A data security management method and system for intelligent business database

Abstract

The present invention relates to the field of data processing, and more specifically, to a data security management method and system for an intelligent business database. The method comprises: collecting user data and profile data of each user in the business database; calculating a data risk assessment factor for each user profile; and formulating a profile key replacement rule for each user based on the data risk assessment factor. The present invention formulates a profile key replacement rule for each user based on the quantified data risk assessment factor, and can dynamically adjust the key replacement strategy based on the risk status of each user profile data, thereby enhancing the security of the profile data.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and more particularly to a data security management method and system for an intelligent business database. Background Art

[0002] The Intelligent Business Library is suitable for various financial institutions, such as banks and credit unions, for storing important items such as cash, cash boxes, important blank vouchers, and securities. It not only meets the financial institutions' need for secure fund storage but also improves operational efficiency and management, making it an indispensable facility for financial institutions.

[0003] Smart business repositories aren't just for storing important items like cash and cash boxes. For example, traditional smart business repositories also provide a stable, long-term storage environment for various archival data. These archives are rich and valuable, including valuable historical records, key legal documents, and detailed personal files, and their storage can span years or even decades.

[0004] Traditional encryption practices mostly use static keys to encrypt data. Static keys remain unchanged throughout the encryption process, meaning the key lifecycle may coincide with the storage period of the archival data. Due to the long storage period of archival data, static key management becomes more difficult, which can easily lead to improper key management. For example, keys that remain unchanged for an extended period of time are more vulnerable to being cracked or stolen by attackers through various means.

[0005] With the advancement of technology and the increasing sophistication of network attacks, security threats may come from different directions and change with time and environment. Traditional static encryption and fixed security measures cannot ensure the data security of the intelligent business library. Summary of the Invention

[0006] In order to solve the above-mentioned technical problem that the traditional static encryption and fixed security measures cannot ensure the data security of the intelligent business database, the present invention provides solutions in the following aspects.

[0007] In a first aspect, a data security management method for an intelligent business library includes:

[0008] Collect user data and profile data of each user in the business database;

[0009] Calculate the data risk assessment factor for each user profile;

[0010] Formulate user archive key replacement rules based on data risk assessment factors;

[0011] The data risk assessment factor is:

[0012] The user's attack situation assessment coefficient, the physical risk score of the business library, and the key usage frequency of the user's profile data are calculated, and the ratio of the sum of the user's attack situation assessment coefficient and the physical risk score of the business library to the key usage frequency of the user's profile data is normalized to obtain the data risk assessment factor; the attack situation assessment coefficient is used to characterize the impact of the correlation between the user's profile data on security; the physical risk score is positively correlated with the real-time power consumption of the business library.

[0013] This invention comprehensively considers multiple factors that influence archival data security. Specifically, the attack situation assessment coefficient reflects the security impact of the correlation between user archival data, the physical risk score of the archival management system considers the physical environment of the service database (such as power consumption), and the frequency of key usage reflects the security of the key. This allows for a more comprehensive and accurate assessment of the risk level faced by archival data. Based on the quantified data risk assessment factors, user archival key replacement rules are formulated, allowing for dynamic adjustment of the key replacement strategy based on the risk profile of each user's archival data. For higher-risk users, keys can be replaced more frequently, reducing the risk of key cracking or leakage, thereby enhancing archival data security.

[0014] Preferably, the file data includes file access times, storage duration, and electronic files; each electronic file is encoded using Huffman coding, and the memory size occupied by each encoded electronic file is recorded.

[0015] Huffman coding is a lossless data compression algorithm that constructs an optimal binary tree based on the frequency of occurrence of characters (i.e., a certain data unit of electronic files) and assigns codes of different lengths to each character. For characters that appear frequently, shorter codes are assigned, and for characters that appear less frequently, longer codes are assigned. In this way, the memory space occupied by electronic file data during storage can be effectively reduced; recording the memory size occupied by each encoded electronic file can assist in file data analysis.

[0016] Preferably, the process of obtaining the key usage frequency includes:

[0017] Count the number of times each user's files are accessed in the business database; calculate the average time each user's files are stored in the business database;

[0018] The ratio of the number of times each user's files are accessed in the business database to the average time each user's files are stored in the business database is used as the key usage frequency of each user's file data.

[0019] By analyzing the frequency of key usage, we can identify which files pose a higher security risk. For example, if the key usage frequency of a file is abnormally high, it may mean that the file is being illegally accessed or there is a risk of internal leakage.

[0020] Preferably, the process of obtaining the attack situation assessment coefficient includes:

[0021] Calculate the similarity between any two files of the user, sum the similarities between all the said two files of the user, and divide it by the average memory occupied by all the encoded files of the user to obtain the user's attack posture assessment coefficient.

[0022] By calculating the similarity between different user profiles, we can measure the consistency of user behavior and characteristics across different scenarios or time periods. Low similarity indicates significant differences in user behavior patterns, potentially posing a risk of attack or abnormal operation. Summing the similarity between all profiles and dividing it by the mean memory usage of the encoded profiles further standardizes the similarity metric, making it more comparable. This helps eliminate bias caused by differences in the number of profiles or memory usage, resulting in a more accurate attack situation assessment coefficient.

[0023] Preferably, the process of obtaining the physical risk score includes:

[0024] Obtain the real-time power consumption of the business library at each moment within the preset time. For each moment, calculate the difference between the real-time power consumption of the business library and the standard power consumption, and integrate them to obtain the total deviation between the real-time power consumption of the business library and the standard power consumption within the preset time. Use the total deviation as the physical risk score.

[0025] When a service database experiences a fault, equipment aging, or other anomalies, its real-time power consumption often differs significantly from the standard power consumption. By calculating the total deviation as a physical risk score, these anomalies can be quickly identified. For example, if a service database seal is damaged, causing the cooling or heating system to consume more energy to maintain the cabinet temperature, the real-time power consumption will increase, and the total deviation will also increase accordingly, thus issuing a timely anomaly warning.

[0026] Preferably, the process of obtaining the physical risk score further includes:

[0027] Counting the number of times each user fails to authenticate before successfully authenticating within the preset time period, finding the number of failures that results in the highest number of users failing to authenticate based on a Poisson distribution model, and recording the number of failures as the authentication failure factor;

[0028] The physical risk score is obtained by normalizing the product of the verification failure factor and the total deviation.

[0029] By counting the number of authentication failures for each user within a preset timeframe before successfully authenticating, we can identify unusual user behavior patterns during the authentication process. For example, while a legitimate user might occasionally fail authentication due to input errors, a malicious attacker or someone attempting to illegally access the system might frequently try different passwords or verification methods, resulting in multiple authentication failures. Using a Poisson distribution model, we identify the number of failures that results in the highest number of users failing authentication, using this as the authentication failure factor. This allows us to quantify the extent of this unusual behavior and more accurately identify potentially high-risk users.

[0030] Preferably, formulating a user profile key replacement rule based on a data risk assessment factor includes:

[0031] When the data risk assessment factor is greater than a first threshold, increasing the key rotation frequency of the user profile;

[0032] Periodically update the user archive key according to the determined key rotation frequency, re-encrypt the archive data with the new key, and delete the old key and the archive data encrypted with the old key.

[0033] Preferably, the similarity between any two profiles of the user satisfies the following relationship:

[0034] Where, For the user's File and The similarity between the files, For the user's The data after file encoding, For the user's The data after file encoding, Indicates the user's File and The intersection of the encoded data of the archives, Indicates the user's File and The union of the encoded data of the two files.

[0035] By comparing the similarities between files, we can find abnormal files that are significantly different from the majority of files.

[0036] Preferably, the key usage frequency satisfies the relationship:

[0037] Where, For users No. The frequency of key usage for each archive, For users No. The number of times a file is accessed within the set time window, For users No. The average storage time of files, 、 are all weight factors.

[0038] In a second aspect, a data security management system for an intelligent business library comprises: a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, any one of the data security management methods for an intelligent business library is implemented.

[0039] The beneficial effects of the present invention are:

[0040] This method calculates a data risk assessment factor by comprehensively considering factors such as the attack situation assessment coefficient, physical risk score, and key usage frequency, thereby quantifying the security risk of archival data. Dynamically adjusting the key replacement frequency based on the data risk assessment factor ensures data security while avoiding the waste of resources caused by excessive key replacement. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a method flow chart of steps S1 to S3 in a data security management method for an intelligent business library according to an embodiment of the present invention.

[0042] Figure 2 A diagram showing the frequency of authentication failures. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0044] Reference Figure 1 A data security management method for an intelligent business database includes steps S1 to S3, specifically as follows:

[0045] S1: Collect user data and profile data of each user in the business database.

[0046] In one embodiment, archive data in the business database is collected from the archive management system, specifically including: recording the number of times each archive is accessed, the duration each archive is kept in the business database, and the digital information content of the archive itself (i.e., electronic archive).

[0047] At the same time, it is also necessary to collect relevant information of each user in the system, including user name and user identification. In the example of the present invention, the user's fingerprint is used to determine the user's identification, but in other embodiments, other methods can be selected according to actual conditions, such as face recognition, iris recognition, etc.

[0048] In addition to collecting user data and file data, it is also necessary to record the number of times each user's identity verification (such as fingerprint verification) fails when accessing files in the business library, and to monitor the power consumption during the operation of the smart business library in real time.

[0049] Among them, the encryption algorithm selected is the symmetric encryption algorithm (AES), and Huffman coding is used for user data and archive data.

[0050] S2: Calculate the data risk assessment factor for each user profile.

[0051] The storage time and access frequency of files in the business database will affect the frequency of use of its encryption key. If the file is stored in the business database for a long time, it means that it is less frequently used, the number of encrypted transmissions will also be reduced, and therefore the number of times the key is used will also be reduced.

[0052] In one embodiment, the number of times each user's files are accessed in the business database is counted; the average time each user's files are stored in the business database is calculated; and the ratio of the number of times each user's files are accessed in the business database to the average time each user's files are stored in the business database is used as the key usage frequency of each user's file data. Taking any file data of any user as an example, the key usage frequency of the file data of that user satisfies the following relationship:

[0053]

[0054] Where, The frequency of key usage for the user profile data. The number of times the user's file is accessed in the business database. The average time that the user's file is stored in the business database.

[0055] By analyzing the access history of files in the business database (access time and frequency), we can calculate the frequency of key usage and assess key security. Files that have been stored for a long time and have been accessed infrequently have low key usage frequencies and may require additional security measures to prevent key leakage.

[0056] In another embodiment, the key usage frequency satisfies the relationship:

[0057]

[0058] Where, For users No. The frequency of key usage for each archive, For users No. The number of times a file is accessed within the set time window, For users No. The average storage time of files, 、 All are weight factors (set according to actual conditions or historical data).

[0059] It should be noted that when a user stores a large number of files in a business database and there is a high degree of correlation between the files (this is because the files may overlap or share content, etc.), once the data of one of the electronic files is attacked or the key is leaked, the other files are also likely to be leaked. This is because the correlation between the files allows attackers to infer the content of other files through the information of one file.

[0060] To quantify this risk, in one embodiment, the similarity between any two profiles of a user is calculated, the similarities between all the said two profiles of the user are summed up, and the sum is divided by the average memory occupied by all the encoded profiles of the user to obtain the user's attack situation assessment coefficient.

[0061] Then the attack situation assessment coefficient of the above user satisfies the relationship:

[0062]

[0063]

[0064] Where, is the user's attack situation assessment coefficient, is the total number of all files stored by the user in the business database, For the user's File and The similarity between the files, is the average memory occupied by the encoded data of all the user's electronic archive data, For the user's The data after file encoding, For the user's The data after file encoding, Indicates the user's File and The intersection of the encoded data of the archives, Indicates the user's File and The union of the data after the file encoding. This is to eliminate repeated combination calculations and avoid meaningless self-intersections.

[0065] When the similarity of all the files stored by the user in the business database is high, the similarity between the codes of the electronic file data is also high. The larger the value is, the higher the similarity between all the electronic archive data of the user is. When the encrypted data of one of the electronic archive data is attacked, the possibility of the user's other electronic data archives in the business library being attacked and leaked is higher, and the attack situation assessment coefficient is higher. The larger the value of The larger the value.

[0066] Attack situation assessment coefficient The larger the value, the more frequently the encryption key of the user's electronic archive data needs to be rotated to prevent the electronic archive data from being leaked due to attacks.

[0067] It should be noted that in the business database, electronic archive data may be subject to side-channel attacks during encrypted transmission (that is, attackers obtain encrypted information by analyzing the device's physical properties such as power consumption and electromagnetic radiation), resulting in data leakage.

[0068] In one embodiment, the real-time power consumption of the service library at each moment within a preset time period (e.g., one year) is obtained. For each moment, the difference between the real-time power consumption of the service library and the standard power consumption is calculated and integrated to obtain the total deviation between the real-time power consumption of the service library and the standard power consumption within the preset time period. The total deviation is used as the physical risk score of the service library. The physical risk score of the service library then satisfies the following relationship:

[0069]

[0070] Where, Score the physical risk of the business database, For business database at all times Real-time power consumption, For business database at all times The standard power consumption, The preset time.

[0071] The physical risk score above represents the sum of all instantaneous differences between the service library's real-time power consumption and the standard power consumption during the time interval. A large sum indicates significant power consumption fluctuations in the service library, potentially indicating a significant security risk or efficiency issue. Conversely, a small sum indicates relatively stable power consumption, potentially indicating higher security and efficiency.

[0072] In another embodiment, in addition to considering the security of electronic archive data transmission and the physical security of the business library, user identity authentication security is also a crucial aspect.

[0073] When a user needs to access a file in the business database, the system will verify the user's personal information. In order to estimate the probability of such verification failure, the system uses the Poisson distribution model. By counting the number of times each user fails to authenticate before successfully authenticating within a preset period of time (such as one year), the system can calculate the number of times the user fails to authenticate before successfully authenticating. Figure 2 As shown, a diagram of the frequency of identity authentication failure is constructed (the horizontal axis represents the frequency of user identity authentication failure, and the vertical axis represents the number of users who failed identity authentication), and based on this, the parameters of the Poisson distribution are calculated (usually using methods such as sample mean), and then the probability of the frequency of identity authentication failure for each user is estimated.

[0074] In obtaining After that, the probability density function of the Poisson distribution can be used to estimate the probability of different authentication failure frequencies. The probability density function of the Poisson distribution is:

[0075]

[0076] in, is the parameter of the Poisson distribution, which represents the average occurrence rate (i.e., the average number of failures), is the frequency of authentication failures, is the probability of the frequency occurring.

[0077] Using the Poisson distribution's probability density function, we can estimate the number of users corresponding to different authentication failure frequencies. By comparing these estimates, we can find the authentication failure frequency that yields the highest estimated number of users experiencing authentication failures. This frequency is known as the "authentication failure factor." Simply put, the authentication failure factor is the most likely authentication failure frequency, reflecting a typical authentication failure scenario in the system.

[0078] Furthermore, the product of the verification failure factor and the total deviation is normalized to obtain the physical risk score, that is, the relationship is satisfied:

[0079]

[0080] Where, Score the physical risk of the business database, is a constant, is the verification failure factor, For business database at all times Real-time power consumption, For business database at all times The standard power consumption, The preset time.

[0081] When a user's identity verification fails frequently in their profile, the Verification Failure Factor is higher, indicating a lower physical security level for the business database. When the business database is vulnerable to side-channel attacks, the gap between real-time power consumption and standard power consumption is larger, resulting in a lower physical risk score, also indicating lower physical security. Conversely, if the number of identity verification failures is low and the business database power consumption is stable, the physical risk score is higher, indicating a higher physical security level.

[0082] The longer the archive is stored in the business database, the lower the frequency of key usage will be. At the same time, the attack situation assessment coefficient and physical risk score may increase. Therefore, considering the three influencing factors of attack situation assessment coefficient, physical risk score and key usage frequency, the data risk assessment factor of the user archive is calculated, which satisfies the relationship:

[0083]

[0084] Where, is the data risk assessment factor, is the user's attack situation assessment coefficient, Score the physical risk of the business database, The frequency of key usage for user profile data. Indicates normalization processing.

[0085] The longer each file is stored in the business library, the fewer times the electronic file data is encrypted and transmitted; the larger the attack situation assessment coefficient, the more serious the attack threat faced by the file; the larger the physical risk score, the lower the physical security level of the business library.

[0086] According to the above The calculation operation can be similarly used to obtain the data risk assessment factors of all collected files of all users.

[0087] S3: Formulate user profile key replacement rules based on data risk assessment factors.

[0088] In one embodiment, when a user's electronic archival data is found to be high-risk, the key rotation frequency used to encrypt the user's electronic archival data should be increased to improve the security of the electronic archival data. Regular key rotation can reduce the risk of key leakage due to long-term use, thereby ensuring the security of the archival data to a certain extent.

[0089] Specifically, a user's archive key replacement rule is formulated based on the data risk assessment factor. The rule is as follows:

[0090] when When the value is greater than the first threshold (in the embodiment of the present invention, the first threshold is 0.8), the key of the user's corresponding profile is rotated every eight hours; when When the value is less than or equal to the first threshold and greater than the second threshold (in the embodiment of the present invention, the second threshold is 0.9), the key of the user's corresponding profile is rotated every 24 hours; when When the key is less than or equal to a second threshold (in the embodiment of the present invention, the second threshold is 0.9), the key of the profile corresponding to the user is rotated every 48 hours.

[0091] Then, the user archive key is regularly updated according to the determined key rotation frequency, the archive data is re-encrypted with the new key, and the old key and the archive data encrypted with the old key are deleted.

[0092] The system includes a processor and a memory, wherein the memory stores computer program instructions. When the computer program instructions are executed by the processor, the data security management method for an intelligent business library according to the first aspect of the present invention is implemented.

[0093] The system also includes other components well known to those skilled in the art, such as a communication bus and a communication interface. The configuration and functions of these components are known in the art and therefore will not be described in detail here.

[0094] It should be noted that those skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the appended claims.

Claims

1. A data security management method for an intelligent business database, characterized in that: include: Collect user data and profile data of each user in the business database; User data includes user name and user identification; Calculate the data risk assessment factor for each user profile; Formulate user archive key replacement rules based on data risk assessment factors; Among them, the data risk assessment factors are: Calculate the user's attack situation assessment coefficient, the physical risk score of the business library, and the key usage frequency of the user's profile data, and normalize the ratio of the sum of the user's attack situation assessment coefficient and the physical risk score of the business library to the key usage frequency of the user's profile data to obtain the data risk assessment factor; The attack situation assessment coefficient is used to characterize the impact of the correlation between a user's profile data on security. The process of obtaining the attack situation assessment coefficient includes: calculating the similarity between any two profiles of the user, summing the similarities between all two profiles of the user, and dividing the sum by the average memory occupied by all encoded profiles of the user to obtain the user's attack situation assessment coefficient. The physical risk score is calculated as: , Score the physical risk of the business database, is a constant, is the verification failure factor, For business database at all times Real-time power consumption, For business database at all times The standard power consumption, The process of obtaining the verification failure factor includes: counting the number of authentication failures of each user before the authentication is successful within the preset time, finding the number of failures that makes the authentication failure of the user the highest according to the Poisson distribution model, and recording the number of failures as the verification failure factor.

2. A data security management method for an intelligent business database according to claim 1, characterized in that: The file data includes the number of file accesses, the storage duration and the electronic file; each electronic file is encoded using Huffman coding, and the memory size occupied by each encoded electronic file is recorded.

3. A data security management method for an intelligent business database according to claim 2, characterized in that: The process of obtaining the key usage frequency includes: Count the number of times each user's files are accessed in the business database; calculate the average time each user's files are stored in the business database; The ratio of the number of times each user's files are accessed in the business database to the average time each user's files are stored in the business database is used as the key usage frequency of each user's file data.

4. A data security management method for an intelligent business database according to claim 3, characterized in that: The user's archive key replacement rule formulated based on the data risk assessment factor includes: When the data risk assessment factor is greater than a first threshold, increasing the key rotation frequency of the user profile; Periodically update the user archive key according to the determined key rotation frequency, re-encrypt the archive data with the new key, and delete the old key and the archive data encrypted with the old key.

5. The data security management method for an intelligent business database according to claim 3, characterized in that: The similarity between any two profiles of the user satisfies the following relationship: Where, For the user's File and The similarity between the files, For the user's The data after file encoding, For the user's The data after file encoding, Indicates the user's File and The intersection of the encoded data of the archives, Indicates the user's File and The union of the encoded data of the two files.

6. A data security management method for an intelligent business database according to claim 2, characterized in that: The key usage frequency satisfies the relationship: Where, For users No. The frequency of key usage for each archive, For users No. The number of times a file is accessed within the set time window, For users No. The average storage time of files, 、 are all weight factors.

7. A data security management system for an intelligent business database, characterized in that: include: A processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the data security management method for an intelligent business library according to any one of claims 1 to 6 is implemented.

Images