System and method for realizing data grading and classification based on metadata

Abstract

The invention relates to a system and a method for realizing data grading and classification based on metadata, and belongs to the technical field of data classification, the system comprises a digital asset checking module, a data grading and classification module and a data security policy planning module, and the modules are connected through output and input ends. The digital asset checking module constructs an asset list by acquiring database data and metadata thereof; the data grading and classifying module is used for grading and classifying the asset lists based on a multi-dimensional data recognition engine; and the data security policy planning module carries out encryption and desensitization processing on the graded asset lists. According to the invention, the data is accurately classified and graded, and the data security policy planning module can implement accurate security measures, such as encryption and desensitization, for different levels of data, so that sensitive data is ensured to be emphatically protected, and data leakage and abuse are prevented. And meanwhile, the problem of excessive protection or insufficient protection is avoided, and the effectiveness and rationality of a data security policy are improved.

Description

Technical Field

[0001] The present invention relates to a data classification system and method based on metadata, belonging to the technical field of data classification. Background Art

[0002] With the rapid development of information technology, businesses and organizations have accumulated vast amounts of data, which has become a vital digital asset. To effectively manage and protect this data, implementing data classification and tiering management has become a key requirement. Data classification and tiering management can help businesses identify sensitive data, rationally allocate resources, and develop targeted data security strategies to ensure data confidentiality, integrity, and availability.

[0003] Traditional data classification and grading methods often rely on manual or simple scripting tools for data inventory. This makes it difficult to fully capture the data and metadata within the database, resulting in incomplete asset inventories and an inaccurate reflection of the company's data assets. Manual data classification and grading is not only time-consuming and labor-intensive, but also prone to errors. Faced with massive amounts of data, manual classification and grading is far from sufficient to meet actual needs, making it difficult to update and adjust classification and grading results in a timely manner and unable to adapt to rapid data changes.

[0004] Prior art, such as Chinese patent application publication number CN114297283A, discloses a metadata-driven data security management method and system, including the following steps: designing metadata and a metamodel based on a common repository metamodel standard; connecting a profiler and adapter as independent applets to the main system used to manage metadata; using the profiler to profile and process database services, and using the adapter to retrieve and store metadata from various data sources; automatically identifying and associating metadata based on the metamodel and the retrieved metadata, thereby constructing a directory for extracting detailed information from the retrieved metadata; using name matching and content sampling matching combined with NLP algorithms for automatic benchmarking to classify and classify data assets and conduct asset inventory; and assessing the overall risk profile of assets based on dynamic changes in the directory and metadata of data assets. Decoupling the profiler and adapter from the main system as independent applets facilitates expansion and flexible deployment, but this decoupling approach can lead to a decrease in system integrity and increased coordination costs between different components. When classifying and grading data, name matching and content sampling matching are used in combination with NLP algorithms for automatic labeling. However, the matching rules are mainly based on limited dimensions such as field names, field annotations, and data content. Complex data content and semantic information may not be accurately identified and classified. Summary of the Invention

[0005] In order to solve the above problems in the prior art, the present invention proposes a data classification system and method based on metadata.

[0006] The technical solutions of the present invention are as follows:

[0007] On the one hand, the present invention provides a data grading and classification system based on metadata, including a digital asset inventory module, a data grading and classification module, and a data security strategy planning module;

[0008] The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module;

[0009] The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data;

[0010] The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine;

[0011] The data security policy planning module is used to encrypt and desensitize the asset list.

[0012] As a preferred embodiment, the digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module;

[0013] The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively;

[0014] The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module.

[0015] The asset list management module constructs an asset list based on database data and metadata;

[0016] The output end of the asset inventory management module is connected to the input end of the data classification module.

[0017] As a preferred embodiment, the input end of the multi-dimensional data recognition engine is connected to the output end of the asset inventory management module;

[0018] The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition;

[0019] The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags;

[0020] The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category;

[0021] The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

[0022] As a preferred embodiment, the AI ​​recognition uses the DeepSeek model for recognition.

[0023] As a preferred embodiment, the data security strategy planning module includes a data encryption module, a data desensitization module and an integrity verification module;

[0024] The integrity verification module is used to verify the integrity of the asset list after classification;

[0025] The data encryption module is used to encrypt the asset list after classification;

[0026] The data desensitization module is used to desensitize the asset list after classification.

[0027] In another aspect, the present invention further provides a method for implementing data grading and classification based on metadata, comprising a digital asset inventory module, a data grading and classification module, and a data security strategy planning module;

[0028] The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module;

[0029] The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data;

[0030] The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine;

[0031] The data security policy planning module is used to encrypt and desensitize the asset list.

[0032] As a preferred embodiment, the digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module;

[0033] The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively;

[0034] The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module.

[0035] The asset list management module constructs an asset list based on database data and metadata;

[0036] The output end of the asset inventory management module is connected to the input end of the data classification module.

[0037] As a preferred embodiment, the input end of the multi-dimensional data recognition engine is connected to the output end of the asset inventory management module;

[0038] The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition;

[0039] The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags;

[0040] The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category;

[0041] The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

[0042] As a preferred embodiment, the AI ​​recognition uses the DeepSeek model for recognition.

[0043] As a preferred embodiment, the data security strategy planning module includes a data encryption module, a data desensitization module and an integrity verification module;

[0044] The integrity verification module is used to verify the integrity of the asset list after classification;

[0045] The data encryption module is used to encrypt the asset list after classification;

[0046] The data desensitization module is used to desensitize the asset list after classification.

[0047] The present invention has the following beneficial effects:

[0048] The present invention accurately classifies and grades data, and the data security policy planning module can implement precise encryption, desensitization and other security measures for data of different levels, ensuring that sensitive data is protected, preventing data leakage and abuse, while avoiding over-protection or under-protection, and improving the effectiveness and rationality of data security policies. The multi-dimensional data recognition engine, combined with hierarchical classification rules and AI recognition technology, can quickly classify and grade asset lists, avoiding the inefficiency and error-proneness of manual classification and grading, and can timely update and adjust classification and grading results to adapt to rapid changes in data. Constructing a complete asset list enables enterprises to fully and clearly understand their own data assets, including information such as the source, type, quantity, and distribution of the data, providing an accurate basis for data value mining and analysis, and helping enterprises to better discover the potential value of data and formulate reasonable data utilization strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a connection diagram of the system modules of the present invention. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0051] It should be understood that the step numbers used herein are only for convenience of description and are not intended to limit the order in which the steps are to be executed.

[0052] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0053] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0054] The term "and / or" refers to and includes any and all possible combinations of one or more of the associated listed items.

[0055] Example 1:

[0056] See also Figure 1, a data grading and classification system based on metadata, including a digital asset inventory module, a data grading and classification module, and a data security strategy planning module;

[0057] The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module;

[0058] The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data;

[0059] The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine;

[0060] The data security policy planning module is used to encrypt and desensitize the asset list.

[0061] As a preferred embodiment, the digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module;

[0062] The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively;

[0063] The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module.

[0064] The asset list management module constructs an asset list based on database data and metadata;

[0065] The output end of the asset inventory management module is connected to the input end of the data classification module.

[0066] As a preferred embodiment, the input end of the multi-dimensional data recognition engine is connected to the output end of the asset inventory management module;

[0067] The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition;

[0068] The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags;

[0069] The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category;

[0070] The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

[0071] As a preferred embodiment, the AI ​​recognition uses the DeepSeek model for recognition.

[0072] As a preferred embodiment, the data security strategy planning module includes a data encryption module, a data desensitization module and an integrity verification module;

[0073] The integrity verification module is used to verify the integrity of the asset list after classification;

[0074] The data encryption module is used to encrypt the asset list after classification;

[0075] The data desensitization module is used to desensitize the asset list after classification.

[0076] The data encryption module adopts SM2 encryption algorithm and RSA encryption algorithm to realize encryption function.

[0077] Example 2:

[0078] A data classification method based on metadata, including a digital asset inventory module, a data classification module, and a data security strategy planning module;

[0079] The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module;

[0080] The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data;

[0081] The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine;

[0082] The data security policy planning module is used to encrypt and desensitize the asset list.

[0083] As a preferred embodiment, the digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module;

[0084] The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively;

[0085] The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module.

[0086] The asset list management module constructs an asset list based on database data and metadata;

[0087] The output end of the asset inventory management module is connected to the input end of the data classification module.

[0088] As a preferred embodiment, the input end of the multi-dimensional data recognition engine is connected to the output end of the asset inventory management module;

[0089] The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition;

[0090] The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags;

[0091] The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category;

[0092] The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

[0093] As a preferred embodiment, the AI ​​recognition uses the DeepSeek model for recognition.

[0094] As a preferred embodiment, the data security strategy planning module includes a data encryption module, a data desensitization module and an integrity verification module;

[0095] The integrity verification module is used to verify the integrity of the asset list after classification;

[0096] The data encryption module is used to encrypt the asset list after classification;

[0097] The data desensitization module is used to desensitize the asset list after classification.

[0098] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0099] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0100] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0101] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk, and other media that can store program code.

[0102] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention's description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data classification system based on metadata, characterized in that: Includes digital asset inventory module, data classification module and data security strategy planning module; The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module; The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data; The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine; The data security policy planning module is used to encrypt and desensitize the asset list.

2. The data classification system based on metadata according to claim 1, characterized in that: The digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module; The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively; The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module. The asset list management module constructs an asset list based on database data and metadata; The output end of the asset inventory management module is connected to the input end of the data classification module.

3. The data classification system based on metadata according to claim 2, characterized in that: The input end of the multi-dimensional data recognition engine is connected to the output end of the asset list management module; The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition; The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags; The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category; The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

4. The data classification system based on metadata according to claim 3, characterized in that: The AI ​​recognition uses the DeepSeek model for recognition.

5. The data classification system based on metadata according to claim 3 is characterized in that: The data security strategy planning module includes data encryption module, data desensitization module and integrity verification module; The integrity verification module is used to verify the integrity of the asset list after classification; The data encryption module is used to encrypt the asset list after classification; The data desensitization module is used to desensitize the asset list after classification.

6. A method for implementing data classification based on metadata, characterized in that: Includes digital asset inventory module, data classification module and data security strategy planning module; The output end of the digital asset inventory module is connected to the input end of the data classification module, and the output end of the data classification module is connected to the input end of the data security strategy planning module; The digital asset inventory module is used to obtain database data and metadata of the database data, and to build an asset list based on the metadata and database data; The data grading and classification module includes a multi-dimensional data recognition engine, which performs grading and classification on the asset list based on the multi-dimensional data recognition engine; The data security policy planning module is used to encrypt and desensitize the asset list.

7. The method for realizing data classification based on metadata according to claim 6, characterized in that: The digital asset inventory module includes a data acquisition module, an asset list management module and a metadata management module; The data acquisition module includes a data source adapter and a database driver, which is used to obtain database data from the database. The output end of the data acquisition module is connected to the input end of the metadata management module and the input end of the asset inventory management module respectively; The metadata management module is used to obtain metadata from the database data and the database and save it. The metadata includes table name, field name, field type, field attribute and table name. The output end of the metadata management module is connected to the input end of the asset list management module. The asset list management module constructs an asset list based on database data and metadata; The output end of the asset inventory management module is connected to the input end of the data classification module.

8. The method for realizing data classification based on metadata according to claim 7, characterized in that: The input end of the multi-dimensional data recognition engine is connected to the output end of the asset list management module; The multi-dimensional data recognition engine includes hierarchical classification rules and AI recognition; The hierarchical classification rules include setting identity information tags, asset information tags, and configuring switch tags; The AI ​​recognition classifies the corresponding tags on the asset list based on the hierarchical classification rules, and classifies the asset lists with the same tags into the same category; The output end of the multi-dimensional data recognition engine is connected to the input end of the data security strategy planning module.

9. The method for realizing data classification based on metadata according to claim 8, characterized in that: The AI ​​recognition uses the DeepSeek model for recognition.

10. The method for realizing data classification based on metadata according to claim 8, characterized in that: The data security strategy planning module includes data encryption module, data desensitization module and integrity verification module; The integrity verification module is used to verify the integrity of the asset list after classification; The data encryption module is used to encrypt the asset list after classification; The data desensitization module is used to desensitize the asset list after classification.

Images