Data protection method for smart classroom

Abstract

The invention relates to the field of wisdom education, in particular to a data protection method for a wisdom classroom, and the method comprises the steps: carrying out the transmission encryption, storage encryption and end-to-end encryption of teaching data based on a hybrid encryption technology; user permission is managed through multi-factor authentication and a role-based dynamic access control mechanism; the student privacy is protected by adopting data desensitization, differential privacy and anonymous ID generation technologies, and student information de-identification is realized; localized data processing and storage are completed by utilizing the edge computing node, and cloud dependence is reduced. Through multi-level encryption, dynamic authority control, data anonymization and localization processing technologies, the security of teaching data and user privacy are comprehensively guaranteed, the risk of data leakage is significantly reduced, the compliance and security of education data processing are improved, and the method is suitable for various smart classroom scenes.

Description

Technical Field

[0001] The present invention relates to the field of smart education, and more particularly to a data protection method for a smart classroom, and more particularly to a method for secure data transmission, storage, identity authentication, and privacy protection in a smart classroom setting. Background Art

[0002] With the popularization of smart classrooms, the amount of data generated during teaching has increased dramatically, including student personal information, classroom behavior data, test scores, courseware, and real-time interactive content. A large amount of teaching data (such as student personal information, classroom behavior data, and real-time interactive content) is transmitted over the network and stored locally or in cloud servers. However, existing technologies have the following problems:

[0003] (1) Traditional encryption protocols are not optimized for educational scenarios and are susceptible to man-in-the-middle attacks or data tampering, leading to the leakage of sensitive information;

[0004] (2) Over-reliance on cloud storage and processing, which poses a risk of third-party leakage and a single encryption method;

[0005] (3) The existing system has a single identity authentication method and extensive authority management, which poses a risk of unauthorized access and makes it difficult to dynamically adapt to the authority requirements of teaching scenarios;

[0006] (4) The technology for anonymizing student information is imperfect, and there is a risk of individual retrospective identification, which may leak student privacy.

[0007] Therefore, there is an urgent need for a comprehensive data security and privacy protection solution to solve the above problems. Summary of the Invention

[0008] To solve the above problems, the present invention provides a data protection method for smart classrooms, which realizes the security protection of smart classroom data throughout its life cycle through multi-level encryption, dynamic access control, differential privacy and edge computing technology. The method mainly includes:

[0009] S1: Implement transmission encryption, storage encryption and end-to-end encryption of teaching data based on hybrid encryption technology;

[0010] S2: Manage user permissions through multi-factor authentication and dynamic role-based access control mechanisms;

[0011] S3: Use data desensitization, differential privacy, and anonymous ID generation technologies to protect student privacy and de-identify student information;

[0012] S4: Use edge computing nodes to complete local data processing and storage, reducing cloud dependence.

[0013] Furthermore, the storage encryption adopts a hybrid encryption mode, combined with the AES-256 encryption algorithm to encrypt the storage, and manage the key through RSA asymmetric encryption, to ensure that the data cannot be decrypted even if there is a leak in the database.

[0014] Furthermore, the end-to-end encryption uses a key exchange protocol based on elliptic curve cryptography to achieve key negotiation, allowing only authorized users to decrypt content using a dynamically generated session key.

[0015] Furthermore, the life cycle of the session key dynamically generated by end-to-end encryption is synchronized with the teaching scenario.

[0016] Furthermore, the multi-factor authentication refers to the combination of password, biometrics and hardware tokens to perform identity verification when a user logs in to ensure login security, wherein the biometrics include face or fingerprint.

[0017] Furthermore, the role-based dynamic access control mechanism includes: RBAC model, scenario-adaptive permissions, and session token expiration control; the RBAC model is used to assign minimum necessary permissions to user roles and limit access to sensitive data; scenario-adaptive permissions are used to adjust access rights in real time according to teaching needs or scenarios; session token expiration control is used to bind the token validity period to the teaching period, and it will automatically expire upon timeout.

[0018] Furthermore, data desensitization means that when analyzing or sharing data, direct identifiers such as name and student ID number are hidden, and only desensitized behavioral data is retained.

[0019] Furthermore, differential privacy technology is implemented by adding Laplace noise, injecting controllable noise into classroom behavior analysis data to ensure that individuals cannot be traced. The noise parameter ε ranges from 0.1≤ε≤1.

[0020] Furthermore, S4 specifically has a built-in AI module in the smart terminal to directly process the original data and only upload the analysis results to avoid the transmission of the original data. When storing, local storage is given priority, that is, sensitive data is stored on the local server by default, and only non-sensitive data is synchronized to the cloud, so as to reduce the risk of third-party leakage.

[0021] A data protection system for a smart classroom, comprising:

[0022] Encryption module, used to realize teaching data transmission, storage and end-to-end encryption;

[0023] A permissions management module for performing multi-factor authentication and dynamic access control;

[0024] Anonymization module, used for data desensitization, differential privacy processing and anonymous ID generation;

[0025] Edge computing and storage modules for local data storage and analysis.

[0026] The beneficial effects brought about by the technical solution provided by the present invention are as follows: the present invention discloses a smart classroom data protection method and system, which ensures the security of data transmission and storage through a course teaching data encryption system covering transmission, storage and end-to-end encryption, and resists external attacks and internal leaks; combines dynamic permission control and multi-factor authentication to prevent unauthorized access, and improves system flexibility through real-time matching of permissions and scenarios; uses differential privacy and anonymization technology to protect student privacy, meets the requirements of data privacy regulations such as GDPR and CCPA, and reduces cloud dependence through edge computing to reduce data leakage risks. The present invention comprehensively protects the security of teaching data and user privacy through multi-level encryption, dynamic permission control, data anonymization and local processing technology, can be widely used in smart education scenarios, and significantly improves data security and privacy protection levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0028] Figure 1 This is a flow chart of a data protection method for a smart classroom in an embodiment of the present invention;

[0029] Figure 2 This is an architectural diagram of the smart classroom data protection system in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described in detail with reference to the accompanying drawings.

[0031] Example 1

[0032] Please refer to Figure 1 , Figure 1 This is a flow chart of a data protection method for a smart classroom according to an embodiment of the present invention, which specifically includes:

[0033] S1: Implement transmission encryption, storage encryption and end-to-end encryption for teaching data based on hybrid encryption technology.

[0034] The transmission encryption refers to the use of TLS / SSL and HTTPS protocols to encrypt data transmission between teacher and student terminals, sensors and servers, optimize the handshake protocol for educational scenarios, reduce latency, and prevent man-in-the-middle attacks.

[0035] The storage encryption mentioned above refers to the use of a hybrid encryption mode for sensitive data (such as student personal information, grades, and courseware), combined with encrypted storage using the AES-256 encryption algorithm, and key management through RSA asymmetric encryption to ensure that the data cannot be decrypted even if there is a database leak.

[0036] End-to-end encryption refers to the use of a key exchange protocol based on elliptic curve cryptography (ECC) in real-time interactive scenarios (such as online answering and video conferencing) to achieve key negotiation, allowing only authorized users to decrypt content using dynamically generated session keys.

[0037] The end-to-end encryption uses dynamically generated session keys, and the key lifecycle is synchronized with the teaching scenario.

[0038] S2: Manage user permissions through multi-factor authentication (MFA) and dynamic role-based access control mechanisms;

[0039] Multi-factor authentication (MFA) refers to the combination of password, biometrics (face / fingerprint) and hardware token for identity authentication when a user logs in to ensure login security.

[0040] The role-based dynamic access control mechanism includes: a role-based access control (RBAC) model, scenario-adaptive permissions, and session token expiration control. The RBAC model is used to assign minimum necessary permissions to user roles (teachers, students, administrators) and restrict access to sensitive data. Scenario-adaptive permissions are used to adjust access rights in real time according to teaching needs or scenarios (such as temporary visitor permissions). For example, limited-time access rights are assigned to visitors, temporary visitor permissions are adjusted in real time, and are automatically reclaimed after the course ends. Session token expiration control is used to bind the token validity period to the teaching period, and the token will automatically expire after timeout.

[0041] S3: Use data desensitization, differential privacy, and anonymous ID generation technologies to protect student privacy, anonymize student information, and de-identify student information;

[0042] Data desensitization refers to the process of removing direct identifiers such as names and student IDs during data analysis or sharing, retaining only desensitized behavioral data. For example, when sharing data, direct identifiers (such as names and student IDs) may be replaced with generalized labels (such as "Student A").

[0043] The differential privacy technology refers to injecting controllable noise into classroom behavior analysis data to ensure that individuals cannot be traced; in this embodiment, the differential privacy technology is implemented by adding Laplace noise, and the noise parameter ε takes a value range of 0.1≤ε≤1.

[0044] The anonymous ID generation technology refers to generating an irreversible random unique identifier (UUID) for each student through a hash algorithm, and the anonymous data is associated with the real identity and can only be decrypted by authorized administrators.

[0045] S4: Use edge computing nodes to complete local data processing and storage, reducing cloud dependence. Edge computing node analysis refers to the built-in AI module in the smart terminal (such as camera, sensor), directly processing the raw data (such as video stream), and only uploading the analysis results (such as classroom concentration statistics) to avoid the transmission of raw data. In this step, local storage is prioritized, that is, sensitive data (such as surveillance video) is stored on the local server by default, and only non-sensitive data is synchronized to the cloud, so as to reduce the risk of third-party leakage.

[0046] Taking a school that deploys smart classrooms as an example, the implementation steps of the present invention are described as follows:

[0047] (1) Deploy the encryption module

[0048] Client software supporting TLS / SSL and ECC protocols is installed between the teacher's and student's terminals. An HTTPS channel is established, using TLS 1.3 for handshakes to ensure transport layer security. For example, student performance data is encrypted with AES-256 and stored in a local database. The administrator encrypts the key with RSA-2048 and stores it in shards.

[0049] (2) Configuring RBAC permissions

[0050] Based on the role initialization permission table, administrators can dynamically add temporary visitor permissions; for example, when a temporary visitor enters the classroom, the system automatically assigns "read-only" permissions that are valid only for that day, prohibiting access to student files.

[0051] (3) Data anonymization

[0052] Differential privacy is enabled in the test analysis system. The noise parameter in this embodiment is set to ε = 0.1. For example, in the classroom participation statistics, Laplace noise (ε = 0.1) is added to the query results to meet the differential privacy requirements.

[0053] (4) Edge node deployment

[0054] Built-in AI chips in classroom cameras enable localized behavior analysis.

[0055] Example 2

[0056] A data protection system for a smart classroom, characterized by comprising:

[0057] Encryption module, used to realize teaching data transmission, storage and end-to-end encryption;

[0058] A permissions management module for performing multi-factor authentication and dynamic access control;

[0059] Anonymization module, used for data desensitization, differential privacy processing and anonymous ID generation;

[0060] Edge computing and storage modules for local data storage and analysis.

[0061] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data protection method for a smart classroom, characterized in that: include: S1: Implement transmission encryption, storage encryption and end-to-end encryption of teaching data based on hybrid encryption technology; S2: Manage user permissions through multi-factor authentication and dynamic role-based access control mechanisms; S3: Use data desensitization, differential privacy, and anonymous ID generation technologies to protect student privacy and de-identify student information; S4: Use edge computing nodes to complete local data processing and storage, reducing cloud dependence.

2. The data protection method for a smart classroom according to claim 1, wherein: The storage encryption adopts a hybrid encryption mode, combined with the AES-256 encryption algorithm to encrypt the storage, and manage the key through RSA asymmetric encryption to ensure that the data cannot be decrypted even if there is a leak in the database.

3. The data protection method for a smart classroom according to claim 1, wherein: The end-to-end encryption uses a key exchange protocol based on elliptic curve cryptography to achieve key negotiation, allowing only authorized users to decrypt content using dynamically generated session keys.

4. The data protection method for a smart classroom according to claim 3, wherein: The life cycle of the session key dynamically generated by end-to-end encryption is synchronized with the teaching scenario.

5. The data protection method for a smart classroom according to claim 1, wherein: Multi-factor authentication refers to the combination of password, biometrics and hardware tokens to ensure login security when a user logs in. The biometrics include face or fingerprint.

6. The data protection method for a smart classroom according to claim 1, wherein: The role-based dynamic access control mechanism includes: RBAC model, scenario-adaptive permissions, and session token expiration control; the RBAC model is used to assign minimum necessary permissions to user roles and limit access to sensitive data; scenario-adaptive permissions are used to adjust access rights in real time according to teaching needs or scenarios; session token expiration control is used to bind the token validity period to the teaching period, and the token will automatically expire after timeout.

7. The data protection method for a smart classroom according to claim 1, characterized in that: Data desensitization means that when analyzing or sharing data, direct identifiers such as names and student numbers are hidden, and only desensitized behavioral data is retained.

8. The data protection method for a smart classroom according to claim 1, wherein: Differential privacy technology is achieved by adding Laplace noise, injecting controllable noise into classroom behavior analysis data to ensure that individuals cannot be traced. The noise parameter ε ranges from 0.1≤ε≤1.

9. The data protection method for a smart classroom according to claim 1, wherein: Specifically, S4 has a built-in AI module in the smart terminal to directly process the original data and only upload the analysis results to avoid the transmission of the original data. When storing, local storage is given priority, that is, sensitive data is stored on the local server by default, and only non-sensitive data is synchronized to the cloud, so as to reduce the risk of third-party leakage.

10. A data protection system for a smart classroom, characterized in that: include: Encryption module, used to realize teaching data transmission, storage and end-to-end encryption; A permissions management module for performing multi-factor authentication and dynamic access control; Anonymization module, used for data desensitization, differential privacy processing and anonymous ID generation; Edge computing and storage modules for local data storage and analysis.

Images