A data encryption method based on enterprise data security management

Abstract

The present invention discloses a data encryption method based on enterprise data security management, comprising five steps: extracting attribute information and operation information of a data subject from a system behavior log, establishing attribute-based encryption (ABE) of the data subject, creating zero-trust encryption (ZTA) of an access request, establishing a uniquely matching key pair SP, and establishing an AI encryption management model. Through the triple innovation of attribute-based encryption, zero-trust encryption, and AI-driven management, a fine-grained, dynamic, and adaptive data encryption strategy is implemented, the accuracy of the encryption strategy is improved, and the static, rigid, and fragmentation problems of traditional encryption methods are solved. The initiative, adaptability, and sustainability of enterprise data security are significantly improved, resource waste is reduced while ensuring security, and adaptive key management is realized. Its technical integration and automation characteristics enhance the scalability of data security management and improve compatibility and flexibility in use.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a data encryption method based on enterprise data security management. Background Art

[0002] With the acceleration of enterprise digital transformation, data has become one of the core assets of enterprises, and the importance of data security has become increasingly prominent. Existing data encryption methods have limitations such as static access lag, data fragmentation, and rigid key management.

[0003] Since traditional encryption methods are usually based on fixed permission allocation, they cannot dynamically adapt to changes in the internal and external environment of the enterprise. For example, multi-dimensional data such as device health status, abnormal user behavior, and system environment risks are fragmented, resulting in static and lagging access security policies; and the generation and rotation of keys often rely on manual intervention or fixed-cycle policies, lacking a dynamic trade-off between security gains and performance losses, which can easily lead to resource waste or security vulnerabilities, resulting in rigid key management.

[0004] Existing attribute-based encryption (ABE) can achieve fine-grained attribute-based access control, but lacks dynamic risk assessment capabilities. Zero-trust encryption (ZTA) emphasizes dynamic trust assessment, but the encryption process is disconnected from attribute management. Combining the two leads to high computing resource consumption, high deployment complexity, and security risks. To address these technical shortcomings, a solution is proposed. Summary of the Invention

[0005] The purpose of this invention is to solve the problems of static access lag, data fragmentation and key management rigidity in traditional encryption methods, as well as the problems of large computing resource consumption, high deployment complexity and security risks caused by combining attribute-based encryption (ABE) with zero-trust encryption (ZTA).

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A data encryption method based on enterprise data security management includes the following steps:

[0008] Step 1: Extract the attribute information and operation information of the data subject through the system behavior log;

[0009] Step 2: Build the attribute-based encryption (ABE) of the data subject: integrate the attribute information into the attribute set A, build the access policy tree V based on the attribute set A, perform bilinear encryption on the plaintext M and combine it with hash function analysis to preliminarily obtain the master key MK and public key PK;

[0010] Step 3: Create Zero Trust Encryption (ZTA) for access requests: By preprocessing the operational information, the device health score, user behavior anomaly score, and system environment risk score are obtained. The access decision function is then generated and dynamically updated to obtain the user's private key SK.

[0011] Step 4: Establish a unique matching key pair SP: Use the user's private key SK to encrypt the public key PK twice to obtain the new public key PKnew. The user's private key SK and the new public key PKnew are combined and marked as the key pair SP;

[0012] Step 5: Establish an AI encryption management model: Use deep learning to evaluate the security gains and performance losses of data encryption, obtain data key rotation strategies, and thus adaptively drive key pair SP management.

[0013] Furthermore, the specific process of initially obtaining the master key MK and public key PK is as follows:

[0014] The attribute information is integrated and marked as the attribute set A. The access policy tree V is constructed based on the attribute set A. The leaf nodes of the access policy tree V are attributes, and the non-leaf nodes are thresholds. Only users who meet the access policy tree V can decrypt the data.

[0015] Obtain the corresponding random number through the quantum random number generator to obtain the master key MK:

[0016] ,in, is a random number;

[0017] Set up and label the bilinear group G, which satisfies the bilinear map e: , where G and It is a multiplication cyclic group, and the generator g of the group G is obtained through the GMP library;

[0018] Encrypt the plaintext M through the bilinear mapping e and the generator g to obtain the plaintext bilinear ciphertext ;

[0019] Mark the attribute information as the attribute set A, and mark any attribute element in the attribute set A as a;

[0020] Shared secret via polynomial And combined with the Lagrange interpolation formula to obtain , and then through Combined with the generator g to obtain the first ciphertext Ca of attribute element a 1 ;

[0021] Obtain the hash value H(a) of attribute element a through the hash function, and combine Comprehensively obtain the second ciphertext Ca of attribute element a 2;

[0022] Bilinear ciphertext , the first ciphertext Ca of attribute element a 1 and the second ciphertext Ca 2 Combined to obtain the public key PK.

[0023] Furthermore, the specific process of preprocessing the operation information is as follows:

[0024] Operational information includes device status data, user behavior data, and system environment data;

[0025] Set the information collection cycle Tc to collect the operation information regularly;

[0026] Mark the number of indicators of the equipment status data as n1, mark any indicator of the equipment status data as Di, obtain the normalized standard value normDi of the indicator Di, and then obtain the equipment health status score Sd comprehensively through the normalized standard values ​​of n1 indicators Di;

[0027] Mark the number of indicators of user behavior data as n2, mark any indicator of user behavior data as Et, obtain the normalized standard value normEt of indicator Et, mark the historical data evaluation value of indicator Et in the long short-term memory network LSTM as LSTMEt, and use the difference between the normalized standard value of n2 indicators Et and the historical data evaluation value to comprehensively obtain the user behavior anomaly score Se;

[0028] Mark the number of indicators of the system environment data as n3, mark any indicator of the system environment data as Gj, obtain the normalized standard value normGj of the indicator Gj, and then obtain the system environment risk score Sg comprehensively through the normalized standard values ​​of n3 indicators Gj.

[0029] Furthermore, the specific process of obtaining the user's private key SK is as follows:

[0030] By combining the device health status score Sd, the user behavior anomaly score Se and the system environment risk score Sg, the comprehensive risk probability Access(t) is obtained;

[0031] Set the risk threshold θ of the comprehensive risk probability Access(t) for comparison and generate an access decision function: if the output comprehensive risk probability Access(t) is lower than the risk threshold θ, access is allowed;

[0032] Timestamp Tn and dynamic attenuation factor of tag attribute information collection , get the ciphertext aging factor ;

[0033] Set the ciphertext aging factor Compare it with the time threshold r, obtain the updated attribute set and mark it as A(t+1);

[0034] Mark any element in the updated attribute set A(t+1) as , and then obtain the user's private key SK through the hash function.

[0035] Furthermore, the specific process of obtaining the new public key PKn is as follows:

[0036] The public key PK is encrypted twice using the user's private key SK, and then concatenated with the enterprise data plaintext M. The new public key PKnew is obtained through a hash function combined with an access decision function.

[0037] Integrate the user's private key SK and the new public key PKnew into a key pair SP: .

[0038] Furthermore, the specific process for evaluating the security gains and performance losses of data encryption is as follows:

[0039] Monitor and obtain security parameters and performance parameters of data encryption;

[0040] The security parameters are marked as set Qaq, and any element of the set Qaq is marked as ;

[0041] The performance parameters are marked as a set Qxn, and any element of the set Qxn is marked as ;

[0042] The safety gain and performance loss are evaluated, and the reward function R is obtained comprehensively:

[0043] ;

[0044] in, For elements The conversion index, For elements Conversion index; refers to the safety gain, It refers to performance loss; and are the proportional coefficients of safety gain and performance loss respectively.

[0045] Furthermore, the specific process of obtaining the data key rotation strategy is as follows:

[0046] The data key rotation strategy includes state space and action space;

[0047] Label the state space as ZTt and any element of the state space ZTt as zt;

[0048] Mark the action space as DZt: mark any element of the action space DZt as dz;

[0049] Obtain the strategy value function St(zt,dz) through the state space ZTt and action space DZt;

[0050] Iteratively update the policy value function St(zt, dz) through deep learning to perform adaptive drive management for keys;

[0051] If the DQN (Deep Q-Network) algorithm is selected, the data key rotation strategy is:

[0052] ;

[0053] in, is the learning rate, For instant rewards, Refers to the next state and its actions .

[0054] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0055] This invention, through the triple innovation of attribute-based encryption (ABE), zero-trust encryption (ZTA), and AI-driven management, implements a fine-grained, dynamic, and adaptive data encryption strategy. This addresses the static, rigid, and fragmented nature of traditional encryption methods, significantly improving the proactive, adaptable, and sustainable nature of enterprise data security. Its technological integration and automation features are particularly suitable for scenarios with high security requirements, enhancing the scalability of data security management.

[0056] This invention integrates attribute-based encryption (ABE) and zero-trust encryption (ZTA), and dynamically adjusts access rights through access decision functions based on real-time scoring of device status, user behavior, and system environment, achieving continuous verification and reducing the risks of internal threats and external attacks.

[0057] This invention integrates multi-dimensional data such as device status, user behavior, and system environment, generates a comprehensive risk score through normalization processing, and uses hash functions and bilinear group technology to ensure that attribute information cannot be tampered with and the encryption process is efficient and reliable, thereby improving the accuracy of the encryption strategy;

[0058] This invention uses an AI-driven management model to set a reward function to quantify security gains and performance losses, and introduces a ciphertext aging factor and a dynamic decay factor to automatically eliminate outdated attributes or keys, avoiding security risks caused by long-term key updates. The DQN algorithm dynamically optimizes the key rotation strategy, ensuring security while reducing resource waste and achieving adaptive key management.

[0059] This invention uses AI to automatically process key generation, rotation, and policy updates, reducing manual intervention. It is suitable for large-scale enterprise environments and presets parameters through actual application scenarios to adapt to the security needs of different enterprises, thereby improving compatibility and flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic flow chart showing the overall solution of the present invention is shown;

[0061] Figure 2 A schematic diagram of the process of attribute-based encryption (ABE) of the present invention is shown;

[0062] Figure 3 A schematic diagram of the process of zero-trust encryption ZTA of the present invention is shown;

[0063] Figure 4 A flow chart of the AI ​​encryption management model of the present invention is shown. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention. Example 1

[0065] like Figure 1-Figure 4 As shown, a data encryption method based on enterprise data security management includes the following steps:

[0066] S1, extracts attribute information and operation information of the data subject through system behavior logs;

[0067] Attribute information includes user name, department, role, and level;

[0068] Operation information includes device status data, user behavior data, and system environment data; set the information collection period Tc to collect operation information regularly;

[0069] Device status data includes the number of system patches, the proportion of abnormal access processes, and the proportion of GPS geographic anomalies;

[0070] User behavior data includes the number of failed decryption attempts, the frequency of sensitive file access, and keyboard tapping delays;

[0071] System environment data includes the frequency of network threat alerts, the proportion of non-enterprise network connection ports, and the proportion of third-party component vulnerabilities.

[0072] S2, build the attribute-based encryption (ABE) of the data subject: integrate the attribute information into the attribute set A, build the access policy tree V based on the attribute set A, perform bilinear encryption on the plaintext M and combine it with hash function analysis to preliminarily obtain the master key MK and public key PK;

[0073] S2-1: Attribute information is integrated and marked as the attribute set A. An access policy tree V is constructed based on the attribute set A. The leaf nodes of the access policy tree V are attributes, and the non-leaf nodes are thresholds. Only users who meet the requirements of the access policy tree V can decrypt the data.

[0074] S2-2, obtaining the corresponding random number through the quantum random number generator;

[0075] Get the master key MK: ,in, is a random number;

[0076] S2-3, set and label the bilinear group G, which satisfies the bilinear map e: , where G and is a multiplicative cyclic group;

[0077] Get the generator g of the group G through the GMP library (GNU Multiple - Precision Arithmetic Library). For example, select a large prime number p of the group G, select an integer g in the interval [2, p-1], and verify that for all positive integers i less than p-1, , then g is a generator of G;

[0078] Encrypt the plaintext M to obtain the plaintext bilinear ciphertext : ,in, is a bilinear map, is a random number;

[0079] S2-4, hash the attribute information. The specific process is as follows:

[0080] Tag attribute set A: , transform any attribute element a and obtain the first ciphertext Ca of attribute element a 1 and the second ciphertext Ca 2 ;

[0081] , , where g is the generator of group G, is a polynomial shared secret, obtained by the Lagrange interpolation formula , H is the hash function, H(a) is the hash value of attribute element a;

[0082] S2-5, through plaintext bilinear ciphertext , the first ciphertext Ca of attribute element a 1 and the second ciphertext Ca 2 Combined, get the public key PK: .

[0083] S3, creating zero-trust encryption (ZTA) for access requests: This pre-processes operational information to obtain the device health score, user behavior anomaly score, and system environment risk score. It then generates and dynamically updates the access decision function to obtain the user's private key (SK).

[0084] S3-1, the specific process of pre-processing the operation information is as follows:

[0085] S3-101, mark the number of indicators of the device status data as n1, mark any indicator of the device status data as Di, and obtain the normalized standard value normDi of the indicator Di: ;

[0086] in, and They are the minimum and maximum values ​​of indicator Di in historical data respectively;

[0087] By assigning the corresponding abnormal weight factor to the indicator Di , thereby comprehensively obtaining the equipment health status score Sd: ;

[0088] S3-102, mark the number of indicators of user behavior data as n2, mark any indicator of user behavior data as Et, and obtain the normalized standard value normEt of indicator Et: ;

[0089] in, and are the mean and standard deviation of the indicator Et respectively;

[0090] The historical data evaluation value of indicator Et in the long short-term memory network LSTM is marked as LSTMEt:

[0091] ;in, It is a preset conversion constant, the purpose of which is to combine the mean and standard deviation of the indicator Et to convert it into the historical data evaluation value of the indicator Et;

[0092] By assigning the corresponding abnormal weight factor to the indicator Et , thereby comprehensively obtaining the user behavior abnormality score Se: ;

[0093] S3-103, mark the number of indicators of the system environment data as n3, mark any indicator of the system environment data as Gj, and obtain the normalized standard value normGj of the indicator Gj: ;

[0094] By assigning the corresponding abnormal weight factor to the indicator Gj , thereby comprehensively obtaining the system environment risk score Sg: ;

[0095] in, It is the maximum value of indicator Gj in historical data.

[0096] S3-2, the specific process of obtaining the user's private key SK is as follows:

[0097] S3-201, by combining the device health status score Sd, the user behavior anomaly score Se and the system environment risk score Sg, obtains the access decision function:

[0098] ;

[0099] in, 、 、 are the weight coefficients of the device health status score Sd, the user behavior abnormality score Se, and the system environment risk score Sg, respectively, and 、 、 The preset values ​​of are all greater than 0. The weight coefficient is obtained by calculating a large amount of experimental data and needs to be set in combination with the actual application situation. Access (t) is the comprehensive risk probability, θ is the risk threshold, and the Sigmoid function is: ;

[0100] If the output comprehensive risk probability Access(t) is lower than the risk threshold θ, access is allowed; otherwise, access is denied;

[0101] S3-202, timestamp Tn and dynamic attenuation factor of attribute information collection , get the ciphertext aging factor : , where e is a natural constant, λ is the decay rate, λ is a constant parameter obtained by preset, and t is the encryption duration, which refers to the time interval from the start of the encryption operation to the current timestamp Tn;

[0102] S3-203, and then obtain the dynamic attribute update strategy:

[0103] The complete set of attributes marked as updated is A(t+1):

[0104] ;

[0105] Among them, r is the aging threshold, when the attenuation factor of attribute element a When it is lower than the aging threshold r, the attribute element is removed; For the new attribute element;

[0106] Mark any element in the updated attribute set A(t+1) as , and then obtain the user's private key SK through the hash function: .

[0107] S4, establish a unique matching key pair SP: use the user's private key SK to encrypt the public key PK twice to obtain the new public key PKnew, and combine the user's private key SK and the new public key PKnew into a key pair SP;

[0108] The public key PK is encrypted twice using the user's private key SK, and then concatenated with the enterprise data plaintext M. The new public key PKnew is obtained by taking the modulus of q using the hash function combined with the access decision function:

[0109] ;

[0110] Integrate the user's private key SK and the new public key PKnew into a key pair SP: .

[0111] S5, establish an AI encryption management model: Use deep learning to evaluate the security gains and performance losses of data encryption, obtain data key rotation strategies, and thus perform adaptive drive management of key pairs SP;

[0112] S5-1, the specific process of evaluating the security gains and performance losses of data encryption is as follows:

[0113] Monitor the security and performance parameters of data encryption during enterprise data security management;

[0114] Security parameters include the reduction of threat events, the number of key attacks cracked, and the number of security vulnerabilities repaired;

[0115] Among them, statistics are collected before and after the implementation of the key management strategy, such as the number of security threat events such as key leakage and illegal access. If the number of events decreases significantly, it indicates a high security gain. Penetration testing is used to compare the time and resources required for attackers to successfully crack the key under the dynamic strategy. The longer the time and the greater the resource consumption, the greater the security gain. The number of related security vulnerabilities repaired and the changes in severity during the key management process are examined. When high-risk vulnerabilities are repaired and the total number of vulnerabilities decreases, it means that the system security is enhanced and the security gain is obvious.

[0116] Mark the security parameters as set Qaq: , mark any element of the set Qaq as ;

[0117] Performance parameters include system response time, resource utilization, and service throughput;

[0118] Among them, by measuring the change in system response time when performing key-related operations (such as key generation and rotation), the longer the response time, the greater the performance loss; by monitoring the usage of system resources such as CPU and memory during the execution of key management tasks, if the resource usage rate increases significantly, it indicates performance loss; by comparing the business processing volume or throughput before and after the key management policy adjustment, if the business processing capacity decreases, it indicates performance loss;

[0119] The performance parameters are labeled as a set Qxn: , mark any element of the set Qxn as ;

[0120] The reward function R is obtained from this: ;

[0121] in, For elements The conversion index, For elements Conversion index; refers to the safety gain, It refers to performance loss; and They are the proportional coefficients of safety gain and performance loss respectively; the conversion index and proportional coefficient are preset according to actual application conditions.

[0122] S5-2, the specific process of obtaining the data key rotation policy is as follows:

[0123] The data key rotation strategy includes state space and action space;

[0124] Let the state space be labeled ZTt: ;

[0125] Let the action space be labeled DZt: ;

[0126] The state space includes access frequency, sensitivity level, and risk score; the action space includes immediately rotating keys, delaying key aging, and keeping keys unchanged;

[0127] Obtain the strategy value function St(zt,dz) through the state space ZTt and action space DZt;

[0128] Iteratively update the policy value function St(zt, dz) through deep learning to perform adaptive drive management for keys;

[0129] For example, if the DQN (Deep Q-Network) algorithm is selected, the data key rotation strategy is:

[0130] ;

[0131] in, is the learning rate, For instant rewards, Refers to the next state and its actions , the purpose is to make Getting closer , thereby obtaining the optimal action, realizing key-driven self-growth optimization, and finally realizing a data encryption method for enterprise data security management that integrates dynamic keys and access control.

[0132] The application effects of the present invention are as follows:

[0133] This invention integrates attribute-based encryption (ABE) and zero-trust encryption (ZTA), and dynamically adjusts access rights through access decision functions based on real-time scoring of device status, user behavior, and system environment, achieving continuous verification and reducing the risks of internal threats and external attacks.

[0134] This invention integrates multi-dimensional data such as device status, user behavior, and system environment, generates a comprehensive risk score through normalization processing, and uses hash functions and bilinear group technology to ensure that attribute information cannot be tampered with and the encryption process is efficient and reliable, thereby improving the accuracy of the encryption strategy;

[0135] This invention uses AI-driven management to set a reward function to quantify security gains and performance losses, and introduces a ciphertext aging factor and a dynamic decay factor to automatically eliminate outdated attributes or keys, avoiding security risks caused by long-term key updates. The DQN algorithm dynamically optimizes the key rotation strategy, ensuring security while reducing resource waste and achieving adaptive key management.

[0136] This invention uses AI models to automatically process key generation, rotation, and policy updates, reducing manual intervention and making it suitable for large-scale enterprise environments. It also presets parameters based on actual application scenarios to adapt to the security needs of different enterprises, improving compatibility and flexibility.

[0137] In summary, this solution implements a fine-grained, dynamic, and adaptive data encryption strategy through the triple innovations of dynamic attribute-based encryption, zero-trust real-time decision-making, and AI-driven management. It solves the static, rigid, and fragmented problems of traditional encryption methods, and significantly improves the proactiveness, adaptability, and sustainability of enterprise data security. Its technological integration and automation features are particularly suitable for scenarios with high security requirements, and improve the scalability of data security management.

[0138] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by technical personnel in this field for each set of sample data; as long as it does not affect the proportional relationship between the parameter and the quantized value.

[0139] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by those skilled in the art according to actual conditions.

[0140] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A data encryption method based on enterprise data security management, characterized by: The following steps are involved: Step 1: Extract the attribute information and operation information of the data subject through the system behavior log; Step 2: Build the attribute-based encryption (ABE) of the data subject: integrate the attribute information into the attribute set A, build the access policy tree V based on the attribute set A, perform bilinear encryption on the plaintext M and combine it with hash function analysis to preliminarily obtain the master key MK and public key PK; Step 3: Create Zero Trust Encryption (ZTA) for access requests: By preprocessing the operational information, the device health score, user behavior anomaly score, and system environment risk score are obtained. The access decision function is then generated and dynamically updated to obtain the user's private key SK. Step 4: Establish a unique matching key pair SP: Use the user's private key SK to encrypt the public key PK twice to obtain the new public key PKnew. The user's private key SK and the new public key PKnew are combined and marked as the key pair SP; Step 5: Establish an AI encryption management model: Use deep learning to evaluate the security gains and performance losses of data encryption, obtain data key rotation strategies, and then adaptively drive key pair SP management. The specific process for evaluating the security gains and performance losses of data encryption is as follows: Monitor and obtain security parameters and performance parameters of data encryption; The security parameters are marked as set Qaq, and any element of the set Qaq is marked as ; The performance parameters are marked as a set Qxn, and any element of the set Qxn is marked as ; The safety gain and performance loss are evaluated, and the reward function R is obtained comprehensively: ； in, For elements The conversion index, For elements Conversion index; refers to the safety gain, It refers to performance loss; and are the proportional coefficients of safety gain and performance loss respectively; The specific process for obtaining the data key rotation policy is as follows: The data key rotation strategy includes state space and action space; Label the state space as ZTt and any element of the state space ZTt as zt; Mark the action space as DZt: mark any element of the action space DZt as dz; Obtain the strategy value function St(zt,dz) through the state space ZTt and action space DZt; Iteratively update the policy value function St(zt, dz) through deep learning to perform adaptive drive management for keys; If the Deep Q-Network algorithm is selected, the data key rotation strategy is: ； in, is the learning rate, For instant rewards, Refers to the next state and its actions .

2. The data encryption method based on enterprise data security management according to claim 1, characterized in that: The specific process of initially obtaining the master key MK and public key PK is as follows: The attribute information is integrated and marked as the attribute set A. The access policy tree V is constructed based on the attribute set A. The leaf nodes of the access policy tree V are attributes, and the non-leaf nodes are thresholds. Only users who meet the access policy tree V can decrypt the data. Obtain the corresponding random number through the quantum random number generator to obtain the master key MK: ,in, is a random number; Set up and label the bilinear group G, which satisfies the bilinear map e: , where G and It is a multiplication cyclic group, and the generator g of the group G is obtained through the GMP library; Encrypt the plaintext M through the bilinear mapping e and the generator g to obtain the plaintext bilinear ciphertext ; Mark the attribute information as the attribute set A, and mark any attribute element in the attribute set A as a; Shared secret via polynomial And combined with the Lagrange interpolation formula to obtain , and then through Combined with the generator g to obtain the first ciphertext Ca of attribute element a 1 ; Obtain the hash value H(a) of attribute element a through the hash function, and combine Comprehensively obtain the second ciphertext Ca of attribute element a 2 ; Bilinear ciphertext , the first ciphertext Ca of attribute element a 1 and the second ciphertext Ca 2 Combined to obtain the public key PK.

3. The data encryption method based on enterprise data security management according to claim 2, characterized in that: The specific process of preprocessing the operation information is as follows: Operational information includes device status data, user behavior data, and system environment data; Set the information collection cycle Tc to collect the operation information regularly; Mark the number of indicators of the equipment status data as n1, mark any indicator of the equipment status data as Di, obtain the normalized standard value normDi of the indicator Di, and then obtain the equipment health status score Sd comprehensively through the normalized standard values ​​of n1 indicators Di; Mark the number of indicators of user behavior data as n2, mark any indicator of user behavior data as Et, obtain the normalized standard value normEt of indicator Et, mark the historical data evaluation value of indicator Et in the long short-term memory network LSTM as LSTMEt, and use the difference between the normalized standard value of n2 indicators Et and the historical data evaluation value to comprehensively obtain the user behavior anomaly score Se; Mark the number of indicators of the system environment data as n3, mark any indicator of the system environment data as Gj, obtain the normalized standard value normGj of the indicator Gj, and then obtain the system environment risk score Sg comprehensively through the normalized standard values ​​of n3 indicators Gj.

4. The data encryption method based on enterprise data security management according to claim 3, characterized in that: The specific process of obtaining the user's private key SK is as follows: The comprehensive risk probability Access(t) is obtained by combining the device health status score Sd, the user behavior abnormality score Se and the system environment risk score Sg; Set the risk threshold θ of the comprehensive risk probability Access(t) for comparison and generate an access decision function: if the output comprehensive risk probability Access(t) is lower than the risk threshold θ, access is allowed; Timestamp Tn and dynamic attenuation factor of tag attribute information collection , get the ciphertext aging factor ; Set the ciphertext aging factor Compare it with the time threshold r, obtain the updated attribute set and mark it as A(t+1); Mark any element in the updated attribute set A(t+1) as , and then obtain the user's private key SK through the hash function.

5. The data encryption method based on enterprise data security management according to claim 4, characterized in that: The specific process of obtaining the new public key PKn is: The public key PK is encrypted twice using the user's private key SK, and then concatenated with the enterprise data plaintext M. The new public key PKnew is obtained through a hash function combined with an access decision function. Integrate the user's private key SK and the new public key PKnew into a key pair SP: .

Images