Data security processing method of smart campus management platform

Abstract

The present disclosure provides a data security processing method of a smart campus management platform, the method comprising: constructing a hierarchical directed permission tree structure based on the user roles of the smart campus management platform; generating a random parameter value for each node through an irreversible hierarchical derivation function HDF based on the directed permission tree structure; when a user requests data access, performing permission verification based on the permission tree and the hierarchical relationship parameters, and providing sustainable support for the evolution of the smart campus through the directed permission state tree architecture and the dual-mode randomization parameter mechanism.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a data security processing method for a smart campus management platform. Background Art

[0002] With the accelerated advancement of educational informatization, campus data management faces increasingly complex challenges. Campus academic administration systems involve the management of multiple levels and groups across the entire campus, as well as permissions at each level. Dynamically expanding permissions, efficient verification, and fine-grained security control have become core challenges. Traditional permission management solutions generally use static role-based access control (RBAC), assigning permissions based on predefined roles (such as principal and class teacher). However, this approach has significant limitations: the permission system lacks flexibility, adding new levels requires a complete reconstruction of the permission table, and the operation is complex and lacks adaptability. For example, when a student transfers to another class, the system must manually update role bindings, which can easily lead to permission mismatches due to operational oversight. This is not only inefficient but also poses a risk of inadvertent data access.

[0003] Furthermore, the existing campus academic affairs system relies on real-time database queries for permission verification. Each user request requires a database query to confirm permission status. This can lead to significant increases in database pressure and response latency in high-concurrency scenarios, severely impacting system availability. For example, during the centralized release of final school-wide grades, a large number of teachers and students simultaneously access the academic affairs system's grade management module. Congestion in the permission verification queue can cause service timeouts, disrupting the user experience.

[0004] In terms of data security, traditional solutions often use a unified key encryption mechanism. Sharing a single key for all permissions simplifies management, but once the key is leaked, sensitive data across the entire school will face systemic risks. Attempting to assign independent keys to different roles increases the complexity of key management exponentially. This is especially true in academic administration scenarios involving multiple levels of permissions, where key rotation and synchronization are difficult and state inconsistencies are prone to occur. This contradiction is particularly prominent in distributed deployment environments, where delays in synchronization between nodes during permission changes can lead to temporary unauthorized access.

[0005] Existing technologies struggle to address these core requirements. The imbalance between these requirements in traditional solutions has become a key obstacle to the intelligent upgrade of the educational administration system on the smart campus platform. Especially with the widespread adoption of mobile access and the surge in demand for cross-campus data sharing, permission management mechanisms urgently need to overcome the dual bottlenecks of efficiency and flexibility while ensuring security. Summary of the Invention

[0006] In view of this, in order to solve the problems brought about by the existing technology, this application provides a data security processing method for a smart campus management platform.

[0007] In a first aspect, the present disclosure provides a data security processing method for a smart campus management platform, the method comprising:

[0008] Based on the user roles of the smart campus management platform, a hierarchical directed permission tree structure is constructed;

[0009] Based on the directed permission tree structure, a randomized parameter value of each node is generated by an irreversible hierarchical derivation function HDF;

[0010] When a user requests data access, permission verification is performed based on the permission tree and hierarchical relationship parameters.

[0011] Optionally, generating a randomized parameter value for each node by using an irreversible hierarchical derivation function HDF includes:

[0012] Randomize parameter value z based on the parent node of the current node i The order parameter n of the node among the nodes of the same level is calculated by the irreversible hierarchical derivation function HDF to derive the randomized parameter value z of the current node. j , wherein the order parameter n represents the sorting position of the current node among its peers under its parent node.

[0013] Optionally, generating a randomized parameter value for each node by using an irreversible hierarchical derivation function HDF includes:

[0014] Based on the first key cardinality u[i] of the parent node of the current node and the forward order parameter n of the target node, an irreversible hierarchical derivation function HDF is used to generate the first derived value u[j] of the current node.

[0015] Based on the second key cardinality v[i] of the parent node and the reverse order parameter N+1-n, the same irreversible hierarchical derivation function HDF is used to generate the second derived value v[j] of the current node.

[0016] The first derived value u[j] and the second derived value v[j] are input into an irreversible two-factor aggregation function BAF for operation, and the final randomized parameter value z after fusion is output. j , wherein the order parameter n represents the sorting position of the current node among the peers under its parent node, and the maximum peer capacity N represents the total number of peer nodes under the parent node.

[0017] Optionally, the generating of the randomized parameter value of each node by using an irreversible hierarchical derivation function HDF includes:

[0018] When accessing low-sensitivity permission data, the parameter value z is randomized based on the parent node of the current node. iThe order parameter n of the node in the same level is calculated by the irreversible hierarchical derivation function HDF to derive the randomized parameter value z of the current node j ;

[0019] When accessing highly sensitive permission data, the irreversible hierarchical derivation function HDF is used to generate the first derived value u[j] of the current node based on the first key base u[i] of the parent node of the current node and the forward order parameter n of the target node.

[0020] Based on the second key cardinality v[i] of the parent node and the reverse order parameter N+1-n, the second derived value v[j] of the current node is generated by performing an operation using the same irreversible hierarchical derivation function HDF;

[0021] The first derived value u[j] and the second derived value v[j] are input into an irreversible two-factor aggregation function BAF for operation, and the final randomized parameter value z after fusion is output. j , wherein the order parameter n represents the sorting position of the current node among the peers under its parent node, and the maximum peer capacity N represents the total number of peer nodes under the parent node.

[0022] Optionally, the performing permission verification based on the permission tree and hierarchical relationship parameters includes:

[0023] The hierarchical relationship parameters include the authority span m, which represents the vertical hierarchical depth difference between nodes, the peer sequence number r, which represents the horizontal sorting position of peer nodes under the same parent node, and the peer maximum capacity N, which represents the total number of peer nodes under the parent node.

[0024] Based on the first key base u[a] of the parent node of the current node and the serial number r of the same level, the theoretical first derived value u[b] is generated.

[0025] Based on the second key base v[a] of the parent node and the reverse sequence number mN + m-r, a theoretical second derivative value v[b] is generated.

[0026] The theoretical first derived value u[b] and the theoretical second derived value v[b] are input into the irreversible double-factor aggregation function BAF for fusion operation, and the theoretical fusion value z is output. cal , and compare it with the randomized parameter value generated by the user node requesting data access. If they match, access is authorized; otherwise, the operation is intercepted and a permission error is returned.

[0027] Optionally, the dynamically updating the affected nodes includes:

[0028] The root key is stored in the Trusted Execution Environment (TEE);

[0029] When the permission topology changes, dynamic randomization parameters are injected only into the affected parent nodes to trigger subtree key invalidation.

[0030] Optionally, the method further includes:

[0031] The irreversible hierarchical derivation function HDF adopts a key derivation function based on zHA-3, and the dual-factor aggregation function BAF adopts an elliptic curve point multiplication fusion algorithm.

[0032] In a second aspect, the present disclosure provides an electronic device, comprising a memory and at least one processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the method of the first aspect.

[0033] In a third aspect, the present disclosure provides a computer storage medium storing a computer program, wherein the computer program implements the method of the first aspect when executed.

[0034] The beneficial effects of the present disclosure are that, compared with the prior art, the present disclosure has the following advantages:

[0035] The present invention brings significant progress to the permission management of campus academic affairs systems through the permission state tree architecture and dual-mode randomized parameter mechanism. In terms of permission management efficiency, the system breaks through the rigid constraints of traditional role binding and realizes dynamic seamless expansion. When a new level is added to the academic affairs business, it is only necessary to expand the branch node in the state tree and configure the order parameters. There is no need to reconstruct the global permission table, which simplifies the permission system maintenance process and avoids the complicated operation of rebuilding the permission mapping table role by role in the traditional solution. At the same time, the permission verification process abandons the traditional database query dependency and completes the judgment in real time through localized calculation. The combined operation based on the randomized parameter value of the parent node and the level parameter is completed in the memory at one time, effectively eliminating the database access bottleneck in high-concurrency scenarios (such as centralized query of the school's grades after the final exam), so that the system response efficiency is improved step by step.

[0036] In terms of security, the solution builds a fine-grained defense system. The independent randomized parameter value generation mechanism for each permission node forms a natural isolation barrier, strictly limiting the impact of local key leaks (such as a class teacher's account being compromised) to the corresponding subtree. Core protection is ensured by cryptographic strength: the irreversible hierarchical derivation function (HDF) ensures that the parameterized derivation process cannot be reversed, and the irreversible two-factor aggregation function (BAF) blocks the key vector combination cracking path. Even if an attacker intercepts the randomized parameter value of the terminal node, they cannot derive the parent permission key, eliminating the risk of unauthorized access from a cryptographic perspective.

[0037] Resource utilization optimization is reflected in the dual innovations of storage structure and computing logic. The storage system only needs to maintain a single root key pair and a tree-like topology. Compared with the traditional approach of storing key chains independently for each role, this significantly reduces storage requirements and presents a significant advantage in ultra-large-scale campus clusters. Lightweight iterative operations are used at the computing level, and a single permission verification only involves a limited number of hash iterations and modular operations, avoiding the heavy computing load of asymmetric encryption. This enables the system to operate stably in resource-constrained environments such as mobile terminals and edge computing devices, providing sustainable support for the evolution of smart campuses. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0039] Figure 1 A flow chart of a data security processing method for a smart campus management platform provided by an embodiment of the present disclosure is shown.

[0040] Figure 2 A schematic diagram of a directed permission tree provided by an embodiment of the present disclosure is shown.

[0041] The above drawings illustrate specific embodiments of the present disclosure, which will be described in more detail below. These drawings and textual descriptions are not intended to limit the scope of the present disclosure in any way, but rather to illustrate the concepts of the present disclosure to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0042] The present disclosure is further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present disclosure and are not intended to limit the scope of protection of the present disclosure.

[0043] The components of the embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the figures is not intended to limit the scope of the claimed invention, but rather merely represents selected embodiments of the present invention. All other embodiments derived by those skilled in the art based on the embodiments of the present invention without inventive effort are intended to be within the scope of protection of the present invention.

[0044] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or the possibility of adding one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0045] Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by those skilled in the art to which the various embodiments of the present invention pertain. Terms (such as those defined in generally used dictionaries) will be interpreted as having the same meaning as their contextual meaning in the relevant technical field and will not be interpreted as having an idealized meaning or an overly formal meaning unless clearly defined in the various embodiments of the present invention.

[0046] Figure 1 The data security processing method flow chart of the smart campus management platform provided by the embodiment of the present disclosure is as follows: Figure 1 As shown, the method may include the following steps:

[0047] S100: Build a hierarchical permission tree structure based on the user roles of the smart campus platform.

[0048] The core of this solution is to build a hierarchical authority status tree, abstracting the administrative affiliation naturally existing in the campus education system into a computable tree structure. Figure 2 As shown, the directed permission tree consists of four types of nodes, namely the root node (All), grade node (B), class node (C) and leaf node (S) from top to bottom. The root node is the virtual highest permission node, representing the global access rights of the entire school data. For example, in actual applications, the root node can correspond to the permission range of the principal role. Grade nodes are directly mounted under the root node, such as Grade 1 (B1), Grade 2 (B2), etc. Each grade node limits its operator (such as the grade leader) to only access the student data of the grade. The grade node is further subdivided into class nodes, with Grade 1 (1) Class (C101) and Grade 1 (2) Class (C102) as typical representatives, and the operation permissions are bound to the class teacher account. The last leaf node is associated with a specific student account (such as student number S1001), representing the individual's access rights to his or her own data.

[0049] The inheritance and isolation of permissions are essentially determined by the parent-child relationship chain between nodes. The inheritance rule is that child nodes naturally inherit the permissions of their parent nodes; the isolation rule is that peer child nodes under different parent nodes, and different child nodes under the same parent node, form permission isolation domains. Based on this, the following two key parameters are used to accurately quantify permission boundaries and perform efficient calculations:

[0050] Authority span (m): This represents the vertical hierarchical depth difference between nodes. On a given parent-child path, the span between parent and child nodes is always 1. For example, in the authority transfer from the principal (root node) to the grade leader, m = 1 indicates a layer of relationship between the two. Similarly, the succession from the grade leader to the class teacher, and from the class teacher to the student, all satisfy a continuous hierarchy of m = 1.

[0051] Peer Sequence Number (r): This represents the horizontal ordering of peer nodes under the same parent node, used to distinguish entities at the same level. For example, the r value for the first-year high school student (B1) is set to 1, and the r value for the second-year high school student (B2) is set to 2, forming a uniquely identifiable sequence code. In the permission verification process, the peer sequence number r is used to precisely locate a specific node in cryptographic calculations.

[0052] The essence of this tree modeling is to transform business rules into mathematical constraints: using the parent-child relationship chain as the skeleton, using the permission span m to quantify the hierarchical depth, and using the peer sequence number r to identify the branch position. When a user requests data access, the system locates its position in the tree and, by combining the parameters m and r, can deduce the permission boundary. For example, when the head teacher operates the class node C101 of Class 1 (1), his permission automatically covers all leaf nodes (students) under the class, without the need to authorize each student separately, forming a natural inheritance mechanism of "parent node permissions include child nodes"; at the same time, according to the isolation rules of parallel child nodes under the same parent node, his permission cannot touch any data under the class node C102 of Class 1 (2).

[0053] Based on the constructed hierarchical directed permission tree structure, the system needs to generate a unique cryptographic credential for each node to achieve secure access control.

[0054] S200: Based on the directed permission tree structure, a randomized parameter value of each node is generated by an irreversible hierarchical derivation function HDF.

[0055] This step converts the tree topology relationship into an irreversible key sequence through a randomized parameter value derivation mechanism.

[0056] Specifically, a single function progressive generation mechanism is adopted, and its working logic is: randomize the parameter value z based on the parent node of the current node i And the order parameter n of the node in the same level, through the irreversible hierarchical derivation function HDF (such as the key derivation function based on zHA-3), the randomized parameter value z of the current node is derived. j . Among them, the order parameter n represents the sorting position of the current node among the same level under its parent node. For example, when the principal node generates the grade leader authority, n=1 corresponds to the first grade of high school and n=2 corresponds to the second grade of high school. When the student node is generated, n corresponds to the order of the student number in the class. Among them, the value range of n is 1 to the maximum capacity N of the class (such as 50 people), which is used to limit the value range of n (1≤n≤N) to avoid overflow risks.

[0057] For example, the root key root of the root node is generated by a multi-factor hybrid engine, and the root key root of the principal authority root node z ... root node z is generated by a multi-factor hybrid engine, and the root key root of the root node z is generated by a multi-factor hybrid engine. i=root generates the randomized parameter value of the year segment node, let n=1 input the irreversible hierarchical derivative function to perform the operation, and output the randomized parameter value z of the higher year segment node B1 , this value can continue to be used as the parent node input, let n=1 and calculate again to generate the randomized parameter value z of the class node high one (1) class node C101 , forming a chain authorization system.

[0058] Through a single-function progressive generation mechanism, the randomized parameters of child nodes can be dynamically generated through a single irreversible operation, relying solely on the parent node's randomized parameter value and the hierarchical order parameter n. This eliminates the storage burden of pre-setting a separate key chain for each role in traditional solutions. This automated key transfer, based on a tree-like relationship, not only ensures basic security but also provides an efficient solution for resource-constrained scenarios such as mobile terminals. It successfully avoids the core flaws of traditional permission systems, such as complex key synchronization and redundant storage. This model provides a lightweight solution for campus platforms, especially suitable for scenarios with limited computing resources, such as mobile terminals.

[0059] Optionally, in order to further address the in-depth protection requirements of highly sensitive scenarios, the present invention also designs a dual-vector irreversible generation mechanism, whose working logic includes three consecutive steps: first, based on the first key base u[i] of the parent node of the current node and the forward order parameter n of the target node, an irreversible hierarchical derivation function HDF is used to perform operations to generate the first derived value u[j] of the current node; second, based on the second key base v[i] of the parent node and the reverse order parameter N+1-n, where N is the maximum capacity of the same level, representing the total number of nodes at the same level under the parent node, the same irreversible hierarchical derivation function HDF is used to perform operations to generate the second derived value v[j] of the current node; finally, the first derived value u[j] and the second derived value v[j] obtained above are input into an irreversible two-factor aggregation function BAF (such as the elliptic curve point multiplication fusion algorithm), and the final randomized parameter value z after fusion is output. j .

[0060] For example, when the principal node is initialized, the root key pair (u[0], v[0]) is generated by the security hardware; when the grade leader authority is created, taking the second grade of high school (the order n=2 in the same grade, assuming that there are 5 grades in the school, that is, N=5) as an example, the system first calculates the first derived value u[B2] of the forward parameterization, whose input is u[0] and the forward parameter n=2; then calculates the second derived value v[B2] of the reverse parameterization, whose input is v[0] and the reverse parameter 5+1-2=4; then the first derived value u[B2] and the second derived value v[B2] obtained above are input into the double-factor aggregation function BAF mixed output, that is, the randomized parameter value z of the grade node is obtained. B2 .

[0061] A multi-dimensional protection system is constructed through dual-base input and bidirectional asymmetric parameterization. In contrast, the single-function model relies only on a single key chain. Once the parent node key is leaked, the subtree key is at risk of chain cracking. The dual-vector mechanism processes the two basis vectors u[j] and v[j] respectively through independent forward order parameters n and reverse order parameters N+1-n, and then binds them through an irreversible fusion function to form an orthogonal protection layer. Even if an attacker intercepts the terminal randomized parameter value z j Because it's impossible to simultaneously reverse-engineer both computation paths and the nonlinear fusion process, it's difficult to trace back the parent node key, fundamentally blocking the vertical unauthorized attack chain. This shows that this mode is suitable for highly sensitive educational permissions, such as requests for permissions from higher-level parent nodes. This mode can also be enabled for lower-level leaf nodes when they need to be strengthened. For example, when student Li (n=2) generates randomized parameter values ​​in a class of 50, the reverse parameter value is 49 (i.e., 50 + 1 - 2). This dual-vector irreversible generation mechanism creates a double obfuscation protection.

[0062] As can be seen from the above, the single-function progressive mechanism ensures the efficient flow of basic permissions with its minimalist architecture, while the dual-vector mechanism strengthens the anti-cracking capabilities of sensitive nodes through multi-dimensional obfuscation.

[0063] In an optional implementation, the two aforementioned models are synergistically applied to the campus platform's academic affairs system. This includes setting the single-function progressive generation strategy as the base mode for low-sensitivity scenarios, such as students at leaf nodes querying their individual grades, to build an efficient permission chain. Setting the dual-vector irreversible generation mechanism to the enhanced mode for high-sensitivity scenarios, such as the principal at the root node querying the grades of all students in the school, uses bidirectional parameter obfuscation to resist brute force attacks. Both models share the function prototypes HDF and BAF, enabling academic administrators to flexibly configure generation strategies for different nodes based on data sensitivity. This balanced design achieves a dynamic balance between security and efficiency within the permission tree framework.

[0064] At this point, the generated node randomized parameter values ​​will become the core cryptographic credentials for permission verification, and their validity must be verified in real time through a hierarchical adjudication mechanism. This credential system is designed to circumvent the performance bottleneck of traditional solutions that rely on database queries, instead achieving efficient and secure control through local computing.

[0065] S300: When a user requests data access, permission verification is performed based on the permission tree and hierarchical relationship parameters.

[0066] Following the node randomization parameter value system generated in the previous step, this step implements instant authority determination through stateless computing. When a user initiates a data access request (e.g., a student queries grades), the system first accurately locates the corresponding node in the directed authority state tree constructed in step S100 based on their identity. Taking student Li (student number S1002) as an example, the system maps it to the leaf node level and automatically associates it with its direct parent node (i.e., the class node C101 of the senior high school class 1 (1) under the jurisdiction of student Li's homeroom teacher). Then, a verification formula is constructed based on the hierarchical relationship parameters: the system retrieves the key cardinality pair of the parent node (such as the u[a] and v[a] values ​​of the class node C101) from the secure storage area, combines the preset permission span m (fixed at 1 for the class teacher to student level), the student's order in the class r (such as the student number order is 2) and the maximum class capacity N (such as 50 people), and performs a two-way calculation through the irreversible hierarchical derivation function HDF: first, based on the first key cardinality u[a] of the parent node and the user's peer sequence number r, a calculation is performed to generate a theoretical first derived value u[b]; secondly, based on the second key cardinality v[a] of the parent node and the peer reverse sequence parameter mN + m- r (where the permission span m and the peer maximum capacity N jointly construct this unique parameter, such as in the example where m=1, N=50, then the reverse parameter is 1 * 50 + 1 - 2 = 49), a theoretical second derived value v[b] is generated.

[0067] Finally, the theoretical first derived value u[b] and the theoretical second derived value v[b] obtained above are input into the irreversible double-factor aggregation function BAF for fusion operation, and the theoretical fusion value z is output. cal The tree relationship derivation and cryptographic verification are completed entirely in memory, completely avoiding real-time database access and ensuring the system maintains high responsiveness even in high-concurrency scenarios.

[0068] While the stateless authentication mechanism effectively avoids database bottlenecks, it still faces the challenge of dynamically changing permission topologies. For example, when a student transfers to another class, their previous permission credentials must be immediately invalidated, and new permissions must be seamlessly inherited. Traditional global key updates can cause system instability in this scenario, necessitating a lightweight key management system.

[0069] S400: Adopts a hierarchical autonomous key strategy to manage keys and dynamically updates affected nodes to maintain security.

[0070] Optionally, to support the dynamic stability of the aforementioned verification system, the present invention introduces a hierarchical autonomous key strategy. The key management system adopts a hierarchical autonomous design to balance security and efficiency. When the system is initialized, the root key root of the root node is generated through a multi-factor hybrid engine: based on the unique characteristics of the account (such as the principal's work ID hash value, hardware fingerprint and system timestamp), the irreversible key base u[0] or key base pair (u[1], v[1]) is derived and hosted in the trusted execution environment (mEE) storage. When the permission topology changes (for example, a student changes classes), only the randomization parameter value of the affected parent node needs to be updated. Taking the case of a student transferring from Class 1 (1) to Class 2 (2) in Grade 1 as an example, the system injects dynamic randomization parameters into the original class node (C101) and the new class node (C102) respectively. This operation automatically triggers the subtree invalidation mechanism: based on the permission span parameter m in the permission state tree, the old randomized parameter values ​​of all leaf nodes under the original class node (including the transferred student) are immediately invalidated. Simultaneously, the subtree of the new class node inherits the old randomized parameter values, and the next time the user accesses the new class node, the randomized parameter values ​​will be re-derived according to the process in step S300. This local update strategy, based on tree-like relationships, significantly reduces key rotation overhead while ensuring forward key security, surpassing traditional global key updates.

[0071] In summary, the present invention brings significant progress to the authority management of the campus academic affairs system through the authority state tree architecture and dual-mode randomized parameter mechanism. In terms of authority management efficiency, the system breaks through the rigid constraints of traditional role binding and realizes dynamic seamless expansion. When a new level is added to the academic affairs business, it is only necessary to expand the branch node in the state tree and configure the order parameters. There is no need to reconstruct the global authority table, which simplifies the authority system maintenance process and avoids the complicated operation of rebuilding the authority mapping table role by role in the traditional solution. At the same time, the authority verification process abandons the traditional database query dependency and completes the judgment in real time through localized calculation. The combined operation based on the randomized parameter value of the parent node and the level parameter is completed in the memory at one time, effectively eliminating the database access bottleneck in high-concurrency scenarios (such as centralized query of the school's grades after the final exam), so that the system response efficiency is improved step by step.

[0072] In terms of security, the solution builds a fine-grained defense system. The independent randomized parameter value generation mechanism for each permission node forms a natural isolation barrier, strictly limiting the impact of local key leaks (such as a class teacher's account being compromised) to the corresponding subtree. Core protection is ensured by cryptographic strength: the irreversible hierarchical derivation function (HDF) ensures that the parameterized derivation process cannot be reversed, and the irreversible two-factor aggregation function (BAF) blocks the key vector combination cracking path. Even if an attacker intercepts the randomized parameter value of the terminal node, they cannot derive the parent permission key, eliminating the risk of unauthorized access from a cryptographic perspective.

[0073] Resource utilization optimization is reflected in the dual innovations of storage structure and computing logic. The storage system only needs to maintain a single root key pair and a tree-like topology. Compared with the traditional approach of storing key chains independently for each role, this significantly reduces storage requirements and presents a significant advantage in ultra-large-scale campus clusters. Lightweight iterative operations are used at the computing level, and a single permission verification only involves a limited number of hash iterations and modular operations, avoiding the heavy computing load of asymmetric encryption. This enables the system to operate stably in resource-constrained environments such as mobile terminals and edge computing devices, providing sustainable support for the evolution of smart campuses.

[0074] According to an embodiment of the present disclosure, an electronic device is provided. The electronic device may include: a processor, a communications interface, a memory, and a communications bus. The processor, the communications interface, and the memory communicate with each other via the communications bus. The processor may call logic instructions in the memory to execute an interface automation testing method provided by the aforementioned methods.

[0075] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0076] On the other hand, the present disclosure further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented to perform the above methods when executed by a processor.

[0077] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0078] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0079] It should be understood that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present disclosure.

Claims

1. A data security processing method for a smart campus management platform, characterized in that: The method comprises: Based on the user roles of the smart campus management platform, a hierarchical directed permission tree structure is constructed; Based on the directed permission tree structure, a randomized parameter value of each node is generated by an irreversible hierarchical derivation function HDF; When a user requests data access, permission verification is performed based on the directed permission tree and hierarchical relationship parameters; The generating of the randomized parameter value of each node by the irreversible hierarchical derivation function HDF includes: Randomize parameter value z based on the parent node of the current node i The order parameter of the node in the same level node is calculated by the irreversible hierarchical derivation function HDF to derive the randomized parameter value z of the current node j , wherein the order parameter represents the sorting position of the current node among its peers under its parent node; The performing of permission verification based on the directed permission tree and the hierarchical relationship parameters includes: The hierarchical relationship parameters include the authority span m, which represents the vertical hierarchical depth difference between nodes, the peer sequence number r, which represents the horizontal sorting position of peer nodes under the same parent node, and the peer maximum capacity N, which represents the total number of peer nodes under the parent node. Based on the first key base u[a] of the parent node of the current node and the serial number r of the same level, the theoretical first derived value u[b] is generated. Based on the second key base v[a] of the parent node and the reverse sequence number mN + m-r, a theoretical second derivative value v[b] is generated. The theoretical first derived value u[b] and the theoretical second derived value v[b] are input into the irreversible double-factor aggregation function BAF for fusion operation, and the theoretical fusion value z is output. cal , and compare it with the randomized parameter value generated by the user node requesting data access. If they match, access is authorized; otherwise, the operation is intercepted and a permission error is returned.

2. The data security processing method of the smart campus management platform according to claim 1 is characterized in that: The generating of the randomized parameter value of each node by the irreversible hierarchical derivation function HDF includes: Based on the first key cardinality u[i] of the parent node of the current node and the forward order parameter n of the target node, an irreversible hierarchical derivation function HDF is used to generate the first derived value u[j] of the current node. Based on the second key cardinality v[i] of the parent node and the reverse order parameter N+1-n, the second derived value v[j] of the current node is generated by performing an operation using the same irreversible hierarchical derivation function HDF. The first derived value u[j] and the second derived value v[j] are input into an irreversible two-factor aggregation function BAF for operation, and the final randomized parameter value z after fusion is output. j , wherein the order parameter represents the sorting position of the current node among the peers under its parent node, and the maximum peer capacity N represents the total number of peer nodes under the parent node.

3. The data security processing method of the smart campus management platform according to claim 1 is characterized in that: The generating of the randomized parameter value of each node by the irreversible hierarchical derivation function HDF includes: When accessing low-sensitivity permission data, the parameter value z is randomized based on the parent node of the current node. i The order parameter of the node in the same level is calculated by the irreversible hierarchical derivation function HDF to derive the randomized parameter value z of the current node j ; When accessing highly sensitive permission data, the irreversible hierarchical derivation function HDF is used to generate the first derived value u[j] of the current node based on the first key base u[i] of the parent node of the current node and the forward order parameter n of the target node. Based on the second key cardinality v[i] of the parent node and the reverse order parameter N+1-n, the second derived value v[j] of the current node is generated by performing an operation using the same irreversible hierarchical derivation function HDF. The first derived value u[j] and the second derived value v[j] are input into an irreversible two-factor aggregation function BAF for operation, and the final randomized parameter value z after fusion is output. j , wherein the order parameter represents the sorting position of the current node among the peers under its parent node, and the maximum peer capacity N represents the total number of peer nodes under the parent node.

4. The data security processing method of the smart campus management platform according to claim 1 is characterized in that: The method further comprises: A hierarchical autonomous key strategy is used to manage keys and dynamically update affected nodes to maintain security.

5. The data security processing method of the smart campus management platform according to claim 4 is characterized in that: The dynamically updating affected nodes includes: The root key is stored in the trusted execution environment; When the permission topology changes, dynamic randomization parameters are injected only into the affected parent nodes to trigger subtree key invalidation.

6. An electronic device, characterized in that: The electronic device includes a memory and at least one processor, the memory stores a computer program, and the processor is used to execute the computer program to implement the data security processing method of the smart campus management platform according to any one of claims 1 to 5.

7. A computer storage medium, characterized in that It stores a computer program, which, when executed, implements the data security processing method of the smart campus management platform according to any one of claims 1-5.

Images