: Based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, each user data access process is recorded to obtain data access records and stored in the database to ensure the integrity and traceability of the data access records.

[0131] The data access record includes the visitor ID, access time and accessed data type.

[0132] The completeness of the data access record is calculated by the following formula:

[0133] Record completeness rate = (number of recorded data access events / total number of data access events) × 100%; this formula ensures that all data access behaviors are accurately recorded by the system to form detailed data access records.

[0134] Step S62: Based on the data access records, identify access attempts that do not comply with the preset security policy and label them as abnormal access with risk tags, and represent access attempts that comply with the preset security policy as normal access, and obtain security check results; including:

[0135] Based on data access records, through the set security policies and rule engines, automatically check whether each data access record complies with the authorization standards and security requirements of user access rights, identify any abnormal or suspicious access attempts and mark them as abnormal access with risk labels, and indicate access attempts that comply with preset security policies as normal access; generate security check results based on abnormal access records and normal access records.

[0136] The abnormal access ratio is calculated by the following formula:

[0137] Abnormal access ratio = (number of access attempts marked as abnormal / total number of access attempts) × 100%;

[0138] This formula can help the security team quickly locate potential security threats and make corresponding security adjustments or countermeasures to form comprehensive security inspection results.

[0139] Step S63: Based on the user authority database, the terminal user authority corresponding to the data access records in the security check results (focusing on the records of abnormal access) is compared and verified to check whether the terminal user has the user access rights corresponding to the data access (that is, to check whether each data access is initiated by the user with the corresponding user access rights), and to check whether the access behavior is in full compliance with the data access policy, so as to optimize the legality and security of data access and obtain access and use audit records (that is, access and use audit records).

[0140] Among them, the user authority verification success rate is calculated by the following formula:

[0141] The success rate of authority verification = (the number of successfully verified access attempts / the total number of verified access attempts) × 100%.

[0142] This step ensures that each data access is initiated by a legitimate and authorized user.

[0143] The method of the present invention can ensure that personal identity information and itinerary information are effectively protected during the data sharing process through the identification and classification of sensitive information and encryption processing based on attribute types, thereby minimizing the privacy risks caused by data leakage or improper use. At the same time, the encryption set of sensitive data ensures the security of the data during transmission or storage, thereby providing a safe sharing environment for passenger data. The application of user dynamic access control strategies dynamically adjusts user access rights according to the sensitivity of the data and the user's access history, thereby improving data security and enhancing the flexibility of data access. Through sophisticated access rule configuration, the present invention enables various users to access passenger data on demand without exceeding their access rights, effectively preventing data abuse and illegal access.

[0144] The method of the present invention introduces hidden query technology, optimizes data privacy protection during the query process through encryption and hash processing technology, ensures that the query content will not be leaked to unnecessary third parties, and also ensures the efficiency and accuracy of the query process; such a query mechanism reduces the risk of data exposure during the processing process, increases the security boundary of data utilization, performs secondary encryption on the matching results, and completes permission records and security checks, thereby enhancing data security. Secondary encryption ensures that even if the data is intercepted during transmission, unauthorized users cannot parse the data content, and access and use audit records provide a mechanism for tracking and auditing all data access behaviors, which is essential for complying with regulatory requirements and discovering potential security threats.

[0145] An embodiment of the present invention discloses a data cross-industry sharing system, the system comprising:

[0146] An identification and encryption unit is used to identify and encrypt sensitive information in the shared data to obtain an encrypted set of sensitive data;

[0147] A formulation unit, which is used to analyze the data leakage risk of the sensitive data encryption set to configure the user's access permission level, and formulate a user dynamic access control policy in combination with the analysis of the current data access request;

[0148] A concealment unit, used to analyze shared business requirements based on user dynamic access control policies, construct concealed query requests for multiple query items, and perform concealment optimization on each concealed query request to generate an encrypted query request;

[0149] A data item processing unit, configured to perform data item identification matching, data item screening, and data item priority sorting based on the encrypted query request and the encrypted set of sensitive data to obtain a matching result data set;

[0150] The transmission decryption unit is used to perform security layer encryption on the data items in the matching result data set and transmit the data to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

[0151] In some specific embodiments, the system of the present invention further comprises:

[0152] The inspection and verification unit is used to record the user data access process and user authority usage and perform security inspection and authority verification based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, and obtain access and use audit records;

[0153] Among them, it is used to record the user data access process and user permission usage and perform security checks and permission verification based on sensitive data encryption sets, user dynamic access control policies, encrypted query requests and matching result data sets, and obtain access and use audit records, including:

[0154] Based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, each user data access process is recorded to obtain data access records and store them in the database;

[0155] Based on the data access records, access attempts that do not comply with preset security policies are identified and marked with risk tags as abnormal access, and access attempts that comply with preset security policies are marked as normal access, thereby obtaining security inspection results;

[0156] Verify the terminal user permissions corresponding to the data access records in the security check results to check whether the terminal user has the user access permissions corresponding to the data access, so as to optimize the legality and security of data access and obtain access and use audit records.

[0157] Regarding the system in the above embodiment, the specific manner in which each unit module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0158] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, whose structure is as follows: Figure 3 As shown, it includes a memory, a processor and a computer program stored in the memory, and the processor executes the computer program or instructions to implement the aforementioned cross-industry data sharing method.

[0159] Based on the same inventive concept, an embodiment of the present invention further provides a computer storage medium, in which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the aforementioned method for cross-industry data sharing is implemented.

[0160] Based on the same inventive concept, an embodiment of the present invention also provides a computer program product, including a computer program or instructions, which implement the aforementioned cross-industry data sharing method when executed by a processor.

[0161] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for sharing data across industries, characterized in that: The method comprises: Identify and encrypt sensitive information in the shared data to obtain a sensitive data encryption set; Analyze the data leakage risk of sensitive data encryption sets to configure user access rights levels, and formulate user dynamic access control policies based on the analysis of current data access requests; Analyze shared business needs based on user dynamic access control policies, construct hidden query requests for multiple query items, and perform hidden optimization on each hidden query request to generate an encrypted query request; Based on the encrypted query request and the encrypted set of sensitive data, perform data item identification matching, data item screening, and data item priority sorting to obtain a matching result data set; The data items in the matching result data set are encrypted by the security layer and transmitted to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

2. A method for sharing data across industries according to claim 1, characterized in that: Identify and encrypt sensitive information in the shared data to obtain a sensitive data encryption set, including: Using rule matching technology to identify various sensitive fields in the data to be shared, and generating a sensitive field identification list; Performing attribute type labeling on each sensitive field in the sensitive field identification list to obtain an attribute labeling result; Based on the attribute labeling result, sensitive fields of different attribute types are encrypted using a key to restrict access by unauthorized users, thereby obtaining a sensitive data encryption set.

3. A method for sharing data across industries according to claim 1, characterized in that: The various sensitive fields in the data to be shared are identified using rule matching technology, and a sensitive field identification list is generated, including: Based on the data to be shared, extract all data sets related to the personal information; use a text analysis tool to scan all data sets to obtain text fields related to the personal information; Using rule matching technology to identify various sensitive fields in the text field, and calculating the sensitivity of each data set based on the number of sensitive fields in each data set, that is, obtaining the proportion of sensitive information in each data set; Generate a sensitive field identification list based on various sensitive fields and the proportion of sensitive information in each data set; Among them, the sensitivity of each data set is calculated by the following formula: The sensitivity of each data set = (the number of sensitive fields in the data set / the total number of fields in the data set).

4. A method for cross-industry data sharing according to claim 2, characterized in that: Analyze the data leakage risk of sensitive data encryption sets to configure the user's access permission level, and formulate user dynamic access control policies based on the analysis of current data access requests, including: Evaluate the sensitivity level of each sensitive field in the sensitive data encryption set, and calculate the potential risk of data leakage of each sensitive field based on the historical data access records of the sensitive field, and obtain the data sensitivity and risk assessment information of each sensitive field; Based on the data sensitivity and risk assessment information of each sensitive field, establish access rights levels for different users to limit different users’ access to sensitive data; Based on the access rights levels of different users, the current data access requests and related risk assessment information of the sensitive data encryption set are analyzed, and the Bayesian network algorithm is used to dynamically adjust user access rights to realize the formulation of user dynamic access control strategies.

5. A method for cross-industry data sharing according to claim 4, characterized in that: Use Bayesian network algorithms to dynamically adjust user access rights, including: Construct a Bayesian network model containing multiple factors, calculate the conditional probability of each access to the encrypted set of sensitive data, and calculate the probability of obtaining permission adjustment based on the user's access level, user behavior and environmental variables; and dynamically adjust the user's access rights according to the permission adjustment probability; Among them, the permission adjustment probability is calculated by the following formula: Where P(A|B,C,D) represents the posterior probability that the user should have permission level A under the conditions of current user behavior C and environmental variables D given a risk state B; P(B|A,C,D) represents the probability of being in risk state B under the conditions of user permission level A, user behavior C and environmental variables D; P(A|C,D) represents the probability that the user should have permission level A under the conditions of user behavior C and environmental variables D; P(C,D) represents the joint probability of user behavior C and environmental variables D; P(B,C,D) represents the joint probability of being in risk state with reference to user behavior C and environmental factors.

6. A method for sharing data across industries according to claim 1, characterized in that: Analyze shared business needs based on user dynamic access control policies, build hidden query requests for multiple query items, and perform hidden optimization on each hidden query request to generate an encrypted query request, including: Analyze shared business needs based on user dynamic access control policies to design hidden query requests and their corresponding viewing scopes and query conditions, and generate hidden query information; Concealed query requests of multiple query items are constructed based on the concealed query information, and each of the concealed query requests is concealedly encrypted to obtain an encrypted query request.

7. A method for sharing data across industries according to claim 6, characterized in that: Analyze shared business needs based on user dynamic access control policies to design hidden query requests and their corresponding viewing scopes and query conditions, and generate hidden query information, including: Analyze the data query requirements and data access levels of different users based on the user dynamic access control strategy, that is, obtain business demand analysis information; Based on the business needs analysis information, a semi-homomorphic encryption algorithm is used to design a hidden query request, and the data fields and corresponding query conditions that each hidden query request matches are defined to generate hidden query information; Among them, a semi-homomorphic encryption algorithm is used to design an anonymous query request, including: Generate homomorphic encryption public and private keys through semi-homomorphic encryption algorithm; Based on the public key and the private key, data shielding and partial field anonymization technology are adopted to design a concealed query request including data access and information extraction instructions.

8. A method for sharing data across industries according to claim 6, characterized in that: Constructing a concealed query request with multiple query items based on the concealed query information, including: Encrypting the query conditions in the hidden query information, hashing the data fields in the hidden query information, and adding obfuscated items to the real query items to construct a hidden query request containing multiple query items; Wherein, the real query item refers to a data item in the sensitive data encryption set; The obfuscated items are randomly generated false data or redundant data from a public data source; The obfuscated term is similar to the real query term in data structure, format and semantics.

9. A method for sharing data across industries according to claim 1, characterized in that: Based on the encrypted query request and the encrypted set of sensitive data, data item identification matching, data item screening, and data item priority sorting are performed to obtain a matching result data set, including: According to the encrypted query request, identifier matching and screening are performed on the data items in the encrypted sensitive data set, data items matching the query identifier are identified, and a basic matching data set is obtained; Refining and screening each data item in the basic matching data set according to the query condition in the encrypted query request, so that the screened data items meet the query condition, and obtaining an optimized matching data set; The data items in the optimized matching data set are prioritized to obtain a matching result data set.

10. A method for sharing data across industries according to claim 9, characterized in that: Prioritizing the data items in the optimized matching data set to obtain a matching result data set includes: Based on the matching degree between each data item in the optimized matching data set and the query requirement, a weighted sorting algorithm is used to calculate the weight score of each data item in the optimized matching data set; According to the weight score of each data item, the display order of each data item in the matching data set is adjusted and optimized to obtain the matching result data set, so that the matching result data set is more in line with the actual needs and usage habits of users; Among them, the weight score of each data item in the optimized matching data set is calculated by the following formula: In the formula, Score(D i ) represents the weight score of the i-th data item in the optimized matching data set, D i represents the i-th data item in the optimized matching data set; r i Represents the i-th data item D i The matching degree with the query requirements, s i represents the additional score of the ith data item, w1 and w2 represent the weight coefficients of the matching degree and the additional score respectively; w3 represents the normalization constant; |t i -c i | represents the absolute difference between the data item timestamp and the current timestamp, t i Represents the timestamp of the i-th data item, c i Indicates the current timestamp corresponding to the i-th data item.

11. A method for sharing data across industries according to claim 1, characterized in that: The data items in the matching result data set are encrypted by the security layer and transmitted to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data, including: Perform security layer encryption and vector inner product operation on each data item in the matching result data set to prevent the data from being accessed by unauthorized third parties during transmission and obtain the ciphertext result; The ciphertext result is securely transmitted to the requester using the transport layer security protocol and a secure network channel. The requester uses a private key to decode the received ciphertext result data and remove the obfuscated query requirements to obtain the target query result; The data provider feeds back the target query result to the requester, and the requester parses and filters the target query result to obtain the real query result, that is, to obtain the decrypted shared data; The requesting party is the querying party that holds the private key of the ciphertext result; The decoding operation includes: converting the ciphertext result data back to the original format, and verifying the data integrity and security of the ciphertext result data.

12. A method for sharing data across industries according to claim 1, characterized in that: The method further includes: based on the sensitive data encryption set, the user dynamic access control policy, the encrypted query request and the matching result data set, recording the user data access process and the user authority usage and performing security checks and authority verification to obtain access and use audit records, including: Based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, each user data access process is recorded to obtain data access records and stored in the database; wherein the data access records include visitor ID, access time and accessed data type; Based on data access records, access attempts that do not comply with preset security policies are identified and marked as abnormal access with risk tags, and access attempts that comply with preset security policies are marked as normal access to obtain security inspection results; Verify the terminal user permissions corresponding to the data access records in the security check results to check whether the terminal user has the user access permissions corresponding to the data access, so as to optimize the legality and security of data access and obtain access and use audit records.

13. A data cross-industry sharing system, characterized in that: The system comprises: An identification and encryption unit is used to identify and encrypt sensitive information in the shared data to obtain an encrypted set of sensitive data; A formulation unit, which is used to analyze the data leakage risk of the sensitive data encryption set to configure the user's access permission level, and formulate a user dynamic access control policy in combination with the analysis of the current data access request; A concealment unit, used to analyze shared business requirements based on user dynamic access control policies, construct concealed query requests for multiple query items, and perform concealment optimization on each concealed query request to generate an encrypted query request; A data item processing unit, configured to perform data item identification matching, data item screening, and data item priority sorting based on the encrypted query request and the encrypted set of sensitive data to obtain a matching result data set; The transmission decryption unit is used to perform security layer encryption on the data items in the matching result data set and transmit the data to the requesting party, and the requesting party decrypts the received encrypted data to obtain the decrypted shared data.

14. A data cross-industry sharing system according to claim 13, characterized in that: The system further comprises: The inspection and verification unit is used to record the user data access process and user authority usage and perform security inspection and authority verification based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, and obtain access and use audit records; Among them, it is used to record the user data access process and user permission usage and perform security checks and permission verification based on sensitive data encryption sets, user dynamic access control policies, encrypted query requests and matching result data sets, and obtain access and use audit records, including: Based on the sensitive data encryption set, user dynamic access control policy, encrypted query request and matching result data set, each user data access process is recorded to obtain data access records and store them in the database; Based on the data access records, access attempts that do not comply with preset security policies are identified and marked with risk tags as abnormal access, and access attempts that comply with preset security policies are marked as normal access, thereby obtaining security inspection results; Verify the terminal user permissions corresponding to the data access records in the security check results to check whether the terminal user has the user access permissions corresponding to the data access, so as to optimize the legality and security of data access and obtain access and use audit records.

15. An electronic device, characterized in that: It includes a memory, a processor and a computer program stored in the memory, and the processor executes the computer program or instructions to implement a cross-industry data sharing method as described in any one of claims 1-12.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program or instruction, and when the computer program or instruction is executed by the processor, it implements a cross-industry data sharing method as described in any one of claims 1-12.

17. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by the processor, a method for cross-industry data sharing as described in any one of claims 1-12 is implemented.

Images