Data security transmission method and system based on multi-factor authentication

Abstract

The invention discloses a data security transmission method and system based on multi-factor authentication, and relates to the technical field of data security transmission, and the method comprises the steps: obtaining an authentication factor matrix, and constructing a zero-trust authentication condition in a minimum authority scene; multi-level authentication conditions are determined through coupling relaxation processing of multi-factor authentication, and a self-adjusting authentication module is constructed; receiving a data transmission task, determining a transmission scene from an information source to an information sink, performing security level segmentation, and determining a micro-segmentation channel; and aimed at the micro-segment channel, assisting the self-adjusting authentication module to carry out dynamic authentication triggering and secure transmission authentication along with transmission. According to the invention, the technical problems of data leakage, tampering and transmission interruption caused by insufficient data transmission security protection in the prior art are solved, and the technical effects of realizing efficient security protection based on multi-factor authentication in the data transmission process and guaranteeing the confidentiality, integrity and availability of data transmission are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of secure data transmission, and in particular to a method and system for secure data transmission based on multi-factor authentication. Background Art

[0002] Existing data transmission technologies face many severe challenges. On the one hand, traditional authentication methods mostly rely on a single factor, such as a simple username and password combination, which is easily cracked in the face of increasingly complex network attacks, resulting in the inability to ensure the confidentiality of data transmission and frequent leakage of sensitive information. On the other hand, during the transmission process, there is a lack of effective mechanisms to ensure the integrity of data, and malicious attackers have the opportunity to tamper with the data in transit, causing data errors and business confusion.

[0003] The existing technology has technical problems such as insufficient security protection for data transmission, which can easily lead to data leakage, tampering and transmission interruption. Summary of the invention

[0004] The present application provides a data security transmission method and system based on multi-factor authentication, which is used to solve the technical problems in the prior art of insufficient data transmission security protection, which easily leads to data leakage, tampering and transmission interruption.

[0005] In view of the above problems, the present application provides a data security transmission method and system based on multi-factor authentication.

[0006] In a first aspect of the present application, a data security transmission method based on multi-factor authentication is provided, the method comprising:

[0007] Obtain an authentication factor matrix, and construct a zero-trust authentication condition in a minimum authority scenario based on the authentication factor matrix; take the zero-trust authentication condition as a baseline, determine the multi-level authentication condition by coupling relaxation processing of multi-factor authentication, and combine the zero-trust authentication condition with the multi-level authentication condition to construct a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in a server; receive a data transmission task, determine a transmission scenario from a source to a destination, perform security level segmentation, and determine a micro-segmentation channel, wherein data desensitization is used as a transmission pre-processing; for the micro-segmentation channel, assist the self-adjusting authentication module to perform dynamic authentication triggering and secure transmission authentication along with transmission.

[0008] A second aspect of the present application provides a data security transmission system based on multi-factor authentication, the system comprising:

[0009] A zero-trust authentication condition construction module is used to obtain an authentication factor matrix, and based on the authentication factor matrix, construct a zero-trust authentication condition in a minimum authority scenario; a multi-level authentication condition determination module is used to determine the multi-level authentication condition based on the zero-trust authentication condition as a baseline and the coupling relaxation processing of multi-factor authentication, and to combine the zero-trust authentication condition with the multi-level authentication condition to construct a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in a server; a micro-segment channel determination module is used to receive data transmission tasks, determine the transmission scenario from the source to the destination, perform security level segmentation, and determine a micro-segment channel, wherein data desensitization is used as a transmission pre-processing; a secure transmission authentication module is used to assist the self-adjusting authentication module in performing dynamic authentication triggering and secure transmission authentication with transmission for the micro-segment channel.

[0010] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0011] Obtain the authentication factor matrix, and construct the zero-trust authentication conditions in the minimum authority scenario based on the authentication factor matrix; take the zero-trust authentication conditions as the baseline, and use the coupling relaxation processing of multi-factor authentication to determine the multi-level authentication conditions, and combine the zero-trust authentication conditions with the multi-level authentication conditions to construct a self-adjusting authentication module; receive data transmission tasks, determine the transmission scenario from the source to the destination, perform security level segmentation, and determine the micro-segmented channel; for the micro-segmented channel, assist the self-adjusting authentication module to perform dynamic authentication triggering and secure transmission authentication with transmission. The technical effect of realizing efficient security protection based on multi-factor authentication during data transmission and ensuring the confidentiality, integrity and availability of data transmission is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A schematic diagram of a method for secure data transmission based on multi-factor authentication provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of the structure of a data security transmission system based on multi-factor authentication provided in an embodiment of the present application.

[0015] Explanation of the reference numerals: zero-trust authentication condition building module 10, multi-level authentication condition determination module 20, micro-segmentation channel determination module 30, secure transmission authentication module 40. DETAILED DESCRIPTION

[0016] The present application provides a data security transmission method and system based on multi-factor authentication, which is used to solve the technical problems in the prior art that data transmission security protection is insufficient, which easily leads to data leakage, tampering and transmission interruption.

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] Embodiment 1, as Figure 1 As shown, the present application provides a data security transmission method based on multi-factor authentication, the method comprising:

[0019] Step S100: Obtain an authentication factor matrix, and construct zero-trust authentication conditions in a minimum authority scenario based on the authentication factor matrix.

[0020] Specifically, various authentication-related information is widely collected through various channels. This information covers multiple dimensions such as user identity information, device characteristics, and network environment, and then integrated to form an authentication factor matrix. This matrix comprehensively and meticulously records the key elements used for identity authentication and authority judgment. On this basis, zero-trust authentication conditions are built around the least-privilege scenario. The least-privilege scenario follows the principle of least privilege, that is, any user or device is only granted the minimum privilege required to complete the task before strict authentication. Zero-trust authentication conditions are based on this scenario, setting strict verification standards for each authentication factor and abandoning traditional trust assumptions. For example, for user passwords, not only is the password strength required to meet certain standards, but it also needs to be verified in combination with other authentication factors such as fingerprint recognition or SMS verification codes; for devices, the integrity of the device and whether there are security vulnerabilities will be checked. Only when all authentication factors meet the corresponding strict conditions will the access request be deemed to have passed the authentication, thus laying a solid foundation for subsequent security operations.

[0021] Step S200: Taking the zero-trust authentication condition as a baseline, determining the multi-level authentication condition by coupling relaxation processing of multi-factor authentication, combining the zero-trust authentication condition with the multi-level authentication condition, and constructing a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in the server.

[0022] Specifically, the previously constructed zero-trust authentication conditions are used as the basic framework, and the coupling relaxation of multi-factor authentication is carried out to determine the multi-level authentication conditions and build a self-adjusting authentication module. First, the zero-trust authentication conditions are used as a strict baseline standard, which represents the authentication rules under the most stringent security requirements. Then, the multi-factor authentication is coupled and relaxed according to various factors in the actual application scenario. This process involves adjusting the association and dependency between different authentication factors, and determining multi-level authentication conditions that are suitable for different risk levels and business needs by reasonably relaxing or tightening the combination of certain authentication conditions. For example, in low-risk and simple-operation business scenarios, the verification strength of some authentication factors can be appropriately reduced; when it comes to important data or high-risk operations, the authentication requirements are maintained or even increased. Then, the zero-trust authentication conditions are organically combined with these multi-level authentication conditions to jointly build a self-adjusting authentication module. This module has the ability to intelligently adjust the authentication strategy. It can automatically select appropriate authentication conditions for verification based on real-time access requests, current security risk assessments, and system preset rules. Finally, this self-adjusting authentication module is installed in the server in an embedded manner, making it a part of the server's security protection system. This ensures that when the server processes various data access and transmission requests, it can perform authentication flexibly and accurately based on actual conditions, effectively protecting data security and system stability.

[0023] Step S300: receiving a data transmission task, determining a transmission scenario from a source to a destination, performing security level segmentation, and determining a micro-segment channel, wherein data desensitization is used as a pre-transmission processing.

[0024] Specifically, after receiving the data transmission task, the transmission scenario from the source to the destination is determined based on the metadata, network environment information, source and destination device attributes carried by the task, combined with the Bayesian network algorithm. The Bayesian network comprehensively evaluates the security risk status of the current transmission scenario by analyzing the probabilistic dependency relationship between various factors. Subsequently, the security level is segmented, and the analytic hierarchy process (AHP) is used to construct a judgment matrix and calculate the weight of each indicator based on the sensitivity, importance, and frequency of use of the data as evaluation indicators to determine the security level of the data, such as high, medium, and low. In the pre-processing stage of data desensitization, for structured data that contains personal sensitive information such as name and ID number, a rule-based replacement algorithm is used, such as using a hash function to perform irreversible hashing on the name and replacing the date of birth part of the ID number with fixed characters; for numerical sensitive data, such as financial data, a differential privacy algorithm is used to add noise that conforms to the Laplace distribution to perturb the original data, while ensuring data availability and protecting data privacy. For unstructured data, such as text contracts, we use named entity recognition technology in natural language processing to identify sensitive entities, and then use regular expressions to replace them with universal placeholders. Finally, we determine the micro-segmented channels. We use the Dijkstra algorithm, with the security level, bandwidth, and latency of network nodes as weights. Based on the security level segmentation results, we find multiple optimal paths from the source to the destination that meet different security requirements, and subdivide these paths into micro-segmented channels to ensure that data can be transmitted on a secure and efficient path.

[0025] Step S400: for the micro-segmented channel, assisting the self-adjusting authentication module to perform dynamic authentication triggering and secure transmission authentication along with transmission.

[0026] Specifically, a series of key operations are carried out for the determined micro-segmented channels to ensure the security of data transmission. When data is ready to be transmitted in the micro-segmented channels, it works closely with the self-adjusting authentication module. First, each segment starting point of the micro-segmented channel is used as a key monitoring node. Once the data transmission reaches these nodes, the dynamic authentication process is immediately triggered. In this process, various information related to this transmission is collected in real time, such as the type and size of the transmitted data, the current network environment status, and the status of the device initiating the transmission. The self-adjusting authentication module will automatically adjust the authentication strategy based on this real-time information and the zero-trust authentication conditions and multi-level authentication conditions built previously. For example, if there is a certain risk in the current network environment, the self-adjusting authentication module will increase the authentication requirements and add additional authentication factors, such as requiring users to enter dynamic verification codes or perform fingerprint recognition. Subsequently, the self-adjusting authentication module strictly authenticates the data transmission according to the adjusted authentication strategy. Only data transmission requests that have fully passed the authentication are allowed to continue to be transmitted in the micro-segmented channel. If the authentication fails, the transmission is immediately terminated and a security alarm is issued, thereby ensuring the security and integrity of the data during the entire micro-segmented channel transmission process.

[0027] In a possible implementation, step S200 further includes:

[0028] Step S210: Building a permission space according to the minimum permission scenario, wherein the minimum permission scenario defines the boundary of the permission space.

[0029] Step S220: Interacting with data communication records, performing permission scenario segmentation and multi-factor authentication coupling relaxation processing on the permission space, and determining the multi-level authentication conditions.

[0030] Specifically, building a permission space based on the least privilege scenario is an important basic link. The least privilege scenario follows the least privilege principle and stipulates the minimum set of permissions that users or devices can obtain under specific circumstances. These permissions are essential to completing specific tasks, and also strictly define the boundaries of the permission space. Take the various authentication factors in the authentication factor matrix as a reference to determine the axis of the permission space. For example, if the authentication factors include user identity, device type, operation time, etc., these factors correspond to different axes of the permission space. For the least privilege scenario, clarify the single-factor authentication conditions of each authentication factor under zero-trust authentication conditions, such as password strength requirements for user identity, compliance requirements for device types, and the allowable range of operation time. Finally, these spatial axes and single-factor authentication conditions are combined to construct a permission space, which provides a basic framework for the subsequent determination of multi-level authentication conditions.

[0031] Through interactive data communication records, the established permission space is deeply analyzed and processed. The data communication records contain rich information, reflecting the use of permissions in different scenarios. Based on these records, the permission space is segmented by permission scenarios. This process divides the permission space into multiple different subspaces, each of which corresponds to a specific permission scenario, such as daily office permission scenarios, emergency affairs processing permission scenarios, etc. At the same time, the coupling relaxation of multi-factor authentication is carried out. This means that the strictness of multi-factor authentication is adjusted according to the characteristics of different permission scenarios. In some low-risk permission scenarios, the authentication conditions are appropriately relaxed to reduce the verification requirements of some authentication factors; while in high-risk scenarios, the authentication requirements are maintained or even strengthened. Through the coordinated operation of this permission scenario segmentation and coupling relaxation processing, the multi-level authentication conditions that adapt to different scenarios are accurately determined. These conditions provide a rich strategy selection for the subsequent construction of the self-adjusting authentication module, which helps to improve the flexibility and security of authentication.

[0032] In a possible implementation, step S220 further includes:

[0033] Step S221: clustering the data communication records according to preset scene differences to determine N groups of communication records, where N is a positive integer greater than or equal to 1.

[0034] Step S222: traverse the N groups of communication records to determine N transmission scenario features.

[0035] Step S223: Divide the permission space into blocks according to the N transmission scenario features to determine N permission space blocks.

[0036] Step S224: configuring the multi-level authentication conditions for the N permission space blocks, wherein the multi-level authentication conditions correspond one-to-one to the N permission space blocks.

[0037] Specifically, when performing permission scenario analysis and determining multi-level authentication conditions, refer to the pre-set scenario difference. This difference is set based on the in-depth analysis of historical communication data, security policies, and summaries of past security incidents. It represents a quantitative indicator for distinguishing different communication scenarios. Then, it is applied to the processing of data communication records, and a clustering algorithm is used to process a large number of data communication records. The clustering algorithm calculates the similarity between records based on various attributes in the data communication records, such as communication time, communication equipment, communication service type, data traffic size, etc. If the similarity between records exceeds the range specified by the preset scenario difference, they are grouped together. The data communication records are divided into N groups of communication records, where N is a positive integer greater than or equal to 1.

[0038] Go through these N groups of communication records one by one. During the traversal process, for each group of communication records, deeply explore and extract the corresponding transmission scenario features. These features cover multiple aspects such as the initiation time of the communication, the initiating device, the data transmission volume, the communication frequency, and the business type involved in the communication. By analyzing these features, the uniqueness of the transmission scenario represented by each group of communication records can be accurately grasped, and then N transmission scenario features can be determined.

[0039] Based on the determined N transmission scenario characteristics, the previously constructed permission space is divided into blocks. The transmission scenario characteristics reflect the different requirements for permissions in different scenarios. Based on these differences, the permission space is divided into N different parts, that is, N permission space blocks are determined. For example, if it is found that some transmission scenarios mainly involve reading operations of ordinary office documents, then the corresponding permission space blocks mainly contain permissions for office document-related operations; and for transmission scenarios involving financial data processing, the corresponding permission space blocks will focus on permissions related to financial data.

[0040] For these N permission space blocks, corresponding multi-level authentication conditions are configured respectively. Since different permission space blocks represent different permission scenarios, the security risks they face and the required authentication strengths are also different. Therefore, multi-level authentication conditions that match them are tailored for each permission space block to ensure that these multi-level authentication conditions correspond to the N permission space blocks one by one. For example, for permission space blocks involving highly sensitive data, more stringent authentication conditions will be configured, requiring users to not only provide passwords, but also perform fingerprint recognition and dynamic verification code verification, etc.; while for permission space blocks for general operations, the authentication conditions are relatively loose, and only password verification is required. Through such detailed configuration, the authentication process can better adapt to different permission scenarios and improve security and flexibility.

[0041] In a possible implementation, step S210 further includes:

[0042] Step S211: Determine the spatial axis using each authentication factor in the authentication factor matrix.

[0043] Step S212: For the minimum privilege scenario, determine the single-factor authentication conditions of each authentication factor under the zero-trust authentication condition.

[0044] Step S213: construct the permission space according to the spatial axis and the single-factor authentication condition.

[0045] Specifically, the spatial axis is determined based on each authentication factor in the authentication factor matrix. The authentication factor matrix covers a variety of key elements for identity authentication and permission judgment, such as user identity information (such as user name, password), device characteristics (such as device model, device fingerprint), geographic location information, and time information. These different types of authentication factors correspond to different spatial axes, and each axis represents a dimension that affects permissions. For example, using user identity information as an axis means that the potential differences in permissions for different user identities can be measured on this dimension; using device characteristics as an axis can be used to distinguish the differences in permissions for different devices.

[0046] For the least privilege scenario, determine the single-factor authentication conditions for each authentication factor under the zero-trust authentication condition. The least privilege scenario follows the principle of least privilege. In this scenario, any access request is only granted the minimum privilege required to complete the task before strict authentication. Based on this scenario, the zero-trust authentication condition sets strict verification standards for each authentication factor. Taking the user identity information authentication factor as an example, the user name must comply with specific naming specifications, and the password must reach a certain strength, such as containing letters, numbers, and special characters, and the length must be no less than 8 characters; for device features, the device must be installed with a specific version of security software, and the device system update must be the latest status. By formulating such specific single-factor authentication conditions for each authentication factor, the security of access requests is ensured in the least privilege scenario.

[0047] According to the previously determined spatial axes and single-factor authentication conditions, a permission space is constructed. Each spatial axis is combined according to the authentication factor dimension it represents, and the value range of each axis is limited by the corresponding single-factor authentication condition. For example, in the permission space constructed with user identity, device characteristics, geographic location and time as axes, the value range of the user identity axis is determined by the set of users that meet the username and password requirements, the value range of the device characteristics axis is determined by the set of devices that meet the security software and system update requirements, the value range of the geographic location axis is set according to the geographic location allowed to access, and the time axis is determined according to the time period allowed to access. In this way, through the cross-combination of each axis and its value range, a multi-dimensional permission space is constructed, which clarifies the permission boundaries under different authentication factor combinations, and provides an important basic framework for subsequent permission management and authentication condition determination.

[0048] In a possible implementation, step S224 further includes:

[0049] Step S2241: Identify a first authority space block, where the first authority space block is a multidimensional space block covering the authentication factor matrix.

[0050] Step S2242: determining coupling relaxation based on the distance between each block boundary of the first authority space block and the authority space boundary of the corresponding authentication factor, wherein the coupling relaxation is positively correlated with the distance.

[0051] Step S2243: According to the coupling relaxation, the zero-trust authentication condition is adjusted to determine the first authentication condition.

[0052] Specifically, a first permission space block is identified from the divided permission space blocks. This first permission space block is a multidimensional space block covering the authentication factor matrix, which means that it integrates the dimensions formed by multiple authentication factors and covers multiple permission combinations under different authentication factors. For example, in a system that includes authentication factors such as user identity, device type, and operation time, the first permission space block includes permissions under different user identities, different device types, and different operation time combinations.

[0053] The coupling relaxation is determined by calculating the distance between the boundaries of each block of the first permission space block and the boundary of the permission space of the corresponding authentication factor. For each authentication factor dimension, the distance between the boundary of the first permission space block on this dimension and the boundary of the authentication factor in the entire permission space is measured. Assuming that in the dimension of user identity authentication factor, there is a certain difference between the user identity range allowed by the first permission space block and the user identity range covered by the entire permission space, the distance corresponding to this difference is one of the bases for calculating the coupling relaxation. In addition, it is stipulated here that the coupling relaxation is positively correlated with the distance, that is, the larger the distance, the higher the coupling relaxation; the smaller the distance, the lower the coupling relaxation. This is because a larger distance means that the difference between the permission range of the permission space block on this authentication factor and the overall permission space is large, and the corresponding authentication conditions can be appropriately relaxed, that is, the coupling relaxation is higher.

[0054] The zero-trust authentication conditions are adjusted according to the determined coupling relaxation, and then the first authentication conditions are determined. If the coupling relaxation is high, it means that the scope of authority of the first permission space block on certain authentication factors is relatively loose, so the requirements of the corresponding authentication factors in the zero-trust authentication conditions are appropriately relaxed. For example, if the coupling relaxation of the first permission space block is high in the dimension of the authentication factor of device type, the zero-trust authentication conditions originally require that the device must be of a specific brand and install a specific version of security software. At this time, it can be relaxed to allow some other brands of devices or lower the security software version requirements; conversely, if the coupling relaxation is low, the zero-trust authentication conditions are maintained or even strengthened. After such adjustments, the first authentication condition suitable for the first permission space block is finally determined to ensure that the authentication conditions match the actual needs of the permission space block and improve the rationality and security of the authentication.

[0055] In a possible implementation, step S300 further includes:

[0056] Step S310: According to the data transmission task, determine the transmission data, and identify the sensitive data part and the non-sensitive data part.

[0057] Step S320: Introduce data desensitization rules, wherein byte substitution-row shift-column confusion-round key addition is used as a desensitization method, and the data desensitization rules are determined according to the desensitization level setting under at least one desensitization method according to the data sensitivity characteristics.

[0058] Step S330: Identify the sensitive data portion, initialize the data desensitization rule by performing sensitive feature identification, perform desensitization processing on the sensitive data portion, and determine the desensitized data.

[0059] Step S340: Merge the desensitized data and the non-sensitive data portion as pre-transmission data.

[0060] Specifically, when a data transmission task is received, a comprehensive analysis of the data involved in the task is immediately performed. First, it is clear what data is included in this transmission task, covering data content in different forms such as various files, database records, and real-time messages. Then, the sensitive and non-sensitive data parts are distinguished with the help of pre-set sensitive data identification strategies. These strategies are formulated based on multiple factors such as the type, format, and context of the data. For example, based on the common sensitive data type library, data in specific formats such as ID card numbers, bank card numbers, and commercial secrets can be identified as sensitive data; judging from the context of the data, if personal contact information appears in documents related to user privacy, it will also be identified as sensitive data. For some public information, such as common industry terms, common basic statistical data, etc., they are classified as non-sensitive data. Through this meticulous identification method, the sensitive and non-sensitive parts of the transmitted data can be accurately divided.

[0061] Data desensitization rules are introduced. Here, byte substitution, row shift, column obfuscation, and round key addition are used as desensitization methods. According to the sensitive characteristics of the data, such as data type, data purpose, possible risk level, etc., the corresponding desensitization level is set under at least one desensitization method, and then the specific data desensitization rules are determined. For example, for highly sensitive bank card number data, byte substitution and round key addition are used, and a higher desensitization level is set to ensure full protection of the data; while for relatively less sensitive phone numbers, perhaps only row shift is used, and a lower desensitization level is set.

[0062] After the sensitive data in the transmitted data has been identified, the characteristics of these sensitive data are analyzed in depth. By scanning and parsing the structure, content mode and possible identification information of the data, such as determining whether the data is in the format of an ID card number, whether it contains specific sensitive words, etc., sensitive features can be accurately extracted. These sensitive features are used to initialize pre-set data desensitization rules. Data desensitization rules are formulated based on different sensitive features and security requirements, covering a variety of desensitization methods and different desensitization levels. After completing the rule initialization, the sensitive data part is desensitized according to the established rules. This process involves byte substitution, replacing bytes in the data with other values; row shifting, changing the order of data in the storage structure; column obfuscation, disrupting the organization of data columns; round key addition, encrypting the data with a specific key, and other operations. After these processing steps, the original form of the sensitive data is changed to generate desensitized data, which effectively reduces the risk of sensitive data in the transmission process and ensures data security.

[0063] The desensitized data that has been desensitized is merged with the previously identified non-sensitive data, and the merged data is used as the pre-transmission data. In this way, the pre-transmission data not only ensures the availability of the data, but also reduces the security risks of the data during transmission by desensitizing the sensitive data, laying the foundation for the subsequent secure data transmission.

[0064] In a possible implementation, step S300 further includes:

[0065] Step S350: Decompose the transmission scenario into a hardware scenario and a channel scenario.

[0066] Step S360: According to the hardware scenario, a segmentation based on the hardware scenario transition is performed to determine a first micro-segment channel.

[0067] Step S370: According to the channel scenario, perform secondary segmentation based on channel scenario transition to determine a second micro-segment channel.

[0068] Step S380: Merge the first micro-segment channel and the second micro-segment channel to determine the micro-segment channel.

[0069] Specifically, the overall scenario of data transmission is analyzed and disassembled into two main parts: hardware scenario and channel scenario. The hardware scenario mainly covers various hardware devices involved in data transmission, including source devices, sink devices, and various network devices involved in the transmission path. The performance, security, and connection relationship between these hardware devices constitute the hardware scenario. The channel scenario focuses on the communication channel on which data transmission depends, including the type of channel (such as wired channel, wireless channel), channel bandwidth, latency, stability, and security threats faced by the channel.

[0070] A segmentation based on the transition of hardware scenarios is performed according to the characteristics of the hardware scenarios. This means that the data transmission path is initially divided at the hardware level according to factors such as the changes in hardware devices, the differences in security levels of different hardware devices, and the connection relationship between them. For example, if there are servers with different security levels or different types of terminal devices in the transmission path, the transmission path is divided into different segments based on these differences. Each segment corresponds to a relatively independent hardware environment, thereby determining the first micro-segment channel. This division helps to implement security measures in a targeted manner based on the security requirements of different hardware environments.

[0071] During the data transmission process, in order to ensure data security and achieve more refined transmission path management, secondary segmentation based on channel scenario transition is carried out to determine the second micro-segment channel. First, comprehensive information about the transmission channel from the source to the destination is obtained, including the technical parameters of the channel, the current load status, etc. At the same time, the historical transmission records of the transmission channel are called, and the information confrontation points are mined with the help of data analysis technology. These information confrontation points not only identify the confrontation type, such as network attack, signal interference or data tampering, but also clarify the confrontation level, from low risk to high risk, so as to quantify the degree of security threat faced by the channel. Next, the preset confrontation transition amount is used as the key constraint condition, which is a value set in advance based on the system security strategy and the expected assessment of channel risks. According to the mined information confrontation points and the preset confrontation transition amount, the transmission channel is reasonably divided. For example, near the area where there is a high confrontation level information confrontation point, it is segmented according to the interval distance specified by the preset confrontation transition amount, so that the area with a higher degree of threat is separated from other parts to form a relatively independent channel segment. In this way, the entire transmission channel is divided into multiple segments, which are the second micro-segment channel. This secondary segmentation based on channel scene transition can target the parts of the channel with potential security risks and build a more reliable path system for secure data transmission.

[0072] The first micro-segment channel is merged with the second micro-segment channel. By comprehensively considering the segmentation results of the hardware scenario and the channel scenario, the micro-segment channels at the two levels are integrated, and finally a micro-segment channel that meets the data security transmission requirements is determined. This fused micro-segment channel not only takes into account the differences and security requirements of hardware devices, but also combines the security status of the channel itself, providing more reliable protection for the security and stability of data during transmission.

[0073] In a possible implementation, step S370 further includes:

[0074] Step S371: Acquire the transmission channel from the information source to the information sink.

[0075] Step S372: calling the historical transmission records of the transmission channel to mine information confrontation points, wherein each information confrontation point is marked with a confrontation type and a confrontation level.

[0076] Step S373: According to the information confrontation point, a secondary segmentation based on channel scene transition is performed with a preset confrontation transition amount as a constraint.

[0077] Specifically, the transmission channel from the source to the destination is obtained. This operation involves comprehensive scanning and identification of data transmission links to clarify the physical or logical channels that the data actually passes through in the network environment. Whether it is optical fiber and cable lines in wired networks or specific frequency band channels in wireless networks, they are all included in the acquisition scope of the system to ensure that the acquired transmission channel information is complete and accurate.

[0078] The historical transmission records of the transmission channel are called. These historical records contain various detailed information about the channel during the past data transmission process, such as transmission time, transmission data volume, transmission interruption, etc. By using data mining algorithms, these records are deeply analyzed to mine information confrontation points. Information confrontation points refer to key nodes that interfere with the normal transmission of various types of data and affect transmission security during the transmission process, and each information confrontation point is accurately identified with the confrontation type and confrontation level. Confrontation types include network attacks (such as malicious intrusions by hackers, DDoS attacks), signal interference (such as electromagnetic interference causing signal attenuation or loss), data tampering (illegal modification of data content in transmission), etc.; confrontation levels are divided according to factors such as the severity of interference and frequency of occurrence. For example, a low level may indicate occasional minor interference, while a high level means frequent and serious security threats.

[0079] Based on the previously mined information confrontation points, the preset confrontation transition amount is used as the key constraint condition to carry out the secondary segmentation work based on the channel scenario transition. Each information confrontation point is deeply analyzed to consider its confrontation type (such as malware attack, signal interference or illegal data interception, etc.) and confrontation level (from low-risk occasional minor interference to high-risk frequent serious threat). The preset confrontation transition amount is a quantitative standard set in advance based on the system security strategy, past channel risk assessment and expectations for transmission stability. When facing an information confrontation point, the transmission channel is divided with the point as the center and the interval distance specified by the preset confrontation transition amount. For information confrontation points with high confrontation levels, because they pose a greater threat to data transmission, they are segmented according to a relatively small preset confrontation transition amount around them, so as to isolate the channel area under severe threat and form a separate channel segment; while for information confrontation points with low confrontation levels, because their risks are relatively low, the segmentation interval will be appropriately increased according to the preset confrontation transition amount. Through such operations, the transmission channel is divided into multiple parts with different security characteristics, which are the second micro-segmented channels, providing more refined and reliable channel planning for subsequent data security transmission.

[0080] In a possible implementation, step S400 further includes:

[0081] Step S410: Taking the segment start of the micro-segment channel as a dynamic transmission authentication node, assisting the self-adjusting authentication module to trigger the permission scenario authentication of the micro-segment channel, and generating an authentication pop-up window based on the authentication factor matrix.

[0082] Specifically, each segment starting point of the micro-segment channel is set as a dynamic transmission authentication node. When data transmission arrives at these nodes, the permission scenario authentication process is immediately started, and the self-adjusting authentication module works closely with the self-adjusting authentication module. The self-adjusting authentication module will comprehensively consider the various authentication factors involved in the current transmission data based on the authentication factor matrix. These factors cover multiple dimensions such as user identity, device information, transmission time, and data type. Based on these factors, an authentication pop-up window based on the authentication factor matrix is ​​generated. For example, if the current transmission data involves highly sensitive information, the authentication pop-up window may require the user to enter an additional dynamic verification code and perform fingerprint recognition to strengthen the authentication process; if the transmission environment is in a high-risk public network, the pop-up window may require the device to re-scan the security and upload the scan report. The generation of this authentication pop-up window is intended to ensure that at each key transmission node of the micro-segment channel, the authentication process can be triggered flexibly and accurately based on the real-time transmission scenario and authentication factors, to fully protect the security of data transmission and prevent unauthorized data access and transmission.

[0083] Embodiment 2 is based on the same inventive concept as the data security transmission method based on multi-factor authentication in the above embodiment. Figure 2 As shown, the present application provides a data security transmission system based on multi-factor authentication, and the system and method embodiments in the present application embodiments are based on the same inventive concept. The system includes:

[0084] The zero-trust authentication condition construction module 10 is used to obtain an authentication factor matrix and construct a zero-trust authentication condition in a minimum authority scenario based on the authentication factor matrix.

[0085] The multi-level authentication condition determination module 20 is used to determine the multi-level authentication condition based on the zero-trust authentication condition as a baseline and the coupling relaxation processing of multi-factor authentication, and to combine the zero-trust authentication condition with the multi-level authentication condition to construct a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in the server.

[0086] The micro-segment channel determination module 30 is used to receive data transmission tasks, determine the transmission scenario from the source to the destination, perform security level segmentation, and determine the micro-segment channel, wherein data desensitization is used as a pre-transmission processing.

[0087] The secure transmission authentication module 40 is used to assist the self-adjusting authentication module in performing dynamic authentication triggering and secure transmission authentication along with transmission for the micro-segmented channel.

[0088] Furthermore, the system is also used to implement the following functions:

[0089] According to the minimum permission scenario, a permission space is constructed, wherein the minimum permission scenario defines the boundary of the permission space; interactive data communication records are used to perform permission scenario segmentation and multi-factor authentication coupling relaxation processing on the permission space to determine the multi-level authentication conditions.

[0090] Furthermore, the system is also used to implement the following functions:

[0091] According to the preset scenario differences, the data communication records are clustered to determine N groups of communication records, wherein N is a positive integer greater than or equal to 1; the N groups of communication records are traversed to determine N transmission scenario features; according to the N transmission scenario features, the permission space is divided into blocks to determine N permission space blocks; for the N permission space blocks, the multi-level authentication conditions are configured, wherein the multi-level authentication conditions correspond one-to-one to the N permission space blocks.

[0092] Furthermore, the system is also used to implement the following functions:

[0093] Determine the spatial axis with each authentication factor in the authentication factor matrix; determine the single-factor authentication condition of each authentication factor under the zero-trust authentication condition for the minimum authority scenario; construct the permission space according to the spatial axis and the single-factor authentication condition.

[0094] Furthermore, the system is also used to implement the following functions:

[0095] Identify a first permission space block, where the first permission space block is a multidimensional space block covering the authentication factor matrix; determine the coupling relaxation based on the distance between each block boundary of the first permission space block and the permission space boundary of the corresponding authentication factor, wherein the coupling relaxation is positively correlated with the distance; adjust the zero-trust authentication condition according to the coupling relaxation to determine the first authentication condition.

[0096] Furthermore, the system is also used to implement the following functions:

[0097] According to the data transmission task, the transmission data is determined, and the sensitive data part and the non-sensitive data part are identified; data desensitization rules are introduced, wherein byte substitution-row shift-column confusion-round key addition is used as the desensitization method, and according to the data sensitive characteristics, the data desensitization rules are determined by setting the desensitization level under at least one desensitization method; the sensitive data part is identified, and the data desensitization rules are initialized by performing sensitive feature identification, and the sensitive data part is desensitized to determine the desensitized data; the desensitized data and the non-sensitive data part are merged as pre-transmission data.

[0098] Furthermore, the system is also used to implement the following functions:

[0099] According to the hardware scenario, a first segmentation based on the hardware scenario transition is performed to determine the first micro-segment channel; according to the channel scenario, a second segmentation based on the channel scenario transition is performed to determine the second micro-segment channel; the first micro-segment channel and the second micro-segment channel are merged to determine the micro-segment channel.

[0100] Furthermore, the system is also used to implement the following functions:

[0101] Acquire a transmission channel from a signal source to a signal destination; call the historical transmission record of the transmission channel to mine information confrontation points, wherein each information confrontation point is marked with a confrontation type and a confrontation level; and perform secondary segmentation based on channel scenario transition according to the information confrontation point and with a preset confrontation transition amount as a constraint.

[0102] Furthermore, the system is also used to implement the following functions:

[0103] The segment start of the micro-segment channel is used as a dynamic transmission authentication node to assist the self-adjusting authentication module in triggering the permission scenario authentication of the micro-segment channel and generate an authentication pop-up window based on the authentication factor matrix.

[0104] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0106] This specification and the drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A data security transmission method based on multi-factor authentication, characterized in that: The method comprises: Obtain an authentication factor matrix, and construct zero-trust authentication conditions in a minimum privilege scenario based on the authentication factor matrix; Taking the zero-trust authentication condition as a baseline, determining a multi-level authentication condition by coupling relaxation processing of multi-factor authentication, combining the zero-trust authentication condition with the multi-level authentication condition, and constructing a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in a server; Receive data transmission tasks, determine the transmission scenario from the source to the destination, perform security level segmentation, and determine micro-segment channels, among which data desensitization is used as a pre-transmission processing; For the micro-segmented channel, the self-adjusting authentication module is assisted to perform dynamic authentication triggering and secure transmission authentication along with transmission.

2. The data security transmission method based on multi-factor authentication as claimed in claim 1, characterized in that: The multi-factor authentication coupling relaxation process is used to determine the multi-level authentication conditions, including: According to the minimum permission scenario, a permission space is constructed, wherein the minimum permission scenario defines the boundary of the permission space; Interacting data communication records, performing permission scenario segmentation and multi-factor authentication coupling relaxation processing on the permission space, and determining the multi-level authentication conditions.

3. The data security transmission method based on multi-factor authentication as claimed in claim 2, characterized in that: Determining the multi-level authentication conditions includes: Clustering the data communication records according to the preset scenario difference to determine N groups of communication records, where N is a positive integer greater than or equal to 1; Traversing the N groups of communication records to determine N transmission scenario features; Divide the permission space into blocks according to the N transmission scenario features to determine N permission space blocks; For the N permission space blocks, the multi-level authentication conditions are configured, wherein the multi-level authentication conditions correspond one-to-one to the N permission space blocks.

4. The data security transmission method based on multi-factor authentication as claimed in claim 2, characterized in that: According to the minimum permission scenario, build a permission space, including: Determine a spatial axis using each authentication factor in the authentication factor matrix; For the minimum privilege scenario, determine the single-factor authentication conditions of each authentication factor under the zero-trust authentication condition; The permission space is constructed according to the spatial axis and the single-factor authentication condition.

5. The data security transmission method based on multi-factor authentication as claimed in claim 3, characterized in that: For the N permission space blocks, configuring the multi-level authentication conditions includes: identifying a first authority space block, the first authority space block being a multidimensional space block covering the authentication factor matrix; Determine coupling relaxation according to the distance between each block boundary of the first authority space block and the authority space boundary of the corresponding authentication factor, wherein the coupling relaxation is positively correlated with the distance; According to the coupling relaxation, the zero-trust authentication condition is adjusted to determine a first authentication condition.

6. The data security transmission method based on multi-factor authentication as claimed in claim 1, characterized in that: Data desensitization is used as a pre-transmission processing, including: According to the data transmission task, determine the transmission data, and identify the sensitive data part and the non-sensitive data part; Introducing data desensitization rules, wherein byte substitution-row shift-column confusion-round key addition is used as a desensitization method, and according to the data sensitivity characteristics, the data desensitization rules are determined by setting a desensitization level under at least one desensitization method; Identify the sensitive data portion, initialize the data desensitization rule by performing sensitive feature identification, perform desensitization processing on the sensitive data portion, and determine the desensitized data; The desensitized data and the non-sensitive data portion are merged as pre-transmission data.

7. The data security transmission method based on multi-factor authentication as claimed in claim 1, characterized in that: Decomposing the transmission scenario into a hardware scenario and a channel scenario; According to the hardware scenario, a segmentation based on the hardware scenario transition is performed to determine the first micro-segment channel; According to the channel scenario, perform secondary segmentation based on channel scenario transition to determine a second micro-segment channel; The first micro-segment channel and the second micro-segment channel are merged to determine the micro-segment channel.

8. The data security transmission method based on multi-factor authentication as claimed in claim 7, characterized in that: According to the channel scenario, secondary segmentation based on channel scenario transition is performed, including: Obtaining a transmission channel from a signal source to a signal sink; Calling the historical transmission records of the transmission channel to mine information confrontation points, wherein each information confrontation point is marked with a confrontation type and a confrontation level; According to the information confrontation point, a secondary segmentation based on channel scene transition is performed with a preset confrontation transition amount as a constraint.

9. The data security transmission method based on multi-factor authentication as claimed in claim 1, characterized in that: The segment start of the micro-segment channel is used as a dynamic transmission authentication node to assist the self-adjusting authentication module in triggering the permission scenario authentication of the micro-segment channel and generate an authentication pop-up window based on the authentication factor matrix.

10. A data security transmission system based on multi-factor authentication, characterized in that: The system is used to implement the data security transmission method based on multi-factor authentication according to any one of claims 1 to 9, and the system includes: A zero-trust authentication condition construction module is used to obtain an authentication factor matrix and construct a zero-trust authentication condition in a minimum authority scenario based on the authentication factor matrix; A multi-level authentication condition determination module, used to determine the multi-level authentication condition based on the zero-trust authentication condition as a baseline and the coupling relaxation process of multi-factor authentication, and to combine the zero-trust authentication condition with the multi-level authentication condition to construct a self-adjusting authentication module, wherein the self-adjusting authentication module is embedded in the server; The micro-segment channel determination module is used to receive data transmission tasks, determine the transmission scenario from the source to the destination, perform security level segmentation, and determine the micro-segment channel, wherein data desensitization is used as a pre-transmission processing; The secure transmission authentication module is used to assist the self-adjusting authentication module in performing dynamic authentication triggering and secure transmission authentication along with transmission for the micro-segmented channel.

Images