Charging user portrait data security management system and method

Abstract

The invention relates to the technical field of data security management, in particular to a charging user portrait data security management system and method, and the system comprises a channel state sensing module, a key updating control module, a behavior sequence evaluation module, a data exception recognition module and a key scheduling encryption module. In the invention, active perception of communication quality change is realized, agility and protection of data transmission are enhanced, and signal attenuation and equipment number labels are extracted for secret key updating judgment by comparing communication link quality with a user positioning data sequence, capturing a hopping trend of signal intensity and a noise ratio and mapping an abnormal fluctuation segment to an equipment identifier. The pertinence and efficiency of an encryption strategy are improved, a portrait feature deviation behavior is recognized by combining a user charging behavior and a frequency sequence, a specific user number is positioned, the anomaly recognition precision is improved, a path encryption strategy is dynamically generated according to behavior deviation and access path information, and a flexible and efficient data protection system is constructed.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and particularly to a data security management system and method for charging and swapping user portrait data. Background Art

[0002] The technical field of data security management includes security guarantee measures for data in various links such as storage, transmission, and processing to prevent data leakage, damage, tampering, or loss. The core contents of this technical field include technical means such as data encryption, identity authentication, access control, data backup, and disaster recovery. The goal of data security management technology is to ensure the confidentiality, integrity, and availability of data while meeting the requirements of laws, regulations, and industry standards for data protection. With the development of the information age, data security management has been widely applied in various industries, especially in the fields of finance, electricity, and healthcare.

[0003] Among them, the data security management system for charging and swapping user portrait data refers to a security management system specifically for user portrait data in charging and swapping stations. A complete data security management solution is proposed for the security problems in the storage, management, and access processes of user data in charging and swapping stations. Through data encryption technology, identity authentication mechanisms, access control policies, and data auditing means, the security of user portrait data during storage and transmission is ensured, and the security and compliance of data are improved through refined management measures. This system uses a series of hardware and software means to ensure the security of user data and avoid potential security hazards.

[0004] In the process of user portrait data security management in the prior art, it relies on static rule setting and unified policy execution, lacking the ability to actively perceive and respond to real-time fluctuations in link communication quality, resulting in greater security hazards exposed in data transmission under changing channel environments. In terms of key update, existing solutions mostly rely on periodic unified replacement strategies, lacking directional identification and matching of specific device states and risk tags, resulting in low efficiency in the use of encryption resources and security lag problems. In the link of user behavior analysis, existing solutions rely on the comparison of basic behavior records and cannot deeply analyze the dynamic characteristic curves and frequency deviation degrees of behavior sequences, making the abnormal behavior recognition granularity coarser and increasing the risks of misjudgment and missed judgment. Especially in data encryption scheduling, a unified access policy is often used to process different sensitivity paths, ignoring the need for hierarchical permission management brought about by changes in access patterns and leading to data leakage risks. In the charging and swapping station scenario, when a non-stable communication state occurs in a certain device channel, the existing system is difficult to timely link key update or path encryption actions, resulting in the potential risk of sensitive portrait data being illegally stolen under weak channels, directly affecting the overall effectiveness of data security management in terms of dynamics, accuracy, and response efficiency. Summary of the Invention

[0005] To solve the technical problems existing in the prior art, an embodiment of the present invention provides a charging and swapping user portrait data security management system and method. The technical solutions are as follows:

[0006] On the one hand, a charging and swapping user portrait data security management system is provided, and the system includes:

[0007] The channel state perception module obtains the in-station communication link quality index items and user mobile positioning items, performs time series analysis on the signal quality for a time period, screens the time periods that meet the jump amplitude benchmark, and maps them to the corresponding link records and device numbers to generate a portrait data link fluctuation identifier;

[0008] The key update control module calls the portrait data link fluctuation identifier, extracts the signal attenuation label and device number label within the link abnormal segment, screens the current device identifier to be updated, and compares it with the current key status table to generate a portrait device key update table;

[0009] The behavior sequence evaluation module extracts the charging behavior sequence and usage frequency sequence in the user portrait based on the portrait device key update table, evaluates the fluctuation range of the behavior sequence within a continuous time period, screens the behavior segments that deviate from the portrait feature curve, and obtains a portrait feature fluctuation label set;

[0010] The data anomaly recognition module calls the portrait feature fluctuation label set, compares the currently collected charging event records with the original portrait behavior sequence, judges the degree of behavior deviation according to the user number, screens the records that deviate beyond the preset threshold, and classifies them into abnormal types to obtain a portrait behavior anomaly classification result.

[0011] As a further solution of the present invention, the portrait data link fluctuation identifier includes a link number, a time period identifier, a signal-to-noise ratio difference amplitude, and a jump trend mark. The portrait device key update table includes a key update device list, an abnormal link identification code, a trigger condition label, and a current key status mapping. The portrait feature fluctuation label set includes a behavior segment number, a behavior deviation amplitude, a portrait deviation type, and a user identification code. The portrait behavior anomaly classification result includes a deviation record number, an abnormal category label, a threshold comparison result, and a user behavior label.

[0012] As a further solution of the present invention, the channel state perception module includes:

[0013] The link index extraction sub-module obtains the in-station communication link quality index items and user mobile positioning items, collects the user positioning data and link numbers within a specified time period, identifies the link quality time series of the signal strength and noise value, and maps the user identity identifier to generate a link portrait original identifier sequence;

[0014] The signal-to-noise ratio difference analysis sub-module analyzes the change in the signal-to-noise ratio within a continuous time period based on the original link portrait identification sequence, extracts records with a jump amplitude exceeding the reference difference value, screens the time period and link number of the mutation characteristics, and associates the user equipment identification to generate a signal-to-noise anomaly trigger mapping record;

[0015] The portrait data desensitization identification sub-module identifies the user tags corresponding to the link numbers with jump characteristics according to the signal-to-noise anomaly trigger mapping record, reconstructs and encrypts the user identity and positioning track fields to generate a portrait data link fluctuation identification.

[0016] As a further solution of the present invention, the key update control module includes:

[0017] The key trigger identification sub-module calls the link anomaly time period, signal attenuation label, and device number in the portrait data link fluctuation identification, and filters the user equipment that triggers the signal attenuation threshold based on the identity identification field and communication frequency value in the charging and swapping user portrait to generate a portrait key trigger identification set;

[0018] The portrait key reconstruction sub-module compares the encryption policy number and usage frequency value in the user's current key status table according to the portrait key trigger identification set, identifies the device numbers with policy non-compliance items and status failure items, extracts some portrait fields and updates the key instruction fields to generate a portrait device key update table.

[0019] As a further solution of the present invention, the behavior sequence evaluation module includes:

[0020] The portrait behavior extraction sub-module extracts the user's charging behavior and frequency sequence based on the portrait device key update table, sorts them by time stamp, identifies the mapping between the user and the continuous behavior track, analyzes the behavior trend under the user portrait, and generates a portrait behavior sequence mapping table;

[0021] The sequence fluctuation identification sub-module calls the portrait behavior sequence mapping table, performs a sliding analysis on the charging value and frequency value in the behavior track, calculates the change gradient and compares it with the fluctuation threshold to identify the abnormal behavior interval and obtain a list of portrait sequence abnormal sections;

[0022] The identity offset traceability sub-module extracts the user number and behavior characteristics of the marked section according to the list of portrait sequence abnormal sections, matches the identity registration model, compares the user identification and behavior correlation coefficient, determines the range of identity attribute changes, and obtains a set of portrait feature fluctuation labels.

[0023] As a further solution of the present invention, the data anomaly identification module includes:

[0024] The event behavior comparison sub-module calls the portrait feature fluctuation tag set, extracts the charging duration, start time, and usage frequency according to the user number, makes a numerical comparison with the corresponding fields in the portrait behavior sequence, identifies the behavior difference interval, and generates a behavior deviation difference set;

[0025] The deviation intensity determination sub-module extracts the behavior differences of each user according to the behavior deviation difference set, compares them with the deviation threshold, and makes a joint judgment in combination with the event time interval and deviation frequency to screen the behavior records that meet the deviation intensity requirements, and obtains the deviation behavior section identification set;

[0026] The abnormal type aggregation sub-module calls the deviation behavior section identification set, matches the status field in the event record with the status label range in the user portrait, calculates the status difference offset value parameter, extracts the abnormal type code through the interval correspondence relationship, and obtains the portrait behavior abnormal classification result.

[0027] As a further solution of the present invention, the status difference offset value parameter adopts the formula: ;

[0028] Among them, represents the status difference offset value parameter, represents the corresponding status field value in the event i record, represents the central value of the corresponding status label in the user portrait of the event i record, represents the matching weight between the status field of the event i record and the portrait label, represents the number of event records participating in the weight calculation, represents the status field value of the field j record, represents the overall mean value of the status label range in the user portrait, represents the number of fields not participating in the weight matching calculation.

[0029] As a further solution of the present invention, the system further includes a key scheduling encryption module:

[0030] The key scheduling encryption module identifies the associated user portrait sensitivity identifier and access path information based on the portrait behavior abnormal classification result, obtains the encryption instruction label according to the data classification level and the current access mode, and registers it in the scheduling control table to obtain the portrait path encryption policy set;

[0031] The portrait path encryption policy set includes an access path code, a sensitivity classification label, an encryption instruction type, and a scheduling control identifier.

[0032] As a further solution of the present invention, the key scheduling encryption module includes:

[0033] The sensitive path recognition sub-module extracts the portrait access path and sensitivity identifier of the abnormal user based on the portrait behavior anomaly classification result, filters and groups the associated nodes according to the sensitivity level and path type, and generates a portrait path sensitivity classification table;

[0034] The policy instruction generation sub-module calls the portrait path sensitivity classification table, extracts the encryption policy key according to the path data classification level and access mode, and registers it in the path encryption item field of the scheduling control table to obtain a portrait path encryption policy set.

[0035] On the other hand, a method for managing the security of charging and swapping user portrait data, the method for managing the security of charging and swapping user portrait data is executed based on the above-mentioned charging and swapping user portrait data security management system, and includes the following steps:

[0036] S1: Obtain the in-station communication link quality index items and user mobile positioning items, extract the difference between the signal strength and the noise ratio within a continuous time period, filter the time periods with excessive jump amplitudes, associate the link number with the device number, and generate a portrait communication link fluctuation tag set;

[0037] S2: Based on the portrait communication link fluctuation tag set, extract the signal strength drop and device number within the marked time period, match the corresponding status of the device in the key status table, filter the items to be updated and establish the corresponding relationship between the device number and the key status, and generate a portrait device key update instruction set;

[0038] S3: Based on the portrait device key update instruction set, extract the charging behavior time series and frequency series in the user portrait, identify the behavior offset segment and mark the abnormal change interval, and generate a portrait behavior security fluctuation tag set in combination with the user number mapping;

[0039] S4: Based on the portrait behavior security fluctuation tag set, compare the current charging behavior record with the portrait behavior sequence, judge the degree of deviation of the behavior time and frequency, filter the records exceeding the threshold and classify the tags, and generate a portrait behavior anomaly identification set;

[0040] S5: Based on the portrait behavior anomaly identification set, extract the user portrait sensitivity identifier and access path information, match the data classification level and access mode, filter the corresponding encryption tags and write them into the scheduling control table to obtain a portrait path encryption policy set.

[0041] The beneficial effects brought by the technical solution provided by the embodiments of the present invention at least include:

[0042] By comparing the time - series sequences of communication link quality indicators and user location data, it is possible to capture the jump trend of signal - to - noise ratio, identify abnormal fluctuation segments and map them to specific link and device identifiers, realizing the active perception of the dynamic changes in communication quality, making the data transmission process have stronger agility and precise protection capabilities. When there is a risk of communication link fluctuation, extracting the corresponding signal attenuation tags and device number tags can form a basis for judging the update of associated devices, enhancing the pertinence and effectiveness of key updates, and avoiding the lag of key use and resource redundancy. Based on the user charging behavior and frequency sequence, comparing and evaluating the fluctuation intervals of continuous time periods of behavior patterns can effectively analyze the degree of deviation of user portraits, and further associate them with specific user numbers, improving the individual accuracy of abnormal behavior recognition. When there is a significant deviation between charging behavior and portrait features, combining portrait sensitivity identification and access path records, dynamically matching encryption instructions and access patterns, and constructing a set of path encryption strategies to form a multi - dimensional and dynamic data protection structure. Each processing link realizes the collaborative control of link security situation, behavior deviation trend and data sensitivity through cross - module data mapping and behavior feature comparison, jointly improving the security management level of portrait data from multiple dimensions such as link stability, behavior compliance and data encryption response mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following - described drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0044] Figure 1 It is a schematic diagram of a data security management system for charging and swapping users' portraits provided by an embodiment of the present invention;

[0045] Figure 2 It is a schematic diagram of the system framework of the present invention;

[0046] Figure 3 It is a flowchart of the channel state perception module in the present invention;

[0047] Figure 4 It is a flowchart of the key update control module in the present invention;

[0048] Figure 5 It is a flowchart of the behavior sequence evaluation module in the present invention;

[0049] Figure 6 It is a flowchart of the data anomaly recognition module in the present invention;

[0050] Figure 7 It is a flowchart of the key scheduling and encryption module in the present invention;

[0051] Figure 8 It is a flowchart of a method for secure management of charging and swapping user portrait data provided by an embodiment of the present invention. Detailed implementation manners

[0052] The technical solutions in the present invention will be described below with reference to the accompanying drawings.

[0053] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as an "example" in the present invention should not be construed as being more preferred or more advantageous than other embodiments or design solutions. Rather, the use of the word "example" is intended to present concepts in a specific manner. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or either of them can be selected.

[0054] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference is not emphasized, the meanings they express are the same. "(of)", "corresponding", and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference is not emphasized, the meanings they express are the same.

[0055] In the embodiments of the present invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meanings they express are the same.

[0056] To make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

[0057] The embodiments of the present invention provide a charging and swapping user portrait data security management system, as Figure 1-2 shown in the schematic diagram of the charging and swapping user portrait data security management system. The system includes:

[0058] The channel state perception module obtains the in-station communication link quality index items and user mobile positioning items, performs time-series analysis on the signal quality, calculates the difference in signal strength and noise ratio between adjacent time periods, judges the trend change, screens the time periods that meet the jump amplitude benchmark, and maps them to the corresponding link records and device numbers to generate a portrait data link fluctuation identifier;

[0059] The key update control module calls the portrait data link fluctuation identifier, extracts the signal attenuation label and device number label in the link abnormal segment, judges whether there is a key update trigger condition, screens the current device identifier to be updated, and compares it with the current key status table to generate a portrait device key update table;

[0060] Based on the portrait device key update table, the behavior sequence evaluation module extracts the charging behavior sequence and usage frequency sequence in the user portrait, evaluates the fluctuation range of the behavior sequence within a continuous time period, filters out the behavior segments that deviate from the portrait feature curve, and maps them to the user number to obtain the portrait feature fluctuation label set;

[0061] The data anomaly recognition module calls the portrait feature fluctuation label set, compares the currently collected charging event records with the original portrait behavior sequence, judges the degree of behavior deviation according to the user number, filters out the records that deviate beyond the preset threshold, and classifies them into anomaly types to obtain the portrait behavior anomaly classification result;

[0062] Based on the portrait behavior anomaly classification result, the key scheduling encryption module identifies the associated user portrait sensitivity identifier and access path information, obtains the encryption instruction label according to the data classification level and the current access mode, and registers it in the scheduling control table to obtain the portrait path encryption policy set.

[0063] The portrait data link fluctuation identifier includes the link number, time period identifier, signal-to-noise ratio difference amplitude, and jump trend mark. The portrait device key update table includes the key update device list, abnormal link identification code, trigger condition label, and current key status mapping. The portrait feature fluctuation label set includes the behavior segment number, behavior deviation amplitude, portrait deviation type, and user identification code. The portrait behavior anomaly classification result includes the deviation record number, anomaly category label, threshold comparison result, and user behavior label. The portrait path encryption policy set includes the access path code, sensitivity classification label, encryption instruction type, and scheduling control identifier.

[0064] Specifically, as Figure 2 、 3 shown, the channel state perception module includes:

[0065] The link metric extraction sub-module obtains the in-station communication link quality metric items and user mobile positioning items, collects the user positioning data and link number within a specified time period, identifies the link quality time series of the signal strength and noise value, and maps the user identity identifier to generate the original link portrait identification sequence;

[0066] First, obtain quality metrics related to the communication link, such as signal strength, signal-to-noise ratio, latency, throughput, etc., and perform data collection in combination with the user's mobile positioning items (such as longitude, latitude, and time). The specified time period is set to 5 minutes, 10 minutes, or longer. During each time period, the user's location and the quality of the communication link are synchronously collected. The link number identifies each independent communication link for subsequent analysis. During data collection, the signal strength and noise value of the link are recorded to form a time series of link quality. For example, if the collected data shows that the signal strength of a certain link is -75 dBm and the noise value is -95 dBm during a certain time period, this indicates that the link quality is good. Map this data according to the user identity identifier, associate the quality data of each link with the user ID, and generate an original identification sequence of the link portrait through the data for subsequent data analysis and anomaly detection.

[0067] Based on the original identification sequence of the link portrait, the signal-to-noise ratio difference analysis sub-module analyzes the change in the signal-to-noise ratio within consecutive time periods, extracts the records with the jump amplitude exceeding the reference difference value, filters the time periods and link numbers with mutation characteristics, and associates the user equipment identifier to generate a signal-to-noise anomaly trigger mapping record;

[0068] Perform an in-depth analysis of the change in the signal-to-noise ratio (SNR) based on the original identification sequence of the link portrait, calculate the difference in the signal-to-noise ratio within consecutive time periods. For example, if the signal-to-noise ratio at the current moment is 20 dB and the previous moment is 10 dB, the difference is 10 dB. If this value exceeds the preset reference difference value (such as 5 dB), it is considered that a significant mutation has occurred in the signal. At this time, extract the records with the signal-to-noise ratio change exceeding the reference difference value. To filter the time periods and link numbers with mutation characteristics, continue to analyze the mutation points to determine the specific time period when it occurred and the corresponding link number, and associate the user equipment identifier of this link to the anomaly record. For example, if the signal-to-noise ratio of a certain link jumps from 10 dB to 25 dB within 2 seconds, and this difference is greater than the set threshold of 10 dB, mark the link number and related user identifier during this time period to generate a signal-to-noise anomaly trigger mapping record for subsequent anomaly detection or user behavior analysis.

[0069] Based on the signal-to-noise anomaly trigger mapping record, the portrait data desensitization identification sub-module identifies the user tags corresponding to the link numbers with jump characteristics, reconstructs and encrypts the user identity and positioning trajectory fields to generate a link fluctuation identifier for the portrait data;

[0070] Identify the link numbers in the record, find the user tags corresponding to the link numbers (such as the user's device ID, SIM card number, etc.), desensitize the user's identity information and their positioning trajectory, and encrypt or reconstruct the user's real identity and positioning information through an encryption algorithm (such as AES encryption) to protect the user's privacy. Use the encrypted data to generate the current link fluctuation identifier for subsequent data analysis or risk assessment. For example, if the user's real positioning trajectory is from location A to location B and passes through location C, this trajectory will be transformed into a set of unidentifiable encrypted data through an encryption algorithm and associated with the link fluctuation identifier. After processing, the portrait data link fluctuation identifier will not contain any user personal information and will only display data related to the link quality fluctuation for subsequent anonymous data analysis.

[0071] Specifically, as Figure 2 、 4 shown, the key update control module includes:

[0072] The key trigger identification sub-module calls the link abnormal time period, signal attenuation label, and device number in the portrait data link fluctuation identifier, filters the user devices that trigger the signal attenuation threshold based on the identity identification field and communication frequency value in the charging and swapping user portrait, and generates a portrait key trigger identification set;

[0073] By monitoring the fluctuation of the device communication link, obtain the link quality data of each device within a period of time. The data includes signal strength, link delay, data transmission rate, etc. Based on the data, set a threshold to filter out those devices whose signal attenuation amplitude exceeds the predetermined standard. Assume that the signal strength threshold is set to -80dBm. If the signal strength of the device is lower than this value during the period, it is considered that it has triggered the signal attenuation threshold. Further confirm the filtered devices according to the identity identification field and communication frequency value in the charging and swapping user portrait. Combining the usage frequency and identity information of the device, active users or devices corresponding to specific identity users can be further filtered out, and then a device list is generated. This list contains all the devices that meet the trigger conditions within a specific period. Finally, a portrait key trigger identification set is generated, which contains information such as the number of the trigger device, the attenuation threshold, the time period of link fluctuation, and its communication frequency, and can accurately identify the devices related to it during the abnormal period of device link fluctuation.

[0074] The portrait key reconstruction sub-module compares the encryption policy number and usage frequency value in the user's current key status table according to the portrait key trigger identification set, identifies the device numbers with inconsistent policies and invalid status items, extracts some portrait fields and updates the key instruction fields, and generates a portrait device key update table;

[0075] According to the portrait key trigger identification set, extract the encryption policy number and usage frequency value corresponding to each device from the current key status table of the user device. Suppose the current encryption policy number of a certain device is A, and its usage frequency value is 10 times. While the current key update requires the device to use encryption policy B, and the usage frequency needs to be increased to 15 times, then this device will be marked as a policy non-compliance item. By comparing the encryption policies and usage frequencies of all devices, identify those devices with policy non-compliance or usage frequencies lower than the requirements. For example, if a device's encryption policy does not meet the requirements or its usage frequency is low, then the device is marked as a status failure item. Extract relevant portrait fields of the device, such as device model, usage frequency, user identity, etc., and analyze in combination with user portrait data to ensure that the user identity matches the actual usage situation of the device; finally, according to the analysis results, update the key instruction field, reset the device's encryption policy, and generate a portrait device key update table, which contains all device numbers whose key status needs to be updated and their updated key information, ensuring that each device can correctly execute under the current encryption policy and enhance communication security.

[0076] Specifically, as Figure 2 、 5 shown, the behavior sequence evaluation module includes:

[0077] The portrait behavior extraction sub-module extracts the user's charging behavior and frequency sequence based on the portrait device key update table, sorts them by timestamp, identifies the mapping between the user and the continuous behavior trajectory, analyzes the behavior trend under the user portrait, and generates a portrait behavior sequence mapping table;

[0078] Extract the user's charging data from the device's behavior log. The data includes information such as the charging start time, charging end time, charging power, charging frequency, etc. Then sort the data by timestamp to ensure the order of all charging behaviors is consistent. Next, analyze the user's behavior trajectory. By observing the change trend of the charging data, identify the user's behavior pattern. For example, a certain user frequently performs fast charging within a certain period, while another user relies more on slow charging. The data of the behavior trajectory will ultimately be mapped to a behavior sequence mapping table, which records the relationship between each user's charging behavior and its behavior change trend. Thus, it is possible to predict the user's future charging behavior based on the historical data of the user's behavior, and can also conduct comparative analysis in combination with the user's behavior. Through such mapping, abnormal patterns of user behavior in specific situations can be identified, such as frequently changing charging stations for several consecutive days, or abnormally increasing the charging frequency at certain time points, etc. Finally, a portrait behavior sequence mapping table is generated, which records the mapping relationship between the user and its behavior trajectory, providing data support for further behavior analysis.

[0079] The sequence fluctuation recognition sub-module calls the portrait behavior sequence mapping table, performs a sliding analysis on the charging value and frequency value in the behavior trajectory, calculates the change gradient and compares it with the fluctuation threshold, identifies the abnormal behavior interval, and obtains the list of abnormal sections of the portrait sequence;

[0080] Perform a sliding analysis on the user's charging behavior, divide the charging behavior data with a certain time window, calculate the change gradient of the charging behavior within each time window. The change gradient reflects the change range of the charging frequency and charging value during this time period. Suppose a user's charging value changes from 5 kWh to 7 kWh within a certain period of time, and the time span is the time interval between the start and end of charging. Then compare the change gradient within each time period with the preset fluctuation threshold. For example, set the fluctuation threshold to 0.5 kWh / hour. If the change gradient in a certain time period exceeds this threshold, it indicates that the user's charging behavior fluctuates greatly, and then mark this time period as an abnormal behavior interval. Through the sliding analysis, gradually process the entire behavior sequence, identify the areas with large fluctuations in charging behavior, and finally generate a list of abnormal sections of the portrait sequence, listing all the abnormal behavior time periods and the user numbers and behavior characteristics of the relevant users.

[0081] The identity deviation tracing sub-module extracts the user numbers and behavior characteristics of the marked sections according to the list of abnormal sections of the portrait sequence, matches the identity registration model, compares the user identification and behavior correlation coefficient, determines the range of identity attribute changes, and obtains the portrait feature fluctuation label set;

[0082] First, extract the user numbers and behavior characteristics marked as abnormal. Then, through matching the identity registration model, conduct further comparative analysis on the user's behavior data, calculate the correlation coefficient between each user's behavior characteristics and their registered identity. This coefficient is used to measure whether the user's charging behavior has deviated significantly from the original pattern. Suppose a user's charging behavior in the previous registration model showed that most of their charging behaviors were concentrated in specific time periods or locations, but in the recent behavior sequence, the user's charging behavior has changed significantly, such as a large increase in charging frequency or a change in the charging time period. By comparing the differences between the current behavior and the historical behavior, calculate the correlation coefficient. If the correlation coefficient is lower than the predetermined threshold (such as 0.3), it is considered that the user's identity attribute has changed. According to the analysis, the range of identity attribute changes can be determined, thereby generating a portrait feature fluctuation label set. This label set contains the identity change range and behavior fluctuation characteristics of each user, providing a basis for further identity verification and security protection.

[0083] Specifically, as Figure 2 、 6 shown, the data anomaly recognition module includes:

[0084] The event behavior comparison sub-module calls the portrait feature fluctuation label set, extracts the charging duration, start time, and usage frequency according to the user number, compares the corresponding fields with the portrait behavior sequence numerically, identifies the behavior difference interval, and generates a set of behavior deviation differences;

[0085] Obtain the user number from the user's portrait feature fluctuation label set, and then extract the corresponding user's charging data, including indicators such as the start time, charging duration, and usage frequency of each charge. Suppose a user's charging duration is 1 hour and the charging frequency is 3 times on a certain day. Compare the user's behavior data with the corresponding fields in the portrait behavior sequence numerically. In this way, the change trend of the user's charging behavior within a certain period can be identified. If there are obvious changes in the user's charging duration or frequency, such as increasing from charging 1 hour 3 times a day to charging 2 hours 5 times suddenly, the behavior difference interval of the charging duration and frequency can be identified. In this way, the differences in the user's behavior can be accurately marked, and a set of behavior deviation differences can be generated, recording the differences and the corresponding time periods for subsequent analysis.

[0086] The deviation intensity determination sub-module extracts the behavior differences of each user according to the set of behavior deviation differences, compares them with the deviation threshold, and makes a combined judgment in combination with the event time interval and deviation frequency, screens the behavior records that meet the deviation intensity requirements, and obtains the deviation behavior section identification set;

[0087] Compare the behavior differences of each user with the set deviation threshold. The deviation threshold is defined as a standard value. For example, the set deviation threshold is ±20%. When the behavior difference of a certain user exceeds this threshold, it is considered that a large deviation has occurred in their behavior. For example, if the user's charging duration increases from 1 hour to 1.5 hours and the charging frequency increases from 3 times to 5 times, the charging behavior deviation of the user will be calculated. For example, the charging duration change is 50% (1.5 hours relative to 1 hour), and the charging frequency change is 66.7% (5 times relative to 3 times). If the deviation exceeds the set deviation threshold (such as 20%), the user will be marked as the target of behavior deviation. Combining the time interval of the event and the deviation frequency, further judge whether their behavior meets the deviation intensity requirements. This deviation intensity requirement can be achieved through a combined judgment formula. Suppose the event time interval is 2 hours and the deviation frequency is 5 times. It is considered that the behavior has sufficient deviation intensity. Finally, a deviation behavior section identification set is generated. This identification set contains all behavior records that meet the deviation intensity requirements and provides a basis for subsequent abnormal behavior analysis.

[0088] The abnormal type aggregation sub-module calls the deviation behavior section identification set, matches the status field in the event record with the status label range in the user profile, calculates the status difference offset value parameter, extracts the abnormal type code through the interval correspondence relationship, and obtains the portrait behavior abnormal classification result;

[0089] The status difference offset value parameter, using the formula: ;

[0090] Where, represents the status difference offset value parameter, represents the status field value corresponding to the event i record, represents the central value of the corresponding status label in the user profile of the event i record, represents the matching weight between the status field of the event i record and the portrait label, represents the number of event records participating in the weight calculation, represents the status field value of the field j record, represents the overall mean value of the status label range in the user profile, represents the number of fields not participating in the weight matching calculation;

[0091] Extract each abnormal behavior record from the deviation behavior section identification set, and obtain the related event status field. The status field includes information such as the user's device status and charging environment. According to the user's portrait data, match the status of this event with the user's status label range. If the user's charging behavior has changed significantly, it can be quantified by calculating the status difference offset value. Assume that the user's behavior deviates by 30% within the status label range. If the status difference offset value exceeds a certain preset threshold (such as 25%), it is considered that the user's behavior has a large anomaly. By extracting the status difference, the abnormal type code can be obtained, such as behavior anomaly, device anomaly or environment anomaly, etc. Finally, the portrait behavior abnormal classification result is generated, which includes the abnormal behavior type and its corresponding code, providing data support for further monitoring and processing;

[0092] : The status field value in the event record, collected from the user behavior log, such as login frequency, page stay time, etc., obtained through the system log record, and the unit is unified as times / day;

[0093] : The central value of the corresponding status label in the user profile, calculated based on historical user behavior data, such as average login frequency, and the unit is times / day;

[0094] : The matching weight between the status field and the portrait label is set according to the importance of the field and its impact on anomaly detection. The weight value is determined by the expert scoring method, ranging from 0 to 1, without unit;

[0095] : The number of event records participating in the weight calculation, directly counting the number of fields participating in the calculation, without unit;

[0096] : The numerical value of the status field that does not participate in the weight matching calculation in the event record, and the collection method is the same as , and the unit is unified as times / day;

[0097] : The overall mean of the status label range in the user portrait, and the calculation method is the average value of all , and the unit is times / day;

[0098] : The number of fields that do not participate in the weight matching calculation, directly counting the number of fields, without unit;

[0099] Specific numerical setting:

[0100] times / day, times / day, ;

[0101] times / day, times / day, ;

[0102] ;

[0103] times / day, times / day;

[0104] times / day;

[0105] ;

[0106] Formula calculation process:

[0107] Calculate the weighted difference term:

[0108] ;

[0109] ;

[0110] Sum: ;

[0111] Calculate the square root of the sum of squared deviations of non-weight fields:

[0112] ;

[0113] ;

[0114] Sum: ;

[0115] Square root: ;

[0116] Calculate the denominator: ;

[0117] Substitute into the formula for calculation: ;

[0118] This result indicates that the state difference offset value parameter is 1.033, indicating that there is a certain degree of deviation between the state field in the event record and the state label range in the user profile. This value can be used to further analyze the degree of abnormality of user behavior.

[0119] Specifically, as Figure 2 , 7 shown, the key schedule encryption module includes:

[0120] The sensitive path recognition sub-module extracts the profile access paths and sensitivity identifiers of abnormal users based on the portrait behavior anomaly classification results, filters and groups the associated nodes according to the sensitivity level and path type, and generates a portrait path sensitivity classification table;

[0121] Classify the behavior of each user and associate its abnormal behavior with specific behavior patterns, so that users who do not conform to the conventional behavior patterns can be identified. During the anomaly classification process, by analyzing the behavior characteristics, comparing the behavior patterns with the normal standards, and judging whether it is abnormal behavior based on the error value. For example, if a user suddenly accesses a large amount of sensitive data late at night, it is marked as abnormal, and the anomaly level is determined by the degree of deviation of the behavior. Extract the profile access paths and sensitivity identifiers of abnormal users. The portrait path refers to a series of access nodes on the user behavior trajectory, and the nodes represent the various operations of the user. The sensitivity identifier is graded according to the behavior content of the user and the specific sensitivity of the path. For example, when accessing personal privacy data, it is marked as high sensitivity. Weight the path according to the identifier, and finally filter out those access paths with significant sensitivity. Filter and group according to the sensitivity level and path type, classify according to the path type such as data query, information editing, etc., generate a path mapping through association analysis to establish a portrait path sensitivity classification table, which contains the sensitivity information of various access paths.

[0122] The policy instruction generation sub-module calls the portrait path sensitivity classification table, extracts the encryption policy key according to the path data classification level and access mode, and registers it in the path encryption item field of the scheduling control table to obtain the portrait path encryption policy set;

[0123] Determine the implementation criteria of the encryption policy according to the classification level and access mode of each path data (such as: read mode, modification mode, query mode, etc.). For each sensitive access path, extract the corresponding encryption policy key. The generation of this key is based on the sensitivity of the path. If the path is marked as highly sensitive, a stronger encryption algorithm and key will be assigned, involving symmetric encryption or asymmetric encryption algorithms. The length of the key and the complexity of the algorithm will increase with the increase of sensitivity. For example, for a highly sensitive path, select the AES-256 encryption method and generate the corresponding encryption key. This encryption policy is registered in the path encryption item field of the scheduling control table to provide real-time encryption protection for user behavior during subsequent execution. Finally, organize all encryption policies into a portrait path encryption policy set and attach the corresponding encryption policy to each path to ensure data security and privacy protection.

[0124] Please refer to Figure 8 , the charging and swapping user portrait data security management method is executed based on the above charging and swapping user portrait data security management system, including the following steps:

[0125] S1: Obtain the in-station communication link quality index items and user mobile positioning items, extract the difference between the signal strength and the noise ratio within a continuous time period, screen the time periods with excessive jump amplitude, associate the link number with the device number, and generate a portrait communication link fluctuation label set;

[0126] S2: Based on the portrait communication link fluctuation label set, extract the signal strength drop and device number within the marked time period, match the corresponding status of the device in the key status table, screen the items to be updated and establish the corresponding relationship between the device number and the key status, and generate a portrait device key update instruction set;

[0127] S3: Based on the portrait device key update instruction set, extract the charging behavior time series and frequency series in the user portrait, identify the behavior offset segments and mark the abnormal change intervals, and generate a portrait behavior security fluctuation label set in combination with the user number mapping;

[0128] S4: Based on the portrait behavior security fluctuation label set, compare the current charging behavior record with the portrait behavior sequence, judge the degree of deviation of the behavior time and frequency, screen the records exceeding the threshold and classify the labels, and generate a portrait behavior anomaly identification set;

[0129] S5: Based on the set of portrait behavior anomaly identifiers, extract the user portrait sensitivity identifier and access path information, match the data classification level and access mode, filter the corresponding encryption tags and write them into the scheduling control table to obtain the set of portrait path encryption policies.

[0130] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of changes or substitutions, which should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the said claims.

Claims

1. A data security management system for charging and swapping user portraits, characterized in that, The system includes: The channel state perception module obtains the in-station communication link quality metric items and user mobile positioning items, performs time-series analysis on the signal quality for a time period, filters out the time periods that meet the jump amplitude benchmark, and maps them to the corresponding link records and device numbers, generating a portrait data link fluctuation identifier; The key update control module calls the portrait data link fluctuation identifier, extracts the signal attenuation label and device number label within the link abnormal segment, filters out the devices that need to update the current identifier, and compares them with the current key status table to generate a portrait device key update table; The behavior sequence evaluation module, based on the portrait device key update table, extracts the charging behavior sequence and usage frequency sequence in the user portrait, evaluates the fluctuation range of the behavior sequence within a continuous time period, filters out the behavior segments that deviate from the portrait feature curve, and obtains a portrait feature fluctuation label set; The data anomaly recognition module calls the portrait feature fluctuation label set, compares the currently collected charging event records with the original portrait behavior sequence, judges the degree of behavior deviation according to the user number, filters out the records that deviate beyond the preset threshold, and classifies them into abnormal types to obtain a portrait behavior anomaly classification result.

2. The charging and swapping user portrait data security management system according to claim 1, wherein: The portrait data link fluctuation identifier includes a link number, a time period identifier, a signal-to-noise ratio difference amplitude, and a jump trend marker. The portrait device key update table includes a key update device list, an abnormal link identification code, a trigger condition label, and a current key status mapping. The portrait feature fluctuation label set includes a behavior segment number, a behavior deviation amplitude, a portrait deviation type, and a user identification code. The portrait behavior anomaly classification result includes a deviation record number, an abnormal category label, a threshold comparison result, and a user behavior label.

3. The charging and swapping user portrait data security management system according to claim 1, wherein: The channel state perception module includes: The link metric extraction sub-module obtains the in-station communication link quality metric items and user mobile positioning items, collects the user positioning data and link number within a specified time period, identifies the link quality time series of the signal strength and noise value, and maps the user identity identifier to generate a link portrait original identifier sequence; The signal-to-noise ratio difference analysis sub-module, based on the link portrait original identifier sequence, analyzes the change of the signal-to-noise ratio within a continuous time period, extracts the records with a jump amplitude exceeding the benchmark difference, filters out the time periods and link numbers with mutation characteristics, and associates the user device identifier to generate a signal-to-noise anomaly trigger mapping record; The portrait data desensitization identification sub-module, according to the signal-to-noise anomaly trigger mapping record, identifies the user label corresponding to the jump feature link number, reconstructs and encrypts the user identity and positioning trajectory fields to generate a portrait data link fluctuation identifier.

4. The charging and swapping user portrait data security management system according to claim 3, wherein: The key update control module includes: The key trigger identification sub-module calls the link abnormal time period, signal attenuation label, and device number in the portrait data link fluctuation identifier, and filters out the user devices that trigger the signal attenuation threshold based on the identity identifier field and communication frequency value in the charging and swapping user portrait to generate a portrait key trigger identifier set; The image key reconstruction sub-module triggers an identification set according to the image key, compares the encryption policy numbers and usage frequency values in the user's current key status table, identifies the device numbers with inconsistent policies and invalid status items, extracts some image fields and updates the key instruction fields, and generates an image device key update table.

5. The charging and swapping user portrait data security management system according to claim 4, wherein: The behavior sequence evaluation module includes: The image behavior extraction sub-module extracts the user's charging behavior and frequency sequence based on the image device key update table, sorts them by timestamp, identifies the mapping between the user and the continuous behavior trajectory, analyzes the behavior trend under the user image, and generates an image behavior sequence mapping table; The sequence fluctuation identification sub-module calls the image behavior sequence mapping table, performs a sliding analysis on the charging values and frequency values in the behavior trajectory, calculates the change gradient and compares it with the fluctuation threshold, identifies the abnormal behavior interval, and obtains a list of abnormal sections of the image sequence; The identity deviation tracing sub-module extracts the user numbers and behavior characteristics of the marked sections according to the list of abnormal sections of the image sequence, matches the identity registration model, compares the user identification and behavior correlation coefficients, determines the range of changes in identity attributes, and obtains an image feature fluctuation label set.

6. The charging and swapping user portrait data security management system according to claim 5, characterized in that: The data anomaly identification module includes: The event behavior comparison sub-module calls the image feature fluctuation label set, extracts the charging duration, start time and usage frequency according to the user number, compares the numerical values with the corresponding fields of the image behavior sequence, identifies the behavior difference interval, and generates a set of behavior deviation differences; The deviation intensity determination sub-module extracts the behavior differences of each user according to the set of behavior deviation differences, compares them with the deviation threshold, combines the event time interval and deviation frequency for joint judgment, screens the behavior records that meet the deviation intensity requirements, and obtains a set of deviation behavior section identifiers; The abnormal type aggregation sub-module calls the set of deviation behavior section identifiers, matches the status fields in the event records with the status label range in the user image, calculates the status difference offset value parameter, and extracts the abnormal type code through the interval correspondence relationship to obtain the image behavior abnormal classification result.

7. The charging and swapping user portrait data security management system according to claim 6, characterized in that: The status difference offset value parameter uses the formula: ； Among them, represents the state difference offset value parameter, represents the value of the corresponding state field in the record of event i, represents the central value of the corresponding state label in the user profile of the record of event i, represents the matching weight between the state field of the record of event i and the profile label, represents the number of event records participating in the weight calculation, represents the value of the state field of the record of field j, represents the overall mean of the state label range in the user profile, represents the number of fields not participating in the weight matching calculation.

8. The charging and swapping user portrait data security management system according to claim 1, characterized in that: The system also includes a key scheduling encryption module: The key scheduling encryption module identifies the associated user image sensitivity identifier and access path information based on the image behavior abnormal classification result, obtains the encryption instruction label according to the data classification level and the current access mode, and registers it in the scheduling control table to obtain an image path encryption policy set; The image path encryption policy set includes an access path code, a sensitivity classification label, an encryption instruction type, and a scheduling control identifier.

9. The charging and swapping user portrait data security management system according to claim 8, characterized in that: The key scheduling encryption module includes: The sensitive path identification sub-module extracts the image access paths and sensitivity identifiers of abnormal users based on the image behavior abnormal classification result, filters and groups the associated nodes according to the sensitivity level and path type, and generates an image path sensitive classification table; The policy instruction generation sub-module calls the image path sensitive classification table, extracts the encryption policy key according to the path data classification level and access mode, and registers it in the path encryption item field of the scheduling control table to obtain an image path encryption policy set.

10. A method for secure management of charging and swapping user portrait data, characterized in that, The method is used to implement the execution of the charging and swapping user portrait data security management system described in any one of claims 1-9, and includes the following steps: S1: Obtain the in-station communication link quality index items and user mobile positioning items, extract the difference between the signal strength and the noise ratio within a continuous time period, screen the time periods with excessive jump amplitudes, associate the link number with the device number, and generate a portrait communication link fluctuation label set; S2: Based on the portrait communication link fluctuation label set, extract the signal strength reduction and the device number within the marked time period, match the corresponding status of the device in the key status table, screen the items to be updated and establish the corresponding relationship between the device number and the key status, and generate a portrait device key update instruction set; S3: Based on the portrait device key update instruction set, extract the charging behavior time series and frequency series in the user portrait, identify the behavior offset segments and mark the abnormal change intervals, and generate a portrait behavior security fluctuation label set in combination with the user number mapping; S4: Based on the portrait behavior security fluctuation label set, compare the current charging behavior record with the portrait behavior sequence, judge the degree of deviation of the behavior time and frequency, screen the records exceeding the threshold and classify the labels, and generate a portrait behavior anomaly identification set; S5: Based on the portrait behavior anomaly identification set, extract the user portrait sensitivity identification and access path information, match the data classification level and access mode, screen the corresponding encryption labels and write them into the scheduling control table to obtain a portrait path encryption policy set.

Images