A dynamic data isolation method based on multi-dimensional security posture assessment

Abstract

The application relates to the technical field of network security, and discloses a dynamic data isolation method based on a multi-dimensional security situation assessment, which comprises the following steps: step a, collecting basic parameters and transmission parameters of multi-source data; step b, collecting multi-dimensional features of the data; step c, calculating a security situation index of the current data; step d, dynamically adjusting an isolation strategy according to the change amount of the security situation index; step e, selecting an encryption algorithm according to the sensitivity; step f, dynamically adjusting the desensitization degree to obtain desensitized data; and step g, isolating the multi-source data according to the dynamically adjusted strategy, algorithm and data. The application can realize real-time sensing of multi-dimensional features such as network environment and data sensitivity through a three-layer dynamic adjustment model, and dynamically adjust the isolation strategy in a closed-loop feedback mode. The application overcomes the defects of traditional static rules, realizes the effect of actively adapting to the change of the security situation, and realizes more accurate and timely intelligent protection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a dynamic data isolation method based on multi-dimensional security posture assessment. Background Technology

[0002] While existing multi-source data isolation methods have improved data security and protection levels to some extent through isolation rules, encryption algorithms, data masking techniques, and authentication architectures, they still have many shortcomings, as detailed below:

[0003] Static isolation mechanisms rely on predefined static isolation strategies (such as the RBAC model), cannot dynamically adapt to changes in data sensitivity, and lack dynamic evaluation of environmental factors such as network topology, access terminals, and spatiotemporal context.

[0004] Encryption technologies often rely on a single encryption algorithm (such as full AES-256), resulting in insufficient encryption strength for highly sensitive data and unnecessary performance degradation. Furthermore, the centralized key management system used in key encryption technologies introduces a single point of failure risk.

[0005] The authentication architecture suffers from high latency in distributed authentication and password fatigue caused by independent authentication by multiple systems, which increases security risks. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a dynamic data isolation method based on multi-dimensional security situation assessment, which solves the problems of insufficient overall protection capabilities caused by the lag in policy adjustment, the imbalance between encryption cost and security strength, and the existence of single points of failure and security risks in the authentication process.

[0007] To achieve the above objectives, the present invention provides a dynamic data isolation method based on multi-dimensional security situation assessment, comprising the following steps:

[0008] Step a, Data Acquisition: Acquire basic parameters and transmission parameters of multi-source data;

[0009] Step b, Feature extraction: Preprocess and extract features from the collected multi-source data to obtain multi-dimensional features of the data;

[0010] Step c, Security Situation Assessment: Based on the multidimensional features, calculate the security situation indicators for the current data;

[0011] Step d, Adaptive learning: Dynamically adjust the isolation strategy based on the changes in the security situation indicators;

[0012] Step e, Dynamic Encryption Algorithm Selection: Select an encryption algorithm based on the security situation indicators and the sensitivity of the multi-source data;

[0013] Step f, Intelligent Desensitization: Based on the context, relevance, and desensitization target of the multi-source data, the degree of desensitization is dynamically adjusted to obtain the desensitized data;

[0014] Step g, Isolation strategy execution: Based on the dynamically adjusted isolation strategy, the selected encryption algorithm, and the de-identified data, the multi-source data is isolated.

[0015] Preferably, steps c and d are executed using a three-layer dynamic adjustment model, which includes:

[0016] Environment perception layer: Real-time collection of multi-dimensional features including network environment risks, data sensitivity classification, and abnormal access behavior constants;

[0017] Policy generation layer: Based on the multidimensional features and historical policy states, a new isolation policy is generated through a policy activation function;

[0018] Execution verification layer: compares the actual protection effect with the expected effect, and triggers the reconstruction of the isolation strategy when the difference exceeds a preset threshold.

[0019] Preferably, the policy generation layer generates a new isolation policy by weighting the multidimensional features, combining them with historical policy states, and then processing them through a policy activation function.

[0020] Preferably, in step e, the selection of the encryption algorithm is achieved by constructing a dynamically perceptive quantum chaotic encryption system, specifically including:

[0021] Construct a dynamic sensitivity assessment model to calculate the sensitivity of data tuples;

[0022] Based on the aforementioned sensitivity and the introduced quantum noise, a quantum chaotic key is constructed using a Logistic-Tent composite mapping.

[0023] Preferably, the dynamic sensitivity assessment model calculates the sensitivity of the data tuple by normalizing parameters including security level, data timeliness, and correlation topology, and then performing a weighted summation.

[0024] Preferably, in step b, the extraction of the multidimensional features further includes:

[0025] The credibility of a user's identity is obtained through a two-factor authentication mechanism. This mechanism constructs a comprehensive biometric evaluation model that integrates biometric matching degree, contextual credibility value, and behavioral entropy value to calculate a comprehensive authentication score.

[0026] Preferably, the comprehensive biometric assessment model calculates a comprehensive authentication score by weighting and combining biometric matching degree, contextual credibility value and behavioral entropy value, wherein the weight coefficients of each item are dynamically adjusted by a support vector machine.

[0027] A dynamic data isolation system based on multi-dimensional security posture assessment includes:

[0028] The data acquisition module is used to collect basic parameters and transmission parameters of multi-source data;

[0029] The feature extraction module is used to preprocess and extract features from the collected data to obtain multidimensional features of the data;

[0030] The security situation assessment module is used to calculate the security situation indicators of the current data based on the multidimensional features.

[0031] An adaptive learning module is used to dynamically adjust the isolation strategy based on the changes in the security situation indicators.

[0032] The dynamic encryption algorithm selection module is used to select an encryption algorithm based on the security situation indicators and the sensitivity of the multi-source data.

[0033] The intelligent desensitization module is used to dynamically adjust the degree of desensitization based on the context, relevance, and desensitization target of multi-source data to obtain desensitized data;

[0034] The isolation policy execution module is used to isolate multi-source data based on the adjusted isolation policy, the selected encryption algorithm, and the de-identified data.

[0035] Preferably, the security situation assessment module and the adaptive learning module are used to run a three-layer dynamic adjustment model, which includes:

[0036] The environment perception layer is used to collect multi-dimensional features in real time, including network environment risks, data sensitivity classification, and abnormal access behavior constants.

[0037] The policy generation layer is used to generate new isolation policies based on the multidimensional features and historical policy states through a policy activation function.

[0038] The execution verification layer is used to compare the actual protection effect with the expected effect. When the difference exceeds a preset threshold, the isolation strategy is reconstructed.

[0039] Preferably, the dynamic encryption algorithm selection module is used to run a dynamically sensed quantum chaotic encryption system, the quantum chaotic encryption system being used for:

[0040] Construct a dynamic sensitivity assessment model to calculate the sensitivity of data tuples;

[0041] Based on the aforementioned sensitivity and the introduced quantum noise, a quantum chaotic key is constructed using a Logistic-Tent composite mapping.

[0042] This invention provides a dynamic data isolation method based on multi-dimensional security situation assessment. It has the following beneficial effects:

[0043] 1. This invention constructs a three-layer dynamic adjustment model. Its environment perception layer can collect multi-dimensional features such as network environment, data sensitivity, and user behavior in real time. Based on these real-time features, the policy generation layer can dynamically adjust isolation policies, forming a closed-loop feedback through the execution verification layer. This overcomes the shortcomings of traditional methods that rely on predefined static rules, enabling security protection to proactively adapt to dynamic changes in the security situation, thereby achieving more accurate and timely intelligent protection.

[0044] 2. This invention utilizes a dynamically sensing quantum chaotic encryption system to dynamically generate keys of varying complexity based on the sensitivity of data tuples and select appropriate encryption algorithms. Simultaneously, intelligent desensitization maximizes data usability while protecting sensitive information, avoiding the performance waste associated with applying a single high-strength protection to all data, thus achieving optimal allocation of security resources.

[0045] 3. This invention strengthens the reliability of identity authentication from the source of access through a dual verification mechanism. This mechanism integrates biometrics, contextual environment and user behavior patterns, thus realizing dynamic policy adjustment from identity authentication, which greatly reduces the risk of the whole system failing due to the breach of a single link. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0047] Figure 2 This is a schematic diagram of the system architecture of the present invention. Detailed Implementation

[0048] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] To better understand the present invention, the above content will be described in detail below with reference to specific embodiments.

[0050] Please see the appendix Figure 1 , Figure 1This invention provides a flowchart illustrating a dynamic data isolation method based on multi-dimensional security situation assessment. The method includes the following steps:

[0051] Step a, Data Acquisition: Acquire basic parameters and transmission parameters of multi-source data;

[0052] In this embodiment, the method of the present invention performs step a, namely data acquisition. This step aims to obtain raw data from one or more data sources for subsequent processing.

[0053] During the data acquisition step, information is obtained from multiple heterogeneous data sources. Optionally, heterogeneous data sources include, but are not limited to: relational databases, document databases, application server log files, network traffic logs generated by network boundary devices, and data services provided through application programming interfaces (APIs). By obtaining information from multiple data sources, more comprehensive raw data can be provided for subsequent feature extraction steps.

[0054] Specifically, the data acquisition steps include acquiring basic parameters. These basic parameters characterize the static properties of the data. In one implementation, the basic parameters include:

[0055] Data identification information, such as the data's unique identifier, data owner information, creation timestamp, or last modification timestamp;

[0056] Data classification and grading information, such as security level labels or content classification labels set by the data source system for the data;

[0057] Business-related information, such as the business system identifier to which the data belongs, the business process step identifier, and the user identity or role information associated with the data operation. The basic parameters collected will be used as input in subsequent data sensitivity assessment and intelligent de-identification steps.

[0058] The data acquisition step also includes acquiring transmission parameters. Transmission parameters are used to characterize the dynamic properties of data during network transmission. In one implementation, the transmission parameters include:

[0059] Network session information, such as the source IP address, destination IP address, source port number, destination port number, and network protocol used for data transmission;

[0060] Transmission behavior information, such as network connection duration, number of data packets transmitted, total data volume, data flow direction, and database operation commands in database interaction scenarios, will be collected. These transmission parameters will be used in subsequent steps for network environment risk assessment and user access behavior analysis.

[0061] To achieve data acquisition, the data collection process can be implemented using various technologies. In one alternative implementation, basic and transmission parameters can be obtained by deploying an agent program on the host where the data source resides, by listening to a mirror port on a network switching device, or by establishing a data interface with a log management platform.

[0062] Therefore, in this step, after acquiring data from different data sources, a normalization process is further executed. This process transforms the input data with different structures into a pre-defined, unified data structure, and outputs the processed data to the subsequent feature extraction step. This normalization process ensures that the data processed in subsequent steps has a consistent format.

[0063] Step b, Feature extraction: Preprocess and extract features from the collected multi-source data to obtain multi-dimensional features of the data;

[0064] In this embodiment, after obtaining the raw data in step a, step b, namely feature extraction, is performed. The goal of this step is to preprocess and characterize the diverse multi-source data collected in step a, converting it into a standardized set of multi-dimensional features that can be used for quantitative analysis in subsequent steps.

[0065] First, preprocessing is performed on the collected multi-source data in this step. Optionally, the preprocessing process may include data cleaning, data transformation, and data normalization. Data cleaning is used to handle missing or outlier values ​​in the original data; data transformation is used to convert non-numerical parameters (such as IP addresses or business system identifiers) into numerical formats; data normalization scales numerical parameters of different dimensions to a uniform range, such as [0,1], to eliminate the impact of differences in the numerical range of different features on subsequent calculations.

[0066] After preprocessing, features are extracted from the data. Multidimensional features aim to comprehensively characterize the static and dynamic attributes of current data manipulation events from different dimensions.

[0067] Specifically, to assess the legality and risk of data operations from the perspective of user identity, the feature extraction process in this step also includes implementing a double verification mechanism to obtain the credibility of the user's identity. The result of this mechanism is a quantified comprehensive authentication score, which also serves as a key dimension of the multi-dimensional features.

[0068] The dual verification mechanism is achieved by constructing and applying a comprehensive biometric assessment model. This model comprehensively considers indicators at three different levels, as follows:

[0069] Biometric Matching Degree B: This value is obtained through biometric identification devices (such as fingerprint or facial recognition devices). It represents the degree of match between the biometric information provided by the current user and the template pre-stored in the system. The higher the value, the greater the likelihood of successful biometric authentication.

[0070] Context Trust Value C: This value is calculated based on the transmission parameters collected in step a. It quantifies the risk level of the current data operation's environment. For example, it can be calculated comprehensively based on information such as the geographical location of the operation, IP address reputation, whether the access time is within normal working hours, and whether the device used is a registered and trusted device. A context environment deviating from the normal pattern will cause this value to decrease.

[0071] Behavioral entropy value E: This is a numerical value used to quantify the consistency between a user's current operation sequence and its historical behavioral patterns. It is calculated by analyzing a user's operation sequence within a certain time window (e.g., the order of accessing database tables, the distribution of SQL command types executed, etc.) and comparing it with the user's established behavioral baseline model. A higher behavioral entropy value indicates that the current operation sequence deviates from the user's usual behavioral habits and may indicate an anomaly.

[0072] The comprehensive biometric assessment model uses the following formula to weight and combine the three indicators mentioned above to calculate the final comprehensive certification score, where the formula is expressed as follows:

[0073] T = α*B + β*C + γ*E;

[0074] In the formula, B is the biometric matching degree, C is the contextual confidence value, E is the behavioral entropy value, and α, β and γ are weighting coefficients;

[0075] To achieve adaptive risk assessment across different scenarios, the weight coefficients α, β, and γ are not fixed. In one specific implementation, these weight coefficients are dynamically adjusted using a pre-trained Support Vector Machine (SVM) model. The input to this SVM model is the context-specific parameters of the current operation request, such as the security level of the requested data. When the requested data is detected to be of extremely high sensitivity, the weight set output by the SVM model may significantly increase the proportion of α (biometric matching weight) and γ (behavioral entropy weight) to perform more stringent identity and behavioral consistency verification.

[0076] Finally, this step combines the extracted features, including but not limited to the data's inherent attributes, transmission behavior characteristics, and the comprehensive authentication score calculated through a two-factor authentication mechanism, into a multi-dimensional feature vector. This vector will be used as output and provided to subsequent security posture assessment steps for processing.

[0077] Step c, Security Situation Assessment: Calculate the security situation value of the current data based on multi-dimensional characteristics;

[0078] Step d, Adaptive learning: Dynamically adjust the isolation strategy based on changes in security situation indicators;

[0079] In this embodiment, after feature extraction is completed in step b, the method then executes steps c (security situation assessment) and d (adaptive learning). These two steps are implemented through a three-layer dynamic adjustment model, which takes the multi-dimensional feature vector generated in step b as input and outputs a dynamically adjusted isolation strategy.

[0080] The three-layer dynamic adjustment model includes an environment perception layer, a policy generation layer, and an execution verification layer.

[0081] Specifically, the environment perception layer is configured to receive and process the multidimensional feature vector output by the feature extraction step. This layer analyzes and integrates specific dimensions of the multidimensional features to generate quantified environmental features E, which, in a specific embodiment, is expressed as:

[0082]

[0083] In the formula, E represents the final calculated behavioral entropy value. This value is used to quantify the degree of consistency between the user's current operation sequence and its historical behavior patterns; n represents the total number of discrete operation types defined in the pre-established user behavior baseline model; x i This represents the i-th discrete operation type. Optionally, these operation types may include, but are not limited to: read operations on a specific database table, write operations on a specific database table, data export operations, or modification operations on system configuration, etc.; p(x i This represents the user performing the i-th operation x within a preset observation time window. i The actual frequency of occurrence. This frequency is used here as the frequency of operation x. i An estimate of the probability of occurrence. For example, if a total of 100 operations are recorded within the observation window, of which type x... i If the operation occurs 20 times, then p(x) i The value of ) is 0.2.

[0084] Then, based on the proposed security situation assessment model, the security situation is calculated comprehensively based on the multi-dimensional characteristics of the data and is used to reflect the current security status of the data. The specific formula is as follows:

[0085] S=f(F1,F2,...,F n );

[0086] In the formula, S represents the final calculated safety state-potential index, F1, F2, ..., Fn This represents the multidimensional characteristics of the data, such as permission complexity, proportion of publicly available data, encryption strength, frequency of data security alerts, and historical interaction behavior. 'f' represents the feature fusion function, used to fuse multidimensional features into a single security posture indicator.

[0087] In one implementation, the feature dimensions analyzed by this layer include:

[0088] Network environment risk: A value calculated based on transmission parameters, used to characterize the security status of the network environment in which the current data interaction takes place.

[0089] Data sensitivity grading: A numerical value determined based on the data classification information in the basic parameters, used to characterize the importance of the accessed data.

[0090] Access Behavior Anomaly Constant: A numerical value that quantifies the degree to which a user's current access behavior deviates from their historical regular behavior pattern. In an optional implementation, this value is output by a time series analysis model (e.g., a Long Short-Term Memory network, LSTM).

[0091] Specifically, after processing, the environment perception layer transforms the generated environmental features E into an environmental feature vector. And output to the policy generation layer, where the environment feature vector The formula for expressing it is:

[0092]

[0093] In the formula, e2 represents network environment risk, e n For data sensitivity classification, e1 is the access behavior anomaly constant output based on LSTM time series analysis;

[0094] Subsequently, the strategy generation layer designs the following dynamic computation strategy:

[0095]

[0096] Among them, P t Let H be the dynamic policy at the computation point, W be the policy weight matrix, and H be the dynamic policy at the computation point. t-1 Let σ be the historical policy state, σ be the policy activation function, and b be the bias term;

[0097] Furthermore, an execution verification layer is constructed through a closed-loop feedback mechanism, expressed as follows:

[0098]

[0099] In the formula, Δ represents the final calculated difference value. This value is a quantitative representation of the average degree to which the actual protection effect deviates from the expected protection effect over the entire observation period T; T represents the total number of time steps within the preset observation period. Optionally, a time step can be defined as a natural unit of time (such as an hour or a day), or as the time to process a fixed number of data access requests; t represents the t-th time step within the observation period; V t This represents the actual protection effect vector collected by the system at time step t. This vector consists of a set of quantitative indicators used to measure the system's security status. In one implementation, this vector may include indicators such as: the number of intrusion alarms related to the protected data per unit time, the number of unauthorized access attempts recorded per unit time, and the abnormal fluctuation range of system performance indicators, etc.; P t This represents the system's preset expected protection effect vector at time step t. This vector is related to V. t A set of baseline or target values ​​with the same dimension represents the desired safety state of the system at that time step; |V t -P t |2 represents the actual protection effect vector V at time step t. t Vector P of expected protection effect t The Euclidean distance (L2 norm) between them. This value is used to quantify the deviation between the actual effect and the expected effect at a single time step.

[0100] By performing the calculation using this formula, a comprehensive difference value Δ can be obtained. This difference value Δ will be compared with a preset threshold. If Δ exceeds the threshold, the verification layer will trigger a refactoring process for the isolation strategy.

[0101] Specifically, for example, policy refactoring is triggered when Δ > 0.15;

[0102] In a further embodiment, to respond to changes in the overall external security situation, at least one weighting coefficient is set as a dynamic weight. For example, the weighting coefficient α can be dynamically calculated based on the security situation indicators output by the security situation assessment module, and the calculation method is as follows:

[0103]

[0104] In the formula, α t The dynamic weight at time t is used to replace the static weight α in the original formula; S t It is the security situation indicator calculated by the security situation assessment module at the current time t; S avg The baseline security situation indicator is either preset or obtained through long-term statistics; k is a positive kurtosis coefficient; e represents a natural constant.

[0105] By introducing this dynamic weight, the present invention can achieve the following technical effects: when the overall security situation of the system is severe (i.e., S... t Significantly higher than S avg ), α t The value will approach 1, making biometric matching dominant in the calculation of the overall trust score, thus strengthening the verification of the visitor's physical identity. Conversely, when the security situation is stable, this weight will decrease accordingly. By comprehensively considering other environmental and behavioral factors, an adaptive enhancement of the trust assessment mechanism is achieved.

[0106] In another embodiment, the policy generation layer is configured to use the environmental feature vector E output by the environment perception layer, combined with the historical policy states P recorded by the system. old Generate a new isolation strategy P new This process is step c, the specific implementation of the security situation assessment, which outputs a new strategy P. new This is a quantitative indicator of the current data security situation. The strategy generation process, also known as step d, is the specific execution of strategy adjustment in adaptive learning. The specific formula is as follows:

[0107] P new =g(P old ,ΔS,θ);

[0108] In the formula, P new This indicates a new isolation strategy, P old Let ΔS represent the old isolation strategy, θ represent the change in security posture (the difference between the current security posture and the previous assessment), and g(.) represent the learning model parameters. The learning function is used to dynamically adjust the isolation strategy based on the change in security posture and the learning model parameters.

[0109] The execution verification layer is configured to implement the feedback mechanism to complete the adaptive learning in step d. This layer operates under the new isolation strategy P. new After being executed by downstream steps, the system's operating status is monitored.

[0110] Specifically, the execution verification layer collects a set of quantitative security metrics to measure the effectiveness of policy execution (e.g., the number of unauthorized access attempts detected per unit time). Then, the collected actual metrics are compared with a set of preset expected performance metrics, and the difference between the two is calculated.

[0111] When the calculated difference exceeds a preset threshold, it indicates that the current isolation strategy's execution effect does not meet the preset requirements. At this point, the verification layer triggers a reconstruction process for the isolation strategy. This reconstruction process may include adjusting the weight matrix W in the strategy generation layer's calculation formula or updating other configurable parameters in the model. This feedback and reconstruction loop allows the method to adjust its internal parameters based on actual performance, thereby achieving adaptive learning of the strategy.

[0112] Step e, Dynamic Encryption Algorithm Selection: Select an encryption algorithm based on security posture indicators and the sensitivity of multi-source data;

[0113] In this embodiment, after adjusting the isolation strategy in step d, the method proceeds to step e, namely, dynamic encryption algorithm selection. This step determines an appropriate encryption algorithm and key for the data based on the security posture indicators output from the preceding steps and the sensitivity of the data to be processed. This step is implemented through a dynamically aware quantum chaotic encryption system.

[0114] Execution of a dynamically sensing quantum chaotic encryption system;

[0115] First, a dynamic sensitivity assessment model is constructed and applied to calculate the sensitivity S of the current data tuple to be processed. This model obtains a comprehensive sensitivity value by quantizing, normalizing, and weighting a set of preset parameters.

[0116] Specifically, the dynamic encryption algorithm selection model selects a suitable encryption algorithm in real time based on the sensitivity and importance of the data, as well as the system's performance requirements. The specific formula is as follows:

[0117] E = h(S,P,R);

[0118] In the formula, E represents the selected encryption algorithm, S represents the security posture of the data, P represents the sensitivity and importance of the data, R represents the system performance requirements, and h represents the selection function used to select a suitable encryption algorithm based on the security posture, data sensitivity, and system performance requirements.

[0119] In one implementation, the preset parameters include:

[0120] Security Level: This is a value determined based on the basic parameters collected in step a, which represents the static confidentiality level of the data in the business regulations.

[0121] Data timeliness: This is a numerical value that quantifies how the value of data changes over time. Optionally, this value can be inversely proportional to the length of time since the data was created.

[0122] Association Topology Degree: This is a numerical value characterizing the degree of association between the current data tuple and other data tuples in the data relationship graph. Data tuples that are more closely associated with other highly sensitive data are assigned a higher association topology degree. Specifically, its formula is as follows:

[0123]

[0124] In the formula, Γ(D) represents the final calculated comprehensive evaluation score; ω k For feature weights, φ k For the normalization function, d k The parameters include security level, data timeliness, and correlation topology; n represents the total number of data points or feature dimensions used to describe the target object D; k represents the index of the current summation term, which ranges from 1 to n.

[0125] Subsequently, a quantum chaotic key is constructed. This process employs a Logistic-Tent composite mapping and introduces quantum noise to enhance the randomness of the key.

[0126] In one specific implementation, the Logistic-Tent composite mapping is used to generate pseudo-random chaotic sequences. The control parameters or initial values ​​of this mapping are associated with a sensitivity S calculated in the previous step. In this way, the sensitivity of the data tuples directly affects the characteristics of the generated chaotic sequence. For example, a higher sensitivity value can be used to generate longer or more complex chaotic sequences.

[0127] Specifically, a quantum chaotic key is constructed using the Logistic-Tent coincidence mapping shown below, and its formula includes:

[0128]

[0129] In the formula, x n This represents the state value of the chaotic sequence in the nth iteration. This value is the input for this iteration calculation. In one implementation, the initial state value x0 of the sequence is a preset system parameter;

[0130] r represents a control parameter used to adjust the dynamic behavior of the mapping. In an optional implementation, the value of this parameter r depends on the sensitivity of the data tuples calculated in the preceding steps. In this way, the sensitivity of the data to be encrypted directly affects the characteristics of the generated chaotic sequence, and thus affects the structure of the key; y n This represents the original random value obtained from the quantum random number generator at the nth iteration. This value constitutes the quantum noise introduced into the iteration process, the purpose of which is to utilize the inherent uncertainty of quantum physical processes to enhance the randomness and unpredictability of the generated sequence; 2 64This represents the normalization scaling factor. This constant is used to normalize the original quantum random value y. n (For example, a 64-bit unsigned integer) is converted into a smaller perturbation term. This operation ensures that quantum noise can effectively perturb the iterative trajectory without completely destroying the inherent chaotic properties of the mapping; For quantum noise, is a parameter that includes security level, data timeliness, and correlation topology.

[0131] To further enhance the unpredictability of the generated key, quantum noise is introduced during the iterative generation of the chaotic sequence. Optionally, a truly random number can be obtained using a quantum random number generator, and this random number can be used to perturb a certain intermediate state value of the chaotic map. This operation introduces the undeterminism inherent in quantum physical processes into the key generation process, thereby improving the cryptographic security of the final generated key.

[0132] Finally, the generated chaotic sequence is processed (e.g., binarized) to form the final quantum chaotic key. Simultaneously, the system selects an encryption algorithm from a pre-defined encryption algorithm library based on the sensitivity value (e.g., AES-256 is selected when the sensitivity value is in a high range; a less computationally expensive symmetric encryption algorithm is selected when S is in a low range). The selected encryption algorithm and its corresponding quantum chaotic key output in this step will be passed to the subsequent isolation policy execution step.

[0133] Step f, Intelligent Desensitization: Based on the context, relevance, and desensitization target of the multi-source data, the degree of desensitization is dynamically adjusted to obtain the desensitized data;

[0134] In this embodiment, after completing the aforementioned steps, the method proceeds to step f, i.e., intelligent desensitization. This step aims to apply dynamically adjusted desensitization operations to the multi-source data that needs processing, so as to process sensitive information while meeting specific data usage objectives, and finally obtain desensitized data.

[0135] This step is implemented through a dynamic desensitization decision model. Based on three core input dimensions—context, relevance, and desensitization objective—the model calculates a quantified desensitization level index and selects and executes specific desensitization techniques accordingly.

[0136] First, this step obtains and quantifies the input parameters for three core dimensions:

[0137] Data Usage Context: This parameter characterizes the specific context in which the data is accessed or used. In one implementation, the context is quantified as a context risk score. This score can be determined based on information such as the target environment of the data request (e.g., a production environment, a development / testing environment, or a third-party analytics platform), the visitor's role and permission level, and the specific business process in which the data will be used. Contexts with a higher potential risk of disclosure will be assigned a higher risk score.

[0138] Data Relevance: This parameter characterizes the degree of risk that the data field to be de-identified could be used for association analysis or identity re-identification with other data fields (especially other sensitive fields). The quantified result of this parameter is an association risk score. In an optional implementation, this score can be calculated using the association topology calculated in the dynamic sensitivity assessment model in step e, or it can be calculated independently by analyzing the connectivity and paths of the data in the knowledge graph.

[0139] Desensitization Target: This parameter is the data utility requirement value determined according to a preset strategy. It defines the requirement for data fidelity or usability in this data usage. For example, scenarios used for statistical analysis may tolerate a higher degree of information loss, with a lower utility requirement value; while scenarios used for model training may need to preserve the distribution characteristics of the data, with a higher utility requirement value.

[0140] Specifically, intelligent data anonymization technology dynamically adjusts the degree of anonymization based on the context and relevance of the data, in order to maintain data availability while protecting security, as detailed below:

[0141] D=k(C,R t ,T);

[0142] In the above formula, D represents the anonymized data, C represents the data context, and R... t The relationship between data is represented by T, the target level of desensitization (including data availability requirements, etc.), and k is the desensitization function, which is used to dynamically adjust the desensitization level according to the context, relationship, and desensitization target of the data.

[0143] After calculating the anonymized data D, the system matches and selects one or more specific anonymization algorithms from a predefined anonymization rule base based on the value of this indicator. This rule base maps different numerical ranges of D to different anonymization techniques.

[0144] For example, a higher D value indicates a scenario with high risk and low utility. The system will match and select desensitization techniques with a high degree of information masking, such as performing data suppression (i.e., complete removal) or hashing on key fields.

[0145] For D values ​​in the middle range, the system will use desensitization techniques that can preserve some data format or type, such as masking (e.g., replacing some characters with specific symbols, such as "138****1234") or data generalization (e.g., replacing the specific age value "28" with the age range "20-30").

[0146] For lower D values, indicating scenarios with low risk and high efficiency requirements, the system will select desensitization techniques with minimal information loss, such as applying controlled random noise perturbations to numerical data. When D is below a certain preset threshold, the system can also determine that no desensitization operation is required.

[0147] Through the above process, this step completes the intelligent de-identification of the data, and its output is the data after adaptive de-identification. This data will be used in subsequent business processes, provided that specific security and utility requirements are met.

[0148] Step g, Isolation strategy execution: Based on the dynamically adjusted isolation strategy, the selected encryption algorithm, and the de-identified data, the multi-source data is isolated.

[0149] In this embodiment, after completing the selection of encryption algorithms and intelligent desensitization, the method finally executes step g, namely, the isolation strategy execution. This step is the final execution carrier of the entire data security processing flow, which integrates the output results of all the aforementioned analysis and decision-making steps, and performs the final isolation processing on multi-source data.

[0150] The function of this step is to translate the abstract strategies and data processing results generated in the preceding steps into concrete control commands at the data interaction level and implement them. The execution of this step depends on three key inputs:

[0151] The isolation strategy generated after dynamic adjustment in step d;

[0152] The encryption algorithm and key selected in step e based on data sensitivity;

[0153] The data obtained after intelligent desensitization in step f.

[0154] In a specific execution flow, this step first obtains the final isolation strategy determined during the adaptive learning process in step d. This strategy, as a comprehensive guiding principle, defines the required level of security isolation for this data interaction. The isolation strategy execution module parses the control requirements implied by this strategy. For example, a high-strength isolation strategy will be parsed as implementing strict data access blocking or requiring data to be directed to a logical area with the highest security level.

[0155] Next, this step invokes the encryption algorithm and generated quantum chaotic key selected in step e. When data needs to be transmitted or stored at the target location, the isolation policy execution module applies this encryption algorithm and key to encrypt the data payload. If the data was de-identified in step f, the encryption operation here is performed on the de-identified data. This operation ensures that even if the data is intercepted during transmission or storage, its content remains invisible to unauthorized parties.

[0156] Simultaneously, this step receives the anonymized data from step f. The implementation of the isolation strategy ensures that only the anonymized version of the data is used in subsequent data delivery or usage processes. This achieves the principle of data minimization, which exposes only necessary information based on context, relevance, and usage objectives, thereby reducing the risk of sensitive information leakage while ensuring the data is used legitimately.

[0157] Finally, the isolation policy execution module integrates the above policy parsing, encryption application, and use of de-identified data to complete the data isolation process. Optionally, the specific form of isolation processing may include: directing the encrypted and de-identified data to a designated, network-isolated computing environment; allowing or blocking specific data flows at the data gateway level according to the policy; or allowing data access but simultaneously triggering a high-frequency, detailed access behavior auditing and logging process.

[0158] By performing this step, this method transforms the intelligent decisions formed by dynamic evaluation and adaptive learning into precise control of data flow and data state, thus completing the entire closed-loop secure processing of multi-source data.

[0159] Please see the appendix Figure 2 , attached Figure 2 A schematic diagram of a dynamic data isolation system based on multi-dimensional security situation assessment is provided for an embodiment of the present invention. The system includes:

[0160] The data acquisition module is used to collect basic parameters and transmission parameters of multi-source data;

[0161] This module is used to acquire data streams in real time from multiple data source interfaces. It is responsible for collecting two types of core data attributes: basic parameters and transmission parameters. Basic parameters may include data type, data source identifier, static security classification label, etc.; transmission parameters may include packet size, transmission protocol type, source IP address, destination IP address, and timestamp, etc.

[0162] The feature extraction module is used to preprocess and extract features from the collected data to obtain multidimensional features of the data;

[0163] This module connects to the data acquisition module and is configured to receive the acquired raw parameters and perform data preprocessing operations, such as data cleaning, standardization, or normalization. Subsequently, this module extracts and quantifies a set of multidimensional features from the preprocessed data, such as permission complexity, proportion of public data, encryption strength, frequency of data security alerts, and historical interaction behavior characteristics, and constructs these features into a multidimensional feature vector for output.

[0164] The security situation assessment module is used to calculate the security situation indicators of the current data based on multi-dimensional characteristics.

[0165] This module connects to the feature extraction module and is configured to receive multi-dimensional feature vectors. Using a pre-defined feature fusion function or model, it performs comprehensive calculations on the input multi-dimensional features to generate a quantified security posture indicator. This indicator characterizes the overall security status of the current data interaction environment.

[0166] The adaptive learning module is used to dynamically adjust the isolation strategy based on changes in security situation indicators.

[0167] This module connects to the security posture assessment module and is configured to dynamically generate or update isolation policies based on security posture indicators and their changes over time. This module employs a three-layer dynamic adjustment model (including an environment awareness layer, a policy generation layer, and an execution verification layer) to achieve feedback adjustment and reconstruction of isolation policy parameters by comparing the actual and expected effects of policy execution.

[0168] The dynamic encryption algorithm selection module is used to select an encryption algorithm based on security posture indicators and the sensitivity of multi-source data;

[0169] This module determines the encryption scheme based on security posture indicators and the sensitivity of data tuples calculated through a dynamic sensitivity assessment model (based on security level, data timeliness, and correlation topology). The module selects an encryption algorithm from a pre-built encryption algorithm library and can use a Logistic-Tent composite mapping combined with quantum noise to generate a corresponding quantum chaotic key.

[0170] The intelligent desensitization module is used to dynamically adjust the degree of desensitization based on the context, relevance, and desensitization target of multi-source data to obtain desensitized data;

[0171] This module calculates a comprehensive anonymization level index based on the contextual information of multi-source data, the results of data correlation analysis, and the preset anonymization target (data utility requirements). Based on the anonymization level index, this module dynamically selects and applies appropriate anonymization techniques (e.g., masking, generalization, or data suppression) to output the anonymized data.

[0172] The isolation policy execution module is used to isolate multi-source data based on the adjusted isolation policy, the selected encryption algorithm, and the de-identified data.

[0173] This module comprises an adaptive learning module, a dynamic encryption algorithm selection module, and an intelligent de-identification module. It is configured to receive a dynamically adjusted isolation policy, the selected encryption algorithm and key, and the de-identified data. Based on the instructions of the isolation policy, the module applies the selected encryption algorithm to encrypt the de-identified data and performs final isolation operations at the data access control point, such as data stream redirection, access control, or secure storage.

[0174] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A dynamic data isolation method based on multi-dimensional security situation assessment, characterized in that, Includes the following steps: Step a, Data Acquisition: Acquire basic parameters and transmission parameters of multi-source data; Step b, Feature extraction: Preprocess and extract features from the collected multi-source data to obtain multi-dimensional features of the data; Step c, Security Situation Assessment: Based on the multidimensional features, calculate the security situation indicators for the current data; Step d, Adaptive learning: Dynamically adjust the isolation strategy based on the changes in the security situation indicators; Step e, Dynamic Encryption Algorithm Selection: Select an encryption algorithm based on the security situation indicators and the sensitivity of the multi-source data; Step f, Intelligent Desensitization: Based on the context, relevance, and desensitization target of the multi-source data, the degree of desensitization is dynamically adjusted to obtain the desensitized data; Step g, Isolation strategy execution: Based on the dynamically adjusted isolation strategy, the selected encryption algorithm, and the de-identified data, the multi-source data is isolated. Steps c and d are executed through a three-layer dynamic adjustment model, which includes: Environment perception layer: Real-time collection of multi-dimensional features including network environment risks, data sensitivity classification, and abnormal access behavior constants; Policy generation layer: Based on the multidimensional features and historical policy states, a new isolation policy is generated through a policy activation function; Execution verification layer: compares the actual protection effect with the expected effect, and triggers the reconstruction of the isolation strategy when the difference exceeds a preset threshold.

2. The dynamic data isolation method based on multi-dimensional security situation assessment according to claim 1, characterized in that, The policy generation layer generates a new isolation policy by weighting the multidimensional features, combining them with historical policy states, and then processing them through a policy activation function.

3. The dynamic data isolation method based on multi-dimensional security situation assessment according to claim 1, characterized in that, In step e, the selection of the encryption algorithm is achieved by constructing a dynamically perceptive quantum chaotic encryption system, specifically including: Construct a dynamic sensitivity assessment model to calculate the sensitivity of data tuples; Based on the aforementioned sensitivity and the introduced quantum noise, a quantum chaotic key is constructed using a Logistic-Tent composite mapping.

4. The dynamic data isolation method based on multi-dimensional security situation assessment according to claim 3, characterized in that, The dynamic sensitivity assessment model calculates the sensitivity of data tuples by normalizing parameters including security level, data timeliness, and correlation topology, and then performing a weighted summation.

5. The dynamic data isolation method based on multi-dimensional security situation assessment according to claim 1, characterized in that, In step b, the extraction of the multidimensional features further includes: The credibility of a user's identity is obtained through a two-factor authentication mechanism. This mechanism constructs a comprehensive biometric evaluation model that integrates biometric matching degree, contextual credibility value, and behavioral entropy value to calculate a comprehensive authentication score.

6. The dynamic data isolation method based on multi-dimensional security situation assessment according to claim 5, characterized in that, The comprehensive biometric assessment model calculates a comprehensive authentication score by weighting and combining biometric matching degree, contextual credibility value, and behavioral entropy value, where the weight coefficients of each item are dynamically adjusted by a support vector machine.

7. A dynamic data isolation system based on multi-dimensional security situation assessment, used to implement the dynamic data isolation method based on multi-dimensional security situation assessment as described in any one of claims 1-6, characterized in that, include: The data acquisition module is used to collect basic parameters and transmission parameters of multi-source data; The feature extraction module is used to preprocess and extract features from the collected data to obtain multidimensional features of the data; The security situation assessment module is used to calculate the security situation indicators of the current data based on the multidimensional features. An adaptive learning module is used to dynamically adjust the isolation strategy based on the changes in the security situation indicators. The dynamic encryption algorithm selection module is used to select an encryption algorithm based on the security situation indicators and the sensitivity of the multi-source data. The intelligent desensitization module is used to dynamically adjust the degree of desensitization based on the context, relevance, and desensitization target of multi-source data to obtain desensitized data; The isolation policy execution module is used to isolate multi-source data based on the adjusted isolation policy, the selected encryption algorithm, and the de-identified data.

8. A dynamic data isolation system based on multi-dimensional security situation assessment according to claim 7, characterized in that, The security situation assessment module and the adaptive learning module are used to run a three-layer dynamic adjustment model, which includes: The environment perception layer is used to collect multi-dimensional features in real time, including network environment risks, data sensitivity classification, and abnormal access behavior constants. The policy generation layer is used to generate new isolation policies based on the multidimensional features and historical policy states through a policy activation function. The execution verification layer is used to compare the actual protection effect with the expected effect. When the difference exceeds a preset threshold, the isolation strategy is reconstructed.

9. A dynamic data isolation system based on multi-dimensional security situation assessment according to claim 7, characterized in that, The dynamic encryption algorithm selection module is used to run a dynamically sensed quantum chaotic encryption system, which is used for: Construct a dynamic sensitivity assessment model to calculate the sensitivity of data tuples; Based on the aforementioned sensitivity and the introduced quantum noise, a quantum chaotic key is constructed using a Logistic-Tent composite mapping.

Images