Data encryption protection method and system based on data large model

Abstract

The invention discloses a data encryption protection method and system based on a data large model, and belongs to the technical field of encryption protection, the data encryption protection method and system based on the data large model comprises the following specific steps: step 1, data collection and preprocessing: collecting data from each link of software development, and storing the collected data in a database; according to the method, the collected data are preprocessed, irrelevant spaces and annotations are removed, the data are formatted into a form suitable for model processing in a unified mode, text data are converted into word vectors or character vectors and the like, and a standard input format is provided for subsequent data recognition. According to the data encryption protection method and system based on the large data model, intelligent and refined protection of software development data can be achieved, the data security in the software development process is effectively improved, the data leakage risk is reduced, and a solid guarantee is provided for robust development of the software industry.

Description

Technical Field

[0001] The present invention belongs to the technical field of encryption protection, and particularly relates to a data encryption protection method and system based on a data large model. Background Art

[0002] In today's digital age, the software development process involves a vast amount of diverse data, which includes an enterprise's core technologies, business secrets, and user privacy information, etc. With the frequent occurrence of data leakage incidents, how to ensure the security of data in the software development process has become a key issue to be solved urgently. Traditional data encryption protection methods often lack accurate data recognition capabilities and are unable to implement differential protection strategies for data of different importance levels and different types, making it difficult to adapt to the complex and changeable software development environment.

[0003] A data large model, also known as an AI large model, refers to a "large parameter" model trained using large-scale data and powerful computing capabilities. These models usually have high generality and generalization capabilities and can be applied to fields such as natural language processing, image recognition, and speech recognition. Therefore, through the data large model, better data recognition and encryption protection for software development can be provided. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the above-mentioned disadvantages of the prior art and provide a data encryption protection method and system based on a data large model.

[0005] The technical solution adopted to solve the above technical problem is: A data recognition and encryption protection method based on a data large model, including the following specific steps:

[0006] Step 1: Data collection and preprocessing:

[0007] Collect data from all aspects of software development, preprocess the collected data, remove irrelevant spaces and comments, uniformly format the data into a form suitable for model processing, convert text data into word vectors or character vectors, etc., to provide a standard input format for subsequent data recognition;

[0008] Step 2: Model training and fine-tuning:

[0009] Use existing large-scale labeled data and manually label part of the data to train a data recognition model, and fine-tune the model according to the characteristics of software development data;

[0010] Step 3: Data scanning and recognition:

[0011] Use the trained model to scan the data in the software development process. For the parts that are identified as possibly containing sensitive data, further verify them through a rule engine;

[0012] Step Four: Key Generation:

[0013] Use an encryption algorithm to generate an encryption key and use a Hardware Security Module (HSM) to store the key. For the identified sensitive data, use the selected encryption algorithm and key for encryption;

[0014] Step Five: Data Management:

[0015] Establish a strict access control policy so that only authorized users or system components can access the encrypted sensitive data. Adopt Role-Based Access Control (RBAC) to back up the encrypted sensitive data. Ensure the security of the backup data during the backup process. Establish an audit mechanism to record all access operations on the encrypted sensitive data.

[0016] Furthermore, the encryption algorithm adopts the AES encryption algorithm as follows:

[0017] Definition of related variables:

[0018] Let the original data to be encrypted be P, with each group being 128 bits, and the round key sequence be K0, K1,..., K N-1 , where N depends on the key length. For a 128-bit key, N = 10; for a 192-bit key, N = 12; for a 256-bit key, N = 14, and the final ciphertext is C

[0019] Initial round encryption:

[0020] First round encryption execution:

[0021]

[0022] Among them, represents the bitwise exclusive OR operation;

[0023] Middle round encryption:

[0024] For the rounds from i = 1 to N - 1, the encryption formula is:

[0025]

[0026] It includes three operations:

[0027] SubBytes (Byte Substitution Operation): Perform byte substitution based on a 16×16 S-box. For the input byte x, its substitution result y is found according to the AES standard;

[0028] ShiftRows (Row Shift Operation): For a 4×4 byte matrix, perform a cyclic left shift operation by row. The first row remains unchanged, the second row is shifted left by 1 bit, the third row is shifted left by 2 bits, and the fourth row is shifted left by 3 bits;

[0029] MixColumns(column mixing operation): Treat the bytes in each column as polynomials over GF(2 8 ) and perform modular multiplication with the fixed polynomial c(x) = 03x 3 + 01x 2 + 01x + 02;

[0030] Final round of encryption:

[0031]

[0032] The column mixing operation is omitted to ensure the reversibility of the encryption process.

[0033] Furthermore, it includes a data recognition module, an encryption module, a key management module, and a decryption module. The data recognition module uses a data large model to monitor and collect various data sources during the software development process, deeply analyzes the data characteristics collected through a pre-trained model, and classifies the data into different sensitive levels.

[0034] Furthermore, the encryption module automatically matches the corresponding encryption algorithm according to the sensitive level determined by the data recognition module. For highly sensitive data, the Advanced Encryption Standard (AES) is adopted and combined with a key management mechanism; for moderately sensitive data, a relatively simple and efficient encryption algorithm is selected to balance encryption efficiency while ensuring security; for generally sensitive data, a hash function is used for simple encryption processing.

[0035] Furthermore, the key management module is responsible for generating, storing, distributing, and updating the keys used for encryption, and adopts a Hardware Security Module (HSM) combined with a software key management strategy to ensure the security of the keys.

[0036] Furthermore, when an authorized user needs to access encrypted data, the decryption module obtains the corresponding key from the secure storage area according to the user's permissions and the key management strategy corresponding to the data, and uses the decryption algorithm corresponding to the encryption process to restore the data to ensure that the data can be used normally in a secure and controllable environment.

[0037] Furthermore, the overall system architecture adopts a hierarchical distributed design, including a data acquisition layer, a data processing layer, an encryption layer, a storage layer, and a user interaction layer. The data acquisition layer connects to the software development data source through various sensors and interfaces, and transmits the data to the data processing layer; after the data processing layer completes the data recognition and classification tasks relying on the large data model, it pushes the data to be encrypted to the encryption layer; the encryption layer performs encryption operations according to the encryption policy and stores the encryption results in the storage layer; the user interaction layer is responsible for receiving the user's access request, coordinating the decryption module to complete data decryption and delivery, and the layers interact through a secure and reliable communication protocol to ensure the stability and security of the overall system operation.

[0038] The beneficial effects of the present invention are as follows: Through the data encryption protection method and system based on the large data model, the present invention can realize the intelligent and refined protection of software development data, effectively improve the data security in the software development process, reduce the risk of data leakage, and provide a solid guarantee for the stable development of the software industry. Description of the Drawings

[0039] Figure 1 is the flowchart of the method of the present invention. Detailed Embodiments

[0040] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0041] As Figure 1 shown, a data recognition and encryption protection method and system based on a large data model in this embodiment includes the following specific steps:

[0042] Step 1: Data collection and preprocessing:

[0043] Collect data from all aspects of software development, preprocess the collected data, remove irrelevant spaces and comments, uniformly format the data into a form suitable for model processing, convert text data into word vectors or character vectors, etc., to provide a standard input format for subsequent data recognition;

[0044] Step 2: Model training and fine-tuning:

[0045] Use the existing large-scale labeled data and manually label part of the data to train the data recognition model, and fine-tune the model according to the characteristics of software development data;

[0046] Step 3: Data scanning and recognition:

[0047] Use the trained model to scan the data in the software development process. For the parts that may contain sensitive data identified, further verify them through the rule engine;

[0048] Step Four: Key Generation:

[0049] Generate an encryption key using an encryption algorithm and use a Hardware Security Module (HSM) to store the key. For the identified sensitive data, encrypt it using the selected encryption algorithm and key;

[0050] Step Five: Data Management:

[0051] Establish a strict access control policy so that only authorized users or system components can access the encrypted sensitive data. Adopt Role - Based Access Control (RBAC) to back up the encrypted sensitive data. Ensure the security of the backup data during the backup process. Establish an audit mechanism to record all access operations to the encrypted sensitive data.

[0052] The encryption algorithm adopts the AES - based encryption algorithm as follows:

[0053] Definition of related variables:

[0054] Let the original data to be encrypted be P, with each group being 128 bits, and the round key sequence be K0, K1,..., K N-1 , where N depends on the key length. For a 128 - bit key, N = 10; for a 192 - bit key, N = 12; for a 256 - bit key, N = 14. The final ciphertext is C

[0055] Initial round encryption:

[0056] The first - round encryption execution:

[0057]

[0058] Among them, represents the bit - wise exclusive - or operation;

[0059] Middle - round encryption:

[0060] For the rounds from i = 1 to N - 1, the encryption formula is:

[0061]

[0062] Among them, it contains three operations:

[0063] SubBytes (byte substitution operation): Perform byte substitution based on a 16×16 S - box. For the input byte x, its substitution result y is found according to the AES standard;

[0064] ShiftRows (Row Shifting Operation): For a 4×4 byte matrix, perform a cyclic left shift operation row by row. The first row remains unchanged, the second row is shifted left by 1 bit, the third row is shifted left by 2 bits, and the fourth row is shifted left by 3 bits;

[0065] MixColumns (Column Mixing Operation): Treat the bytes in each column as polynomials over GF(2 8 ), and perform a modular multiplication operation with the fixed polynomial c(x) = 03x 3 + 01x 2 + 01x + 02;

[0066] Final round of encryption:

[0067]

[0068] The column mixing operation is omitted to ensure the reversibility of the encryption process.

[0069] It includes a data recognition module, an encryption module, a key management module, and a decryption module. The data recognition module uses a data large model to monitor and collect various data sources during the software development process, deeply analyzes the data features collected through a pre-trained model, and classifies the data into different sensitive levels. The encryption module automatically matches the corresponding encryption algorithm according to the sensitive level determined by the data recognition module. For highly sensitive data, the Advanced Encryption Standard (AES) is used, combined with a key management mechanism; for moderately sensitive data, a relatively simple and efficient encryption algorithm is selected to balance encryption efficiency while ensuring security; for generally sensitive data, a hash function is used for simple encryption processing.

[0070] The key management module is responsible for generating, storing, distributing, and updating the keys used for encryption. It adopts a Hardware Security Module (HSM) combined with a software key management strategy to ensure the security of the keys. When an authorized user needs to access encrypted data, the decryption module obtains the corresponding key from the secure storage area according to the user's permissions and the key management strategy corresponding to the data, and uses the decryption algorithm corresponding to the encryption process to restore the data, ensuring that the data can be used normally in a secure and controllable environment. The overall system architecture adopts a hierarchical distributed design, including a data acquisition layer, a data processing layer, an encryption layer, a storage layer, and a user interaction layer. The data acquisition layer connects to the software development data sources through various sensors and interfaces, and transmits the data to the data processing layer; after the data processing layer completes the data recognition and classification tasks relying on the data large model, it pushes the data to be encrypted to the encryption layer; the encryption layer performs encryption operations according to the encryption policy and stores the encryption results in the storage layer; the user interaction layer is responsible for receiving the user's access requests and coordinating the decryption module to complete data decryption and delivery. Each layer interacts through a secure and reliable communication protocol to ensure the stability and security of the overall system operation.

[0071] Data large model training phase:

[0072] Collect a large number of historical software development data samples, covering data of different types of projects and different industry fields, and annotate them. The annotation content includes data sensitivity levels, data types to which they belong, etc.

[0073] Adopt a deep learning framework to construct the architecture of the data large model. Select a suitable neural network model, a combined model of convolutional neural network (CNN) and recurrent neural network (RNN) to meet the learning requirements for the structured and unstructured features of the data.

[0074] Use the annotated sample data to repeatedly train the model. By adjusting the model parameters, optimize the accuracy and recall rate of the model so that it can accurately identify the sensitive characteristics of software development data.

[0075] System deployment phase:

[0076] In the internal network environment of software development enterprises, deploy hardware facilities such as data acquisition nodes and server clusters according to the system architecture design requirements to ensure that the system can comprehensively cover key process nodes of software development.

[0077] Install the trained data large model and supporting software modules such as encryption, key management, and decryption to the corresponding servers, and complete the system initialization configuration, including key generation, initial encryption policy setting, etc.

[0078] Operation and maintenance phase:

[0079] During the continuous operation of the system, monitor the data recognition and encryption protection effects in real time. By regularly comparing the encrypted data with the original data samples, check the data integrity and security.

[0080] The above is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A data recognition encryption protection method based on a large data model, characterized in that, It includes the following specific steps: Step 1: Data collection and preprocessing: Collect data from all aspects of software development, preprocess the collected data, remove irrelevant spaces and comments, uniformly format the data into a form suitable for model processing, convert text data into word vectors or character vectors, etc., to provide a standard input format for subsequent data recognition; Step 2: Model training and fine-tuning: Use existing large-scale labeled data and manually label part of the data to train a data recognition model, and fine-tune the model according to the characteristics of software development data; Step 3: Data scanning and recognition: Use the trained model to scan the data in the software development process. For the identified parts that may contain sensitive data, further verify them through a rule engine; Step 4: Key generation: Use an encryption algorithm to generate an encryption key, and use a Hardware Security Module (HSM) to store the key. For the identified sensitive data, use the selected encryption algorithm and key for encryption; Step 5: Data management: Establish a strict access control policy so that only authorized users or system components can access the encrypted sensitive data. Adopt Role-Based Access Control (RBAC) to back up the encrypted sensitive data. Ensure the security of the backup data during the backup process. Establish an audit mechanism to record all access operations on the encrypted sensitive data.

2. The data recognition encryption protection method based on a large data model according to claim 1, characterized in that The encryption algorithm adopts the AES encryption algorithm, specifically as follows: Definition of relevant variables: Let the original data to be encrypted be P, with each group being 128 bits, and the round key sequence be K0, K1,..., K N-1 , where N is determined according to the key length. For a 128-bit key, N = 10; for a 192-bit key, N = 12; for a 256-bit key, N = 14, and the final ciphertext is C Initial round encryption: Execution of the first round of encryption: Among them, represents bitwise exclusive OR operation; Middle round encryption: For the rounds from i = 1 to N - 1, the encryption formula is: It includes three operations: SubBytes (byte substitution operation): Perform byte substitution based on a 16×16 S-box. For the input byte x, its substitution result y is found according to the AES standard; ShiftRows (row shift operation): For a 4×4 byte matrix, perform a circular left shift operation row by row. The first row remains unchanged, the second row is shifted left by 1 bit, the third row is shifted left by 2 bits, and the fourth row is shifted left by 3 bits; MixColumns(column mixing operation): Treat the bytes of each column as polynomials over GF(2 8 ), and perform a modular multiplication operation with the fixed polynomial c(x) = 03x 3 + 01x 2 + 01x + 02; Final round encryption: The column mixing operation is omitted to ensure the reversibility of the encryption process.

3. A data recognition and encryption protection system based on a large data model according to claim 1, characterized in that, It includes a data recognition module, an encryption module, a key management module, and a decryption module. The data recognition module uses a data large model to monitor and collect various data sources in the software development process, deeply analyzes the data characteristics collected through a pre-trained model, and classifies the data into different sensitive levels.

4. A data recognition and encryption protection system based on a large data model according to claim 3, characterized in that, The encryption module automatically matches the corresponding strength encryption algorithm according to the sensitive level determined by the data recognition module. For highly sensitive data, adopt the Advanced Encryption Standard (AES), combined with a key management mechanism; for moderately sensitive data, select a relatively simple and efficient encryption algorithm, taking into account encryption efficiency while ensuring security; for generally sensitive data, perform simple encryption processing using a hash function.

5. The data recognition and encryption protection system based on a large data model according to claim 4, wherein, The key management module is responsible for generating, storing, distributing, and updating the keys used for encryption, and adopts a combination of a Hardware Security Module (HSM) and a software key management strategy to ensure the security of the keys.

6. The data recognition encryption protection system based on a large data model according to claim 5, characterized in that, When an authorized user needs to access encrypted data, the decryption module obtains the corresponding key from the secure storage area according to the user's permissions and the key management policy corresponding to the data, and uses the decryption algorithm corresponding to the encryption process to restore the data to ensure that the data can be used normally in a secure and controllable environment.

7. The data recognition encryption protection system based on the large data model according to claim 6, characterized in that, The overall system architecture adopts a hierarchical distributed design, including a data acquisition layer, a data processing layer, an encryption layer, a storage layer, and a user interaction layer. The data acquisition layer connects to the software development data source through various sensors and interfaces, and transmits the data to the data processing layer; After the data processing layer completes the data identification and classification tasks relying on the data large model, it pushes the data to be encrypted to the encryption layer; the encryption layer performs encryption operations according to the encryption policy and stores the encryption results in the storage layer; the user interaction layer is responsible for receiving the user's access requests, coordinating the decryption module to complete data decryption and delivery. The layers interact with each other through a secure and reliable communication protocol to ensure the stability and security of the overall system operation.

Images