Data encryption strategy formulation and data full life cycle security assurance system and method based on artificial intelligence

Abstract

The present invention relates to the field of data security technology, and discloses an artificial intelligence-based data encryption strategy formulation and data full life cycle security assurance system and method, including multiple public clouds and intelligent encryption and decryption engines, and deploying business systems, databases, encryption judgment service systems and encryption and decryption service systems on multiple public cloud platforms respectively. The intelligent encryption and decryption engine includes a cataloging system, a key management service system and an authorization management service system; by introducing the intelligent encryption engine, cataloging system, encryption judgment service, key management module and artificial intelligence algorithm, the intelligent identification, dynamic update and automatic execution of data encryption strategies are realized, and combined with multiple links such as authorization management and encryption and decryption services, a security assurance system covering the entire data life cycle is constructed.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically to an artificial intelligence-based data encryption strategy formulation and data full life cycle security assurance system and method. Background Art

[0002] With the rapid development of information technology, cloud computing, as a new IT service model, has been widely adopted in enterprise information construction and data management. Public cloud, as one of the key cloud computing service models, provides computing resources, storage resources, network services, and other infrastructure support to the public and enterprises via the internet, significantly reducing the construction and operation and maintenance costs of enterprise IT systems while improving resource utilization and business deployment efficiency.

[0003] However, with the increasing adoption of multi-cloud architectures by enterprises, data interaction and management across public cloud environments has become a major challenge in the current development of cloud computing. In particular, the heterogeneity of different public cloud platforms and the lack of unified security policy management and key control mechanisms expose sensitive data to risks such as leakage, tampering, and unauthorized access during cross-platform transmission and processing. Therefore, how to achieve data security across public cloud environments has become a core issue that needs to be addressed in the field of cloud computing security.

[0004] Traditional data encryption methods often rely on manually defined encryption rules or configuration based on fixed templates. However, with the explosive growth of data volumes and the increasing complexity of data types, this static, manual approach can no longer meet the dual requirements of data security and processing efficiency in modern information systems. Furthermore, when it comes to managing data throughout its lifecycle, existing technologies often focus solely on security during the data storage phase, while ignoring security risks in other stages of data generation, transmission, use, and even destruction.

[0005] In summary, the current data security system across public cloud environments still has the following major problems:

[0006] 1) Lack of intelligent data encryption strategy formulation: Traditional methods rely on manual judgment and cannot adapt to the rapid changes in massive and multi-type data. They also lack the automatic identification and hierarchical encryption capabilities based on AI algorithms.

[0007] 2) Inflexible encryption rule management: Static encryption rules are difficult to adapt to dynamically changing business scenarios and lack an effective automated update mechanism.

[0008] 3) Insufficient security protection for the entire data lifecycle: Lack of security control measures covering the entire process of data generation, storage, transmission, and use;

[0009] 4) Difficulty in cross-cloud security management: The lack of a unified encryption engine and key management system makes it difficult to implement consistent data security policy applications across multiple public clouds.

[0010] In response to the above problems, the present invention proposes an artificial intelligence-based intelligent data encryption strategy formulation and data full life cycle security assurance system and method. Summary of the Invention

[0011] In light of this, this paper presents an AI-based data encryption policy formulation and data lifecycle security assurance system and method, designed to address data security challenges across public cloud environments. By introducing an intelligent encryption engine, cataloging system, encryption determination service, key management module, and AI algorithms, it enables intelligent identification, dynamic updating, and automated execution of data encryption policies. Combined with authorization management, encryption and decryption services, it builds a comprehensive security system covering the entire data lifecycle.

[0012] In order to achieve the above object, the present invention adopts the following technical solutions:

[0013] An AI-based data encryption strategy development and data lifecycle security assurance system, including multiple public clouds and intelligent encryption and decryption engines. Each public cloud is equipped with a business system, database, encryption judgment service system, and encryption and decryption service system. The intelligent encryption and decryption engine includes a cataloging system, a key management service system, and an authorization management service system.

[0014] The application system is used to receive data operation requests input by users, execute corresponding business logic, and generate operation instructions for the database;

[0015] The database is used to store data and provide data access interfaces for application systems;

[0016] The cataloging system is responsible for analyzing the data structure information in the database. By evaluating the sensitivity and importance of the data, it automatically identifies the data in the fields that need to be encrypted, formulates encryption and decryption rules, periodically updates the encryption and decryption rules, and sends the latest encryption and decryption rules to the encryption judgment service system to achieve dynamic management;

[0017] The key management service system is used to complete the life cycle management of keys;

[0018] The authorization management service system is used to verify access rights to the encryption judgment service systems in each public cloud and complete authorization management;

[0019] The encryption judgment service system is used to complete authorization operations and regularly obtain the latest encryption and decryption rules from the cataloging system. It also intercepts operation instructions when the application system initiates data operation requests and determines in real time whether encryption or decryption is required based on the current operation type and field information. If encryption or decryption is determined to be necessary, it calls the cataloging system to obtain encryption and decryption rules.

[0020] The encryption and decryption service system is used to respond to requests from the encryption judgment service system, obtain the corresponding key from the key management service system, perform specific encryption or decryption operations according to the preset encryption level, and return the processed data to the application system or write it to the database.

[0021] Preferably, the operation instructions include operations of adding, querying, updating or deleting data.

[0022] Preferably, the lifecycle management of the key includes the generation, storage, distribution, update and synchronization of the key.

[0023] Preferably, the encryption and decryption rules include the encryption level, encryption algorithm and parameter configuration of the field.

[0024] Preferably, the encryption and decryption rules are regularly trained, specifically including:

[0025] Convert the field name in the field into a word vector, extract the field data type, field length, the field data volume and perform a full connection operation with the word vector to obtain a length of word vector Composition feature matrix ;

[0026] The feature matrix In the input feedforward neural network model, the feedforward neural network model includes four hidden layers and one output layer;

[0027] Each hidden layer uses variables Indicates that the processing through the hidden layer is:

[0028]

[0029]

[0030] in, and Representing the layer weight matrices and biases, is the RELU activation function, and express The input and output of

[0031]

[0032] represents the weight matrix of the first hidden layer, represents the offset vector of the first hidden layer, and Represents the input and output of the first hidden layer;

[0033] After the hidden layer, the input matrix is obtained , input matrix The output layer probability distribution is obtained through the output layer and the Softmax function :

[0034]

[0035] in, Indicates the encryption levels, is the number of encryption levels, As a temporary variable in the accumulated value, Indicates the total number of samples Middle samples, Represents the output layer input matrix No. In the sample The encryption level value, Representative The sample in The value to be accumulated for each encryption level;

[0036] Use the cross entropy loss function to calculate the loss and train the model to the optimal state:

[0037]

[0038] in, Representative In the sample The true value of the encryption level, represents the function value of the cross entropy function, N Indicates the total number of samples.

[0039] AI-based data encryption strategy formulation and data lifecycle security assurance methods, including:

[0040] Business systems, databases, encryption judgment service systems, and encryption and decryption service systems are deployed on multiple public cloud platforms. The cataloging system is responsible for analyzing the data structure information in the database. By assessing the sensitivity and importance of the data, it automatically identifies the data in the fields that need to be encrypted, formulates encryption and decryption rules, determines the corresponding encryption level, and periodically updates the encryption and decryption rules. The latest encryption and decryption rules are sent to the encryption judgment service system to achieve dynamic management. The authorization management service system regularly verifies the access rights of the encryption judgment service systems in each public cloud to complete authorization management.

[0041] Receive data operation requests input by users through the application system, execute corresponding business logic, and generate operation instructions for the database;

[0042] The encryption judgment service system intercepts the operation instructions and determines in real time whether encryption or decryption is required based on the current operation type and field information;

[0043] If encryption or decryption is determined to be necessary, the encryption judgment service system calls the cataloging system to obtain encryption and decryption rules;

[0044] The encryption judgment service system triggers the encryption and decryption service system. The encryption and decryption service system obtains the corresponding key from the key management service system, performs specific encryption or decryption operations according to the preset encryption level, and returns the processed data to the application system or writes it to the database, completing the full life cycle security management of the data.

[0045] Preferably, the operation instructions include operations of adding, querying, updating or deleting data.

[0046] Preferably, the lifecycle management of the key includes the generation, storage, distribution, update and synchronization of the key.

[0047] Preferably, the encryption and decryption rules include the encryption level, encryption algorithm and parameter configuration of the field.

[0048] Preferably, the encryption and decryption rules are regularly trained, specifically including:

[0049] Convert the field name in the field into a word vector, extract the field data type, field length, the field data volume and perform a full connection operation with the word vector to obtain a length of word vector Composition feature matrix ;

[0050] The feature matrix In the input feedforward neural network model, the feedforward neural network model includes four hidden layers and one output layer;

[0051] Each hidden layer uses variables Indicates that the processing through the hidden layer is:

[0052]

[0053]

[0054] in, and Representing the layer weight matrices and biases, is the RELU activation function, and express The input and output of

[0055]

[0056] represents the weight matrix of the first hidden layer, represents the offset vector of the first hidden layer, and Represents the input and output of the first hidden layer;

[0057] After the hidden layer, the input matrix is obtained , input matrix The output layer probability distribution is obtained through the output layer and the Softmax function :

[0058]

[0059] in, Indicates the encryption levels, is the number of encryption levels, As a temporary variable in the accumulated value, Indicates the total number of samples Middle samples, Represents the output layer input matrix No. In the sample The encryption level value, Representative The sample in The value to be accumulated for each encryption level;

[0060] Use the cross entropy loss function to calculate the loss and train the model to the optimal state:

[0061]

[0062] in, Representative In the sample The true value of the encryption level, represents the function value of the cross entropy function, N Indicates the total number of samples.

[0063] As can be seen from the above technical solutions, compared with the existing technology, the present invention provides a data encryption strategy formulation and data lifecycle security assurance system and method based on artificial intelligence, which has the following advantages:

[0064] 1) For data systems with many tables and large amounts of data, the field encryption level is automatically determined through artificial intelligence.

[0065] 2) Through multiple links (such as authorization management, encryption and decryption, rule application, etc.), data is securely processed throughout its life cycle, achieving all-round protection of data.

[0066] 3) By distributing encryption rules from the cataloging system to the encryption segmentation service, the automated management and application of encryption rules is achieved. This allows for dynamic acquisition, updating, and application of encryption rules, ensuring that data encryption policies always meet the latest security requirements and business needs.

[0067] 4) The intelligent encryption and decryption engine can be deployed flexibly, supporting both private deployment and public cloud deployment, and can be deployed reasonably according to user needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0069] Figure 1 This is a schematic diagram of the structure of the artificial intelligence-based data encryption strategy formulation and data full life cycle security assurance system provided by the present invention.

[0070] Figure 2 Flowchart of the artificial intelligence-based data encryption strategy formulation and data lifecycle security assurance method provided by the present invention. DETAILED DESCRIPTION

[0071] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0072] The embodiment of the present invention discloses a data encryption strategy formulation and data life cycle security assurance system based on artificial intelligence, such as Figure 1 As shown, including:

[0073] Multiple public clouds, at least 2, Figure 1 There are 2 public clouds shown in the figure;

[0074] The business systems, databases, encryption judgment service systems, and encryption and decryption service systems deployed on the public clouds;

[0075] An intelligent encryption and decryption engine, deployed locally or in the cloud, is used to uniformly manage cross-platform data security policies. The intelligent encryption and decryption engine includes a cataloging system, a key management service system, and an authorization management service system.

[0076] in,

[0077] The application system is used to receive data requests input by users, execute business logic, and generate operation instructions for the database, including adding, querying, updating, or deleting data;

[0078] The database is used to store structured data and provide a data access interface for the application system, supporting the reading of metadata such as table structure and field definition;

[0079] The cataloging system connects to databases in various public clouds, obtains their data structure information, analyzes the sensitivity and importance of the data, automatically determines the data in the fields that need to be encrypted, and formulates corresponding encryption and decryption rules. The encryption and decryption rules include the encryption level of the field, encryption algorithm, and parameter configuration. For example, the encryption level is divided into L0 (no encryption required), L1, L2, L3, and L4. The larger the number, the more the data in the field needs to be encrypted, and the larger the number, the higher the degree of encryption. For example, L2 uses the SM4 algorithm for encryption, and L3 uses AES with a 192-bit key for encryption. The correspondence between the encryption level and the encryption method is pre-made in the encryption judgment service system, and different levels correspond to different encryption algorithms and parameter configurations.

[0080] The key management service system is used to complete the lifecycle management of keys, including key generation, storage, distribution, update and synchronization, to ensure that encryption and decryption services can securely obtain and use the corresponding encryption keys;

[0081] The authorization management service system is used to perform identity authentication and permission control on the encryption judgment service system to ensure that it has legal authority to access encryption and decryption resources;

[0082] The encryption judgment service system is used to complete access authorization by calling the authorization management service system and regularly obtain the latest encryption and decryption rules from the cataloging system. When the application system initiates a data operation, it intercepts the operation instruction and determines in real time whether encryption or decryption is required based on the current operation type and field information. If encryption or decryption is determined to be necessary, it calls the cataloging system to obtain the encryption and decryption rules.

[0083] The encryption and decryption service system responds to the request of the encryption judgment service system, obtains the corresponding key from the key management service system, performs specific encryption or decryption operations according to the preset encryption level, and returns the processed data to the encryption judgment service system, which then returns it to the application system or writes it into the database.

[0084] Among them, the intelligent encryption and decryption engine can be deployed privately or in the public cloud according to user needs, and the key management service system is deployed in the key management device.

[0085] In this embodiment, the encryption level of the field data in the connected database system is dynamically and intelligently determined. The main process is as follows:

[0086] 1. Feature extraction

[0087] The cataloging system configures the database address, port, user name, password and other information to establish a connection to the database and complete the access.

[0088] Get the field names of all data table fields in the database, perform word segmentation based on the symbol "_", and then use the word-to-word vector tool Word2Vec to convert the fields into word vectors. Extract the field data type, field length, field data volume and other features and perform full connection operations with the word vectors to obtain a length of word vector Composition feature matrix .

[0089] Perform one-hot encoding on the encryption levels (L0, L1, L2, L3, L4) and represent each encryption level as a binary vector. For example:

[0090]

[0091] 2. Model Training

[0092] The feature matrix Input DNN (feedforward neural network) model to calculate the first hidden layer input And after RELU activation function Processed output :

[0093]

[0094] in, represents the weight matrix of the first layer, Represents the offset vector of the first layer.

[0095] In the present invention, there are four hidden layers and one output layer, and each hidden layer uses variables Representation. Calculation Input and output Need to use the output of the previous layer

[0096]

[0097]

[0098] in, and Representing the Layer weight matrices and biases.

[0099] Finally, the output layer input matrix is calculated by the above formula , and the output layer probability distribution is obtained through the Softmax function :

[0100]

[0101] in, Indicates the encryption levels, is the number of encryption levels, As a temporary variable in the accumulated value, Indicates the total number of samples Middle samples, Represents the output layer input matrix No. In the sample The encryption level value, Representative The sample in The value to be accumulated for each encryption level.

[0102] Finally, the cross entropy loss function is used to calculate the loss and train the model to the optimal state:

[0103]

[0104] in, Representative In the sample The true value of the encryption level, represents the function value of the cross entropy function, N Indicates the total number of samples.

[0105] At this point, the cataloging system generates intelligent encryption levels for fields in the public data system through regular training of artificial intelligence.

[0106] In this embodiment, each public cloud includes three modules: application system, database, and plug-in. The plug-in includes encryption judgment service and encryption and decryption service. The main process of data encryption and decryption in each public cloud is as follows:

[0107] 1) According to the encryption and decryption rules, the fields in the data table that need to be encrypted are obtained, and the data to be inserted into the encrypted fields in the data is obtained according to the fields. That is, it is not the fields that need to be encrypted, but the data corresponding to the fields.

[0108] 2) Based on the data to be encrypted, call the encryption and decryption service system to encrypt the data;

[0109] 3) The encryption and decryption service system calls the key management service system in the key management device to obtain the key;

[0110] 4) Based on the obtained key, encrypt the data and return it to the encryption judgment service system;

[0111] 5) The encryption judgment service system returns the encrypted data to the database.

[0112] Since the business data of the business system is stored in the database, if the business system needs to query the data, but it has been encrypted by the encryption judgment service, the business system needs to decrypt the data after obtaining it. The main process is as follows:

[0113] 1) The business system calls the encryption judgment service system to determine which fields of data are encrypted and obtain the encryption rules;

[0114] 2) Based on the obtained encryption and decryption rules, the decryption method is obtained according to the pre-set correspondence between encryption level and encryption method;

[0115] 3) Based on the obtained decryption method, call the encryption and decryption service system to decrypt the data;

[0116] 4) The encryption and decryption service system obtains the key from the key management service system;

[0117] 5) Based on the obtained key, the encrypted data is decrypted and returned to the encryption judgment service system, which then returns it to the business system;

[0118] 6) The business system obtains the decrypted data for subsequent business processing.

[0119] In addition, when the encryption judgment service synchronizes encryption rules, it needs to apply for authorization from the authorization management service system, and encryption rules can only be synchronized after obtaining authorization permission.

[0120] In this embodiment, a data encryption strategy formulation and data life cycle security assurance method based on artificial intelligence is provided. Figure 2 As shown, business systems, databases, encryption judgment service systems, and encryption and decryption service systems are deployed on multiple public cloud platforms respectively;

[0121] The user submits a data operation request to the application system, which executes the corresponding business logic and generates operation instructions for the database, including adding, querying, updating or deleting operations;

[0122] The encryption judgment service system intercepts the operation instructions and determines in real time whether encryption or decryption is required based on the current operation type and the data field information involved;

[0123] If encryption or decryption is determined to be necessary, the encryption judgment service system calls the cataloging system to obtain encryption and decryption rules. The cataloging system provides encryption and decryption rules to determine whether the data under the field needs to be encrypted and determine the corresponding encryption level.

[0124] The encryption judgment service system triggers the encryption and decryption service system, and the encryption and decryption service system obtains the corresponding encryption key from the key management service system;

[0125] The encryption and decryption service system selects the corresponding encryption or decryption algorithm according to the preset encryption level and performs the specific encryption or decryption operation;

[0126] The encryption and decryption service system returns the processed data to the application system or writes it into the database after passing it through the encryption judgment service system, completing the security management of the data throughout its life cycle.

[0127] During the deployment of business systems, databases, encryption judgment service systems, and encryption and decryption service systems on multiple public cloud platforms, the cataloging system configures the database address, port, user name, password, and other information to establish a connection to the database and complete the access. The cataloging system is responsible for analyzing the data structure information in the database and automatically identifying the data fields that need to be encrypted by evaluating the sensitivity and importance of the data.

[0128] Based on the above analysis results, the cataloging system develops and maintains encryption and decryption rules. These rules include the encryption level, encryption algorithm, and parameter configuration of the field. For example, the encryption level is divided into L0 (no encryption required), L1, L2, L3, and L4. The larger the number, the more the data in the field needs to be encrypted, and the higher the encryption level. For example, L2 uses the SM4 algorithm for encryption, and L3 uses AES with a 192-bit key for encryption. The corresponding relationship between encryption level and encryption method is pre-set in the encryption judgment service system, and different levels correspond to different encryption algorithms and parameter configurations.

[0129] The cataloging system periodically updates these encryption and decryption rules and sends the latest encryption and decryption rules to the encryption judgment service system to ensure that it can perform encryption or decryption judgments based on the latest security policies.

[0130] At the same time, the authorization management service system regularly verifies access rights to the encryption judgment service systems in each public cloud to complete authorization management, serving as a security mechanism throughout the entire system operation process.

[0131] The database is used to store structured data and provide a data access interface for the application system, supporting the reading of metadata such as table structure and field definition.

[0132] Among them, the intelligent encryption and decryption engine can be deployed privately or in the public cloud according to user needs.

[0133] In this embodiment, the encryption level of the field data in the connected database system is dynamically and intelligently determined. The main process is as follows:

[0134] 1. Feature extraction

[0135] The cataloging system configures the database address, port, user name, password and other information to establish a connection to the database and complete the access.

[0136] Get the field names of all data table fields in the database, perform word segmentation based on the symbol "_", and then use the word-to-word vector tool Word2Vec to convert the fields into word vectors. Extract the field data type, field length, field data volume and other features and perform full connection operations with the word vectors, that is, the length is word vector Composition feature matrix .

[0137] Perform one-hot encoding on the encryption levels (L0, L1, L2, L3, L4) and represent each encryption level as a binary vector. For example:

[0138]

[0139] 2. Model Training

[0140] The feature matrix Input DNN (feedforward neural network) model to calculate the first hidden layer input And after RELU activation function Processed output :

[0141]

[0142] in, represents the weight matrix of the first layer, Represents the offset vector of the first layer.

[0143] In the present invention, there are four hidden layers and one output layer, and each hidden layer uses variables Representation. Calculation Input and output Need to use the output of the previous layer

[0144]

[0145]

[0146] in, and Representing the Layer weight matrices and biases.

[0147] Finally, the output layer input matrix is calculated by the above formula , and the output layer probability distribution is obtained through the Softmax function :

[0148]

[0149] in, Indicates the encryption levels, is the number of encryption levels, As a temporary variable in the accumulated value, Indicates the total number of samples Middle samples, Represents the output layer input matrix No. In the sample The encryption level value, Representative The sample in The value to be accumulated for each encryption level.

[0150] Finally, the cross entropy loss function is used to calculate the loss and train the model to the optimal state:

[0151]

[0152] in, Representative In the sample The true value of the encryption level, represents the function value of the cross entropy function, N Indicates the total number of samples.

[0153] At this point, the cataloging system generates intelligent encryption levels for fields in the public data system through regular training of artificial intelligence.

[0154] In this embodiment, each public cloud includes three modules: application system, database, and plug-in. The plug-in includes encryption judgment service and encryption and decryption service. The main process of data encryption and decryption in each public cloud is as follows:

[0155] 1) According to the encryption and decryption rules, the fields in the data table that need to be encrypted are obtained, and the data under the fields in the data table is the data to be encrypted. That is, it is not the fields that need to be encrypted, but the data corresponding to the fields.

[0156] 2) Based on the data to be encrypted, call the encryption and decryption service system to encrypt the data;

[0157] 3) The encryption and decryption service system calls the key management service system in the key management device to obtain the key;

[0158] 4) Based on the obtained key, encrypt the data and return it to the encryption judgment service system;

[0159] 5) The encryption judgment service system returns the encrypted data to the database.

[0160] Since the business data of the business system is stored in the database, if the business system needs to query the data, but it has been encrypted by the encryption judgment service, the business system needs to decrypt the data after obtaining it. The main process is as follows:

[0161] 1) The business system calls the encryption judgment service system to determine which fields of data are encrypted and obtain the encryption and decryption rules;

[0162] 2) Based on the obtained encryption and decryption rules, the decryption method is obtained according to the pre-set correspondence between encryption level and encryption method;

[0163] 3) Based on the obtained decryption method, call the encryption and decryption service system to decrypt the data;

[0164] 4) The encryption and decryption service system obtains the key from the key management service system;

[0165] 5) Based on the obtained key, the encrypted data is decrypted and returned to the encryption judgment service system, which then returns it to the business system;

[0166] 6) The business system obtains the decrypted data for subsequent business processing.

[0167] In addition, when the encryption judgment service synchronizes encryption rules, it needs to apply for authorization from the authorization management service system, and encryption rules can only be synchronized after obtaining authorization permission.

[0168] The present invention can be applied in many fields, for example:

[0169] Financial services: Banks, securities firms, insurance companies, and other financial institutions handle large amounts of sensitive customer information, such as account details, transaction records, and financial data. This patented technology enables secure data exchange between public clouds hosting different financial business systems. For example, when conducting customer credit assessments, data from multiple sources can be securely integrated and analyzed, ensuring that data is not leaked or tampered with during transmission and storage, thus meeting the strict regulatory compliance requirements of the financial industry.

[0170] Healthcare: Hospitals, pharmaceutical companies, and medical research institutions generate and manage massive amounts of medical data, including patient medical records, genetic data, and clinical trial data. This patent enables secure cross-cloud data processing, supporting the secure sharing of medical data across public cloud systems at different medical institutions, facilitating remote medical diagnosis and medical research collaboration while protecting patient privacy.

[0171] Government public services: Government departments have numerous government systems distributed across different public clouds, such as tax systems, social security systems, and household registration systems. This patented technology enables secure encryption and decryption of government data across cloud environments, protecting citizens' personal information and sensitive government data.

[0172] Internet technology companies: Large internet companies often have multiple business lines, with data storage and processing dispersed across different public clouds. This patent can help companies securely integrate and analyze internal data, unlocking its value. For example, this allows for secure processing and utilization of user data in scenarios such as advertising and user behavior analysis.

[0173] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0174] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. Data encryption strategy formulation and data lifecycle security assurance system based on artificial intelligence, characterized by: It includes an intelligent encryption and decryption engine and multiple public clouds. Each public cloud is equipped with an application system, a database, an encryption judgment service system, and an encryption and decryption service system. The intelligent encryption and decryption engine includes a cataloging system, a key management service system, and an authorization management service system. The application system is used to receive data operation requests input by users, execute corresponding business logic, and generate operation instructions for the database; The database is used to store data and provide data access interfaces for application systems; The cataloging system is responsible for analyzing the data structure information in the database. By evaluating the sensitivity and importance of the data, it automatically identifies the data in the fields that need to be encrypted, formulates encryption and decryption rules, periodically updates the encryption and decryption rules, and sends the latest encryption and decryption rules to the encryption judgment service system to achieve dynamic management; The key management service system is used to complete the life cycle management of keys; The authorization management service system is used to verify access rights to the encryption judgment service systems in each public cloud and complete authorization management; The encryption judgment service system is used to complete authorization operations and regularly obtain the latest encryption and decryption rules from the cataloging system. It also intercepts operation instructions when the application system initiates data operation requests and determines in real time whether encryption or decryption is required based on the current operation type and field information. If encryption or decryption is determined to be necessary, it calls the cataloging system to obtain encryption and decryption rules. The encryption and decryption service system is used to respond to requests from the encryption judgment service system, obtain the corresponding key from the key management service system, perform specific encryption or decryption operations according to the preset encryption level, and return the processed data to the application system or write it to the database.

2. The artificial intelligence-based data encryption strategy formulation and data lifecycle security assurance system according to claim 1 is characterized in that: Operation instructions include adding, querying, updating or deleting data.

3. The artificial intelligence-based data encryption strategy formulation and data lifecycle security assurance system according to claim 1 is characterized in that: Key lifecycle management includes key generation, storage, distribution, update, and synchronization.

4. The artificial intelligence-based data encryption strategy formulation and data lifecycle security assurance system according to claim 1 is characterized in that: Encryption and decryption rules include the encryption level of the field, encryption algorithm and parameter configuration.

5. The artificial intelligence-based data encryption strategy formulation and data lifecycle security assurance system according to claim 1 is characterized in that: Regular training of encryption and decryption rules includes: Convert the field name in the field into a word vector, extract the field data type, field length, and the amount of data in the field, and perform a full connection operation with the word vector to obtain a word vector x of length n to form a feature matrix X; Input the feature matrix X into the feedforward neural network model, which includes four hidden layers and one output layer; Each hidden layer is represented by the variable l, and the processing through the hidden layer is: z l+1 =W l+1 a l +b l+1 a l+1 =σ(z l+1 ) Among them, W l+1 and b l+1 Represent the l+1th layer weight matrix and offset respectively, σ is the RELU activation function, z l+1 and a l+1 represents the input and output of l+1; where, z1=W1X+b1,a1=σ(z1) W1 represents the weight matrix of the first hidden layer, b1 represents the offset vector of the first hidden layer, z1 and a1 represent the input and output of the first hidden layer; After the hidden layer, we get the input matrix z out , input matrix z out The output layer probability distribution is obtained through the output layer and the Softmax function Where i represents the i-th encryption level, m is the number of encryption levels, k is a temporary variable in the cumulative value, and j represents the j-th sample in the total number of samples N. Represents the output layer input matrix z out The value of the i-th encryption level in the j-th sample, Represents the value that needs to be accumulated for the j-th sample at the k-th encryption level; Use the cross entropy loss function to calculate the loss and train the model to the optimal state: in, represents the true value of the i-th encryption level in the j-th sample, L represents the function value of the cross entropy function, and N represents the total number of samples.

6. Data encryption strategy formulation and data lifecycle security assurance method based on artificial intelligence, characterized by: include: Application systems, databases, encryption judgment service systems, and encryption and decryption service systems are deployed on multiple public cloud platforms. The cataloging system is responsible for analyzing the data structure information in the database. By assessing the sensitivity and importance of the data, it automatically identifies the data in the fields that need to be encrypted, formulates encryption and decryption rules, determines the corresponding encryption level, and periodically updates the encryption and decryption rules. The latest encryption and decryption rules are sent to the encryption judgment service system to achieve dynamic management. The authorization management service system regularly verifies the access rights of the encryption judgment service systems in each public cloud to complete authorization management. Receive data operation requests input by users through the application system, execute corresponding business logic, and generate operation instructions for the database; The encryption judgment service system intercepts the operation instructions and determines in real time whether encryption or decryption is required based on the current operation type and field information; If encryption or decryption is determined to be necessary, the encryption judgment service system calls the cataloging system to obtain encryption and decryption rules; The encryption judgment service system triggers the encryption and decryption service system. The encryption and decryption service system obtains the corresponding key from the key management service system, performs specific encryption or decryption operations according to the preset encryption level, and returns the processed data to the application system or writes it to the database, completing the full life cycle security management of the data.

7. The method for formulating data encryption strategies and ensuring data security throughout its lifecycle based on artificial intelligence according to claim 6 is characterized in that: Operation instructions include adding, querying, updating or deleting data.

8. The method for formulating data encryption strategies and ensuring data security throughout its lifecycle based on artificial intelligence according to claim 6 is characterized in that: Key lifecycle management includes key generation, storage, distribution, update, and synchronization.

9. The method for formulating data encryption strategies and ensuring data security throughout its lifecycle based on artificial intelligence according to claim 6 is characterized in that: Encryption and decryption rules include the encryption level of the field, encryption algorithm and parameter configuration.

10. The method for formulating data encryption strategies and ensuring data security throughout its lifecycle based on artificial intelligence according to claim 6 is characterized in that: Regular training of encryption and decryption rules includes: Convert the field name in the field into a word vector, extract the field data type, field length, and the amount of data in the field, and perform a full connection operation with the word vector to obtain a word vector x of length n to form a feature matrix X; Input the feature matrix X into the feedforward neural network model, which includes four hidden layers and one output layer; Each hidden layer is represented by the variable l, and the processing through the hidden layer is: z l+1 =W l+1 a l +b l+1 a l+1 =σ(z l+1 ) Among them, W l+1 and b l+1 Represent the l+1th layer weight matrix and offset respectively, σ is the RELU activation function, z l+1 and a l+1 represents the input and output of l+1; where, z1=W1X+b1,a1=σ(z1) W1 represents the weight matrix of the first hidden layer, b1 represents the offset vector of the first hidden layer, z1 and a1 represent the input and output of the first hidden layer; After the hidden layer, we get the input matrix z out , input matrix z out The output layer probability distribution is obtained through the output layer and the Softmax function Where i represents the i-th encryption level, m is the number of encryption levels, k is a temporary variable in the cumulative value, and j represents the j-th sample in the total number of samples n. Represents the output layer input matrix z out The value of the i-th encryption level in the j-th sample, Represents the value that needs to be accumulated for the j-th sample at the k-th encryption level; Use the cross entropy loss function to calculate the loss and train the model to the optimal state: in, represents the true value of the i-th encryption level in the j-th sample, L represents the function value of the cross entropy function, and N represents the total number of samples.

Images