A Big Data Message Encryption Method

Abstract

The present invention provides a method for encrypting big data messages, belonging to the technical field of key management. The method includes comprehensively auditing existing data, classifying the existing data according to the audit results, analyzing the potential impact of anomalies in each classification result on the business process, and determining the data sensitivity of the classification results; determining the specific uses and purposes corresponding to the classification results, constructing a category-purpose table, and designing a hierarchical framework in combination with the data sensitivity; conducting a requirements analysis on the hierarchical framework, determining the different confidentiality requirements between each level and level, formulating corresponding key management strategies, generating key pairs to encrypt messages for transmitting data; controlling the generated keys according to the hierarchical framework, recording the usage of all keys, determining and updating the security of the keys, realizing the systematicness of key management, ensuring that various types of data are properly protected, effectively identifying and classifying sensitive data, enhancing the data protection ability, and reducing the risk of data leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of key management, and particularly to a method for encrypting big data messages. Background Art

[0002] With the rapid development of information technology and the explosion of data volume, data security and privacy protection have become important challenges faced by enterprises and organizations. An effective key management strategy is the core to ensure data security, which can help organizations protect sensitive data. However, existing key management often lacks systematicness and overall planning, resulting in inconsistent or incomplete key management strategies, and deficiencies in data classification and sensitivity assessment, leading to the inability to effectively identify and protect sensitive data.

[0003] Therefore, the present invention provides a method for encrypting big data messages. Summary of the Invention

[0004] A method for encrypting big data messages provided by the present invention includes comprehensively auditing existing data and classifying it, analyzing the sensitivity and potential impact of each classification on the business process, constructing a category-purpose table, designing a hierarchical framework, formulating a key management strategy and generating keys according to the confidentiality requirements of different levels, controlling the use of keys, recording their usage, and updating them regularly, so as to ensure data security and compliance, realize the systematicness of key management, ensure the proper protection of various types of data, effectively identify and classify sensitive data, enhance data protection capabilities, and reduce the risk of data leakage.

[0005] The present invention provides a method for encrypting big data messages, including:

[0006] Step 1: Comprehensively audit existing data, classify the existing data according to the audit results to obtain classification results, analyze the potential impact of each classification result's abnormality on the business process, and then determine the data sensitivity of the corresponding classification result;

[0007] Step 2: Determine the specific uses and purposes corresponding to each classification result, construct a category-purpose table, and design a hierarchical framework based on the category-purpose table and the data sensitivity;

[0008] Step 3: Conduct a requirements analysis on the hierarchical framework, determine the different confidentiality requirements between each level and the levels, formulate corresponding key management strategies based on the different confidentiality requirements, and generate key pairs according to the key management strategies to encrypt the transmitted data;

[0009] Step 4: Control the generated keys according to the hierarchical framework. At the same time, record the usage of all keys, determine the security of the keys, and update the keys.

[0010] The present invention provides a method for encrypting big data messages, comprehensively auditing existing data, classifying the existing data according to the audit results, and obtaining classification results, including:

[0011] Identifying the data sources and corresponding data types of the existing data according to the audit results;

[0012] Pre-classifying the existing data according to the data sources and data types to obtain a pre-classification result, recording the data scale of the corresponding existing data in each data source based on the pre-classification result, and determining the data usage corresponding to each existing data according to the audit results;

[0013] Formulating classification criteria based on the data scale and data usage, classifying the existing data, and obtaining classification results.

[0014] The present invention provides a method for encrypting big data messages, analyzing the potential impact of anomalies in each classification result on the business process, and then determining the data sensitivity of the corresponding classification result, including:

[0015] Identifying the data anomalies corresponding to the classification result according to the audit results;

[0016] Collecting the business processes corresponding to the classification results, and determining the data dependency relationships and data usage in the existing data based on the business processes;

[0017] Drawing a data flow diagram, determining the flow of each classification result in the business process, and determining the dependency relationships between each business process and all classification results in combination with the flow situation, data dependency relationships and data usage;

[0018] Ranking the importance of the business processes to obtain a process ranking result, and determining the dependency degree of the corresponding classification result based on the process ranking result and the dependency situation;

[0019] Analyzing the potential impact on the corresponding business process when data anomalies occur in the classification result based on the dependency degree of the classification result, formulating data sensitivity criteria for the corresponding classification result according to the potential impact, and then obtaining the data sensitivity of each classification result.

[0020] The present invention provides a method for encrypting big data messages, determining the specific uses and usage purposes corresponding to each classification result, constructing a category-purpose table, and designing a hierarchical framework based on the category-purpose table and the data sensitivity, including:

[0021] Analyzing the specific uses of each classification result in different scenarios according to the business process, drafting corresponding usage purposes for each classification result, and creating a category-purpose table according to the specific uses and usage purposes;

[0022] Design a hierarchical architecture based on the data sensitivity of the category-purpose table and the corresponding classification results.

[0023] The present invention provides a big data message encryption method, which conducts a requirements analysis on the hierarchical architecture, determines different confidentiality requirements between each layer and the layer, formulates a corresponding key management strategy based on the different confidentiality requirements, and generates a key pair according to the key management strategy to encrypt the transmission data for message encryption, including:

[0024] Determine the involved groups in each layer of the hierarchical architecture, and determine the first confidentiality requirement of each involved group according to the group requirements table;

[0025] At the same time, conduct an inter-layer confidentiality requirement analysis on each layer to obtain a second confidentiality requirement;

[0026] Use the operation-side event and the receiving-side event as the respective key generation entropy sources, determine the cryptographic pseudorandom number generator based on the first confidentiality requirement, and formulate a key generation standard based on the second confidentiality requirement;

[0027] Evaluate the initial entropy collected from the key generation entropy source according to the key generation standard to obtain an entropy evaluation result, and define the pseudorandom number generation frequency of the cryptographic pseudorandom number generator according to the entropy evaluation result;

[0028] Match the key length corresponding to the second confidentiality requirement from the security requirements table. At the same time, determine the key generation method according to the message transmission situation between the operation side and the receiving side;

[0029] Determine the key management strategy according to the pseudorandom number generation frequency, key length, and key generation method, and generate a key pair from the cryptographic pseudorandom number generator according to the key management strategy to encrypt the transmission data for message encryption.

[0030] The present invention provides a big data message encryption method, which evaluates the initial entropy collected from the key generation entropy source according to the key generation standard to obtain an entropy evaluation result, and defines the pseudorandom number generation frequency of the cryptographic pseudorandom number generator according to the entropy evaluation result, including:

[0031] , where represents the entropy evaluation result; represents the probability of the random event occurring in the key generation entropy source; n represents the total number of events contained in the key generation entropy source; represents the i th event in the key generation entropy source; represents the quality function of the key generation entropy source; represents the i th event's influence weight; Represents random events in the entropy source for key generation Under certain conditions y The joint probability of the following occurrences; Represents random events in the entropy source for key generation Under certain conditions y The conditional probability of the following happening;

[0032] ,in, f Indicates the frequency of pseudo-random number generation; k Indicates the frequency reference value adjustment factor; Indicates the degree of influence of adjusting load conditions on entropy; Indicates the degree of influence of adjusting the health status on entropy; S indicates the health status of the entropy source for key generation; L Indicates the load of the cryptographic pseudo-random number generator; Based on environmental factors E Determine the frequency influence function.

[0033] The present invention provides a method for encrypting a large data message, which controls the generated key according to the hierarchical architecture, including:

[0034] Classify the keys according to the hierarchical structure, mark the usage level of each key, store the keys in an encrypted database, and perform secondary encryption on the stored keys;

[0035] Set different levels of access permissions based on the hierarchical architecture to control keys.

[0036] The present invention provides a large data message encryption method, which records the usage of all keys, determines the security of the keys, and updates the keys, including:

[0037] Record each use of the key, generate a use log, make a security determination on the key based on the use log, and set a first update strategy for the key according to the security determination result;

[0038] A second update strategy for setting the key according to the operation end event and the receiving end event;

[0039] The key is updated by combining the first update strategy and the second update strategy.

[0040] Compared with the prior art, the beneficial effects of the present application are as follows: By comprehensively auditing the existing data and classifying it, analyzing the sensitivity and potential impact of each classification, constructing a category-purpose table, designing a hierarchical framework, formulating a key management strategy and generating keys according to the confidentiality requirements of different levels, controlling the use of keys, recording their usage, and updating them regularly, the security and compliance of the data are ensured, the systematicness of key management is achieved, all types of data are properly protected, sensitive data is effectively identified and classified, the data protection ability is enhanced, and the risk of data leakage is reduced.

[0041] Other features and advantages of the present invention will be described in the following specification, and in part will be obvious from the specification, or will be understood by implementing the present invention. The objectives and other advantages of the present invention can be achieved and obtained by the structures specifically pointed out in the written specification and the drawings.

[0042] The technical solution of the present invention will be further described in detail below through the drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation to the present invention. In the drawings:

[0044] Figure 1 is a schematic flowchart of a big data message encryption method provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0045] The following describes the preferred embodiments of the present invention with reference to the drawings. It should be understood that the preferred embodiments described herein are only for explaining and illustrating the present invention and are not used to limit the present invention.

[0046] Embodiment 1:

[0047] An embodiment of the present invention provides a big data message encryption method, as Figure 1 shown, including:

[0048] Step 1: Conduct a comprehensive audit of the existing data, classify the existing data according to the audit results to obtain a classification result, analyze the potential impact of an abnormality in each classification result on the business process, and then determine the data sensitivity of the corresponding classification result;

[0049] Step 2: Determine the specific uses and purposes corresponding to each classification result, construct a category-purpose table, and design a hierarchical framework based on the category-purpose table and the data sensitivity;

[0050] Step 3: Conduct a requirements analysis on the hierarchical architecture, determine the different confidentiality requirements between each level, formulate corresponding key management strategies based on the different confidentiality requirements, and generate key pairs to encrypt the transmitted data according to the key management strategies;

[0051] Step 4: Control the generated keys according to the hierarchical architecture. At the same time, record the usage of all keys, determine the security of the keys, and update the keys.

[0052] In this embodiment, the audit result is the information obtained after a comprehensive inspection of the existing data, including data sources, data types, data scales, uses, and their sensitivities, etc.

[0053] In this embodiment, the classification result is the result of the final division of the existing data according to the formulated classification criteria after auditing, preliminary classification, and use analysis. For example, sensitive data (such as personal information, financial information), non-sensitive data (such as public information, operation logs), restricted data (such as compliance data, trade secrets). For instance, sensitive data is the encrypted user ID number and credit card information.

[0054] In this embodiment, data anomalies refer to data deviations or inconsistencies found during the audit process. For example, data format errors, missing values, duplicate records, or unexpected numerical values. For example, the user's personal information is encrypted during transmission, but data loss or an unexpected format is found during decryption.

[0055] In this embodiment, the business process refers to a series of interrelated activities or tasks executed within an organization to achieve specific goals, usually including input, processing, output, and feedback links, and involving different departments and systems.

[0056] In this embodiment, the potential impact refers to the specific impact on the corresponding business process when a data anomaly occurs, including process interruption, reduced efficiency, increased compliance risks, etc. This impact can be direct or indirect. If a failure occurs during the encryption process, resulting in the incorrect encryption of the customer's sensitive information, it may lead to data leakage, thereby affecting the company's reputation and compliance.

[0057] In this embodiment, identify data anomalies through audit results, collect business processes and analyze data dependencies, draw data flow diagrams to determine the flow of classification results in business processes, evaluate the impact of data anomalies on business processes according to the importance ranking and dependency analysis of the processes, formulate data sensitivity criteria, and determine the data sensitivity of the corresponding data.

[0058] In this embodiment, the specific use refers to the actual application of each data classification result in different business scenarios. For example: Personal identity information: used for user registration, identity verification, and customer service; Financial data: used for bill processing, financial analysis, and credit scoring; Transaction records: used for order processing, inventory management, and financial auditing.

[0059] In this embodiment, the purpose of use refers to the goal or intention of using data in a specific scenario. For example, Personal identity information: to ensure the authenticity and security of user identities; Financial data: for making financial decisions and risk assessments; Transaction records: to ensure the accuracy and traceability of transactions.

[0060] In this embodiment, the category-purpose table is a clear mapping table that lists each data classification and its corresponding purpose of use. For example, if the content of the data classification is personal identity information, the corresponding purposes of use are identity verification, user registration, and customer service.

[0061] In this embodiment, by analyzing the business processes, the data classification results are combined with the specific uses to formulate the category-purpose table, which clarifies the purpose of use for each type of data. Based on this table and data sensitivity, a hierarchical architecture is designed.

[0062] In this embodiment, different confidentiality requirements include the first confidentiality requirement and the second confidentiality requirement. The first confidentiality requirement refers to the basic requirements of each involved group for data confidentiality. For example, IT security team: needs to ensure data encryption and access control; Business department: needs to protect business-sensitive information; Compliance department: needs to comply with regulatory requirements to ensure data privacy. The second confidentiality requirement refers to the higher-level confidentiality requirements obtained through inter-layer confidentiality requirement analysis. This usually involves more stringent protection measures for data. For example, IT security team: needs to implement multi-factor authentication; Business department: requires regular auditing and monitoring of data access; Compliance department: needs to ensure data encryption during transmission.

[0063] In this embodiment, the key management strategy refers to the specifications and processes for key generation, storage, distribution, use, and destruction. For example, Key storage: use a secure hardware module (HSM) to store keys; Key rotation: regularly replace keys to improve security.

[0064] In this embodiment, message encryption refers to encrypting information during data transmission to ensure data confidentiality and integrity. Common encryption algorithms include, Symmetric encryption: such as AES; Asymmetric encryption: such as RSA.

[0065] In this embodiment, the keys are classified through a hierarchical architecture, the usage levels are marked and stored in an encrypted database to ensure the security of the keys. The stored keys are encrypted twice to enhance the protection measures, and different access permissions are set according to the levels to achieve precise control of the keys.

[0066] In this embodiment, security determination is a process of evaluating the security of keys based on usage logs and other security metrics. The factors for determination may include: abnormal access: whether there are unauthorized or abnormal access attempts; frequent usage: whether the keys are frequently used and there is a risk of abuse; expiration status: whether the keys are approaching the expiration time and need to be rotated; usage pattern: whether there are unusual usage patterns, such as access during non-working hours. The results of the security determination will affect the key management strategy and update decisions.

[0067] The working principle and beneficial effects of the above technical solution are as follows: By comprehensively auditing and classifying the existing data, analyzing the sensitivity and potential impact of each classification, constructing a category-purpose table, designing a hierarchical architecture, formulating a key management strategy and generating keys according to the confidentiality requirements of different levels, controlling the use of keys, recording their usage, and updating regularly, the security and compliance of the data are ensured, the systematicness of key management is achieved, all types of data are properly protected, sensitive data is effectively identified and classified, the data protection ability is enhanced, and the risk of data leakage is reduced.

[0068] Embodiment 2:

[0069] The embodiment of the present invention provides a big data message encryption method, which comprehensively audits the existing data, classifies the existing data according to the audit results, and obtains the classification results, including:

[0070] Identifying the data sources and corresponding data types of the existing data according to the audit results;

[0071] Based on the data sources and data types, the existing data is preliminarily classified to obtain the preliminary classification results. Based on the preliminary classification results, the data scale of the corresponding existing data in each data source is recorded, and the data usage corresponding to each existing data is determined according to the audit results.

[0072] Based on the data scale and data usage, a classification standard is formulated to classify the existing data and obtain the classification results.

[0073] In this embodiment, the data sources include all systems or platforms that collect and store data, such as: databases (relational databases, non-relational databases), applications (enterprise software, mobile applications), etc. For example, MySQL is used in the database to store user information and transaction records.

[0074] In this embodiment, the data type includes the specific form of data. For example, structured data (numbers, texts, dates, etc.), semi-structured data (JSON, XML, etc.), and unstructured data (pictures, videos, audios, etc.).

[0075] In this embodiment, the preliminary classification result is to initially divide data into different categories by analyzing the data source and data type. For example, personal data, financial data, operation data, and business data.

[0076] In this embodiment, the data scale refers to the amount of data stored in each data source, usually expressed in bytes, number of rows, or number of records. For example, in terms of bytes: the total size of user records stored in the database is 500GB.

[0077] In this embodiment, the process of determining the data usage corresponding to each existing data according to the audit result is to evaluate the usage scenarios of the data, such as business decision-making, customer relationship management, compliance reporting, etc.; associate the data source with its specific usage to ensure that the purpose of using each data set is clear.

[0078] The working principle and beneficial effects of the above technical solution are as follows: By auditing existing data, identifying data sources and data types, conducting preliminary classification and recording the data scale, formulating classification criteria based on usage analysis, and further systematically classifying the data to obtain the final classification result. This process ensures the structured management of data, lays a foundation for subsequent sensitivity assessment and key management, can more effectively identify and protect sensitive data, reduce the risk of leakage, and improve the effectiveness of data usage.

[0079] Embodiment 3:

[0080] The embodiment of the present invention provides a big data message encryption method, which analyzes the potential impact of anomalies in each classification result on the business process, and then determines the data sensitivity of the corresponding classification result, including:

[0081] Clarify the data anomaly situation corresponding to the classification result according to the audit result;

[0082] Collect the business processes corresponding to the classification results, and determine the data dependency relationship and data usage situation in the existing data based on the business processes;

[0083] Draw a data flow diagram to determine the flow situation of each classification result in the business process, and determine the dependency situation between each business process and all classification results in combination with the flow situation, data dependency relationship and data usage situation;

[0084] Sort the importance of the business processes to obtain the process sorting result, and determine the dependency degree of the corresponding classification result based on the process sorting result and the dependency situation;

[0085] Analyze the potential impact on the corresponding business processes when data anomalies occur in the classification results based on the degree of dependence of the classification results, formulate data sensitivity criteria for the corresponding classification results according to the potential impact, and then obtain the data sensitivity of each classification result.

[0086] In this embodiment, the data dependency relationship refers to the mutual relationship between different data sets. For example, a certain business process needs to rely on a specific data source or data set for operation; the data usage situation describes the specific application of data in the business process, including the access frequency of data, the usage method (such as reading, writing, updating), and the data life cycle.

[0087] In this embodiment, the dependency situation refers to the mutual dependency relationship between the business process and the classification result, determining whether a certain business process depends on a specific data classification result, and the intensity and nature of this dependency. For example, in big data analysis, some analysis models rely on encrypted user data. If these data are abnormal (such as the encryption key is lost), the analysis model may not be able to run properly.

[0088] In this embodiment, the process sorting result is the priority order obtained after evaluating the importance of the business process. The importance is usually based on factors such as the contribution of the process to the organizational goal, the impact on customers, or the requirements for compliance. For example, in big data analysis, some analysis models rely on encrypted user data. If these data are abnormal (such as the encryption key is lost), the analysis model may not be able to run properly.

[0089] In this embodiment, the degree of dependence refers to the degree of importance of the classification result in the business process, which usually reflects the potential impact of data anomalies on the business process. A high degree of dependence means that this classification result is crucial for the normal operation of the process. In a financial service application, the customer's financial data is stored encrypted. If the system relies on this encrypted data for credit scoring, a high degree of dependence means that the security of the encryption process is crucial.

[0090] In this embodiment, the process of formulating data sensitivity criteria is to identify different data classifications (such as sensitive data, non-sensitive data) according to the audit results and data anomalies, analyze the degree of dependence of each classification result on the business process, determine its importance, evaluate the potential impact of data anomalies on the business process, consider the severity and scope of the impact, and formulate data sensitivity criteria based on the above analysis to clarify the protection measures and management strategies for different classification results to ensure the security and compliance of sensitive data.

[0091] The working principle and beneficial effects of the above technical solution are as follows: identify data anomalies through audit results, collect business processes and analyze data dependencies, draw data flow diagrams to determine the flow of classification results in business processes, evaluate the impact of data anomalies on business processes according to the importance ranking and dependency analysis of processes, formulate data sensitivity criteria, determine the data sensitivity of corresponding data, so as to effectively identify and protect sensitive data, manage data more efficiently, and reduce redundancy and repetitive work.

[0092] Example 4:

[0093] An embodiment of the present invention provides a big data message encryption method, which determines the specific uses and purposes corresponding to each classification result, constructs a category-purpose table, and designs a hierarchical framework based on the category-purpose table and the data sensitivity, including:

[0094] Analyze the specific uses of each classification result in different scenarios according to the business process, draft corresponding purposes for each classification result, and create a category-purpose table according to the specific uses and purposes;

[0095] Design a hierarchical framework based on the category-purpose table and the data sensitivity of the corresponding classification results.

[0096] In this embodiment, the hierarchical framework refers to a hierarchical design of data access and management according to the sensitivity and purpose of use of data. The specific content includes: The first layer: public data, characteristics: open to the public, no sensitivity, access control: no special restrictions, for example, public product information, market research data; The second layer: internal data, characteristics: only accessible to internal employees, with a certain degree of sensitivity, access control: requires identity verification and permission management, for example, employee information, internal reports; The third layer: sensitive data, characteristics: highly sensitive, requires strict protection, access control: only accessible to specific roles and personnel, using encrypted storage and transmission, for example, personal identity information, financial data, health information; The fourth layer: confidential data, characteristics: extremely high sensitivity, involving legal and compliance requirements, access control: using multi-factor authentication and encryption technology, regularly auditing access permissions, for example, trade secrets, strategic planning data.

[0097] The working principle and beneficial effects of the above technical solution are as follows: by analyzing the business process, combining the data classification results with the specific uses, formulating a category-purpose table, clarifying the purpose of use of each type of data, and designing a hierarchical framework based on this table and the data sensitivity to ensure the effective management and protection of sensitive data in different scenarios, improving data security and compliance, and enhancing data management efficiency.

[0098] Example 5:

[0099] An embodiment of the present invention provides a method for encrypting big data messages. By analyzing the requirements of a hierarchical architecture, different confidentiality requirements between each level are determined. Based on the different confidentiality requirements, corresponding key management strategies are formulated, and keys are generated according to the key management strategies to encrypt the transmission data messages, including:

[0100] Determine the involved groups at each level in the hierarchical architecture, and determine the first confidentiality requirements of each involved group according to the group requirements table;

[0101] At the same time, conduct inter-layer confidentiality requirement analysis for each level to obtain the second confidentiality requirements;

[0102] Use the operation end event and the receiving end event as the respective key generation entropy sources, determine the cryptographic pseudo-random number generator based on the first confidentiality requirements, and formulate the key generation standard based on the second confidentiality requirements;

[0103] Evaluate the initial entropy collected from the key generation entropy source according to the key generation standard to obtain the entropy evaluation result, and define the pseudo-random number generation frequency of the cryptographic pseudo-random number generator according to the entropy evaluation result;

[0104] Match the key length corresponding to the second confidentiality requirements from the security requirements table. At the same time, determine the key generation method according to the message transmission situation between the operation end and the receiving end;

[0105] Determine the key management strategy according to the pseudo-random number generation frequency, key length, and key generation method, and generate keys from the cryptographic pseudo-random number generator according to the key management strategy to encrypt the transmission data messages.

[0106] In this embodiment, the involved group refers to the personnel or departments directly or indirectly involved in data processing and access during the process of data management and protection. For example, the IT security team: responsible for data security and encryption implementation, the business department: uses data for decision-making and analysis, the compliance department: ensures that data processing complies with relevant laws and regulations, and the end user: the user who directly uses the system.

[0107] In this embodiment, the group requirements table is a document recording the requirements of different involved groups in terms of data security and confidentiality, and the content includes: group name, requirement description, priority, relevant laws and regulations.

[0108] In this embodiment, the process of inter-layer confidentiality requirement analysis usually includes identifying the characteristics of each level: understanding the data sensitivity of each level, determining group requirements: analyzing the groups involved in each level and their confidentiality requirements, evaluating potential risks: evaluating the impact of data leakage on each level, and formulating confidentiality requirements: formulating the second confidentiality requirements based on the above analysis.

[0109] In this embodiment, the key generation entropy source is the source of randomness for generating keys, which may include: operating end events such as user input and system events; receiving end events such as data reception and processing feedback.

[0110] In this embodiment, the key standard refers to the conditions that need to be met for generating keys, including: key length, usually in bits, which determines the strength of the key; generation algorithm, such as AES, RSA, etc.

[0111] In this embodiment, the cryptographic pseudo-random number generator is an algorithm used to generate an unpredictable sequence of random numbers and is suitable for key generation. Common pseudo-random number generators include SHA-256, a secure hash algorithm, and AES-CTR, which uses the counter mode of AES encryption.

[0112] In this embodiment, the key length refers to the number of bits of the key. Generally, the longer the key length, the higher the security. Common key lengths are 128 bits, which is suitable for general data encryption, and 256 bits, which is suitable for high-security requirements.

[0113] In this embodiment, the key generation method refers to the specific method of generating keys, including: random generation, using a pseudo-random number generator; password-based, generating a key through a user password.

[0114] The working principle and beneficial effects of the above technical solution are as follows: By analyzing the involved groups at different levels and their confidentiality requirements, a hierarchical confidentiality strategy is formulated. Based on the operating end and receiving end events, a key entropy source is generated. A suitable cryptographic pseudo-random number generator is selected, the key generation standard is defined, the initial entropy is evaluated, and the pseudo-random number generation frequency is determined, thereby formulating a key management strategy to ensure the security of data during transmission and improve the key usage efficiency.

[0115] Embodiment 6:

[0116] The embodiment of the present invention provides a big data message encryption method, which evaluates the initial entropy collected from the key generation entropy source according to the generated key standard to obtain an entropy evaluation result, and defines the pseudo-random number generation frequency of the cryptographic pseudo-random number generator according to the entropy evaluation result, including:

[0117] , where represents the entropy evaluation result; represents the probability of the random event occurring in the key generation entropy source; n represents the total number of events contained in the key generation entropy source; i represents the i th event in the key generation entropy source; represents the quality function of the key generation entropy source; represents the iThe impact weight of an event; Indicates a random event in the key generation entropy source Under specific conditions y The joint probability of occurrence; Indicates a random event in the key generation entropy source Under specific conditions y The conditional probability of occurrence;

[0118] , where f Indicates the pseudo-random number generation frequency; k Indicates the frequency reference value adjustment factor; Indicates the degree of influence of the adjusted load condition on entropy; Indicates the degree of influence of the adjusted health status on entropy; S represents the health status of the key generation entropy source; L Indicates the load condition of the cryptographic pseudo-random number generator; Indicates based on environmental factors E The determined frequency influence function.

[0119] The working principle and beneficial effects of the above technical solution are: By evaluating the initial entropy of the key generation entropy source, the generation frequency of the pseudo-random number generator is determined. The entropy evaluation result combines the event probability and the influence weight, reflecting the quality and randomness of the entropy source. By adjusting the load and health status, the pseudo-random number generation frequency is optimized, thereby ensuring the security and reliability of key generation, reducing the risk of data leakage, and protecting sensitive information.

[0120] Example 7:

[0121] The embodiment of the present invention provides a big data message encryption method, which controls the generated key according to the hierarchical architecture, including:

[0122] Classify the keys according to the hierarchical architecture, mark the usage level of each key, and store the keys in the encrypted database, and perform secondary encryption on the stored keys;

[0123] Set access permissions for different levels according to the hierarchical architecture to control the keys.

[0124] In this embodiment, key classification divides the keys into different types according to the functions and uses of the keys. Common key classifications include: Master key: A key used to generate and manage other keys, Data encryption key: A key used to encrypt actual data, Key encryption key: A key used to encrypt other keys (such as DEK), Session key: Used for one-time session encryption, usually invalid after the session ends.

[0125] In this embodiment, the usage levels refer to classifying data and keys into different levels according to the sensitivity and security requirements of the data. Common usage levels include: Public data: Data that is not sensitive and can be accessed by anyone; Internal data: Data used within the company, with restricted access rights; Sensitive data: Data involving personal information or trade secrets, where access needs to be strictly controlled; Confidential data: Highly sensitive data that can only be accessed by specific authorized personnel.

[0126] In this embodiment, secondary encryption refers to encrypting the already encrypted data or keys again to enhance security. Specific practices include: Secondary encryption of the DEK: Encrypting the DEK using the KEK to ensure that even if the DEK is leaked, the data cannot be directly decrypted; Multi-layer encryption: Encrypting the data multiple times during storage or transmission at different levels to increase the difficulty of cracking.

[0127] In this embodiment, access rights refer to the access control mechanism for keys and data, ensuring that only authorized users can access. Access rights can be set in the following ways: Role-based access control: Assigning access rights according to user roles, such as administrators, developers, ordinary users, etc.; Attribute-based access control: Dynamically determining access rights based on user attributes (such as department, position) and environmental conditions (such as time, location).

[0128] In this embodiment, the control process refers to the specifications and procedures for the management and use of keys, including: Key generation: Generating keys using a secure random number generator; Key storage: Storing the keys in an encrypted database to ensure the security of the keys; Key access control: Controlling who can access and use the keys through the set access rights; Key rotation: Regularly replacing keys to reduce risks; Auditing and monitoring: Recording the usage of keys for auditing and compliance checks.

[0129] The working principle and beneficial effects of the above technical solution are: Classifying keys through a hierarchical architecture, marking the usage levels and storing them in an encrypted database to ensure the security of the keys.

[0130] Performing secondary encryption on the stored keys to enhance the protection measures, setting different access rights according to the levels, achieving precise control of the keys, ensuring that only authorized users can access the corresponding keys, and improving the overall efficiency and consistency of key management.

[0131] Example 8:

[0132] An embodiment of the present invention provides a big data message encryption method that records the usage of all keys, determines the security of the keys, and updates the keys, including:

[0133] Record each usage of the key to generate a usage log, determine the security of the key based on the usage log, and set the first update policy for the key according to the security determination result;

[0134] Set the second update policy for the key according to the operation - side event and the receiving - side event;

[0135] Update the key by integrating the first update policy and the second update policy.

[0136] In this embodiment, the usage situation refers to all operations and events during the life cycle of the key, including but not limited to: key generation: record the creation time, generation method, and generator of the key; key access: record information such as the user, time, and operation type (such as reading, decrypting) for each access to the key; key usage: record the amount and type of data encrypted or decrypted using the key; key rotation: record the time, reason for key replacement, and relevant information of the new key; key destruction: record the time and method of key destruction.

[0137] In this embodiment, the usage log is a detailed record of the key usage situation, usually including the following content: timestamp: record the specific time of each operation; user information: the identity of the user performing the operation (such as username, role); operation type: the recorded operation type (such as generation, access, update, destruction); operation result: whether the operation is successful and any error information; relevant data: the specific data involved or the identifier of the key. The usage log helps to audit and track the usage of the key to ensure compliance and security.

[0138] In this embodiment, the first update policy is a key update policy formulated based on the security determination result, which may include: regular rotation: update the key regularly according to the usage frequency and security assessment result; immediate update in case of anomalies: if abnormal access or security risks are detected, update the key immediately; usage threshold: set a usage count or time threshold, and update the key after exceeding it.

[0139] In this embodiment, the second update policy is a key update policy set according to the operation - side event and the receiving - side event, which may include: updates triggered by events such as key access requests, system failures, etc.; receiving - side events: updates triggered by events such as data transfer completion, data reception success, abnormal termination, etc.; event association: determine whether to update the key according to a combination of specific events (such as after multiple failed access attempts).

[0140] In this embodiment, by combining the first update strategy and the second update strategy described above, a comprehensive key update mechanism can be formed. The specific steps may include: regular evaluation: regularly checking the usage logs and security determination results; event triggering: dynamically adjusting the frequency and method of key update according to the events of the operating end and the receiving end; implementing the update: implementing the key update according to the comprehensive strategy, including generating new keys, updating the storage and distribution mechanisms.

[0141] The working principle and beneficial effects of the above technical solution are as follows: By recording each usage of the key, a detailed usage log is generated to determine the security of the key. According to the determination result, the first update strategy is formulated, and the second update strategy is set in combination with the events of the operating end and the receiving end. By integrating these two strategies, the key is effectively updated to ensure the security and timeliness of the key.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for encrypting large data messages, characterized in that: include: Step 1: Conduct a comprehensive audit of existing data, classify the existing data based on the audit results, obtain classification results, analyze the potential impact of abnormalities in each classification result on the business process, and then determine the data sensitivity of the corresponding classification results; Step 2: Determine the specific use and purpose of each classification result, construct a category-purpose table, and design a hierarchical structure based on the category-purpose table and the data sensitivity; Step 3: Analyze the requirements of the hierarchical architecture, determine the different confidentiality requirements between each layer, formulate corresponding key management strategies based on the different confidentiality requirements, and generate keys according to the key management strategies to encrypt the transmission data; Step 4: Control the generated keys according to the hierarchical architecture, record the usage of all keys, determine the security of the keys, and update the keys; Perform a demand analysis on the hierarchical architecture to determine the different confidentiality requirements between each layer, formulate corresponding key management strategies based on the different confidentiality requirements, and generate keys according to the key management strategies to encrypt the transmission data, including: Determine the involved groups at each level in the hierarchical structure, and determine the first confidentiality requirement of each involved group according to the group requirement table; At the same time, the inter-layer confidentiality requirements of each layer are analyzed to obtain the second confidentiality requirements; Using the operation end event and the receiving end event as respective entropy sources for key generation, determining a cryptographic pseudo-random number generator based on the first confidentiality requirement, and formulating a key generation standard based on the second confidentiality requirement; Evaluate the initial entropy collected from the key generation entropy source according to the key generation standard to obtain an entropy evaluation result, and define the pseudo-random number generation frequency of the cryptographic pseudo-random number generator according to the entropy evaluation result; Match the key length corresponding to the second confidentiality requirement from the security requirement table, and determine the key generation method according to the message transmission between the operating end and the receiving end; A key management strategy is determined according to the pseudo-random number generation frequency, key length and key generation method, and a key is generated from a cryptographic pseudo-random number generator according to the key management strategy to encrypt the transmitted data.

2. A method for encrypting large data messages according to claim 1, characterized in that: Conduct a comprehensive audit of existing data, classify the existing data based on the audit results, and obtain classification results, including: Identify the data source and corresponding data type of the existing data according to the audit results; Preliminarily classify the existing data according to the data source and data type to obtain a preliminary classification result, record the data size of the corresponding existing data in each data source based on the preliminary classification result, and determine the data usage corresponding to each existing data according to the audit result; Based on the data scale and data usage, classification standards are formulated, the existing data are classified, and classification results are obtained.

3. A method for encrypting large data messages according to claim 2, characterized in that: Analyze the potential impact of abnormal classification results on business processes, and then determine the data sensitivity of the corresponding classification results, including: Identify data anomalies corresponding to classification results based on audit results; Collect the business processes corresponding to the classification results, and determine the data dependencies and data usage in the existing data based on the business processes; Draw a data flow diagram to determine the flow of each classification result in the business process, and determine the dependency between each business process and all classification results based on the flow, data dependency and data usage; Sorting the business processes by importance to obtain a process sorting result, and determining the dependency of the corresponding classification result based on the process sorting result and the dependency situation; Based on the dependency analysis of the classification results, the potential impact on the corresponding business process when data anomalies occur in the corresponding classification results is analyzed, and the data sensitivity standards of the corresponding classification results are formulated according to the potential impact, thereby deriving the data sensitivity of each classification result.

4. A method for encrypting large data messages according to claim 1, characterized in that: Determine the specific use and purpose of each classification result, build a category-purpose table, and design a hierarchical structure based on the category-purpose table and the data sensitivity, including: Analyze the specific uses of each classification result in different scenarios according to the business process, draft the corresponding use purpose for each classification result, and create a category-purpose table based on the specific uses and use purposes; Based on the category-purpose table and the data sensitivity of the corresponding classification results, a hierarchical architecture is designed.

5. A method for encrypting large data messages according to claim 1, characterized in that: The initial entropy collected from the key generation entropy source is evaluated according to the key generation standard to obtain an entropy evaluation result, and a pseudo-random number generation frequency of a cryptographic pseudo-random number generator is defined according to the entropy evaluation result, including: ,in, Indicates the entropy evaluation result; Represents random events in the entropy source for key generation Probability of occurrence; n Indicates the total number of events contained in the key generation entropy source; i Indicates the first entropy source in key generation i events; A quality function representing the entropy source for key generation; Indicates i The impact weight of each event; Represents random events in the entropy source for key generation Under certain conditions y The joint probability of the following occurrences; Represents random events in the entropy source for key generation Under certain conditions y The conditional probability of the following happening; ,in, f Indicates the frequency of pseudo-random number generation; k Indicates the frequency reference value adjustment factor; Indicates the degree of influence of adjusting load conditions on entropy; Indicates the degree of influence of adjusting the health status on entropy; S indicates the health status of the entropy source for key generation; L Indicates the load of the cryptographic pseudo-random number generator; Based on environmental factors E Determine the frequency influence function.

6. A method for encrypting large data messages according to claim 1, characterized in that: Controlling the generated keys according to the hierarchical architecture includes: Classify the keys according to the hierarchical structure, mark the usage level of each key, store the keys in an encrypted database, and perform secondary encryption on the stored keys; Set different levels of access permissions based on the hierarchical architecture to control keys.

7. A method for encrypting large data messages according to claim 6, characterized in that: Record the usage of all keys, determine the security of keys, and update keys, including: Record each use of the key, generate a use log, make a security determination on the key based on the use log, and set a first update strategy for the key according to the security determination result; A second update strategy for setting the key according to the operation end event and the receiving end event; The key is updated by combining the first update strategy and the second update strategy.

Images