Big data secure storage method and system

Abstract

The invention discloses a big data secure storage method and system, and belongs to the field of data processing, and the big data secure storage method comprises the following steps: judging the importance of different data of a data set, classifying the different data of the data set into data needing to be encrypted or data not needing to be encrypted; grading the data needing to be encrypted based on the importance degree of the data needing to be encrypted to obtain data of different sensitive levels; compared with the prior art, the method has the beneficial effects that the data is classified, and a large amount of conventional data is not encrypted, so that the calculation amount consumed by encryption and decryption is reduced; the data needing to be encrypted is graded, and different encryption algorithms are used based on different sensitive levels, so that the reliability of the data is ensured; when the user modifies the data, feedback information is pushed to the decision-making user, so that working conflicts or data coverage is avoided, and decision-making errors are reduced.

Description

Technical Field

[0001] The present invention belongs to the field of data processing, and in particular relates to a big data secure storage method and system. Background Art

[0002] Databases often store a large amount of sensitive information, such as financial data, business secrets, etc. Once this data is leaked, it will not only cause serious losses to the company, but may also lead to legal disputes and reputation crises. Through encryption technology, these sensitive data can be converted into an unreadable format that can only be decrypted and accessed by people with the correct key, effectively preventing data leakage and abuse.

[0003] Among enterprise data, there is a large amount of regular data, and its encryption and decryption consumes a lot of computing power, which needs to be improved. Summary of the invention

[0004] Based on this, it is necessary to provide a big data security storage method and system to address the above-mentioned problems.

[0005] The embodiment of the present invention is implemented as follows: a method for secure storage of big data, comprising the following steps:

[0006] Determine the importance of different data in the data set, and classify the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted;

[0007] Based on the importance of the data to be encrypted, the data to be encrypted is classified to obtain data of different sensitivity levels;

[0008] Data of different sensitivity levels are encrypted at different levels. Users with access permissions higher than the encryption level of the data can obtain and use the data.

[0009] In one embodiment, the present invention provides a method for secure storage of big data, which determines the importance of different data in a data set, classifies the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted, and specifically includes:

[0010] By analyzing the characteristics of sensitive information, a sensitive information feature library is extracted. Sensitive information includes identity information, financial data, R&D information, order information, and transaction records. The sensitive information feature library includes feature names and data types. The sensitive information feature library is extensible.

[0011] Intelligent algorithms are used to automatically identify sensitive information in data through a sensitive information feature library. Intelligent algorithms include machine learning and natural language processing (NLP). Data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

[0012] In one embodiment, the present invention provides a method for secure storage of big data, wherein the data to be encrypted is graded based on the importance of the data to be encrypted, and obtaining data of different sensitivity levels specifically includes:

[0013] Conduct business impact analysis, data value analysis, and privacy analysis on sensitive information, and classify sensitive information into different sensitivity levels;

[0014] Import the sensitivity level of sensitive information into the sensitive information feature library; use automated tools to verify the sensitive information feature library after the sensitivity level is imported to ensure that the classification results are correct;

[0015] According to the highest level of sensitive information in the data to be encrypted, the sensitivity level of the data to be encrypted is determined to obtain data of different sensitivity levels.

[0016] In one embodiment, the present invention provides a method for secure storage of big data, wherein different levels of encryption are performed on data of different sensitivity levels, and only users with a higher authority level than the encryption level of the data can obtain and use the data, specifically including:

[0017] Before data of different sensitivity levels are written into a database or storage medium, different encryption algorithms are used according to the sensitivity level of the data; encryption algorithms include high-level encryption algorithms (such as AES-256), medium-level encryption algorithms (such as AES-128), and low-level encryption algorithms (such as DES);

[0018] When a user needs to access data, it is decrypted according to the user's authority level and the data encryption level. Only users with authority levels higher than the data encryption level can decrypt and use the accessed data.

[0019] When a user modifies data, the modification must be approved by the decision-making user, and the modification record and original data must be saved. The decision-making user is a user with the same authority level or above.

[0020] In one embodiment, the present invention provides a method for secure storage of big data. When the user modifies the data, the modification can only be made after approval by the decision-making user, and the modification record and the original data are saved. After the decision-making user is a user of the same authority level or above, the method further includes:

[0021] When a decision-making user accesses data, the modification information is pushed to the decision-making user. The modification information is not limited to the decision-making users whose modification has been approved. The modification information includes the modified data, the data before the modification, the modification time, and the modifying user.

[0022] If the decision-making user does not access the data within the set time, feedback will be given to the decision-making user indicating that the data has been modified. The information does not include the data before or after the modification.

[0023] In one embodiment, the present invention provides a big data security storage system, the big data security storage system comprising:

[0024] A data classification module is used to determine the importance of different data in a data set and classify the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted;

[0025] A data classification module is used to classify the data to be encrypted based on the importance of the data to be encrypted, and obtain data of different sensitivity levels;

[0026] The encryption processing module is used to perform different levels of encryption on data of different sensitivity levels. Users with access permissions higher than the encryption level of the data can obtain and use the data.

[0027] In one embodiment, the present invention provides a big data security storage system, wherein the data classification module comprises:

[0028] The sensitive information feature library acquisition unit is used to extract the sensitive information feature library by analyzing the features of sensitive information. The sensitive information includes identity information, financial data, R&D information, order information, and transaction records. The sensitive information feature library includes feature names and data types. The sensitive information feature library is extensible.

[0029] The sensitive information automatic identification unit is used to automatically identify sensitive information in data through a sensitive information feature library using intelligent algorithms, and the intelligent algorithms include machine learning and natural language processing (NLP); data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

[0030] In one embodiment, the present invention provides a big data security storage system, wherein the data classification module includes:

[0031] Sensitive information classification unit, used to perform business impact analysis, data value analysis, and privacy analysis on sensitive information, and classify sensitive information into different sensitivity levels;

[0032] The sensitivity level import unit is used to import the sensitivity level of sensitive information into the sensitive information feature library; the sensitive information feature library after the sensitivity level is imported is verified by an automated tool to ensure that the classification result is correct;

[0033] The data sensitivity level judgment unit is used to judge the sensitivity level of the data to be encrypted according to the highest level of sensitive information in the data to be encrypted, and obtain data of different sensitivity levels.

[0034] In one embodiment, the present invention provides a big data security storage system, and the encryption processing module includes:

[0035] A data encryption unit is used to use different encryption algorithms according to the sensitivity level of data before writing data of different sensitivity levels into a database or storage medium; the encryption algorithms include high-level encryption algorithms (such as AES-256), medium-level encryption algorithms (such as AES-128), and low-level encryption algorithms (such as DES);

[0036] The user access unit is used to decrypt the data according to the user's authority level and the data encryption level when the user needs to access the data. Only users with authority levels higher than the data encryption level can decrypt and use the accessed data;

[0037] The data modification unit is used when users modify data. The modification can only be approved by the decision-making user, and the modification records and original data are saved. The decision-making user is a user with the same authority level or above.

[0038] In one embodiment, the present invention provides a big data security storage system, and the encryption processing module further includes:

[0039] The information push unit is used to push the modification information to the decision-making user when the decision-making user accesses the data. The modification information is not limited to the decision-making users whose modification has been approved. The modification information includes the modified data, the data before the modification, the modification time, and the modification user.

[0040] The information feedback unit is used to feedback information about the data modification behavior to the decision-making user if the decision-making user does not access the data within the set time. The information does not include the modified data or the data before the modification.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention classifies data, and a large amount of conventional data is not encrypted, thereby reducing the amount of computing consumed by encryption and decryption; for data that needs to be encrypted, it is graded and different encryption algorithms are used based on different sensitivity levels to ensure data reliability; when a user modifies the data, feedback information will be pushed to the decision-making user to avoid work conflicts or data overwriting and reduce decision-making errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A flowchart of a method for secure storage of big data provided by an embodiment of the present invention.

[0043] Figure 2 A schematic diagram of a flow chart for classifying data based on whether it needs to be encrypted is provided in an embodiment of the present invention.

[0044] Figure 3 A schematic diagram of a process for grading data based on encryption levels provided in an embodiment of the present invention.

[0045] Figure 4 A schematic diagram of the data encryption and user access process provided by an embodiment of the present invention.

[0046] Figure 5 A schematic diagram of the process of information push feedback provided by an embodiment of the present invention.

[0047] Figure 6 A schematic diagram of a big data security storage system provided in an embodiment of the present invention.

[0048] Figure 7 A schematic diagram of a data classification module provided in an embodiment of the present invention.

[0049] Figure 8 A schematic diagram of a data classification module provided in an embodiment of the present invention.

[0050] Fig. 9 A schematic diagram of the first part of the encryption processing module provided in an embodiment of the present invention.

[0051] Fig.10 A schematic diagram of the second part of the encryption processing module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0053] In one embodiment, Figure 1 As shown, a big data security storage method (applied to a big data security storage system) comprises the following steps:

[0054] Step S1, determining the importance of different data in a data set, and classifying the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted;

[0055] Step S2, based on the importance of the data to be encrypted, classify the data to be encrypted to obtain data of different sensitivity levels;

[0056] Step S3, encrypting data of different sensitivity levels at different levels, and only users with a higher authority level than the encryption level of the data can obtain and use the data.

[0057] In enterprise data, there are both data that need to be encrypted and data that do not need to be encrypted. Data that do not need to be encrypted include public information, such as basic information such as company name, address, and contact number; publicly released financial reports, press releases, product information, etc.; content on official websites, such as product introductions, company culture, and service descriptions. Data that need to be encrypted include customer identity information, company financial data, company R&D information, company order information, and company consumer transaction records. By judging whether there is sensitive information in the data, it is determined whether the data needs to be encrypted or not, thereby reducing the amount of computing consumed by encryption and decryption. For data that needs to be encrypted, it is classified. The classification is based on sensitive information. Business impact analysis, data value analysis, and privacy analysis are performed on sensitive information, and sensitive information is divided into different sensitivity levels; and different encryption algorithms are selected based on different sensitivity levels to ensure data reliability, while reducing the amount of computing consumed by encryption and decryption of low-sensitivity levels, and different levels of encryption are performed on data of different sensitivity levels.

[0058] In one embodiment, Figure 2 As shown, the step S1, determining the importance of different data in the data set, classifying the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted, specifically includes:

[0059] Step S11, by analyzing the characteristics of sensitive information, extracting a sensitive information feature library, the sensitive information includes identity information, financial data, R&D information, order information, and transaction records; the sensitive information feature library includes feature names and data types; the sensitive information feature library is extensible;

[0060] Step S12, using an intelligent algorithm to automatically identify sensitive information of the data through a sensitive information feature library, the intelligent algorithm includes machine learning and natural language processing (NLP); data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

[0061] Collect samples of text, pictures, videos, etc. containing sensitive information from company databases and internal systems, conduct detailed analysis on the collected samples, and identify the sensitive information features therein, including keywords, phrases, named entities, image features, audio features, etc.

[0062] Frequently occurring sensitive keywords and phrases are extracted from text samples, which are often important clues for identifying sensitive information. For image samples, image recognition algorithms are used to extract key features in the image, such as color, texture, shape, etc. These features help identify sensitive content such as confidential images. For voice samples, acoustic models and language models are used to extract sensitive words and expressions in the voice.

[0063] Based on the extracted sensitive information features, the structure of the sensitive information feature library is designed, including feature name, feature type, feature value, feature weight, etc. The extracted sensitive information features are stored in the feature library for subsequent sensitive information identification and detection. With the emergence of new sensitive information types, the feature library needs to be continuously updated to maintain its accuracy and completeness.

[0064] Intelligent algorithms are used to build a sensitive information feature library to identify sensitive information in new text, images, videos and other data.

[0065] In one embodiment, Figure 3 As shown, the step S2, based on the importance of the data to be encrypted, classifies the data to be encrypted, and obtains data of different sensitivity levels, specifically including:

[0066] Step S21, performing business impact analysis, data value analysis, and privacy analysis on sensitive information, and classifying the sensitive information into different sensitivity levels;

[0067] Step S22, importing the sensitivity level of the sensitive information into the sensitive information feature library; verifying the sensitive information feature library after the sensitivity level is imported by an automated tool to ensure that the classification result is correct;

[0068] Step S23, judging the sensitivity level of the data to be encrypted according to the highest level of sensitive information in the data to be encrypted, and obtaining data of different sensitivity levels.

[0069] Conduct business impact analysis, identify sensitive information in business processes, sort out business processes, identify sensitive information involved in each link, analyze the importance of this information to business processes, and the possible business impact after leakage, and evaluate the business risks that may be caused by leakage, such as financial losses, legal risks and reputation losses, based on the nature and importance of sensitive information.

[0070] Conduct data value analysis to determine the value of data, analyze the role of sensitive information in supporting business operations and decision-making, and determine its intrinsic value. Evaluate the market value of data, consider the potential value of sensitive information in the market, and the negative impact that may be caused by competitors or malicious users obtaining it.

[0071] Conduct privacy analysis, identify privacy risks, and analyze the potential damage to personal privacy caused by the leakage of sensitive information, such as identity theft, fraud, etc. Evaluate privacy protection needs and, based on the severity of privacy risks, assess the necessity and urgency of privacy protection for sensitive information.

[0072] Classify sensitivity levels and develop sensitivity level classification standards. Based on the results of business impact analysis, data value analysis, and privacy analysis, develop sensitivity level classification standards. Sensitive information can usually be classified into different levels such as internal, confidential, and highly confidential. According to the classification standards, the identified sensitive information is classified and marked with the corresponding sensitivity level.

[0073] In one embodiment, Figure 4 As shown, the step S3, encrypting data of different sensitivity levels at different levels, and the accessing user can only obtain and use the data if the permission level is higher than the encryption level of the data, specifically includes:

[0074] Step S31, before writing data of different sensitivity levels into a database or storage medium, using different encryption algorithms according to the sensitivity level of the data; the encryption algorithms include high-level encryption algorithms (such as AES-256), medium-level encryption algorithms (such as AES-128), and low-level encryption algorithms (such as DES);

[0075] Step S32: when a user needs to access data, the data is decrypted according to the user's authority level and the data encryption level. Only users with authority levels higher than the data encryption level can decrypt and use the accessed data.

[0076] Step S33, when the user modifies the data, the modification is subject to approval by the decision-making user, and the modification record and the original data are saved. The decision-making user is a user with the same authority level or above.

[0077] Different levels such as internal, confidential and highly confidential correspond to low-level encryption algorithms (such as DES), medium-level encryption algorithms (such as AES-128), and high-level encryption algorithms (such as AES-256). The sensitivity level of the current data is identified through the sensitive information feature library to determine whether it is internal, confidential or highly confidential, and different encryption algorithms are selected to encrypt the data.

[0078] In one embodiment, Figure 5 As shown, in step S33, when a user modifies data, the modification can only be made after approval by the decision-making user, and the modification record and the original data are saved. After the decision-making user is a user with the same authority level or above, the following steps are also included:

[0079] Step S34, when the decision-making user accesses the data, the modification information is pushed to the decision-making user, not limited to the decision-making users whose modification is approved, and the modification information includes the modified data, the data before the modification, the modification time, and the modifying user;

[0080] Step S35: If the decision-making user does not access the data within the set time, information indicating that there is a data modification behavior is fed back to the decision-making user. The information does not include the modified data or the data before the modification.

[0081] After the data is modified, if the decision-making user fails to access the data within the set time, the decision-making user will be notified of the data modification based on his / her personal information through SMS, phone call, etc., without involving the specific modified data, so as to avoid data leakage.

[0082] In one embodiment, Figure 6 As shown, a big data security storage system includes:

[0083] A data classification module 1 is used to determine the importance of different data in a data set and classify the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted;

[0084] Data classification module 2, used to classify the data to be encrypted based on the importance of the data to be encrypted, and obtain data of different sensitivity levels;

[0085] The encryption processing module 3 is used to perform different levels of encryption on data of different sensitivity levels. Only users with permission levels higher than the encryption level of the data can obtain and use the data.

[0086] The user's permission level should be updated in a timely manner to avoid the situation where the user's permission level is reduced and the user can still access highly sensitive data, which may lead to data leakage risks; after the user's permission level is increased, the user cannot access highly sensitive data, which is not conducive to work.

[0087] In one embodiment, Figure 7 As shown, the data classification module 1 includes:

[0088] The sensitive information feature library acquisition unit 11 is used to extract the sensitive information feature library by analyzing the features of the sensitive information. The sensitive information includes identity information, financial data, research and development information, order information, and transaction records. The sensitive information feature library includes feature names and data types. The sensitive information feature library is extensible.

[0089] The sensitive information automatic identification unit 12 is used to automatically identify the sensitive information of the data through the sensitive information feature library using an intelligent algorithm, the intelligent algorithm includes machine learning and natural language processing (NLP); data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

[0090] The intelligent algorithm can be one of machine learning and natural language processing (NLP), or a combination of machine learning and natural language processing.

[0091] In one embodiment, Figure 8 As shown, the data classification module 2 includes:

[0092] A sensitive information classification unit 21 is used to perform business impact analysis, data value analysis, and privacy analysis on sensitive information, and classify sensitive information into different sensitivity levels;

[0093] The sensitivity level importing unit 22 is used to import the sensitivity level of sensitive information into the sensitive information feature library; verify the sensitive information feature library after the sensitivity level is imported through an automated tool to ensure that the classification result is correct;

[0094] The data sensitivity level determination unit 23 is used to determine the sensitivity level of the data to be encrypted according to the highest level of sensitive information in the data to be encrypted, and obtain data of different sensitivity levels.

[0095] As business develops and laws and regulations change, the identification rules and strategies for sensitive information should be updated in a timely manner. New sensitive data types should be promptly identified and classified to ensure the pertinence and effectiveness of protection measures.

[0096] In one embodiment, Fig. 9 As shown, the encryption processing module 3 includes:

[0097] The data encryption unit 31 is used to use different encryption algorithms according to the sensitivity level of the data before writing the data of different sensitivity levels into the database or storage medium; the encryption algorithms include high-level encryption algorithms (such as AES-256), medium-level encryption algorithms (such as AES-128), and low-level encryption algorithms (such as DES);

[0098] The user access unit 32 is used to decrypt the data according to the user's authority level and the encryption level of the data when the user needs to access the data. Only users with an authority level higher than the encryption level of the data can decrypt and use the accessed data;

[0099] The data modification unit 33 is used for the user to modify the data. The modification can only be approved by the decision-making user when the user modifies the data. The modification record and the original data are saved. The decision-making user is a user with the same authority level or above.

[0100] When users modify data, they need to obtain approval from multiple decision-making users before the modification can be made. For example, if A needs to modify data, the approval of multiple people, such as B, C, and D, is required before the data can be modified. This increases the procedurality of data modification and prevents employees from maliciously damaging the company's interests.

[0101] In one embodiment, Fig.10 As shown, the encryption processing module 3 also includes:

[0102] The information push unit 34 is used to push the modification information to the decision-making user when the decision-making user accesses the data. The modification information is not limited to the decision-making user whose modification is approved. The modification information includes the modified data, the data before the modification, the modification time, and the modification user.

[0103] The information feedback unit 35 is used to feedback information of data modification behavior to the decision-making user if the decision-making user does not access the data within the set time. The information does not include the modified data or the data before the modification.

[0104] When multiple users rely on the same data, any modification of the data may affect the decisions and operations of these users or systems. Timely notifications can ensure that all relevant parties are aware of the latest data status, thereby avoiding making wrong decisions based on outdated or erroneous data.

[0105] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0107] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0108] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0109] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0110] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A method for secure storage of big data, characterized in that: The big data security storage method comprises the following steps: Determine the importance of different data in the data set, and classify the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted; Based on the importance of the data to be encrypted, the data to be encrypted is classified to obtain data of different sensitivity levels; Data of different sensitivity levels are encrypted at different levels. Users with access permissions higher than the encryption level of the data can obtain and use the data.

2. The method for secure storage of big data according to claim 1, characterized in that: The step of determining the importance of different data in the data set and classifying the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted specifically includes: By analyzing the characteristics of sensitive information, a sensitive information feature library is extracted. Sensitive information includes identity information, financial data, R&D information, order information, and transaction records. The sensitive information feature library includes feature names and data types. The sensitive information feature library is extensible. Intelligent algorithms are used to automatically identify sensitive information in data through a sensitive information feature library. Intelligent algorithms include machine learning and natural language processing. Data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

3. The big data security storage method according to claim 1, characterized in that: The data to be encrypted is classified based on the importance of the data to be encrypted to obtain data of different sensitivity levels, specifically including: Conduct business impact analysis, data value analysis, and privacy analysis on sensitive information, and classify sensitive information into different sensitivity levels; Import the sensitivity level of sensitive information into the sensitive information feature library; use automated tools to verify the sensitive information feature library after the sensitivity level is imported to ensure that the classification results are correct; According to the highest level of sensitive information in the data to be encrypted, the sensitivity level of the data to be encrypted is determined to obtain data of different sensitivity levels.

4. The big data security storage method according to any one of claims 1 to 3, characterized in that: The step of encrypting data of different sensitivity levels at different levels, and allowing accessing users with a higher authority level than the encryption level of the data to obtain and use the data, specifically includes: Before data of different sensitivity levels are written into a database or storage medium, different encryption algorithms are used according to the sensitivity level of the data; the encryption algorithms include high-level encryption algorithms, medium-level encryption algorithms, and low-level encryption algorithms; When a user needs to access data, it is decrypted according to the user's authority level and the data encryption level. Only users with authority levels higher than the data encryption level can decrypt and use the accessed data. When a user modifies data, the modification must be approved by the decision-making user, and the modification record and original data must be saved. The decision-making user is a user with the same authority level or above.

5. The method for secure storage of big data according to claim 4, characterized in that: When the user modifies data, the modification must be approved by the decision-making user, and the modification record and original data must be saved. After the decision-making user is a user with the same authority level or above, the following steps are also included: When a decision-making user accesses data, the modification information is pushed to the decision-making user. The modification information is not limited to the decision-making users whose modification has been approved. The modification information includes the modified data, the data before the modification, the modification time, and the modifying user. If the decision-making user does not access the data within the set time, feedback will be given to the decision-making user indicating that the data has been modified. The information does not include the data before or after the modification.

6. A big data security storage system, characterized in that: The big data security storage system comprises: A data classification module is used to determine the importance of different data in a data set and classify the different data in the data set into data that needs to be encrypted or data that does not need to be encrypted; A data classification module is used to classify the data to be encrypted based on the importance of the data to be encrypted, and obtain data of different sensitivity levels; The encryption processing module is used to perform different levels of encryption on data of different sensitivity levels. Users with access permissions higher than the encryption level of the data can obtain and use the data.

7. The big data security storage system according to claim 6, characterized in that: The data classification module includes: The sensitive information feature library acquisition unit is used to extract the sensitive information feature library by analyzing the features of sensitive information. The sensitive information includes identity information, financial data, R&D information, order information, and transaction records. The sensitive information feature library includes feature names and data types. The sensitive information feature library is extensible. The sensitive information automatic identification unit is used to automatically identify the sensitive information of the data through the sensitive information feature library using intelligent algorithms. The intelligent algorithms include machine learning and natural language processing. Data with sensitive information is data that needs to be encrypted, and data without sensitive information is data that does not need to be encrypted.

8. The big data security storage system according to claim 6, characterized in that: The data classification module includes: Sensitive information classification unit, used to perform business impact analysis, data value analysis, and privacy analysis on sensitive information, and classify sensitive information into different sensitivity levels; The sensitivity level import unit is used to import the sensitivity level of sensitive information into the sensitive information feature library; the sensitive information feature library after the sensitivity level is imported is verified by an automated tool to ensure that the classification result is correct; The data sensitivity level judgment unit is used to judge the sensitivity level of the data to be encrypted according to the highest level of sensitive information in the data to be encrypted, and obtain data of different sensitivity levels.

9. The big data security storage system according to any one of claims 6 to 8, characterized in that: The encryption processing module includes: A data encryption unit is used to use different encryption algorithms according to the sensitivity level of data before writing data of different sensitivity levels into a database or storage medium; the encryption algorithms include high-level encryption algorithms, medium-level encryption algorithms, and low-level encryption algorithms; The user access unit is used to decrypt the data according to the user's authority level and the data encryption level when the user needs to access the data. Only users with authority levels higher than the data encryption level can decrypt and use the accessed data; The data modification unit is used when users modify data. The modification can only be approved by the decision-making user, and the modification records and original data are saved. The decision-making user is a user with the same authority level or above.

10. The big data security storage system according to claim 9, characterized in that: The encryption processing module also includes: The information push unit is used to push the modification information to the decision-making user when the decision-making user accesses the data. The modification information is not limited to the decision-making users whose modification has been approved. The modification information includes the modified data, the data before the modification, the modification time, and the modification user. The information feedback unit is used to feedback information about the data modification behavior to the decision-making user if the decision-making user does not access the data within the set time. The information does not include the modified data or the data before the modification.

Images