A key management method and system based on security verification device

Abstract

The present invention discloses a key management method and system based on a security verification device, including: performing authority function analysis on the data stored in the target database, partitioning the keys after associating the keys with the authority functions, and associating the data with the corresponding key partition levels. When a key generation request from the target user is received, identity authentication is performed; if the verification is successful and the user authority level matches the request content, an initial key is generated and stored according to the request data type. The method sets a key self-verification mechanism to regularly verify and update the stored keys. At the same time, the key request behavior of the target user is monitored, and historical request monitoring information is extracted. The historical request habits of the target user are obtained through analysis, and a feature profile is generated and associated with the user log. In subsequent requests, risk monitoring is performed based on the user profile, thereby achieving efficient and secure dynamic key management, effectively improving the security and intelligence level of the key management system.

Description

Technical Field

[0001] The present invention relates to the technical field of key management, and in particular to a key management method and system based on a security verification device. Background Art

[0002] Existing key management methods play an important role in information systems and are widely used in scenarios such as communications, storage, and encrypted transactions. Their core is to ensure the security and availability of keys. However, with the development of information technology, the security threats faced by key management systems have become increasingly complex, including the risk of key storage leakage, the threat of hijacking during the distribution process, and improper permission control during key usage. For example, in a distributed network environment, due to the diversity of nodes and the uncertainty of communication links, keys may be illegally intercepted or tampered with, posing a serious threat to the overall security of the system. In addition, traditional key management methods usually rely on a fixed key storage structure or distribution mechanism. When the system encounters anomalies or faces high-risk environments, it is difficult to respond in a timely and effective manner, which may lead to data leakage, loss of user information, and unforeseen consequences. Summary of the Invention

[0003] The present invention overcomes the defects of the prior art and provides a key management method and system based on a security verification device, the important purpose of which is to improve the reliability and security of key management.

[0004] To achieve the above objectives, the present invention provides a key management method based on a security verification device in a first aspect, comprising:

[0005] Obtain a target database that requires security management, perform authority and function analysis on the data stored in the target database, associate keys with authority and function to perform key partitioning, and associate the data stored in the target database with corresponding key partition levels;

[0006] Upon receiving a key generation request from the target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage.

[0007] Setting a key self-checking mechanism, through which the key stored in the encryption storage unit is checked and updated within a preset period;

[0008] Monitor the target user's key request behavior to obtain historical key request monitoring information, and analyze the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information;

[0009] A feature profile of the target user is generated based on the historical key request habit information and associated with the corresponding user log. When the target user makes a next request, risk monitoring is performed using the corresponding feature profile.

[0010] In this solution, the process of obtaining a target database that requires security management, performing authority and function analysis on the data stored in the target database, associating keys with authority and function to partition keys, and associating the data stored in the target database with corresponding key partition levels specifically includes:

[0011] Obtain the target database that needs security management, obtain a list of all users and roles based on the target database, traverse each user and role to extract permission features, and obtain permission extraction information;

[0012] Extracting data access scope features corresponding to different permission levels according to the permission extraction information, and analyzing access patterns of different permission levels to stored data based on the extracted access scope features to obtain access pattern analysis information;

[0013] Defining authority functions of each authority level based on the access pattern analysis information, and associating corresponding authority functions with accessible data types and ranges to obtain first analysis information;

[0014] Perform a key partitioning operation based on the first analysis information, define primary permissions and secondary permissions by the type and scope of data accessed by each permission, define a partition key based on the primary permission type and the secondary permission type, and obtain key partition information;

[0015] The data stored in the target database is associated with the corresponding key partition level according to the key partition information, and different key partition levels correspond to different data types.

[0016] In this solution, upon receiving a key generation request from a target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage, specifically including:

[0017] The target user sends a key generation request to the target security verification device through a system associated with the target security verification device. When the target security verification device receives the key generation request from the target user, it sends an identity authentication request to the target user to collect identity information;

[0018] Obtaining identity collection information, including biometric identity information and digital identity information, and comparing and analyzing the identity collection information with identity data stored in a target database to determine whether the person is a known identity;

[0019] If the target user's identity is known, the target user's permission characteristics are extracted to analyze whether the target user has the permission to request key generation; if so, the request data type is extracted from the target user's key generation request information and a random key seed is generated;

[0020] Performing an encryption operation on the generated random key seed and the preset security parameters to generate an initial key, storing the initial key in the encryption storage unit of the security verification device, and recording the key generation time and generator information;

[0021] When the target security verification device receives the key distribution request, it extracts the key from the encryption storage unit after identity verification, encrypts and encapsulates it, and sends the encapsulated key to the key distribution request user through a secure communication channel.

[0022] In this solution, the key self-checking mechanism is set to check and update the key stored in the encryption storage unit within a preset period through the key self-checking mechanism, specifically including:

[0023] Extracting the initial keys stored in the target security verification device, clustering the keys based on their partition levels, and obtaining sets of initial keys of different partition levels;

[0024] Perform feature extraction on each initial key set to convert the key into a feature vector, introduce a local sensitive hashing algorithm, and calculate the hash value and index value of each initial key in each initial key set;

[0025] Creating a hash table, mapping each initial key set and the hash value and index value of each initial key to the hash table, wherein the key of the hash table is the hash value, and the value of the hash table is the index value of the corresponding initial key;

[0026] Constructing hash chains of different key partitions based on the hash table, and performing key self-checking on the initial key set of each partition level according to a preset period through the hash chains of different key partitions;

[0027] By calculating the hash value and index value of each initial key in the target initial key set during key self-checking, a self-checking hash chain is constructed and compared with the stored hash chain for analysis;

[0028] If the self-checking hash chain is inconsistent with the stored hash chain, it means there is a risk of abnormal key tampering, then the abnormal hash chain position is extracted, and the abnormal initial key is obtained through the abnormal hash chain position;

[0029] Based on the abnormal initial key, data associated with the abnormal initial key is obtained from the target database, and the key is regenerated to obtain a new initial key. The abnormal initial key is replaced by the new initial key, and the hash value and index value of the new initial key are calculated and updated in the stored hash chain.

[0030] In this solution, the target user's key request behavior is monitored to obtain historical key request monitoring information, and the target user's historical key request habits are analyzed based on the historical key request monitoring information to obtain historical key request habit information, which specifically includes:

[0031] Monitor the target user's key request behavior through the target security verification device to obtain historical key request monitoring information, wherein the historical key request monitoring information includes user request environment information and user usage behavior information;

[0032] Introducing a long short-term memory network and initializing the input layer, hidden layer, and output layer of the long short-term memory network, importing the historical key request monitoring information as input features into the input layer, and using the target user's historical key request habits as output targets of the output layer;

[0033] The time series processing capability of the long short-term memory network is used to extract historical key request monitoring features, and the stacked autoencoder is used to perform feature encoding reconstruction to obtain the reconstructed historical key request monitoring features;

[0034] A learnable embedding dictionary is set in the hidden layer of the long short-term memory network to represent the time points of the target user's key request behavior. The spatiotemporal correlation between the target user's historical key request monitoring features and the time nodes is analyzed to generate spatiotemporal correlation features.

[0035] Based on the spatiotemporal correlation features, a multi-head self-attention mechanism is used to measure the contribution of each historical key request behavior feature of the target user to all request behavior features, and the importance of the corresponding request behavior feature is represented by the contribution to obtain the feature weight distribution;

[0036] The target user's historical key request habit of performing key request behaviors through the security verification device is output according to the feature weight distribution in combination with the spatiotemporal correlation feature to obtain historical key request habit information.

[0037] In this solution, a characteristic profile of the target user is generated based on the historical key request habit information, and is associated with the corresponding user log. When the target user makes the next request, risk monitoring is performed based on the corresponding characteristic profile, specifically including:

[0038] Obtain historical key request habit information, import the historical key request habit information into a graph neural network, convert the target user's historical key request habits into a graph data format through the graph neural network, and construct a request behavior feature profile of the target user;

[0039] A request behavior database is set up in the target security verification device, and a characteristic profile of each user's request behavior is stored in the request behavior database to monitor abnormal risks when the user makes key request behaviors;

[0040] When the target user makes the next key request, the target security verification device monitors the target user's real-time key request environment and behavior to obtain real-time key request monitoring information, and performs data preprocessing on the obtained real-time key request monitoring information;

[0041] Generate a search tag based on the target user's identity information, search the request behavior database to obtain the target user's request behavior feature profile, and perform similarity calculation with the pre-processed real-time key request information to obtain a cosine similarity value;

[0042] The calculated cosine similarity value is compared with the preset threshold. If it is greater than the preset threshold, it means that the current key request behavior of the target user is normal. Based on the key request requirement of the target user, the corresponding initial key is obtained for encryption and transmission;

[0043] If the value is less than the preset threshold, it indicates that the target user's current key request behavior is abnormal. Then, the target user's request behavior profile is used to analyze the difference between the target user's real-time request behavior and historical request behavior to obtain differential behavior analysis information.

[0044] Based on the differential behavior analysis information, a preset risk control strategy corresponding to the retrieved risk control strategy is used to control the real-time key request behavior of the target user.

[0045] A second aspect of the present invention provides a key management system based on a security verification device, the system comprising: a memory and a processor, the memory containing a key management method program based on the security verification device, the key management method program based on the security verification device, when executed by the processor, implementing the following steps:

[0046] Obtain a target database that requires security management, perform authority and function analysis on the data stored in the target database, associate keys with authority and function to perform key partitioning, and associate the data stored in the target database with corresponding key partition levels;

[0047] Upon receiving a key generation request from the target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage.

[0048] Setting a key self-checking mechanism, through which the key stored in the encryption storage unit is checked and updated within a preset period;

[0049] Monitor the target user's key request behavior to obtain historical key request monitoring information, and analyze the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information;

[0050] A feature profile of the target user is generated based on the historical key request habit information and associated with the corresponding user log. When the target user makes a next request, risk monitoring is performed using the corresponding feature profile.

[0051] The present invention discloses a key management method and system based on a security verification device, including: performing authority function analysis on the data stored in the target database, partitioning the keys after associating the keys with the authority functions, and associating the data with the corresponding key partition levels. When a key generation request from the target user is received, identity authentication is performed; if the verification is successful and the user authority level matches the request content, an initial key is generated and stored according to the request data type. The method sets a key self-verification mechanism to regularly verify and update the stored keys. At the same time, the key request behavior of the target user is monitored, and historical request monitoring information is extracted. The historical request habits of the target user are obtained through analysis, and a feature profile is generated and associated with the user log. In subsequent requests, risk monitoring is performed based on the user profile, thereby achieving efficient and secure dynamic key management, effectively improving the security and intelligence level of the key management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments or exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or exemplary descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained according to these drawings without paying any creative work.

[0053] Figure 1 A flow chart of a key management method based on a security verification device provided in one embodiment of the present invention;

[0054] Figure 2 A flow chart of a method for monitoring key request anomalies according to an embodiment of the present invention;

[0055] Figure 3 A block diagram of a key management system based on a security verification device provided by one embodiment of the present invention;

[0056] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0057] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that, in the absence of conflict, the embodiments of the present application and the features therein can be combined with each other.

[0058] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the scope of protection of the present invention is not limited to the specific embodiments disclosed below.

[0059] Figure 1 A flow chart of a key management method based on a security verification device provided in one embodiment of the present invention;

[0060] like Figure 1 As shown, the present invention provides a flow chart of a key management method based on a security verification device, including:

[0061] S102, obtaining a target database that requires security management, performing authority and function analysis on the data stored in the target database, associating keys with authority and functions to create key partitions, and associating the data stored in the target database with corresponding key partition levels;

[0062] S104: Upon receiving a key generation request from a target user, the target user is authenticated. If the authentication passes and the target user's permission level is analyzed and the request content matches the permission level, the requested data type is extracted to generate an initial key for storage.

[0063] S106, setting a key self-checking mechanism, and verifying and updating the key stored in the encryption storage unit within a preset period through the key self-checking mechanism;

[0064] S108, monitoring the target user's key request behavior to obtain historical key request monitoring information, and analyzing the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information;

[0065] S110, generating a feature profile of the target user based on the historical key request habit information, associating it with the corresponding user log, and performing risk monitoring through the corresponding feature profile when the target user makes a next request.

[0066] It should be noted that the present invention provides a key management method and system based on a security verification device. The method first analyzes the data in a target database, associates keys with corresponding permissions and functions based on the data's permission level, and partitions the keys based on the analysis results. Furthermore, the data in the target database is associated with the corresponding key partition levels to ensure consistent and secure data-key mapping. When the system receives a key generation request from a target user, it first verifies the target user's identity. If the verification passes and the user's permission level matches the request, it extracts the data type contained in the request, generates an initial key based on the data characteristics, and stores the key, thereby ensuring the accuracy and specificity of the generated key. To ensure the long-term validity and security of the key, the present invention incorporates a key self-verification mechanism that automatically verifies and updates the keys stored in the encryption storage unit within a preset time period. This periodic verification mechanism reduces the risk of key leakage and improves system security. Furthermore, the present invention monitors the target user's key request behavior in real time, extracts key request monitoring information by recording and analyzing the target user's historical request behavior, and mines the user's key request habits based on this historical information. Based on this acquired habit information, we further generate a user profile, which is then correlated with the corresponding user logs to establish a risk monitoring reference for subsequent requests. When the target user initiates their next key request, the system will use their profile to determine whether the request poses a potential risk. By combining historical data with the degree of match between the current request and the request, we can effectively identify anomalous behavior, thereby achieving a dynamic, efficient, and secure key management process.

[0067] Furthermore, in a preferred embodiment of the present invention, obtaining a target database requiring security management, performing authority and function analysis on data stored in the target database, associating keys with authority and functions to perform key partitioning, and associating the data stored in the target database with corresponding key partition levels specifically includes:

[0068] Obtain the target database that needs security management, obtain a list of all users and roles based on the target database, traverse each user and role to extract permission features, and obtain permission extraction information;

[0069] Extracting data access scope features corresponding to different permission levels according to the permission extraction information, and analyzing access patterns of different permission levels to stored data based on the extracted access scope features to obtain access pattern analysis information;

[0070] Defining authority functions of each authority level based on the access pattern analysis information, and associating corresponding authority functions with accessible data types and ranges to obtain first analysis information;

[0071] Perform a key partitioning operation based on the first analysis information, define primary permissions and secondary permissions by the type and scope of data accessed by each permission, define a partition key based on the primary permission type and the secondary permission type, and obtain key partition information;

[0072] The data stored in the target database is associated with the corresponding key partition level according to the key partition information, and different key partition levels correspond to different data types.

[0073] It should be noted that first, a target database requiring security management is obtained, and a list of all users and roles is extracted from this database. Based on the obtained user and role information, each user and role is iterated through, and permission characteristics are extracted. The permission information corresponding to each user and role is extracted, forming permission extraction information. Subsequently, based on the extracted permission information, the data access scope characteristics corresponding to different permission levels are further analyzed. By summarizing and analyzing these access scope characteristics, the access patterns of different permission levels to the target database data are explored, thereby generating access pattern analysis information. After completing the access pattern analysis, the functions of permissions are further defined based on the obtained access pattern analysis information. Specifically, corresponding permission functions are assigned to each permission level, and these permission functions are associated with the data types and access scopes that can be accessed, thereby generating first analysis information. Based on this first analysis information, the method performs a key partitioning operation. By analyzing the characteristics of data access types and access scopes for each permission level, primary and secondary permissions are categorized. Partition keys are further defined based on the primary and secondary permission types, ultimately obtaining key partition information. Key partition information allows for the association of data stored in the target database with corresponding key partition levels, enabling different key partition levels to accurately map to specific data types. This partition management mechanism not only enhances the hierarchical nature of data protection, but also improves the compatibility and security of key management and data access, effectively mitigating potential security risks associated with cross-privilege access.

[0074] Furthermore, in a preferred embodiment of the present invention, upon receiving a key generation request from a target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage, specifically including:

[0075] The target user sends a key generation request to the target security verification device through a system associated with the target security verification device. When the target security verification device receives the key generation request from the target user, it sends an identity authentication request to the target user to collect identity information;

[0076] Obtaining identity collection information, including biometric identity information and digital identity information, and comparing and analyzing the identity collection information with identity data stored in a target database to determine whether the person is a known identity;

[0077] If the target user's identity is known, the target user's permission characteristics are extracted to analyze whether the target user has the permission to request key generation; if so, the request data type is extracted from the target user's key generation request information and a random key seed is generated;

[0078] Performing an encryption operation on the generated random key seed and the preset security parameters to generate an initial key, storing the initial key in the encryption storage unit of the security verification device, and recording the key generation time and generator information;

[0079] When the target security verification device receives the key distribution request, it extracts the key from the encryption storage unit after identity verification, encrypts and encapsulates it, and sends the encapsulated key to the key distribution request user through a secure communication channel.

[0080] It should be noted that when a target user initiates a key generation request through the system associated with the target security verification device, the target security verification device first receives the request and sends an identity verification request to the target user to collect their identity information. The collected identity information, including biometric and digital identity information, is compared and analyzed with the identity data stored in the target database to determine whether the target user is a known person. If the comparison indicates that the user is a known person, the system further extracts the target user's permission characteristics to determine whether they have key generation permission. If the target user's permission is determined to meet the requirements, the system extracts the requested data type based on the key generation request information and generates a random key seed based on this information. The generated random key seed is then encrypted with preset security parameters to generate an initial key. This initial key is stored in an encrypted storage unit within the security verification device, and information about the key generation time and generator is recorded to ensure security for subsequent traceability and management. When the target security verification device receives a key distribution request, it verifies the identity of the requesting user. If the identity verification is successful, the corresponding key is extracted from the encrypted storage unit, encrypted and encapsulated, and distributed to the user requesting key distribution via a secure communication channel. The entire process ensures that key generation and distribution are completed in a safe and reliable environment, improving the security and operational efficiency of the system.

[0081] Furthermore, in a preferred embodiment of the present invention, the key self-checking mechanism is set to check and update the key stored in the encryption storage unit within a preset period through the key self-checking mechanism, specifically including:

[0082] Extracting the initial keys stored in the target security verification device, clustering the keys based on their partition levels, and obtaining sets of initial keys of different partition levels;

[0083] Perform feature extraction on each initial key set to convert the key into a feature vector, introduce a local sensitive hashing algorithm, and calculate the hash value and index value of each initial key in each initial key set;

[0084] Creating a hash table, mapping each initial key set and the hash value and index value of each initial key to the hash table, wherein the key of the hash table is the hash value, and the value of the hash table is the index value of the corresponding initial key;

[0085] Constructing hash chains of different key partitions based on the hash table, and performing key self-checking on the initial key set of each partition level according to a preset period through the hash chains of different key partitions;

[0086] By calculating the hash value and index value of each initial key in the target initial key set during key self-checking, a self-checking hash chain is constructed and compared with the stored hash chain for analysis;

[0087] If the self-checking hash chain is inconsistent with the stored hash chain, it means there is a risk of abnormal key tampering, then the abnormal hash chain position is extracted, and the abnormal initial key is obtained through the abnormal hash chain position;

[0088] Based on the abnormal initial key, data associated with the abnormal initial key is obtained from the target database, and the key is regenerated to obtain a new initial key. The abnormal initial key is replaced by the new initial key, and the hash value and index value of the new initial key are calculated and updated in the stored hash chain.

[0089] It should be noted that when managing keys through a security verification device, stored keys may be tampered with or lost due to modification by unauthorized personnel or other issues. Furthermore, the stored initial keys are extracted from the target security verification device and clustered according to their partition levels to form initial key sets at different partition levels. After obtaining the partitioned key sets, features are extracted for each initial key, and the extracted key features are converted into feature vectors. Subsequently, a locality-sensitive hashing algorithm is introduced to calculate the hash value and index value of each initial key in the set, generating a mapping basis for operation and management. Based on the hash calculation results, a hash table is created, mapping the keys in different initial key sets and their corresponding hash values ​​and index values. Specifically, the key of the hash table is the hash value of the key, and the value is the index value of the corresponding initial key. After the hash table is constructed, hash chains are further established for each key partition. These hash chains are used to perform key self-verification operations on the initial key sets at different partition levels at a preset period. During the self-checking process, the current hash value and index value of each initial key in the target initial key set are calculated to generate a new self-checking hash chain, which is then compared and analyzed one by one with the original stored hash chain. If the comparison finds that the self-checking hash chain is inconsistent with the stored hash chain, it is determined that there may be a risk of key anomaly or tampering. In this case, the system further extracts the location of the abnormal hash chain and locates the specific initial key where the anomaly occurred. Subsequently, a new initial key is regenerated based on the data in the target database associated with the abnormal initial key to replace the abnormal key. After the newly generated initial key is replaced, its corresponding hash value and index value are synchronously calculated, and the stored hash chain is updated to ensure the integrity of the hash chain and the security of the key system. This ensures that problems can be quickly located and repaired when key anomalies or security risks occur, thereby improving the robustness and security level of the system.

[0090] Furthermore, in a preferred embodiment of the present invention, the target user's key request behavior is monitored to obtain historical key request monitoring information, and the target user's historical key request habits are analyzed based on the historical key request monitoring information to obtain historical key request habit information, specifically including:

[0091] Monitor the target user's key request behavior through the target security verification device to obtain historical key request monitoring information, wherein the historical key request monitoring information includes user request environment information and user usage behavior information;

[0092] Introducing a long short-term memory network and initializing the input layer, hidden layer, and output layer of the long short-term memory network, importing the historical key request monitoring information as input features into the input layer, and using the target user's historical key request habits as output targets of the output layer;

[0093] The time series processing capability of the long short-term memory network is used to extract historical key request monitoring features, and the stacked autoencoder is used to perform feature encoding reconstruction to obtain the reconstructed historical key request monitoring features;

[0094] A learnable embedding dictionary is set in the hidden layer of the long short-term memory network to represent the time points of the target user's key request behavior. The spatiotemporal correlation between the target user's historical key request monitoring features and the time nodes is analyzed to generate spatiotemporal correlation features.

[0095] Based on the spatiotemporal correlation features, a multi-head self-attention mechanism is used to measure the contribution of each historical key request behavior feature of the target user to all request behavior features, and the importance of the corresponding request behavior feature is represented by the contribution to obtain the feature weight distribution;

[0096] The target user's historical key request habit of performing key request behaviors through the security verification device is output according to the feature weight distribution in combination with the spatiotemporal correlation feature to obtain historical key request habit information.

[0097] It should be noted that, first, comprehensive monitoring of the target user's key request behavior during use is performed, including information about the user's request context and specific usage behavior. This information together constitutes historical key request monitoring information. Subsequently, a long short-term memory (LSTM) network is introduced, and the network's input, hidden, and output layers are initialized. This historical key request monitoring information serves as input features for the input layer, while the target user's historical key request habits serve as the target output for the output layer. This is then trained and modeled through the network.

[0098] Leveraging the LSTM network's ability to process time series data, the system conducts in-depth analysis and feature extraction on the input historical key request monitoring information. The extracted monitoring features are then encoded and reconstructed using a stacked autoencoder, resulting in a reconstructed historical key request monitoring feature. Furthermore, a learnable embedding dictionary is introduced into the hidden layer of the LSTM network to represent the time nodes when the target user's key request behavior occurred. The spatial and temporal correlations between user behavior features and time nodes are further analyzed, generating spatiotemporal correlation features that incorporate these relationships. To more accurately measure the importance of user behavior features, a multi-head self-attention mechanism is introduced to conduct in-depth analysis of the user's historical key request behavior features. This mechanism evaluates the contribution of each feature to all request behaviors based on their relative importance. This contribution information quantifies the importance of each request behavior feature, thereby forming a feature weight distribution. Finally, the generated spatiotemporal correlation features are combined with the feature weight distribution to output information on the target user's historical key request behavior habits based on the security verification device. This effectively extracts temporal dynamic features and important patterns in user behavior, providing reliable information on historical key request habits and providing a foundation for subsequent risk assessment and behavioral modeling.

[0099] Furthermore, in a preferred embodiment of the present invention, the characteristic profile of the target user is generated based on the historical key request habit information, and is associated with the corresponding user log. When the target user makes a next request, risk monitoring is performed based on the corresponding characteristic profile, specifically including:

[0100] Obtain historical key request habit information, import the historical key request habit information into a graph neural network, convert the target user's historical key request habits into a graph data format through the graph neural network, and construct a request behavior feature profile of the target user;

[0101] A request behavior database is set up in the target security verification device, and a characteristic profile of each user's request behavior is stored in the request behavior database to monitor abnormal risks when the user makes key request behaviors;

[0102] When the target user makes the next key request, the target security verification device monitors the target user's real-time key request environment and behavior to obtain real-time key request monitoring information, and performs data preprocessing on the obtained real-time key request monitoring information;

[0103] Generate a search tag based on the target user's identity information, search the request behavior database to obtain the target user's request behavior feature profile, and perform similarity calculation with the pre-processed real-time key request information to obtain a cosine similarity value;

[0104] The calculated cosine similarity value is compared with the preset threshold. If it is greater than the preset threshold, it means that the current key request behavior of the target user is normal. Based on the key request requirement of the target user, the corresponding initial key is obtained for encryption and transmission;

[0105] If the value is less than the preset threshold, it indicates that the target user's current key request behavior is abnormal. Then, the target user's request behavior profile is used to analyze the difference between the target user's real-time request behavior and historical request behavior to obtain differential behavior analysis information.

[0106] Based on the differential behavior analysis information, a preset risk control strategy corresponding to the retrieved risk control strategy is used to control the real-time key request behavior of the target user.

[0107] It should be noted that historical key request habit information of the target user is obtained and imported into a graph neural network for processing. This data is converted into a graph data format, thereby constructing a characteristic profile of the target user's request behavior. This detailed record of the user's characteristics and habitual behaviors during the key request process provides data support for subsequent monitoring and analysis. Once constructed, the characteristic profile is stored in the target security verification device's request behavior database. This database is used to store the characteristic profiles of all users' request behaviors and serves as an important basis for monitoring potential abnormal risks in users' key request behaviors. When the target user makes another key request, the target security verification device monitors the target user's request environment and behavioral characteristics in real time, generating real-time key request monitoring information. After data preprocessing, this monitored information is correlated with the target user's characteristic profile stored in the request behavior database. The target user's identity information is used to generate a corresponding search tag, and the target user's request behavior characteristic profile is quickly retrieved from the database. Subsequently, the preprocessed real-time monitoring information is compared with the historical profile for similarity. The cosine similarity method is used to evaluate the consistency between the real-time behavior and the historical behavior, thereby obtaining a similarity value. Next, the calculated cosine similarity value is compared with a preset threshold. If the cosine similarity value is greater than the threshold, it indicates that the target user's current key request behavior matches the characteristics of their historical request behavior and is normal. At this point, the system extracts the corresponding initial key based on the target user's specific key request requirements, encrypts it, and securely transmits it. If the cosine similarity value is less than the preset threshold, it indicates that the target user's current request behavior is abnormal. The system analyzes the target user's request behavior profile, deeply compares the current real-time request behavior with the historical request behavior, and generates differential behavior analysis information. Finally, based on this differential behavior analysis information, it further retrieves the preset risk control policy that matches the current abnormal behavior and implements control over the target user's key request behavior based on this policy. This achieves dynamic risk assessment and security response based on historical data and real-time monitoring, providing an efficient security protection mechanism for key request behavior.

[0108] Figure 2 A flow chart of a method for monitoring key request anomalies according to an embodiment of the present invention;

[0109] like Figure 2 As shown, the present invention provides a flow chart of a key request anomaly monitoring method, including:

[0110] S202, obtaining historical key request monitoring information, inputting the historical key request monitoring information as input into a long short-term memory network for analysis, and extracting historical key request monitoring features using the time series processing capability of the long short-term memory network;

[0111] S204: Using a stacked autoencoder to perform feature encoding reconstruction to obtain a reconstructed historical key request monitoring feature, analyzing the spatiotemporal correlation between the target user's historical key request monitoring feature and the time nodes, and generating a spatiotemporal correlation feature;

[0112] S206, using a multi-head self-attention mechanism based on the spatiotemporal correlation feature to measure the contribution of each historical key request behavior feature of the target user to all request behavior features, and ultimately obtaining historical key request habit information;

[0113] S208: Convert the target user's historical key request habits into a graph data format through a graph neural network and construct a characteristic profile of the target user's request behavior. The profile is stored in a request behavior database for monitoring abnormal risks when the user makes key requests.

[0114] S210, when the target user makes the next key request, real-time key request monitoring information is obtained, a search tag is generated based on the target user's identity information, and a request behavior feature profile of the target user is obtained by searching the request behavior database;

[0115] S212: Calculate the similarity between the target user's request behavior feature portrait and the pre-processed real-time key request information to obtain a cosine similarity value, determine whether there is a risk, and retrieve the corresponding preset risk control strategy for control.

[0116] It should be noted that the target user's historical key request monitoring information includes the environmental and behavioral data of the user's key requests over the past period. This historical key request monitoring information is then fed into a long short-term memory (LSTM) network for in-depth analysis. As a specialized recurrent neural network, LSTM possesses powerful time series processing capabilities and can extract key features from historical key requests. These features reflect the user's key request behavior patterns at different time points. Next, a stacked autoencoder is used to encode and reconstruct the features extracted from the LSTM to generate reconstructed historical key request monitoring features. This process helps further refine and purify the features, making them more representative of the user's key request behavior. The spatiotemporal correlations between these reconstructed features and time nodes are then analyzed to generate spatiotemporal correlation features. This reveals how the user's key request behaviors at different time points are interrelated. After obtaining the spatiotemporal correlation features, a multi-head self-attention mechanism is used to measure the contribution of each historical key request behavior feature of the target user to all request behavior features. The multi-head self-attention mechanism assigns different weights to each feature, thereby identifying the features that most influence user behavior. Ultimately, the target user's historical key request habits are obtained, providing a comprehensive overview of their past key request behavior. To more intuitively display the user's key request habits, a graph neural network is used to convert these historical key request habits into a graph data format, and a characteristic profile of the target user's request behavior is constructed. This profile graphically displays the user's key request behavior characteristics. When the user makes their next key request, real-time key request monitoring information is obtained, and a search tag is generated based on the user's identity information. The request behavior characteristic profile associated with the user is then retrieved from the request behavior database. By calculating the similarity between the real-time request information and the characteristic profile, it is determined whether the current request matches the user's historical behavior, thereby determining whether there is any potential risk. If a risk is detected, the corresponding pre-set risk control policy is retrieved, and appropriate control measures are taken to ensure data security.

[0117] Furthermore, the key management method based on the security verification device provided by the present invention further includes the following steps:

[0118] A self-protection mechanism is set based on the safety verification device, and the operating status of the target safety verification device is monitored through the set self-protection mechanism to obtain operating status monitoring information;

[0119] Extracting the power supply characteristics of the internal power supply module of the target safety verification device based on the operation status monitoring information, and performing time sequencing to obtain a power supply characteristic sequence;

[0120] Inputting the power supply feature sequence into an anomaly detection model constructed based on a generative adversarial network for model training, retaining the model parameters after the training is completed and outputting the trained anomaly detection model;

[0121] By real-time monitoring of the target safety monitoring device, the real-time power supply characteristics of the power supply module are obtained, and the real-time power supply characteristics are input into the anomaly detection model for analysis to determine whether an abnormal power supply condition occurs, thereby obtaining abnormal power supply detection information;

[0122] Comparing the abnormal power supply detection information with a preset threshold, if the abnormal power supply detection information is less than the preset threshold, it means that the target safety verification device has a power supply battery failure;

[0123] When the power supply battery fails, the target security verification device uses the backup energy storage capacitor to provide short-term power supply based on the set self-protection mechanism to perform self-destruction operation on the stored key.

[0124] It should be noted that when the security verification device performs routine key management, if its corresponding power supply battery fails, human damage or abnormal intrusion may occur. To prevent the leakage of stored data or abnormal use of the controlled equipment, the stored keys need to be self-destructed to avoid abnormal risks. By setting a self-protection mechanism, it forms a two-layer security detection mechanism with the physical security detection mechanism set by the security verification device. This prevents the physical layer security detection mechanism from being bypassed, while the software layer can still identify abnormal conditions, thereby improving the security of key management.

[0125] Figure 3 A key management system 3 based on a security verification device is provided in one embodiment of the present invention. The system includes: a memory 31 and a processor 32. The memory 31 contains a key management method program based on the security verification device. When the key management method program based on the security verification device is executed by the processor 32, the following steps are implemented:

[0126] Obtain a target database that requires security management, perform authority and function analysis on the data stored in the target database, associate keys with authority and function to perform key partitioning, and associate the data stored in the target database with corresponding key partition levels;

[0127] Upon receiving a key generation request from the target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage.

[0128] Setting a key self-checking mechanism, through which the key stored in the encryption storage unit is checked and updated within a preset period;

[0129] Monitor the target user's key request behavior to obtain historical key request monitoring information, and analyze the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information;

[0130] A feature profile of the target user is generated based on the historical key request habit information and associated with the corresponding user log. When the target user makes a next request, risk monitoring is performed using the corresponding feature profile.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0132] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0133] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0134] Those skilled in the art will appreciate that all or part of the steps of the above-mentioned method embodiments may be implemented by hardware associated with program instructions, and the aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the program executes the steps of the above-mentioned method embodiments. The aforementioned storage medium includes various media that can store program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0135] Alternatively, if the integrated units described above are implemented as software modules and sold or used as standalone products, they can also be stored on a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present invention, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product, stored on a storage medium, includes instructions for enabling a computer device (such as a personal computer, server, or network device) to execute all or part of the methods described in various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as removable storage devices, ROM, RAM, magnetic disks, or optical disks.

[0136] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A key management method based on a security verification device, characterized in that: include: Obtain a target database that requires security management, perform authority and function analysis on the data stored in the target database, associate keys with authority and function to perform key partitioning, and associate the data stored in the target database with corresponding key partition levels; Upon receiving a key generation request from the target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage. Setting a key self-checking mechanism, through which the key stored in the encryption storage unit is checked and updated within a preset period; Monitor the target user's key request behavior to obtain historical key request monitoring information, and analyze the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information; Generate a feature profile of the target user based on the historical key request habit information, associate it with the corresponding user log, and perform risk monitoring based on the corresponding feature profile when the target user makes the next request; A self-protection mechanism is set based on the safety verification device, and the operating status of the target safety verification device is monitored through the set self-protection mechanism to obtain operating status monitoring information; Extracting power supply characteristics of an internal power supply module of a target safety verification device based on the operation status monitoring information, and performing time sequencing to obtain a power supply characteristic sequence; Inputting the power supply feature sequence into an anomaly detection model constructed based on a generative adversarial network for model training, retaining the model parameters after the training is completed and outputting the trained anomaly detection model; By real-time monitoring of the target safety monitoring device, the real-time power supply characteristics of the power supply module are obtained, and the real-time power supply characteristics are input into the anomaly detection model for analysis to determine whether an abnormal power supply condition occurs, thereby obtaining abnormal power supply detection information; Comparing the abnormal power supply detection information with a preset threshold, if the abnormal power supply detection information is less than the preset threshold, it means that the target safety verification device has a power supply battery failure; When the power supply battery fails, the target security verification device will self-destruct the stored key by providing a short power supply through the backup energy storage capacitor based on the set self-protection mechanism.

2. A key management method based on a security verification device according to claim 1, characterized in that: The step of obtaining a target database requiring security management, performing authority function analysis on data stored in the target database, associating keys with authority functions to perform key partitioning, and associating the data stored in the target database with corresponding key partition levels specifically includes: Obtain the target database that needs security management, obtain a list of all users and roles based on the target database, traverse each user and role to extract permission features, and obtain permission extraction information; Extracting data access scope features corresponding to different permission levels according to the permission extraction information, and analyzing access patterns of different permission levels to stored data based on the extracted access scope features to obtain access pattern analysis information; Defining authority functions of each authority level based on the access pattern analysis information, and associating corresponding authority functions with accessible data types and ranges to obtain first analysis information; Perform a key partitioning operation based on the first analysis information, define primary permissions and secondary permissions by the type and scope of data accessed by each permission, define a partition key based on the primary permission type and the secondary permission type, and obtain key partition information; The data stored in the target database is associated with the corresponding key partition level according to the key partition information, and different key partition levels correspond to different data types.

3. A key management method based on a security verification device according to claim 1, characterized in that: Upon receiving a key generation request from a target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage, specifically including: The target user sends a key generation request to the target security verification device through a system associated with the target security verification device. When the target security verification device receives the key generation request from the target user, it sends an identity authentication request to the target user to collect identity information; Obtaining identity collection information, including biometric identity information and digital identity information, and comparing and analyzing the identity collection information with identity data stored in a target database to determine whether the person is a known identity; If the target user's identity is known, the target user's permission characteristics are extracted to analyze whether the target user has the permission to request key generation; if so, the request data type is extracted from the target user's key generation request information and a random key seed is generated; Performing an encryption operation on the generated random key seed and the preset security parameters to generate an initial key, storing the initial key in the encryption storage unit of the security verification device, and recording the key generation time and generator information; When the target security verification device receives the key distribution request, it extracts the key from the encryption storage unit after identity verification, encrypts and encapsulates it, and sends the encapsulated key to the key distribution request user through a secure communication channel.

4. A key management method based on a security verification device according to claim 1, characterized in that: The setting of the key self-check mechanism, wherein the key stored in the encryption storage unit is checked and updated within a preset period by the key self-check mechanism, specifically includes: Extracting the initial keys stored in the target security verification device, clustering the keys based on their partition levels, and obtaining sets of initial keys of different partition levels; Perform feature extraction on each initial key set to convert the key into a feature vector, introduce a local sensitive hashing algorithm, and calculate the hash value and index value of each initial key in each initial key set; Creating a hash table, mapping each initial key set and the hash value and index value of each initial key to the hash table, wherein the key of the hash table is the hash value, and the value of the hash table is the index value of the corresponding initial key; Constructing hash chains of different key partitions based on the hash table, and performing key self-checking on the initial key set of each partition level according to a preset period through the hash chains of different key partitions; By calculating the hash value and index value of each initial key in the target initial key set during key self-checking, a self-checking hash chain is constructed and compared with the stored hash chain for analysis; If the self-checking hash chain is inconsistent with the stored hash chain, it means there is a risk of abnormal key tampering, then the abnormal hash chain position is extracted, and the abnormal initial key is obtained through the abnormal hash chain position; Based on the abnormal initial key, data associated with the abnormal initial key is obtained from the target database, and the key is regenerated to obtain a new initial key. The abnormal initial key is replaced by the new initial key, and the hash value and index value of the new initial key are calculated and updated in the stored hash chain.

5. The key management method based on the security verification device according to claim 1, characterized in that: The monitoring of the target user's key request behavior to obtain historical key request monitoring information, and analyzing the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information, specifically includes: Monitor the target user's key request behavior through the target security verification device to obtain historical key request monitoring information, wherein the historical key request monitoring information includes user request environment information and user usage behavior information; Introducing a long short-term memory network and initializing the input layer, hidden layer, and output layer of the long short-term memory network, importing the historical key request monitoring information as input features into the input layer, and using the target user's historical key request habits as output targets of the output layer; The time series processing capability of the long short-term memory network is used to extract historical key request monitoring features, and the stacked autoencoder is used to perform feature encoding reconstruction to obtain the reconstructed historical key request monitoring features; A learnable embedding dictionary is set in the hidden layer of the long short-term memory network to represent the time points of the target user's key request behavior. The spatiotemporal correlation between the target user's historical key request monitoring features and the time nodes is analyzed to generate spatiotemporal correlation features. Based on the spatiotemporal correlation features, a multi-head self-attention mechanism is used to measure the contribution of each historical key request behavior feature of the target user to all request behavior features, and the importance of the corresponding request behavior feature is represented by the contribution to obtain the feature weight distribution; The target user's historical key request habit of performing key request behaviors through the security verification device is output according to the feature weight distribution in combination with the spatiotemporal correlation feature to obtain historical key request habit information.

6. A key management method based on a security verification device according to claim 1, characterized in that: The feature profile of the target user is generated based on the historical key request habit information, and is associated with the corresponding user log. When the target user makes a next request, risk monitoring is performed using the corresponding feature profile, specifically including: Obtain historical key request habit information, import the historical key request habit information into a graph neural network, convert the target user's historical key request habits into a graph data format through the graph neural network, and construct a request behavior feature profile of the target user; A request behavior database is set up in the target security verification device, and a characteristic profile of each user's request behavior is stored in the request behavior database to monitor abnormal risks when the user makes key request behaviors; When the target user makes the next key request, the target security verification device monitors the target user's real-time key request environment and behavior to obtain real-time key request monitoring information, and performs data preprocessing on the obtained real-time key request monitoring information; Generate a search tag based on the target user's identity information, search the request behavior database to obtain the target user's request behavior feature profile, and perform similarity calculation with the pre-processed real-time key request information to obtain a cosine similarity value; The calculated cosine similarity value is compared with the preset threshold. If it is greater than the preset threshold, it means that the current key request behavior of the target user is normal. Based on the key request requirement of the target user, the corresponding initial key is obtained for encryption and transmission; If the value is less than the preset threshold, it indicates that the target user's current key request behavior is abnormal. Then, the target user's request behavior profile is used to analyze the difference between the target user's real-time request behavior and historical request behavior to obtain differential behavior analysis information. A preset risk control strategy corresponding to the differential behavior analysis information is retrieved, and the real-time key request behavior of the target user is controlled according to the obtained risk control strategy.

7. A key management system based on a security verification device, characterized in that: The system includes: a memory and a processor, wherein the memory contains a key management method program based on a security verification device, and when the key management method program based on the security verification device is executed by the processor, the following steps are implemented: Obtain a target database that requires security management, perform authority and function analysis on the data stored in the target database, associate keys with authority and function to perform key partitioning, and associate the data stored in the target database with corresponding key partition levels; Upon receiving a key generation request from the target user, the target user is authenticated. If the authentication passes and the target user's permission level analysis shows that the request content matches the permission level, the requested data type is extracted to generate an initial key for storage. Setting a key self-checking mechanism, through which the key stored in the encryption storage unit is checked and updated within a preset period; Monitor the target user's key request behavior to obtain historical key request monitoring information, and analyze the target user's historical key request habits based on the historical key request monitoring information to obtain historical key request habit information; Generate a feature profile of the target user based on the historical key request habit information, associate it with the corresponding user log, and perform risk monitoring based on the corresponding feature profile when the target user makes the next request; A self-protection mechanism is set based on the safety verification device, and the operating status of the target safety verification device is monitored through the set self-protection mechanism to obtain operating status monitoring information; Extracting power supply characteristics of an internal power supply module of a target safety verification device based on the operation status monitoring information, and performing time sequencing to obtain a power supply characteristic sequence; Inputting the power supply feature sequence into an anomaly detection model constructed based on a generative adversarial network for model training, retaining the model parameters after the training is completed and outputting the trained anomaly detection model; By real-time monitoring of the target safety monitoring device, the real-time power supply characteristics of the power supply module are obtained, and the real-time power supply characteristics are input into the anomaly detection model for analysis to determine whether an abnormal power supply condition occurs, thereby obtaining abnormal power supply detection information; Comparing the abnormal power supply detection information with a preset threshold, if the abnormal power supply detection information is less than the preset threshold, it means that the target safety verification device has a power supply battery failure; When the power supply battery fails, the target security verification device will self-destruct the stored key by providing a short power supply through the backup energy storage capacitor based on the set self-protection mechanism.

Images