An Adaptive Key Lifecycle Management Method and System Based on Dynamic Data

Abstract

This invention discloses an adaptive key lifecycle management method and system based on dynamic data, relating to the field of data security technology. The method includes acquiring data storage information, classifying the stored data according to the data storage information, acquiring data classification information, and acquiring a data sensitivity coefficient based on the data classification information. This invention improves key generation efficiency through data classification information, accurately matches key strength through a data confidentiality requirement index, changes the traditional single-key mode, avoids over- or under-encryption, flexibly determines key fragmentation transmission strategies based on user login anomalies and target data confidentiality requirements to prevent unauthorized acquisition, and promptly interrupts, adjusts, or regenerates keys through a key transmission risk index to effectively respond to network attacks, ensures end-to-end transmission security, and greatly improves the adaptability and security of key management, meeting the needs of complex and ever-changing network environments and diverse business scenarios.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to an adaptive key lifecycle management method and system based on dynamic data. Background Technology

[0002] With the rapid development of information technology, data informatization has become the mainstream of current social development. However, this has also led to increasingly prominent information security issues, drawing widespread attention. Digital security hinders the rapid development of informatization, and cryptography is currently widely recognized as an effective solution to information security problems. Mobile smart terminals have become essential devices in people's daily lives and work, handling various user information and data, making them a major source of data security issues. Applying cryptographic technology and products to smart terminals will better protect terminal services and user data security. Key security management is the fundamental support for the application of cryptographic technology and the basis for ensuring the security of cryptographic algorithms. Key leakage poses a fatal threat to the entire information system. Therefore, how to manage keys securely is a key focus for technical personnel, and the key lifecycle is a crucial step, directly affecting key confidentiality.

[0003] Currently, adaptive key lifecycle management still relies on static rules such as preset key expiration times and fixed update cycles. While these methods are simple and easy to use, they often fail to effectively address changes in data traffic, attack threats, and the risk of key leakage in complex and dynamic network environments. They cannot set keys specifically according to the stored data conditions, and during key transmission, they often simply select a fixed key transmission method, failing to dynamically adjust based on the login status of accessing users or the data access status of the key lifecycle. Summary of the Invention

[0004] To address the aforementioned technical problems, this paper provides an adaptive key lifecycle management method and system based on dynamic data. This technical solution solves the problems mentioned in the background technology that rely on static rules such as preset key expiration time and fixed update cycle. Although these methods are simple and easy to use, they are often unable to effectively cope with changes in data traffic, attack threats, and the risk of key leakage in complex and dynamic network environments. They cannot set keys according to the specific status of stored data, and during key transmission, they often simply select the key transmission method according to a fixed procedure, failing to dynamically adjust according to the login status of accessing users or the data access status of the key lifecycle.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] An adaptive key lifecycle management method based on dynamic data includes:

[0007] Obtain data storage information, which includes data attribute information and data format information;

[0008] Based on the data storage information, the stored data is classified to obtain data classification information;

[0009] Based on data classification information, a data sensitivity coefficient is obtained, which represents the degree of impact of data leakage;

[0010] Based on the data format information and data risk analysis, different data format risk coefficients are set for different data formats.

[0011] Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index;

[0012] Based on the data confidentiality requirement index and the key strength setting, key generation information is obtained, which includes key length information and key encryption algorithm information.

[0013] Obtain access user information, which includes access user account information and access user login information;

[0014] Based on the access user information, obtain the access user login anomaly index;

[0015] Obtain the target access data information of the accessing user;

[0016] Based on the abnormal login index of the accessing user, the target access data information, and the key generation information, obtain the key transmission information;

[0017] Acquire key transmission data, which includes transmission status data and network attack data during transmission;

[0018] Based on the key transmission data, obtain the key transmission risk index;

[0019] Based on the key transmission risk index, it is determined whether key transmission should be interrupted. If so, the key is destroyed and a new key is generated. If not, the key lifecycle is adjusted according to the key transmission risk index.

[0020] Preferably, the step of classifying the stored data according to the data storage information and obtaining data classification information specifically includes:

[0021] Based on data storage information and data traceability, data is divided into public data and non-public data. Public data refers to data that can be obtained through any public channel.

[0022] Obtain the timestamp information of non-public data based on non-public data;

[0023] Based on the timestamp information of the non-public data, the non-public data is arranged in order from oldest to most recent time to obtain the non-public data order information;

[0024] Based on the non-public data order information, data interval information is obtained, whereby the data interval information represents the time interval between adjacent non-public data in the non-public data order.

[0025] The maximum value in the data interval information is taken as the first data interval, and the minimum value in the data interval information is taken as the second data interval.

[0026] Based on the first data interval and the second data interval, obtain the data time window information;

[0027] Two adjacent non-public data points in the first data interval are designated as the first non-public data and the second non-public data.

[0028] Two adjacent non-public data points in the second data interval are designated as the third and fourth non-public data points.

[0029] Based on the first, second, third, and fourth non-public data, obtain the initial data for the time window;

[0030] Among them, if Then the third non-public data will be used as the initial data for the time window. Then the fourth non-public data will be used as the initial data for the time window;

[0031] Based on the initial data of the time window, and using the data time window as a benchmark, the non-public data is divided into several time period data sets to obtain data classification information;

[0032] The data time window is specifically:

[0033] ;

[0034] In the formula, T represents the data time window. For the first data interval, This is the second data time interval.

[0035] Preferably, obtaining the data sensitivity coefficient based on data classification information specifically includes:

[0036] Based on data classification information, obtain non-public datasets;

[0037] The data attribute information in the data storage information is used as the data topology criteria to obtain data topology criteria information. The data topology criteria include personal data, commercial data, industrial data and medical data.

[0038] Based on data topology principles, establish a data topology relationship diagram for the non-public data in each non-public dataset;

[0039] Based on the data topology diagram, obtain the data sensitivity coefficient for each non-public data item;

[0040] The formula for calculating the data sensitivity coefficient is as follows:

[0041] ;

[0042] In the formula, Let x be the data sensitivity coefficient of the x-th non-public data. This represents the total number of non-public data adjacent to the x-th non-public data topology under the i-th data topology criterion. This represents the total number of non-public data points connected by the topological relationships to which the x-th non-public data point belongs under the i-th data topology criterion. This represents the total number of data in the non-public dataset to which the x-th non-public data belongs, and n is the total number of data topology criteria.

[0043] Preferably, the step of obtaining key generation information based on the data confidentiality requirement index and key strength settings specifically includes:

[0044] Based on the data format information, obtain the data format type information;

[0045] Based on data risk analysis, data formats are classified into three types: structured data formats, semi-structured data formats, and unstructured data formats, and data format classification information is obtained.

[0046] Based on the data format classification information, different weights are assigned to different data formats in different categories;

[0047] Based on the set weights, obtain the data format risk coefficient corresponding to each data format;

[0048] Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index for each data;

[0049] The data sensitivity coefficient of the publicly available data is 1.

[0050] Based on the data confidentiality requirement index, obtain the maximum and average values ​​of the data confidentiality requirement index;

[0051] The ratio of the mean to the maximum value of the data confidentiality requirement index is used as the key strength coefficient.

[0052] Based on key generation analysis, the maximum key strength and the corresponding key lifespan are obtained;

[0053] The product of the maximum key strength and the key strength coefficient is used as the generated key strength, and the product of the key lifetime and the key strength coefficient is used as the generated key lifetime to obtain key generation information;

[0054] The data confidentiality requirement index is specifically as follows:

[0055] ;

[0056] In the formula, This represents the data confidentiality requirement index for the y-th data point. Let be the data sensitivity coefficient for the y-th data point. Let y be the data format risk coefficient. This represents the data format weight of the y-th data point. This represents the total number of data format categories to which the data format of the y-th data belongs. This represents the data format weight of the s-th data format category. This represents the total number of data format types for the s-th data format category, where s=1 indicates a structured data format. If s=2, it indicates a semi-structured data format. If s=2, it indicates an unstructured data format. .

[0057] Preferably, the step of obtaining key transmission information based on the access user login anomaly index, target access data information, and key generation information specifically includes:

[0058] Retrieve the user's historical login information;

[0059] Based on the user's login time in the access user's historical login information, obtain the user's regular login time period;

[0060] Based on the accessing user information, the accessing user's historical login information, and the user's regular login time period, obtain the accessing user login anomaly index;

[0061] Based on the target access data information of the accessing user, obtain the data confidentiality requirement index of the target access data;

[0062] Based on the abnormal login index of the accessing user and the data confidentiality requirement index of the target access data, obtain the number of key transmission fragments;

[0063] Obtain the key strength coefficient;

[0064] The product of the number of key transmission fragments and the key strength coefficient is used as the number of key reconstruction fragments;

[0065] Based on the number of key transmission fragments and the number of key reconstruction fragments, the generated key is transmitted in fragments to obtain key transmission information;

[0066] The formula for calculating the abnormal login index of the accessing user is as follows:

[0067] ;

[0068] In the formula, R represents the abnormal login index of the accessing user. This refers to the number of times a user logs into their account within a given time period. This function represents an exception for user access time, where the user's login time... If it falls within the user's regular login time period, then If the user's login time If it does not fall within the user's regular login time period, then , Indicates the time of user login Recent user login time periods For a unit of time, and ;

[0069] The specific number of key transmission fragments is as follows:

[0070] ;

[0071] In the formula, D is the number of key transmission fragments. This represents the data confidentiality requirement index for the j-th target data. Let y represent the data confidentiality requirement index for the y-th data, m be the total number of data to be accessed, and g be the total number of data to be stored.

[0072] Preferably, the step of determining whether to interrupt key transmission based on the key transmission risk index specifically includes:

[0073] Acquire routine status data, which includes CPU normal operation data and memory normal operation data;

[0074] Based on data classification information, obtain non-public datasets;

[0075] Based on a non-public dataset, obtain the distribution of the target access data in the non-public dataset;

[0076] Use the non-public dataset to which the target access data belongs as the feature dataset;

[0077] Based on the target access data and feature dataset, obtain the access data sensitivity coefficient;

[0078] The key transmission risk index is obtained based on the sensitivity coefficients of key transmission data, regular status data, and access data.

[0079] Based on the key transmission risk index, determine whether key transmission should be interrupted. If so, use the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If not, update the key lifecycle based on the key transmission risk index.

[0080] Among them, if the key transmission risk index If the key transmission risk index is high, then the key transmission will be interrupted. Then the key lifecycle will be adjusted to If the key transmission risk index Then the key lifecycle will be adjusted to ,in, For the key lifecycle, To generate the key lifecycle;

[0081] The formula for calculating the key transmission risk index is as follows:

[0082] ;

[0083] In the formula, G is the key transmission risk index. This represents the z-th transmission status data. This represents the standard value of the z-th transmission status data. This represents the total number of target access data in the c-th feature dataset. Let m represent the total number of data points in the c-th feature dataset, m be the total number of data points accessed, and M represent the feature dataset. represents the maximum value, and w represents the total number of types of transmission status data.

[0084] Furthermore, an adaptive key lifecycle management system based on dynamic data is proposed to implement the management method described above, including:

[0085] The main control module is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria, take the product of the maximum key strength and the key strength coefficient as the generated key strength, take the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission based on the key transmission risk index. If yes, take the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If no, update the key lifespan based on the key transmission risk index.

[0086] The information acquisition module is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information; based on non-public data, it acquires non-public data timestamp information; it acquires the target access data information of the access user, key transmission data, transmission status data and network attack data during transmission; and based on data format information, it acquires data format type information.

[0087] The evaluation module is used to obtain the data sensitivity coefficient of each non-public data according to the data topology relationship diagram, obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient, obtain the login anomaly index of the accessing user according to the accessing user information, the accessing user's historical login information and the user's regular login time period, obtain the access data sensitivity coefficient according to the target access data and the feature dataset, and obtain the key transmission risk index according to the key transmission data, regular status data and access data sensitivity coefficient.

[0088] The display module interacts with the main control module and is used to output and display data classification information, data confidentiality requirement index, key generation information, key transmission information, and key transmission risk index.

[0089] Optionally, the main control module specifically includes:

[0090] The control unit is used to take the product of the maximum key strength and the key strength coefficient as the generated key strength, and the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission according to the key transmission risk index. If so, the product of the key transmission risk index and the key strength coefficient is used as the new key strength coefficient, and the key is regenerated. If not, the key lifespan is updated according to the key transmission risk index.

[0091] An information receiving unit, which interacts with the information acquisition module and the evaluation module, is used to receive data and transmit it to the data processing unit.

[0092] The data processing unit is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, and establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria.

[0093] Optionally, the information acquisition module specifically includes:

[0094] The first acquisition unit is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information, and acquire non-public data timestamp information based on non-public data.

[0095] The second acquisition unit is used to acquire the target access data information, key transmission data, transmission status data and network attack data during transmission of the accessing user, and acquire the data format type information according to the data format information.

[0096] Optionally, the evaluation module specifically includes:

[0097] The data evaluation unit is used to obtain the data sensitivity coefficient of each non-public data according to the data topology relationship diagram, and to obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient.

[0098] An access evaluation unit is used to obtain an abnormal login index of the accessing user based on the accessing user information, the accessing user's historical login information, and the user's regular login time period.

[0099] The key transmission evaluation unit is used to obtain an access data sensitivity coefficient based on the target access data and the feature dataset, and to obtain a key transmission risk index based on the key transmission data, regular status data and the access data sensitivity coefficient.

[0100] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0101] This invention proposes an adaptive key lifecycle management method and system based on dynamic data. By classifying data information, it improves key generation efficiency. By using a data confidentiality requirement index, it accurately matches key strength, changing the traditional single-key mode and avoiding over- or under-encryption. It flexibly determines key fragmentation transmission strategies based on user login anomalies and target data confidentiality requirements to prevent unauthorized acquisition. By using a key transmission risk index, it can promptly interrupt, adjust, or regenerate keys, effectively responding to network attacks and ensuring end-to-end transmission security. This greatly enhances the adaptability and security of key management, meeting the needs of complex and ever-changing network environments and diverse business scenarios. Attached Figure Description

[0102] Figure 1 Here is a flowchart of an adaptive key lifecycle management method based on dynamic data proposed in this invention;

[0103] Figure 2 This is a flowchart of the data classification information acquisition process in this invention;

[0104] Figure 3 This is a flowchart of the key generation information acquisition process in this invention;

[0105] Figure 4 This is a flowchart of the key transmission information acquisition process in this invention;

[0106] Figure 5 This is a block diagram of an adaptive key lifecycle management system based on dynamic data proposed in this invention. Detailed Implementation

[0107] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0108] Reference Figure 1 - Figure 4 As shown in the figure, an adaptive key lifecycle management method based on dynamic data in an embodiment of the present invention includes:

[0109] Obtain data storage information, which includes data attribute information and data format information;

[0110] Based on the data storage information, the stored data is classified to obtain data classification information;

[0111] Specifically, based on data storage information, the stored data is classified to obtain data classification information, including:

[0112] Based on data storage information and data traceability, data is divided into public data and non-public data. Public data refers to data that can be obtained through any public channel.

[0113] Obtain the timestamp information of non-public data based on non-public data;

[0114] Based on the timestamp information of the non-public data, the non-public data is arranged in order from oldest to most recent time to obtain the non-public data order information;

[0115] Based on the non-public data order information, data interval information is obtained, whereby the data interval information represents the time interval between adjacent non-public data in the non-public data order.

[0116] The maximum value in the data interval information is taken as the first data interval, and the minimum value in the data interval information is taken as the second data interval.

[0117] Based on the first data interval and the second data interval, obtain the data time window information;

[0118] Two adjacent non-public data points in the first data interval are designated as the first non-public data and the second non-public data.

[0119] Two adjacent non-public data points in the second data interval are designated as the third and fourth non-public data points.

[0120] Based on the first, second, third, and fourth non-public data, obtain the initial data for the time window;

[0121] Among them, if Then the third non-public data will be used as the initial data for the time window. Then the fourth non-public data will be used as the initial data for the time window;

[0122] Based on the initial data of the time window, and using the data time window as a benchmark, the non-public data is divided into several time period data sets to obtain data classification information;

[0123] The data time window is specifically:

[0124] ;

[0125] In the formula, T represents the data time window. For the first data interval, This is the second data time interval.

[0126] In this solution, data is categorized into public and non-public data through data tracing. Non-public data is arranged in chronological order from oldest to newest. The maximum value in the data interval information is used as the first data interval, and the minimum value is used as the second data interval. Data time window information is obtained based on the first and second data intervals. Initial data for the time window is obtained based on the first, second, third, and fourth non-public data. Based on the initial data for the time window, the non-public data is divided into several time-period data sets using the data time window as a benchmark.

[0127] It is understood that, as one implementation method in this embodiment, the non-public data is arranged from left to right in order of time from oldest to newest, with the data interval being the time interval between the timestamps of two non-public data. The non-public data on the left of the two non-public data that constitute the maximum data interval is designated as the first non-public data, and the non-public data on the right is designated as the second non-public data. The non-public data on the left of the two non-public data that constitute the minimum data interval is designated as the third non-public data, and the non-public data on the right is designated as the fourth non-public data.

[0128] In this embodiment, the initial data of the time window is taken as the starting point, and the data time window is used as the selection benchmark for the dataset. The data is extended to the left and right sides, and the non-public data in each data time window is taken as a non-public dataset.

[0129] Based on data classification information, a data sensitivity coefficient is obtained, which represents the degree of impact of data leakage;

[0130] Specifically, based on data classification information, the data sensitivity coefficient is obtained, including:

[0131] Based on data classification information, obtain non-public datasets;

[0132] The data attribute information in the data storage information is used as the data topology criteria to obtain data topology criteria information. The data topology criteria include personal data, commercial data, industrial data and medical data.

[0133] Based on data topology principles, establish a data topology relationship diagram for the non-public data in each non-public dataset;

[0134] Based on the data topology diagram, obtain the data sensitivity coefficient for each non-public data item;

[0135] The formula for calculating the data sensitivity coefficient is as follows:

[0136] ;

[0137] In the formula, Let x be the data sensitivity coefficient of the x-th non-public data. This represents the total number of non-public data adjacent to the x-th non-public data topology under the i-th data topology criterion. This represents the total number of non-public data points connected by the topological relationships to which the x-th non-public data point belongs under the i-th data topology criterion. This represents the total number of data in the non-public dataset to which the x-th non-public data belongs, and n is the total number of data topology criteria.

[0138] In this scheme, data attribute information in data storage information is used as data topology criteria. Based on the data topology criteria, a data topology relationship diagram is established for the non-public data in each non-public dataset. According to the data topology relationship diagram, the data sensitivity coefficient of each non-public data is obtained. The data sensitivity coefficient represents the sensitivity of different data, thus realizing accurate analysis of data sensitivity, which facilitates accurate key generation later.

[0139] In this embodiment, different data attributes are used as different data topology criteria. For each non-public dataset, different data topology criteria are used to construct data topology relationships, forming multiple data topology relationship diagrams. Through these diagrams, data sensitivity is assessed. It is understood that personal data leakage may lead to identity theft and other security issues, financial data leakage may lead to economic losses and financial fraud, and commercial data leakage may affect a company's competitiveness and market position. The relationships between data cannot be analyzed directly using a single data processing method. However, the more relationships there are between different data, the more likely these data leakages will lead to the analysis of other previously unleashed data. Therefore, by establishing topology relationships for data using different data topology criteria, the accuracy and reliability of data analysis are improved.

[0140] Based on the data format information and data risk analysis, different data format risk coefficients are set for different data formats.

[0141] Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index;

[0142] Based on the data confidentiality requirement index and the key strength setting, key generation information is obtained, which includes key length information and key encryption algorithm information.

[0143] Specifically, based on the data confidentiality requirement index and the key strength setting, key generation information is obtained, including:

[0144] Based on the data format information, obtain the data format type information;

[0145] Based on data risk analysis, data formats are classified into three types: structured data formats, semi-structured data formats, and unstructured data formats, and data format classification information is obtained.

[0146] Based on the data format classification information, different weights are assigned to different data formats in different categories;

[0147] Based on the set weights, obtain the data format risk coefficient corresponding to each data format;

[0148] Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index for each data;

[0149] The data sensitivity coefficient of the publicly available data is 1.

[0150] Based on the data confidentiality requirement index, obtain the maximum and average values ​​of the data confidentiality requirement index;

[0151] The ratio of the mean to the maximum value of the data confidentiality requirement index is used as the key strength coefficient.

[0152] Based on key generation analysis, the maximum key strength and the corresponding key lifespan are obtained;

[0153] The product of the maximum key strength and the key strength coefficient is used as the generated key strength, and the product of the key lifetime and the key strength coefficient is used as the generated key lifetime to obtain key generation information;

[0154] The data confidentiality requirement index is specifically as follows:

[0155] ;

[0156] In the formula, This represents the data confidentiality requirement index for the y-th data point. Let be the data sensitivity coefficient for the y-th data point. Let y be the data format risk coefficient. This represents the data format weight of the y-th data point. This represents the total number of data format categories to which the data format of the y-th data belongs. This represents the data format weight of the s-th data format category. This represents the total number of data format types for the s-th data format category, where s=1 indicates a structured data format. If s=2, it indicates a semi-structured data format. If s=2, it indicates an unstructured data format. .

[0157] This solution categorizes data formats into three types: structured, semi-structured, and unstructured. Based on this categorization, different weights are assigned to each type. The ratio of the mean to the maximum value of the data confidentiality requirement index is used as the key strength coefficient. Key generation analysis is conducted to obtain the maximum key strength and its corresponding lifespan. The product of the maximum key strength and the key strength coefficient is used as the generated key strength, and the product of the key lifespan and the key strength coefficient is used as the generated key lifespan. This approach, which fully considers data attributes, format, and time factors, accurately matches key strength, changing the traditional single-key model and avoiding over- or under-encryption. This ensures the security of sensitive data while optimizing resource utilization.

[0158] Understandably, different types of data formats have vastly different levels of sensitivity. For example, structured data formats such as database tables and spreadsheets typically contain sensitive information such as personal information and financial data, and their leakage could lead to large-scale data breaches. Semi-structured data formats such as JSON and XML are usually used for data transmission and may contain sensitive information. As for unstructured data formats such as text files, PDF documents, images, and videos, although these formats may contain sensitive information, they may not be easily identified without clear labeling.

[0159] Obtain access user information, which includes access user account information and access user login information;

[0160] Based on the access user information, obtain the access user login anomaly index;

[0161] Obtain the target access data information of the accessing user;

[0162] Based on the abnormal login index of the accessing user, the target access data information, and the key generation information, obtain the key transmission information;

[0163] Specifically, based on the abnormal login index of the accessing user, the target access data information, and the key generation information, the key transmission information is obtained, including:

[0164] Retrieve the user's historical login information;

[0165] Based on the user's login time in the access user's historical login information, obtain the user's regular login time period;

[0166] Based on the accessing user information, the accessing user's historical login information, and the user's regular login time period, obtain the accessing user login anomaly index;

[0167] Based on the target access data information of the accessing user, obtain the data confidentiality requirement index of the target access data;

[0168] Based on the abnormal login index of the accessing user and the data confidentiality requirement index of the target access data, obtain the number of key transmission fragments;

[0169] Obtain the key strength coefficient;

[0170] The product of the number of key transmission fragments and the key strength coefficient is used as the number of key reconstruction fragments;

[0171] Based on the number of key transmission fragments and the number of key reconstruction fragments, the generated key is transmitted in fragments to obtain key transmission information;

[0172] The formula for calculating the abnormal login index of the accessing user is as follows:

[0173] ;

[0174] In the formula, R represents the abnormal login index of the accessing user. This refers to the number of times a user logs into their account within a given time period. This function represents an exception for user access time, where the user's login time... If it falls within the user's regular login time period, then If the user's login time If it does not fall within the user's regular login time period, then , Indicates the time of user login Recent user login time periods For a unit of time, and ;

[0175] The specific number of key transmission fragments is as follows:

[0176] ;

[0177] In the formula, D is the number of key transmission fragments. This represents the data confidentiality requirement index for the j-th target data. Let y represent the data confidentiality requirement index for the y-th data, m be the total number of data to be accessed, and g be the total number of data to be stored.

[0178] In this scheme, by accessing user information, accessing user historical login information, and the user's regular login time period, an access user login anomaly index is obtained. The access user login anomaly index is used to analyze the degree of user login anomaly, which facilitates the selection of an appropriate key transmission strategy. Based on the access user login anomaly index and the data confidentiality requirement index of the target access data, the number of key transmission fragments is obtained. The product of the number of key transmission fragments and the key strength coefficient is used as the number of key reconstruction fragments. Based on the number of key transmission fragments and the number of key reconstruction fragments, the generated key is transmitted in fragments to obtain key transmission information.

[0179] Understandably, splitting the key during transmission can greatly improve its confidentiality. Even if some key fragments are lost due to a network attack, the complete key will not be leaked. However, if there are too many key fragments, the key transmission efficiency will decrease and the time cost will increase. Therefore, the key fragmentation transmission strategy should be flexibly determined by combining user login anomalies and target data confidentiality requirements to prevent unauthorized acquisition.

[0180] Acquire key transmission data, which includes transmission status data and network attack data during transmission;

[0181] Based on the key transmission data, obtain the key transmission risk index;

[0182] Based on the key transmission risk index, it is determined whether key transmission should be interrupted. If so, the key is destroyed and a new key is generated. If not, the key lifecycle is adjusted according to the key transmission risk index.

[0183] Specifically, based on the key transmission risk index, the determination of whether to interrupt key transmission includes:

[0184] Acquire routine status data, which includes CPU normal operation data and memory normal operation data;

[0185] Based on data classification information, obtain non-public datasets;

[0186] Based on a non-public dataset, obtain the distribution of the target access data in the non-public dataset;

[0187] Use the non-public dataset to which the target access data belongs as the feature dataset;

[0188] Based on the target access data and feature dataset, obtain the access data sensitivity coefficient;

[0189] The key transmission risk index is obtained based on the sensitivity coefficients of key transmission data, regular status data, and access data.

[0190] Based on the key transmission risk index, determine whether key transmission should be interrupted. If so, use the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If not, update the key lifecycle based on the key transmission risk index.

[0191] Among them, if the key transmission risk index If the key transmission risk index is high, then the key transmission will be interrupted. Then the key lifecycle will be adjusted to If the key transmission risk index Then the key lifecycle will be adjusted to ,in, For the key lifecycle, To generate the key lifecycle;

[0192] The formula for calculating the key transmission risk index is as follows:

[0193] ;

[0194] In the formula, G is the key transmission risk index. This represents the z-th transmission status data. This represents the standard value of the z-th transmission status data. This represents the total number of target access data in the c-th feature dataset. Let m represent the total number of data points in the c-th feature dataset, m be the total number of data points accessed, and M represent the feature dataset. represents the maximum value, and w represents the total number of types of transmission status data.

[0195] In this scheme, the distribution of target access data in a non-public dataset is obtained based on the non-public dataset. The non-public dataset to which the target access data belongs is used as a feature dataset. Based on the target access data and the feature dataset, the access data sensitivity coefficient is obtained. Based on the key transmission data, regular status data and access data sensitivity coefficient, the key transmission risk index is obtained. Based on the key transmission risk index, it is determined whether to interrupt key transmission.

[0196] Understandably, in this solution, data in the same non-public dataset often have similar timestamps and strong correlations. If the accessed data accounts for too large a proportion of the same dataset, the risk of leakage of other unincluded data will increase when the accessed data is leaked. Therefore, by monitoring key transmission risks in real time through the key transmission risk index, the key can be interrupted, adjusted, or regenerated in a timely manner to effectively deal with network attacks, ensure the security of the entire transmission process, greatly improve the adaptability and security of key management, and meet the needs of complex and ever-changing network environments and diverse business scenarios.

[0197] Reference Figure 5 As shown, further, combining the above-mentioned adaptive key lifecycle management method based on dynamic data, an adaptive key lifecycle management system based on dynamic data is proposed, including:

[0198] The main control module is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria, take the product of the maximum key strength and the key strength coefficient as the generated key strength, take the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission based on the key transmission risk index. If yes, take the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If no, update the key lifespan based on the key transmission risk index.

[0199] The information acquisition module is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information; based on non-public data, it acquires non-public data timestamp information; it acquires the target access data information of the access user, key transmission data, transmission status data and network attack data during transmission; and based on data format information, it acquires data format type information.

[0200] The evaluation module is used to obtain the data sensitivity coefficient of each non-public data according to the data topology relationship diagram, obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient, obtain the login anomaly index of the accessing user according to the accessing user information, the accessing user's historical login information and the user's regular login time period, obtain the access data sensitivity coefficient according to the target access data and the feature dataset, and obtain the key transmission risk index according to the key transmission data, regular status data and access data sensitivity coefficient.

[0201] The display module interacts with the main control module and is used to output and display data classification information, data confidentiality requirement index, key generation information, key transmission information, and key transmission risk index.

[0202] The main control module specifically includes:

[0203] The control unit is used to take the product of the maximum key strength and the key strength coefficient as the generated key strength, and the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission according to the key transmission risk index. If so, the product of the key transmission risk index and the key strength coefficient is used as the new key strength coefficient, and the key is regenerated. If not, the key lifespan is updated according to the key transmission risk index.

[0204] An information receiving unit, which interacts with the information acquisition module and the evaluation module, is used to receive data and transmit it to the data processing unit.

[0205] The data processing unit is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, and establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria.

[0206] The information acquisition module specifically includes:

[0207] The first acquisition unit is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information, and acquire non-public data timestamp information based on non-public data.

[0208] The second acquisition unit is used to acquire the target access data information, key transmission data, transmission status data and network attack data during transmission of the accessing user, and acquire the data format type information according to the data format information.

[0209] The evaluation module specifically includes:

[0210] The data evaluation unit is used to obtain the data sensitivity coefficient of each non-public data according to the data topology relationship diagram, and to obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient.

[0211] An access evaluation unit is used to obtain an abnormal login index of the accessing user based on the accessing user information, the accessing user's historical login information, and the user's regular login time period.

[0212] The key transmission evaluation unit is used to obtain an access data sensitivity coefficient based on the target access data and the feature dataset, and to obtain a key transmission risk index based on the key transmission data, regular status data and the access data sensitivity coefficient.

[0213] In summary, the advantages of this invention are as follows: By classifying stored data through data storage information, non-public data within the stored data is divided into multiple datasets, facilitating accurate setting of key strength and improving key generation efficiency. Based on the key strength setting and a data confidentiality requirement index, key generation information is obtained, fully considering data attributes, format, and time factors to accurately match key strength. This changes the traditional single-key mode, avoiding over- or under-encryption, ensuring the security of sensitive data while optimizing resource utilization. The invention also flexibly determines key fragmentation transmission strategies based on user login anomalies and target data confidentiality requirements, preventing unauthorized access. Simultaneously, real-time monitoring of key transmission risks allows for timely interruption, adjustment, or regeneration of keys based on the key transmission risk index, effectively responding to network attacks and ensuring end-to-end transmission security. This significantly improves the adaptability and security of key management, meeting the needs of complex and ever-changing network environments and diverse business scenarios.

[0214] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. An adaptive key lifecycle management method based on dynamic data, characterized in that, include: Obtain data storage information, which includes data attribute information and data format information; Based on the data storage information, the data is divided into public data and non-public data to obtain data classification information; Based on data classification information, a data sensitivity coefficient is obtained, which represents the degree of impact of data leakage; Based on the data format information and data risk analysis, different data format risk coefficients are set for different data formats. Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index; Based on the data confidentiality requirement index, obtain the maximum and average values ​​of the data confidentiality requirement index; The ratio of the mean to the maximum value of the data confidentiality requirement index is used as the key strength coefficient. Based on key generation analysis, the maximum key strength and the corresponding key lifespan are obtained; The product of the maximum key strength and the key strength coefficient is used as the generated key strength, and the product of the key lifetime and the key strength coefficient is used as the generated key lifetime. The key generation information includes key length information and key encryption algorithm information. Obtain access user information, which includes access user account information and access user login information; Based on the access user information, obtain the access user login anomaly index; Obtain the target access data information of the accessing user; Based on the target access data information of the accessing user, obtain the data confidentiality requirement index of the target access data; Based on the abnormal login index of the accessing user and the data confidentiality requirement index of the target access data, obtain the number of key transmission fragments; The product of the number of key transmission fragments and the key strength coefficient is used as the number of key reconstruction fragments; Based on the number of key transmission fragments and the number of key reconstruction fragments, the generated key is transmitted in fragments. Acquire key transmission data, which includes transmission status data and network attack data during transmission; Based on the key transmission data, obtain the key transmission risk index; Based on the key transmission risk index, determine whether key transmission should be interrupted. If so, use the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If not, update the key lifecycle based on the key transmission risk index. Among them, if the key transmission risk index If the key transmission risk index is high, then the key transmission will be interrupted. Then the key lifecycle will be adjusted to If the key transmission risk index Then the key lifecycle will be adjusted to Where G is the key transmission risk index, For the key lifecycle, Generate the key lifecycle.

2. The adaptive key lifecycle management method based on dynamic data according to claim 1, characterized in that, The step of classifying the stored data according to the data storage information and obtaining data classification information specifically includes: Based on data storage information and data traceability, data is divided into public data and non-public data. Public data refers to data that can be obtained through any public channel. Obtain the timestamp information of non-public data based on non-public data; Based on the timestamp information of the non-public data, the non-public data is arranged in order from oldest to most recent time to obtain the non-public data order information; Based on the non-public data order information, data interval information is obtained, whereby the data interval information represents the time interval between adjacent non-public data in the non-public data order. The maximum value in the data interval information is taken as the first data interval, and the minimum value in the data interval information is taken as the second data interval. Based on the first data interval and the second data interval, obtain the data time window information; Two adjacent non-public data points in the first data interval are designated as the first non-public data and the second non-public data. Two adjacent non-public data points in the second data interval are designated as the third and fourth non-public data points. Based on the first, second, third, and fourth non-public data, obtain the initial data for the time window; Among them, if Then the third non-public data will be used as the initial data for the time window. Then the fourth non-public data will be used as the initial data for the time window; Based on the initial data of the time window, and using the data time window as a benchmark, the non-public data is divided into several time period data sets to obtain data classification information; The data time window is specifically: ； In the formula, T represents the data time window. For the first data interval, This is the second data time interval.

3. The adaptive key lifecycle management method based on dynamic data according to claim 1, characterized in that, The process of obtaining the data sensitivity coefficient based on data classification information specifically includes: Based on data classification information, obtain non-public datasets; The data attribute information in the data storage information is used as the data topology criteria to obtain data topology criteria information. The data topology criteria include personal data, commercial data, industrial data and medical data. Based on data topology principles, establish a data topology relationship diagram for the non-public data in each non-public dataset; Based on the data topology diagram, obtain the data sensitivity coefficient for each non-public data item; The formula for calculating the data sensitivity coefficient is as follows: ； In the formula, Let x be the data sensitivity coefficient of the x-th non-public data. This represents the total number of non-public data adjacent to the x-th non-public data topology under the i-th data topology criterion. This represents the total number of non-public data items connected by the topological relationships to which the x-th non-public data item belongs under the i-th data topology criterion. This represents the total number of data in the non-public dataset to which the x-th non-public data belongs, and n is the total number of data topology criteria.

4. The adaptive key lifecycle management method based on dynamic data according to claim 1, characterized in that, The process of obtaining the data confidentiality requirement index based on the data sensitivity coefficient and data format risk coefficient specifically includes: Based on the data format information, obtain the data format type information; Based on data risk analysis, data formats are classified into three types: structured data formats, semi-structured data formats, and unstructured data formats, and data format classification information is obtained. Based on the data format classification information, different weights are assigned to different data formats in different categories; Based on the set weights, obtain the data format risk coefficient corresponding to each data format; Based on the data sensitivity coefficient and data format risk coefficient, obtain the data confidentiality requirement index for each data; The data sensitivity coefficient of the publicly available data is 1. The data confidentiality requirement index is specifically as follows: ； In the formula, This represents the data confidentiality requirement index for the y-th data point. Let be the data sensitivity coefficient for the y-th data point. Let y be the data format risk coefficient. This represents the data format weight of the y-th data point. This represents the total number of data format categories to which the data format of the y-th data belongs. This represents the data format weight of the s-th data format category. This represents the total number of data format types for the s-th data format category, where s=1 indicates a structured data format. If s=2, it indicates a semi-structured data format. If s=2, it indicates an unstructured data format. .

5. The adaptive key lifecycle management method based on dynamic data according to claim 1, characterized in that, The step of obtaining the number of key transmission fragments based on the abnormal login index of the accessing user and the data confidentiality requirement index of the target access data specifically includes: Retrieve the user's historical login information; Based on the user's login time in the access user's historical login information, obtain the user's regular login time period; Based on the accessing user information, the accessing user's historical login information, and the user's regular login time period, obtain the accessing user login anomaly index; Based on the target access data information of the accessing user, obtain the data confidentiality requirement index of the target access data; Based on the abnormal login index of the accessing user and the data confidentiality requirement index of the target access data, obtain the number of key transmission fragments; The formula for calculating the abnormal login index of the accessing user is as follows: ； In the formula, R represents the abnormal login index of the accessing user. This refers to the number of times a user logs into their account within a given time period. This function represents an exception for user access time, where the user's login time... If it falls within the user's regular login time period, then If the user's login time If it does not fall within the user's regular login time period, then , Indicates the time of user login Recent user login time periods For a unit of time, and ; The specific number of key transmission fragments is as follows: ； In the formula, D is the number of key transmission fragments. This represents the data confidentiality requirement index for the j-th target data. Let y represent the data confidentiality requirement index for the y-th data, m be the total number of data to be accessed, and g be the total number of data to be stored.

6. The adaptive key lifecycle management method based on dynamic data according to claim 1, characterized in that, The step of obtaining the key transmission risk index based on the key transmission data specifically includes: Acquire routine status data, which includes CPU normal operation data and memory normal operation data; Based on data classification information, obtain non-public datasets; Based on a non-public dataset, obtain the distribution of the target access data in the non-public dataset; Use the non-public dataset to which the target access data belongs as the feature dataset; Based on the target access data and feature dataset, obtain the access data sensitivity coefficient; The key transmission risk index is obtained based on the sensitivity coefficients of key transmission data, regular status data, and access data. The formula for calculating the key transmission risk index is as follows: ； In the formula, G is the key transmission risk index. This represents the z-th transmission status data. This represents the standard value of the z-th transmission status data. This represents the total number of target access data in the c-th feature dataset. Let m represent the total number of data points in the c-th feature dataset, m be the total number of data points accessed, and M represent the feature dataset. represents the maximum value, and w represents the total number of types of transmission status data.

7. An adaptive key lifecycle management system based on dynamic data, used to implement the management method as described in any one of claims 1-6, characterized in that, include: The main control module is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria, take the product of the maximum key strength and the key strength coefficient as the generated key strength, take the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission based on the key transmission risk index. If yes, take the product of the key transmission risk index and the key strength coefficient as the new key strength coefficient and regenerate the key. If no, update the key lifespan based on the key transmission risk index. The information acquisition module is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information; based on non-public data, it acquires non-public data timestamp information; it acquires the target access data information of the access user, key transmission data, transmission status data and network attack data during transmission; and based on data format information, it acquires data format type information. The evaluation module is used to obtain the data sensitivity coefficient of each non-public data according to the data topology relationship diagram, obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient, obtain the login anomaly index of the accessing user according to the accessing user information, the accessing user's historical login information and the user's regular login time period, obtain the access data sensitivity coefficient according to the target access data and the feature dataset, and obtain the key transmission risk index according to the key transmission data, regular status data and access data sensitivity coefficient. The display module interacts with the main control module and is used to output and display data classification information, data confidentiality requirement index, key generation information, key transmission information, and key transmission risk index.

8. The adaptive key lifecycle management system based on dynamic data according to claim 7, characterized in that, The main control module specifically includes: The control unit is used to take the product of the maximum key strength and the key strength coefficient as the generated key strength, and the product of the key lifespan and the key strength coefficient as the generated key lifespan, obtain key generation information, perform key fragment transmission on the generated key based on the number of key transmission fragments and the number of key reconstruction fragments, obtain key transmission information, and determine whether to interrupt key transmission according to the key transmission risk index. If so, the product of the key transmission risk index and the key strength coefficient is used as the new key strength coefficient, and the key is regenerated. If not, the key lifespan is updated according to the key transmission risk index. An information receiving unit, which interacts with the information acquisition module and the evaluation module, is used to receive data and transmit it to the data processing unit. The data processing unit is used to obtain the order information of non-public data based on the timestamp information of non-public data, obtain the data time window information based on the first data interval and the second data interval, obtain the initial data of the time window based on the first non-public data, the second non-public data, the third non-public data and the fourth non-public data, and establish a data topology relationship diagram for the non-public data in each non-public dataset based on the data topology criteria.

9. The adaptive key lifecycle management system based on dynamic data according to claim 7, characterized in that, The information acquisition module specifically includes: The first acquisition unit is used to acquire data storage information, data attribute information, data format information, access user information, access user account information and access user login information, and acquire non-public data timestamp information based on non-public data. The second acquisition unit is used to acquire the target access data information, key transmission data, transmission status data and network attack data during transmission of the accessing user, and acquire the data format type information according to the data format information.

10. The adaptive key lifecycle management system based on dynamic data according to claim 7, characterized in that, The evaluation module specifically includes: The data evaluation unit is used to obtain the data sensitivity coefficient of each non-public data according to the data topology diagram, and to obtain the data confidentiality requirement index of each data according to the data sensitivity coefficient and the data format risk coefficient. An access evaluation unit is used to obtain an abnormal login index of the accessing user based on the accessing user information, the accessing user's historical login information, and the user's regular login time period. The key transmission evaluation unit is used to obtain the access data sensitivity coefficient based on the target access data and the feature dataset, and to obtain the key transmission risk index based on the key transmission data, the regular status data and the access data sensitivity coefficient.

Images