A method and system for secure printing of sensitive data

Abstract

The application discloses a kind of safe printing method and system of sensitive data, it is related to the field of safe printing, and the user of access sensitive file is carried out permission classification by constructing permission authentication module, records user access information;Information encryption module is built, and sensitive file is divided into limited data cluster and is encrypted using data folding encryption mode, while introducing equivalent interference data cluster, using channel detection mechanism and data self-destruction mechanism to protect sensitive data;Build printing module to match and decrypt the encrypted file to obtain sensitive file, print sensitive file using private domain service network to ensure data security in printing process, the application guarantees the access security of database by user permission classification, ensures the transmission security of sensitive data by sensitive data folding encryption and data self-destruction mechanism, ensures the printing security of sensitive data by private domain service network, effectively solves the safe printing of sensitive data.

Description

A secure printing method and system for sensitive data Technical Field

[0001] This invention relates to the field of secure printing technology, and more specifically to a secure printing method and system for sensitive data. Background Technology

[0002] Secure printing technology is an important means of ensuring the security of sensitive data. Its core is to prevent sensitive data from being leaked or illegally accessed during the printing process through encryption, watermarking, data deletion and other technical means. This technology is mainly used in government, finance, medical and other fields. It ensures the security and confidentiality of sensitive data by encrypting printed data, restricting access permissions and deleting printed data.

[0003] Most existing technologies use common encryption techniques, which can effectively reduce the risk of sensitive data leakage, but cannot completely eliminate the possibility of information leakage. This invention proposes a brand-new encryption method that encrypts data by folding data and sets up interference data to ensure data security during the data printing process. Summary of the Invention

[0004] The purpose of this invention is to provide a secure printing method and system for sensitive data to address the shortcomings of the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a secure printing system for sensitive data, comprising:

[0006] The access control module classifies database files into sensitive and ordinary files. It also classifies users who access the database into ordinary users, level 2 users, and level 1 users based on their permissions. The module records user information, access operations, and access time when a user accesses a database file as access information.

[0007] Information encryption module: Connected to the authorization module, when a user needs to print a sensitive file, the sensitive file is divided into a limited number of data clusters according to a preset data volume and encrypted to generate encrypted data clusters. At the same time, an equal number of interference data clusters are generated. The encrypted data clusters are randomly tagged using a sensitive data tag library, and the interference data clusters are tagged using an interference tag library. The encrypted data clusters and interference data clusters are arranged alternately and numbered. The random tags and corresponding numbers are used as random tag information, and the interference tags and corresponding numbers are used as interference tag information. The encrypted data clusters and interference data clusters are combined into a file to be printed and transmitted using a dedicated channel. The access information, random tag information, and interference tag information are packaged into audit information.

[0008] Printing module: Connects to the information encryption module, enables the private domain service network, obtains audit information and the file to be printed, uses the sensitive data tag library to match the audit information to obtain the encrypted data cluster and key, decrypts the sensitive file at the printing end, performs the sensitive file printing operation, records the printing time and file information as printing information, and saves the printing information and audit information as log files in the private domain service network.

[0009] In a new embodiment, the authorization module includes:

[0010] Database files are classified into sensitive files and ordinary files, with sensitive files containing sensitive data. Access permissions for users are classified into ordinary users, second-level users, and first-level users.

[0011] Ordinary users can only access ordinary files, while secondary users can read all database files. To perform a printing operation, a primary user needs to provide a verification key. Primary users can access all database files and obtain verification keys that are updated periodically.

[0012] When a user logs into the database, facial recognition and user information authentication are required, and the user information is recorded. When accessing sensitive files, facial recognition and user information authentication are required again, and the user's access operation and access time are also recorded.

[0013] User information, access operations, and access time are used as access information, where user information includes user image, identity information, phone number, and job information.

[0014] In a new embodiment, the information encryption module includes:

[0015] When a user prints a sensitive file, the sensitive file is divided into a finite number of data clusters according to a preset data volume and encrypted to obtain encrypted data clusters. At the same time, an interference data cluster of the same amount is generated.

[0016] Random labels are applied to encrypted data clusters based on a sensitive data label library, and interference labels are applied to interference data clusters based on an interference label database.

[0017] Encrypted data clusters and interference data clusters are interleaved and numbered sequentially. The encrypted data clusters and interference data clusters are combined into a file to be printed and transmitted using a dedicated transmission channel. Random tags and their corresponding numbers are used as random tag information, interference tags and their corresponding numbers are used as interference tag information, and access information, random tag information, and interference tag information are used as audit information.

[0018] In a new embodiment, the steps of dividing sensitive files into a finite number of data clusters according to a preset data volume and encrypting them to obtain encrypted data clusters, while simultaneously generating interference data clusters of the same number as the encrypted data clusters, are as follows:

[0019] Acquire sensitive files, calculate the amount of data in the sensitive files, and divide the sensitive files into a finite number of data clusters according to a preset data volume;

[0020] Construct a data carrier with a finite number of data folds. The data carrier is a planar carrier capable of storing data. Construct a spatial coordinate system for the planar carrier with the center point of the planar carrier, and the coordinate axes are x, y, and z.

[0021] Construct folding rules, which include the number of folds, folding direction, folding position, folding surface, and folding degree;

[0022] The number of folds is represented by a constant, the folding direction is based on the z-axis of the spatial coordinate system, the folding position is formed by connecting the vertex coordinates of the fold, the folding surface is formed by the vertex coordinates of the folded part, and the degree of folding is based on the folding angle obtained from the folding surface. The angle is divided into six levels in 30-degree increments, represented by the letters A, B, C, D, E, and F. The later the letter, the higher the degree of folding.

[0023] A finite number of data clusters are stored on a finite number of data carriers. The finite number of data carriers are randomly folded according to the folding rules to obtain encrypted data clusters, and the folding rules are recorded as keys.

[0024] Simultaneously generate interference data clusters of the same quantity as the encrypted data clusters;

[0025] Each interference data cluster contains a preset amount of ordinary data, and the encryption method of an equal amount of interference data cluster is the same as that of the encrypted data cluster.

[0026] In a new embodiment, the step of interleaving and sequentially numbering encrypted data clusters and combining them into a printable file using a dedicated transmission channel is as follows:

[0027] The key is bound to the jamming data cluster. The jamming data cluster is connected to the corresponding encrypted data cluster through the data channel based on the key. The encrypted data cluster and the jamming data cluster are numbered in the order of the sensitive file data to obtain the file to be printed.

[0028] The data channel is equipped with a channel detection mechanism and a data self-destruction mechanism. The channel detection mechanism is used to detect the channel information of the dedicated transmission channel, and the data self-destruction mechanism is used to destroy the data when the triggering conditions are met.

[0029] The document to be printed is transmitted through a dedicated channel. When the channel detection mechanism detects a change in the channel information, it triggers a data self-destruction mechanism to destroy the encrypted data cluster.

[0030] In a new embodiment, the printing module includes:

[0031] Enable the private domain service network to receive documents to be printed and audit information;

[0032] The sensitive data tag library is used to match the audit information. The printing end obtains the encrypted data clusters and the keys on the interference data clusters in the file to be printed. The corresponding keys are used to decrypt the encrypted data clusters in ascending order according to their numbers to obtain the sensitive file.

[0033] Perform sensitive document printing operations and record the printing time and document information as printing information. Store the printing information and audit information as log files on a private domain server.

[0034] In a new embodiment, the private domain service network includes:

[0035] The private domain service network is used only for printing sensitive files, including the database and printing terminals, as well as a dedicated transmission channel connecting the database and printing terminals, and is used only for transmitting the files to be printed;

[0036] The database transmits the files to be printed and audit information to the printing end through a dedicated transmission channel. After the printing operation is completed, sensitive files are deleted and only log files are retained.

[0037] This invention also provides a method for securely printing sensitive data, comprising:

[0038] Database files are classified into sensitive files and ordinary files. Users accessing the database are classified into ordinary users, second-level users, and first-level users according to their permissions. User information, access operations, and access time when accessing database files are recorded as access information.

[0039] When a user needs to print a sensitive file, the sensitive file is divided into a limited number of data clusters according to a preset data volume and encrypted to generate encrypted data clusters. At the same time, an equal number of interference data clusters are generated. The encrypted data clusters are randomly tagged using a sensitive data tag library, and the interference data clusters are tagged using an interference tag library. The encrypted data clusters and interference data clusters are arranged alternately and numbered. The random tags and their corresponding numbers are used as random tag information, and the interference tags and their corresponding numbers are used as interference tag information. The encrypted data clusters and interference data clusters are combined into a file to be printed and transmitted using a dedicated channel. The access information, random tag information, and interference tag information are packaged into audit information.

[0040] The private domain service network is activated to obtain audit information and files to be printed. The audit information is matched with a sensitive data tag library to obtain encrypted data clusters and keys. The printing end decrypts the data to obtain sensitive files and performs the sensitive file printing operation. The printing time and file information are recorded as printing information. The printing information and audit information are stored as log files in the private domain service network.

[0041] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0042] 1. This invention constructs a data folding encryption method to store sensitive data on a planar carrier. By folding the carrier multiple times, the sensitive data is encrypted. The new encryption method ensures that if sensitive data is leaked during the printing process, the thief will not be able to use an effective decryption method, thus ensuring the security of the sensitive data.

[0043] 2. This invention constructs an interference data cluster and sets up a channel detection mechanism and a data destruction mechanism to ensure the confidentiality of sensitive data during transmission. When sensitive data is attacked and stolen by others during transmission, or when the transmission channel changes, the data destruction mechanism is triggered to destroy the sensitive data and prevent data leakage. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0045] Figure 1 is a system block diagram of the present invention;

[0046] Figure 2 is a flowchart of the method of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] Example 1, as shown in Figure 1, describes a secure printing system for sensitive data, comprising:

[0049] The access control module classifies database files into sensitive and ordinary files. It also classifies users who access the database into ordinary users, level 2 users, and level 1 users based on their permissions. The module records user information, access operations, and access time when a user accesses a database file as access information.

[0050] Information encryption module: Connected to the authorization module, when a user needs to print a sensitive file, the sensitive file is divided into a limited number of data clusters according to a preset data volume and encrypted to generate encrypted data clusters. At the same time, an equal number of interference data clusters are generated. The encrypted data clusters are randomly tagged using a sensitive data tag library, and the interference data clusters are tagged using an interference tag library. The encrypted data clusters and interference data clusters are arranged alternately and numbered. The random tags and corresponding numbers are used as random tag information, and the interference tags and corresponding numbers are used as interference tag information. The encrypted data clusters and interference data clusters are combined into a file to be printed and transmitted using a dedicated channel. The access information, random tag information, and interference tag information are packaged into audit information.

[0051] Printing module: Connects to the information encryption module, enables the private domain service network, obtains audit information and the file to be printed, uses the sensitive data tag library to match the audit information to obtain the encrypted data cluster and key, decrypts the sensitive file at the printing end, performs the sensitive file printing operation, records the printing time and file information as printing information, and saves the printing information and audit information as log files in the private domain service network;

[0052] To further explain, secure printing technology is a crucial means of ensuring the security of sensitive data. Its core lies in using encryption, watermarking, and data deletion techniques to prevent sensitive data from being leaked or illegally accessed during the printing process. While existing technologies mostly employ common encryption techniques, which can effectively reduce the risk of sensitive data leakage, they cannot completely eliminate the possibility of information leakage. This invention constructs a data folding encryption method, storing sensitive data on a planar carrier. Through multiple folding operations of the carrier, the sensitive data is encrypted. This new encryption method ensures that if sensitive data is leaked during printing, the thief cannot effectively decrypt it, guaranteeing the security of the sensitive data. Simultaneously, by constructing interference data clusters and setting up channel detection and data destruction mechanisms, the leakage problem of sensitive data during transmission is prevented. When sensitive data is attacked and stolen during transmission, causing a change in the transmission channel, the data destruction mechanism is triggered to destroy the sensitive data and prevent further leakage.

[0053] In one embodiment, the authorization module includes:

[0054] Database files are classified into sensitive files and ordinary files, with sensitive files containing sensitive data. Access permissions for users are classified into ordinary users, second-level users, and first-level users.

[0055] Ordinary users can only access ordinary files, while secondary users can read all database files. To perform a printing operation, a primary user needs to provide a verification key. Primary users can access all database files and obtain verification keys that are updated periodically.

[0056] When a user logs into the database, facial recognition and user information authentication are required, and the user information is recorded. When accessing sensitive files, facial recognition and user information authentication are required again, and the user's access operation and access time are also recorded.

[0057] User information, access operations, and access time are used as access information, where user information includes user image, identity information, phone number, and job information;

[0058] To further explain, tiered access permissions for users effectively ensure the security of sensitive files. Database files are categorized into sensitive files and ordinary files based on whether they contain sensitive data. Users are also categorized into ordinary users, secondary users, and primary users, with different permissions assigned to each. Ordinary users can only access ordinary files, secondary users can read sensitive files but cannot perform operations, and primary users must provide a verification key for further operations. Primary users have the highest privileges, can access and operate on all files, and can obtain the verification key. The verification key is updated daily. All users accessing the database must undergo information authentication, which involves both facial recognition and data entry. Access to sensitive files requires secondary authentication, effectively ensuring the security of sensitive data.

[0059] In one embodiment, the information encryption module includes:

[0060] When a user prints a sensitive file, the sensitive file is divided into a finite number of data clusters according to a preset data volume and encrypted to obtain encrypted data clusters. At the same time, an interference data cluster of the same amount is generated.

[0061] Random labels are applied to encrypted data clusters based on a sensitive data label library, and interference labels are applied to interference data clusters based on an interference label database.

[0062] Encrypted data clusters and interference data clusters are interleaved and numbered sequentially. The encrypted data clusters and interference data clusters are combined as a file to be printed and transmitted using a dedicated transmission channel. Random tags and their corresponding numbers are used as random tag information, interference tags and their corresponding numbers are used as interference tag information, and access information, random tag information, and interference tag information are used as audit information.

[0063] To further explain, when a user needs to print a sensitive document, the data of the sensitive document is divided into a finite number of data clusters according to a preset quantity. Each data cluster is encrypted to obtain an encrypted data cluster. At the same time, a preset number of random ordinary data are encrypted to obtain interference data clusters, mimicking the encryption method of the encrypted data clusters. Random labels and interference labels are respectively applied to the encrypted data clusters and the interference data clusters. The encrypted data clusters and interference data clusters are then interleaved to obtain the document to be printed. Each type of data cluster is numbered in turn, and access information, random label information, and interference label information are recorded as audit information. The audit information is used to trace the process after sensitive data leakage and find the cause of the leakage.

[0064] In one embodiment, the steps of dividing sensitive files into a finite number of data clusters according to a preset data volume and encrypting them to obtain encrypted data clusters, while simultaneously generating interference data clusters of equal quantity to the encrypted data clusters, are as follows:

[0065] Acquire sensitive files, calculate the amount of data in the sensitive files, and divide the sensitive files into a finite number of data clusters according to a preset data volume;

[0066] Construct a data carrier with a finite number of data folds. The data carrier is a planar carrier capable of storing data. Construct a spatial coordinate system for the planar carrier with the center point of the planar carrier, and the coordinate axes are x, y, and z.

[0067] Construct folding rules, which include the number of folds, folding direction, folding position, folding surface, and folding degree;

[0068] The number of folds is represented by a constant, the folding direction is based on the z-axis of the spatial coordinate system, the folding position is formed by connecting the vertex coordinates of the fold, the folding surface is formed by the vertex coordinates of the folded part, and the degree of folding is based on the folding angle obtained from the folding surface. The angle is divided into six levels in 30-degree increments, represented by the letters A, B, C, D, E, and F. The later the letter, the higher the degree of folding.

[0069] A finite number of data clusters are stored on a finite number of data carriers. The finite number of data carriers are randomly folded according to the folding rules to obtain encrypted data clusters, and the folding rules are recorded as keys.

[0070] Simultaneously generate interference data clusters of the same quantity as the encrypted data clusters;

[0071] Each interference data cluster contains a preset amount of ordinary data, and the encryption method of an equal amount of interference data cluster is the same as that of the encrypted data cluster.

[0072] To further explain, the data in sensitive files is segmented according to a preset data size. This preset size is selected based on the file's data volume; for example, if the file contains 10,000 data points, the preset size could be defined as 100. A data folding carrier is constructed, which is a storage device. The data is stored in a flat, tiled format, enabling data folding operations. Encrypted data clusters are stored on this planar carrier, which is then folded. Folding rules include the number of folds, folding direction, folding position, folding surface, and folding degree. These rules rely on a spatial coordinate system constructed for the planar carrier. The number of folds indicates how many times the carrier has been folded, and the folding direction is based on the spatial coordinate system. The z-axis can be represented as positive and negative. The folding position can be determined by connecting the vertices of the fold. For example, the folding surface of a triangle is formed by connecting the two endpoints of the triangle's baseline on the xy plane. The folding surface is formed by connecting the three vertices of the triangle. The degree of folding is determined by the folding angle. The larger the angle, the higher the degree of folding. The degree of folding is expressed in characters, A, B, C, D, E, and F, with 30 degrees as the scale. The folding rules generated during the folding operation of sensitive data are used as keys for subsequent decryption operations. At the same time, ordinary data is encrypted in the same way as a cluster of interference data.

[0073] In one embodiment, the steps of interleaving and sequentially numbering encrypted data clusters and combining them into a file to be printed, and then transmitting the combined encrypted and interference data clusters using a dedicated transmission channel, are as follows:

[0074] The key is bound to the jamming data cluster. The jamming data cluster is connected to the corresponding encrypted data cluster through the data channel based on the key. The encrypted data cluster and the jamming data cluster are numbered in the order of the sensitive file data to obtain the file to be printed.

[0075] The data channel is equipped with a channel detection mechanism and a data self-destruction mechanism. The channel detection mechanism is used to detect the channel information of the dedicated transmission channel, and the data self-destruction mechanism is used to destroy the data when the triggering conditions are met.

[0076] The document to be printed is transmitted through a dedicated channel. When the channel detection mechanism detects a change in the channel information, it triggers a data self-destruction mechanism to destroy the encrypted data cluster.

[0077] To further explain, a key is bound to a jamming data cluster, and the encrypted data cluster is identified through the key. The encrypted data cluster and the jamming data cluster are connected through a data channel. The encrypted data cluster and the jamming data cluster are interleaved and numbered according to the data order of the sensitive file. A channel detection mechanism and a data self-destruction mechanism are set on the data channel. The channel detection mechanism is used to detect the channel information of the transmission channel, including the channel bandwidth, frequency range, signal-to-noise ratio, routing information, and IP address. When the channel detection mechanism detects a change in the channel information, it triggers the data self-destruction mechanism to destroy the encrypted data cluster, thus ensuring the security of sensitive data.

[0078] In one embodiment, the printing module includes:

[0079] Enable the private domain service network to receive documents to be printed and audit information;

[0080] The sensitive data tag library is used to match the audit information. The printing end obtains the encrypted data clusters and the keys on the interference data clusters in the file to be printed. The corresponding keys are used to decrypt the encrypted data clusters in ascending order according to their numbers to obtain the sensitive file.

[0081] Perform sensitive document printing operations and record the printing time and document information as printing information. Store the printing information and audit information as log files in the private domain service network.

[0082] To further explain, based on the private domain service network, the random and interference tag information in the audit file is matched with the sensitive data tag library to obtain the key and encrypted data clusters and their numbers. The encrypted data clusters are arranged in sequence according to the numbers and decrypted using the key. The sensitive file is obtained by performing a defolding operation based on the key. During the printing process, the printing information, including the printing time and file information, is recorded. The printing information and audit information are stored as log files in the private domain service network for information tracing after sensitive data leakage.

[0083] In one embodiment, the private domain service network includes:

[0084] The private domain service network is used only for printing sensitive files, including the database and printing terminals, as well as a dedicated transmission channel connecting the database and printing terminals, and is used only for transmitting the files to be printed;

[0085] The database transmits the files to be printed and audit information to the printing end through a dedicated transmission channel. After the printing operation is completed, sensitive files are deleted and only log files are retained.

[0086] To further explain, the private domain service network setup only includes the database end, the printing end, and dedicated transmission channels at both ends. The high independence of the private domain service network ensures the security of sensitive files during transmission and printing. After the printing operation is completed, the sensitive files are deleted and only the log files are retained, further ensuring the security of sensitive data. Moreover, the retention of the log files makes it easy to view the usage dynamics of sensitive files.

[0087] A secure printing method for sensitive data includes:

[0088] Database files are classified into sensitive files and ordinary files. Users accessing the database are classified into ordinary users, second-level users, and first-level users according to their permissions. User information, access operations, and access time when accessing database files are recorded as access information.

[0089] When a user needs to print a sensitive file, the sensitive file is divided into a limited number of data clusters according to a preset data volume and encrypted to generate encrypted data clusters. At the same time, an equal number of interference data clusters are generated. The encrypted data clusters are randomly tagged using a sensitive data tag library, and the interference data clusters are tagged using an interference tag library. The encrypted data clusters and interference data clusters are arranged alternately and numbered. The random tags and their corresponding numbers are used as random tag information, and the interference tags and their corresponding numbers are used as interference tag information. The encrypted data clusters and interference data clusters are combined into a file to be printed and transmitted using a dedicated channel. The access information, random tag information, and interference tag information are packaged into audit information.

[0090] The private domain service network is activated to obtain audit information and files to be printed. The audit information is matched with a sensitive data tag library to obtain encrypted data clusters and keys. The printing end decrypts the data to obtain sensitive files and performs the sensitive file printing operation. The printing time and file information are recorded as printing information. The printing information and audit information are stored as log files in the private domain service network.

[0091] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A secure printing system for sensitive data, characterized in that: The access control module classifies database files into sensitive and regular files. Users accessing the database are categorized into regular, secondary, and primary users based on their permissions. User information, access operations, and access times are recorded as access information. The information encryption module connects to the access control module. When a user needs to print a sensitive file, the sensitive file is divided into a finite number of data clusters according to a preset data size and encrypted to generate encrypted data clusters. Simultaneously, an equal number of interference data clusters are generated. A sensitive data tag library is used to randomly label the encrypted data clusters, and an interference tag library is used to add interference tags to the interference data clusters. The encrypted and interference data clusters are then combined. The steps involve interleaving and numbering encrypted and interfering data clusters, using random tags and their corresponding numbers as random tag information, and interference tags and their corresponding numbers as interference tag information. Encrypted and interfering data clusters are combined into a printable file and transmitted via a dedicated channel. Access information, random tag information, and interference tag information are packaged into audit information. The process involves interleaving and numbering encrypted and interfering data clusters, combining them into a printable file, and transmitting it via a dedicated transmission channel. This is done by binding a key to the interfering data cluster, connecting the interfering data cluster to its corresponding encrypted data cluster via a data channel, and numbering the encrypted and interfering data clusters sequentially according to the sensitive file data order to obtain the printable file. The data channel is equipped with a channel detection mechanism and a data self-destruction mechanism. The channel detection mechanism is used to detect the channel information of the dedicated transmission channel, and the data self-destruction mechanism is used to destroy the data when the trigger conditions are met. The document to be printed is transmitted through the dedicated channel. When the channel detection mechanism detects a change in the channel information, it triggers the data self-destruction mechanism to complete the destruction of the encrypted data cluster. Printing module: Connects to the information encryption module, enables the private domain service network, obtains audit information and the file to be printed, uses the sensitive data tag library to match the audit information to obtain the encrypted data cluster and key, decrypts the sensitive file at the printing end, performs the sensitive file printing operation, records the printing time and file information as printing information, and saves the printing information and audit information as log files in the private domain service network.

2. The secure printing system for sensitive data according to claim 1, characterized in that: The access authentication module includes: classifying database files into sensitive files and ordinary files, where sensitive files contain sensitive data; classifying access users into ordinary users, level two users, and level one users; ordinary users can only access ordinary files, level two users can read all database files, and level one users need to provide a verification key to perform printing operations; level one users can access all database files and can obtain periodically updated verification keys; when a user logs into the database, facial recognition and user information authentication are required, and user information is recorded; when accessing sensitive files, facial recognition and user information authentication are required again, and user information is recorded, along with the user's access operations and access time; user information, access operations, and access time are used as access information, where user information includes user image, identity information, phone number, and job information.

3. The secure printing system for sensitive data according to claim 1, characterized in that: The steps of dividing the sensitive file into a finite number of data clusters according to a preset data volume and encrypting them to obtain encrypted data clusters, while generating interference data clusters of the same amount as the encrypted data clusters, are as follows: Acquire the sensitive file, count the data volume of the sensitive file, and divide the sensitive file into a finite number of data clusters according to the preset data volume; construct a data carrier with a finite number of data folds, the data carrier being a planar carrier capable of storing data, constructing a spatial coordinate system of the planar carrier with the center point of the planar carrier, the coordinate axes being x, y, and z; construct folding rules, the folding rules including the number of folds, folding direction, folding position, folding surface, and folding degree; The number of folds is represented by a constant, the folding direction is based on the z-axis of the spatial coordinate system, the folding position is formed by connecting the vertex coordinates of the fold, the folding surface is composed of the vertex coordinates of the folded part, and the degree of folding is based on the folding angle obtained from the folding surface. The angle is divided into six levels in 30-degree increments, represented by the letters A, B, C, D, E, and F, with the later the letter, the higher the degree of folding. A finite number of data clusters are stored on a finite number of data carriers. Based on the folding rules, the finite number of data carriers are randomly folded to obtain encrypted data clusters, and the folding rules are recorded as keys. At the same time, an equal number of interference data clusters are generated. Each interference data cluster contains a preset amount of ordinary data, and the encryption method of the equal number of interference data clusters is the same as that of the encrypted data clusters.

4. The secure printing system for sensitive data according to claim 1, characterized in that: The printing module includes: enabling the private domain service network, receiving the file to be printed and audit information; matching the audit information using a sensitive data tag library, obtaining the encrypted data clusters and the keys on the interference data clusters in the file to be printed, and decrypting them by combining the corresponding keys in ascending order according to the encrypted data cluster numbers to obtain the sensitive file; performing the sensitive file printing operation, and recording the printing time and file information as printing information, and storing the printing information and audit information as log files on the private domain server.

5. A secure printing system for sensitive data according to claim 1, characterized in that: The private domain service network includes: the private domain service network is used only for printing sensitive files, including a database end and a printing end, as well as a dedicated transmission channel connecting the database end and the printing end, and is used only for transmitting the file to be printed; the database end transmits the file to be printed and audit information to the printing end through the dedicated transmission channel, and after the printing operation is completed, the sensitive file is deleted and only the log file is retained.

6. A method for securely printing sensitive data, used to implement the secure printing system for sensitive data as described in any one of claims 1-5, characterized in that: Database files are classified into sensitive files and ordinary files. Users accessing the database are classified into ordinary users, second-level users, and first-level users according to their permissions. User information, access operations, and access time when accessing database files are recorded as access information. When a user needs to print a sensitive file, the sensitive file is divided into a finite number of data clusters according to a preset data volume, and encrypted to generate encrypted data clusters. Simultaneously, an equal number of interference data clusters are generated. A sensitive data tag library is used to assign random tags to the encrypted data clusters, and an interference tag library is used to assign interference tags to the interference data clusters. The encrypted and interference data clusters are arranged alternately and numbered. Random tags and their corresponding numbers are used as random tag information, and interference tags and their corresponding numbers are used as interference tag information. The encrypted and interference data clusters are combined into a file to be printed and transmitted using a dedicated channel. Access information, random tag information, and interference tag information are packaged into audit information. A private domain service network is activated to obtain the audit information and the file to be printed. The sensitive data tag library is used to match the audit information to obtain the encrypted data clusters and keys. The printer decrypts the data to obtain the sensitive file and performs the printing operation. The printing time and file information are recorded as printing information. The printing information and audit information are stored as log files in the private domain service network.

Images