Cross-platform data security management method

Abstract

The invention relates to the technical field of data security management methods, in particular to a cross-platform data security management method, which specifically comprises the following steps of: step 1, firstly, finely classifying cross-platform transmitted and stored data, and dividing the data into different categories according to factors such as sensitive degree, application, belonging business field and the like of the data; 2, a multi-factor identity authentication mechanism is adopted, and a password, a short message verification code, fingerprint recognition and face recognition are combined to verify the identity of the user; 3, in the data transmission and storage process, hierarchical encryption is adopted, and for a transmission layer, according to network protocols supported by different platforms, an encryption protocol is used for data encryption; according to the invention, through data classification marking, unified identity authentication, access control and other mechanisms, seamless adaptation of a security management mechanism to different operating systems, hardware architectures and application platforms is realized, and security management obstacles caused by platform differences are eliminated.

Description

Technical Field

[0001] The present invention relates to the technical field of cross-platform data security management methods, and in particular to a cross-platform data security management method. Background Art

[0002] In the digital age, cross-platform data interaction and sharing are becoming increasingly frequent. With the expansion of enterprise businesses and the increasing demand for multi-device and multi-system collaboration, data needs to flow across different operating systems (such as Windows, macOS, Linux, iOS, and Android), different hardware architectures, and various applications. However, the complexity of this cross-platform environment presents numerous challenges to data security.

[0003] Traditional data security management methods are mostly designed for a single platform or specific environment, and are difficult to adapt to the diverse security needs in cross-platform scenarios. Summary of the Invention

[0004] In view of the technical problem that traditional data security management methods are mostly designed for a single platform or a specific environment and are difficult to adapt to the diverse security needs in cross-platform scenarios, the present invention provides a cross-platform data security management method.

[0005] The technical solution adopted by the present invention is: a cross-platform data security management method, which specifically includes the following steps:

[0006] Step 1: First, carefully classify the data transmitted and stored across platforms, dividing it into different categories based on factors such as data sensitivity, usage, and business area.

[0007] Step 2: Use a multi-factor authentication mechanism that combines passwords, SMS verification codes, fingerprint recognition, and facial recognition to verify user identity;

[0008] Step 3: During data transmission and storage, layered encryption is used. For the transport layer, encryption protocols are used to encrypt data based on the network protocols supported by different platforms.

[0009] Step 4: Use hash algorithm to calculate the summary of data;

[0010] Step 5: Regularly perform security vulnerability checks on cross-platform applications and systems;

[0011] Step 6: Establish a cross-platform security audit system to audit user operations, data access records, security incidents, etc. on different platforms;

[0012] Step 7: Regularly update and optimize cross-platform security policies.

[0013] In one embodiment, in step 1, data transmitted and stored across platforms is carefully classified into different categories based on factors such as the sensitivity of the data, its purpose, and the business domain to which it belongs, including the following:

[0014] Highly sensitive data, moderately sensitive data, general data (such as public product introductions, FAQs, etc.);

[0015] Then, the data classification labeling model is introduced: let the data set be D = {d1, d2, ..., d n}, where d i Represents the i-th data object;

[0016] For each data object d i , define its classification label set C i ={c i1 ,c i2 ,…,c im}, where c ij Indicates d i The j-th classification label;

[0017] The classification model M is constructed by machine learning algorithm, and the feature vector F(d i ), output its classification label set C i , that is, C i =M(F(d i )).

[0018] In one embodiment, in step 2, let the user set be U = {u1,u2,…,u s}, for each user u i , define its authentication factor set A i ={a i1 ,a i2 ,…,a it}, where a i j represents u i The jth authentication factor; construct the identity authentication function Auth(u i ,A input ), where A input A set of authentication factors entered by the user; when Auth(u i ,A input )=true, it means user u i Pass identity authentication;

[0019] Define the role set R = {r1, r2, ..., r p}, each character r j Assigned a set of permissions P j ={p j1 ,pj2 ,…,p jq}, where p jk Represents r j The kth permission of user u i With the character r j Through the assignment relationship Assign(u i ,r j ) to associate; let the access request be Request(u i ,o,a), where o represents the target object and a represents the operation;

[0020] Access control decision function AccessControl(Request(u i ,o,a))The calculation process is:

[0021] First, according to Assign(u i ,r j ) Find user u i The corresponding role set R user ={r j1 ,r j2 ,…,r jl}, then check each character r jm The permission set P jm Does it contain the permission to perform operation a on the target object o? If there is a r j m makes p jkm =(o,a), then AccessControl(Request(u i ,o,a))=true, access is allowed; otherwise, return false, access is denied.

[0022] In one embodiment, in step 3, the transmitted data is assumed to be D transmit , the encryption function is Encrypt transmit (D transmit ,K transmit ), where K transmit Encryption keys for the transport layer;

[0023] Through this encryption function, the original data D t ransmit is encrypted into ciphertext C t ransmit=Encrypt transmit (D transmit ,K transmit ) for transmission;

[0024] At the storage layer, a combination of file-level encryption based on a key management system and database field-level encryption is used to address the storage formats and characteristics of different platforms.

[0025] For file storage, let the file be F and the file encryption function be Encrypt file (F,K file ), where K file is the file encryption key, and the encrypted file is F encrypted =Encrypt file (F,K file );

[0026] For database storage, let the field in the database table be Field and the field encryption function be Encrypt field (Field,K field ), where K field The encrypted field value is Eiold-E ∞ omot(Eiold,K...)Field encrypted =Encrypt field (Field,K field );

[0027] In terms of key management, a key hierarchy is introduced, and the master key is set as MasterKey. The transport layer encryption key K is generated by the key derivation function KDF (MasterKey, salt, info) transmit、文件加密密钥 K file and field encryption key K field wait;

[0028] Among them, salt is a randomly generated salt value used to increase the randomness of the key; info is additional data containing key information.

[0029] In one embodiment, in step 4, let the data be D, the hash function be Hash(D), and the calculated data digest be Digest=Hash(D);

[0030] At the data receiving or consuming end, the hash digest of the received or read data is recalculated and compared with the original digest;

[0031] Define the integrity verification function IntegrityCheck(D received ,Digest original ), where D received For the received data, Digest original is a summary of the original data;

[0032] Calculating Digest received =Hash(D received ), if Digest received =Digestoriginal , then IntegrityCheck(D received ,Digest oriainal )=true, indicating that the data integrity is not damaged; otherwise, it returns false, indicating that the data has been tampered with.

[0033] In one embodiment, in step five, a combination of static analysis and dynamic analysis is used;

[0034] Static analysis analyzes the source code or binary code of an application to construct an abstract model of the program's control flow graph, data flow graph, and call graph. It uses lexical analysis, syntax analysis, semantic analysis, and data flow analysis to identify potential vulnerabilities in the code.

[0035] Suppose the static analysis tool is SAST, the input code is Code, the static analysis function is SAST(Code), and the output potential vulnerability set Vulnerabilities static =SAST(Code);

[0036] Dynamic analysis technology simulates various attack scenarios while the application is running, detecting runtime vulnerabilities such as SQL injection, session management flaws, and cross-site scripting attacks;

[0037] Assume that the dynamic analysis tool is DAST, the operating environment is Environment, the application is App, and the dynamic analysis function is DAST(App, Environment;

[0038] Output runtime vulnerability set Vulnerabilityes dynamic =DAST(App,Environment);

[0039] Combine the vulnerability sets obtained from static analysis and dynamic analysis to obtain the total vulnerability set Vulnerabilities = Vulnerabilities static ∪Vulnerabilityes dynamic ;

[0040] For detected vulnerabilities, establish a vulnerability repair priority ranking model.

[0041] In one embodiment, in step 6, the audit log set is Log = {l1, l2, ..., l q}, where l i Represents the i-th audit log;

[0042] Each audit log record contains the operation time Time(l i )、Operation User User(li )、Operation objectObject(l i )、Operation typeAction(l i ), operation result Result(l i ) and other information;

[0043] Construct the security audit query function AuditQuery(condition), where condition is the query condition;

[0044] Use machine learning algorithms to analyze audit log data in real time and build normal behavior models;

[0045] Assume that the normal behavior data set is NormalData={n1,n2,…,n r}, build a normal behavior model through clustering algorithm or anomaly detection algorithm normal ;

[0046] In the real-time monitoring process, the newly generated operation behavior data new , calculate its difference with the normal behavior model Model normal Deviation(Data new ,Model normal );

[0047] If Deviation(Data new ,Model normal )>threshold (threshold is the preset threshold), the behavior is determined to be abnormal behavior and a security alert is triggered.

[0048] In one embodiment, in step 7, a security policy update team is established to collect the latest security vulnerability information, changes in industry security standards, and legal and regulatory requirements, and to evaluate the effectiveness of existing security policies based on the collected information.

[0049] The beneficial effects of the present invention are: compared with the existing technology, in the present invention, through mechanisms such as data classification and labeling, unified identity authentication and access control, the security management mechanism is seamlessly adapted to different operating systems, hardware architectures and application platforms, eliminating the security management barriers caused by platform differences; for the prevention of diverse security threats, the coordination of multiple links such as layered encryption, data integrity verification, vulnerability detection and repair, and security monitoring can effectively resist various threats such as data leakage, XSS, CSRF, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic flow diagram of the present invention; DETAILED DESCRIPTION

[0051] In the description of the present invention, it should be noted that the terms "front", "up", "down", "left", "right", "vertical", "horizontal", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limiting the present invention.

[0052] refer to Figure 1 In order to solve the problems existing in the background technology, this application proposes the following technical solution: a cross-platform data security management method, which specifically includes the following steps:

[0053] Step 1: First, carefully classify the data transmitted and stored across platforms, dividing it into different categories based on factors such as data sensitivity, usage, and business area.

[0054] In step 1, carefully classify the data transmitted and stored across platforms. The data is divided into different categories based on factors such as its sensitivity, purpose, and business area. Specifically, the following categories are included:

[0055] Highly sensitive data (such as user ID number, bank card information, etc.), moderately sensitive data (such as user name, contact information, etc.), general data (such as public product introductions, FAQs, etc.);

[0056] Then, the data classification labeling model is introduced: let the data set be D = {d1, d2, ..., d n}, where d i Represents the i-th data object;

[0057] For each data object d i , define its classification label set C i ={c i1 ,c i2 ,…,c im}, where c ij Indicates d i The j-th classification label;

[0058] The classification model M is constructed by machine learning algorithms (such as decision tree, support vector machine, etc.), and the feature vector F (d i ), output its classification label set C i , that is, C i =M(F(d i)). The training data of this model comes from a large number of manually labeled data samples, and the classification accuracy is improved by continuously optimizing the model parameters. For example, for user information data, its feature vector may include information such as data field type (name, ID number, etc.), data source (registration form, third-party interface, etc.). Through the trained classification model, user ID number data can be accurately marked as a highly sensitive data category. The classified data is labeled, and the classification label information is added to the data metadata. In this way, in the subsequent data processing, transmission and storage process, the data category can be quickly identified based on the label, so that the corresponding security strategy can be adopted.

[0059] Step 2: Use a multi-factor authentication mechanism that combines passwords, SMS verification codes, fingerprint recognition, and facial recognition to verify user identity.

[0060] In step 2, let the user set be U = {u1,u2,…,u s}, for each user u i , define its authentication factor set A i ={a i1 ,a i2 ,…,a it}, where a i j represents u i The jth authentication factor; construct the identity authentication function Auth(u i ,A input ), where A input A set of authentication factors entered by the user; when Auth(u i ,A input )=true, it means user u i Pass identity authentication. For example, when a user logs in, the system first verifies whether the password entered by the user is correct. If it is correct, it verifies whether the SMS verification code matches. If both pass, then Auth(u i ,A input )=true, the user is authenticated. In terms of access control, the role-based access control (RBAC) model is extended.

[0061] Define the role set R = {r1, r2, ..., r p}, each character r j Assigned a set of permissions P j ={p j1 ,p j2 ,…,p jq}, where p jk Represents r j The kth permission of user u i With the character r j Through the assignment relationship Assign(ui ,r j ) to associate; let the access request be Request(u i ,o,a), where o represents the target object (such as data file, application function, etc.), and a represents the operation (such as read, write, delete, etc.);

[0062] Access control decision function AccessControl(Request(u i ,o,a))The calculation process is:

[0063] First, according to Assign(u i ,r j ) Find user u i The corresponding role set R user ={r j1 ,r j2 ,…,r jl}, then check each character r jm The permission set P jm Does it contain the permission to perform operation a on the target object o? If there is a r j m makes p jkm =(o,a), then AccessControl(Request(u i If ,o,a)) = true, access is allowed; otherwise, false is returned, denying access. For example, in a financial application, a "Financial Manager" role is defined, which has read, modify, and delete permissions for financial report data. When a user is assigned the "Financial Manager" role and initiates an access request to financial report data, the access control decision function described above determines whether the operation is permitted.

[0064] Step 3: Layered encryption is used during data transmission and storage. For the transport layer, encryption protocols (such as TLS / SSL) are used to encrypt data based on the network protocols supported by different platforms.

[0065] In step 3, let the transmitted data be D transmit , the encryption function is Encrypt transmit (D transmit ,K transmit ), where K transmit Encryption keys for the transport layer;

[0066] Through this encryption function, the original data D t ransmit is encrypted into ciphertext C t ransmit=Encrypt transmit (D transmit ,K transmit ) for transmission;

[0067] At the storage layer, a combination of file-level encryption and database field-level encryption based on the Key Management System (KMS) is used to address the storage formats and characteristics of different platforms.

[0068] For file storage, let the file be F and the file encryption function be Encrypt file (F,K file ), where K file is the file encryption key, and the encrypted file is F encrypted =Encrypt file (F,K file );

[0069] For database storage, let the field in the database table be Field and the field encryption function be Encrypt field (Field,K field ), where K field The encrypted field value is Eiold-E ∞ omot(Eiold,K...)Field encrypted =Encrypt field (Field,K field );

[0070] In terms of key management, a key hierarchy is introduced, and the master key is set as MasterKey. The transport layer encryption key K is generated by the key derivation function KDF (MasterKey, salt, info) transmit、文件加密密钥 K file and field encryption key K field wait;

[0071] Among them, salt is a randomly generated salt value used to increase the randomness of the key; info is additional data containing key information.

[0072] For example, when generating transport layer encryption keys, K transmit =KDF(MasterKey,salt transmit ,info transmit ), where salt t ransmit and info transmit It is the salt value and information related to transport layer encryption.

[0073] Step 4: Use hash algorithm to calculate the summary of data;

[0074] In step 4, let the data be D, the hash function be Hash(D), and the calculated data digest be Digest = Hash(D);

[0075] At the data receiving or consuming end, the hash digest of the received or read data is recalculated and compared with the original digest;

[0076] Define the integrity verification function IntegrityCheck(D received ,Digest original ), where D received For the received data, Digest original is a summary of the original data;

[0077] Calculating Digest received =Hash(D received ), if Digest received =Digest original , then IntegrityCheck(D received ,Digest original )=true, indicating that the data integrity is not damaged; otherwise, it returns false, indicating that the data may have been tampered with. For example, in a file transfer scenario, the sender calculates the hash digest of the file before transmitting it. original , and transmit the file and digest together. After the receiver receives the file, it calculates the hash digest of the file received ,By calling the integrity verification function, we can determine whether the file is complete during the transmission process.,For the data in the database, after each data update operation, the hash digest of the relevant data is recalculated and stored in the database metadata.,When reading data, the hash digest is also calculated and compared to verify the integrity of the data.

[0078] Step 5: Regularly perform security vulnerability checks on cross-platform applications and systems;

[0079] In step five, a combination of static analysis and dynamic analysis is used;

[0080] Static analysis analyzes the source code or binary code of an application to build an abstract model of the program's control flow graph, data flow graph, and call graph. It uses lexical analysis, syntax analysis, semantic analysis, and data flow analysis methods to identify potential vulnerabilities in the code, such as unvalidated input processing, buffer overflow, and null pointer dereference.

[0081] Suppose the static analysis tool is SAST, the input code is Code, the static analysis function is SAST(Code), and the output potential vulnerability set Vulnerabilities static =SAST(Code);

[0082] Dynamic analysis technology simulates various attack scenarios while the application is running, detecting runtime vulnerabilities such as SQL injection, session management flaws, and cross-site scripting attacks;

[0083] Let the dynamic analysis tool be DAST, the operating environment be Environment, the application be App, and the dynamic analysis function be DAST(App, Environment);

[0084] Output runtime vulnerability collection Vulnerabilities dynamic =DAST(App,Environment);

[0085] Combine the vulnerability sets obtained from static analysis and dynamic analysis to obtain the total vulnerability set Vulnerabilities = Vulnerabilities static ∪Vulnerabilities dynamic ;

[0086] For detected vulnerabilities, a vulnerability remediation priority ranking model is established. Each vulnerability is assigned a priority value, Priority(v), based on factors such as the severity of the vulnerability (e.g., severe impact on system availability, large-scale data leakage), the number of affected users, and the difficulty of remediation. v represents the vulnerability. Let the severity weight be w1, the number of affected users weight be w2, and the remediation difficulty weight be w3, with w1 + w2 + w3 = 1. The priority value calculation function is Priority(v) = w1 × Severity(v) + w2 × AffectedUsers(v) + w3 × Difficulty(v), where Severity(v) represents the severity score of vulnerability v, AffectedUsers(v) represents the number of users affected by vulnerability v, and Difficulty(v) represents the difficulty score of remediating vulnerability v. Vulnerabilities are ranked according to their priority values, with high-priority vulnerabilities being remediated first.

[0087] Step 6: Establish a cross-platform security audit system to audit user operations, data access records, security incidents, etc. on different platforms.

[0088] In step 6, let the audit log set be Log = {l1,l2,…,l q}, where l i Represents the i-th audit log;

[0089] Each audit log record contains the operation time Time(l i )、Operation User User(l i )、Operation objectObject(li )、Operation typeAction(l i ), operation result Result(l i ) and other information;

[0090] Construct a security audit query function AuditQuery(condition), where condition is the query condition, such as "query all read operations of financial data by user Zhang San in the past week." By traversing the audit log set Log, filter out the audit log subset Log that meets the query condition. result ={l j ∈Log|condition(l j )}, and returns it to the inquirer. At the same time, a real-time security monitoring mechanism is implemented.

[0091] Use machine learning algorithms to analyze audit log data in real time and build normal behavior models;

[0092] Assume that the normal behavior data set is NormalData={n1,n2,…,n r}, build a normal behavior model through clustering algorithms (such as K-Means clustering) or anomaly detection algorithms (such as IsolationForest) normal ;

[0093] In the real-time monitoring process, the newly generated operation behavior data new , calculate its difference with the normal behavior model Model normal Deviation(Data new ,Model normal );

[0094] If Deviation(Data new ,Model normal ) > threshold (where threshold is a preset threshold), the behavior is considered abnormal and a security alert is triggered. For example, if a user is detected to have frequently attempted to log in to different platforms within a short period of time, and the number of failed attempts exceeds the normal range, the real-time security monitoring mechanism can promptly detect and issue an alert, allowing security personnel to conduct further investigation and action.

[0095] Step 7: Regularly update and optimize cross-platform security policies.

[0096] In step 7, a security policy update team is established to collect the latest security vulnerability information, industry security standard changes, and legal and regulatory requirements. Based on the collected information, the effectiveness of the existing security policy is evaluated. Let the security policy set be Policy = {p1, p2, ..., pt}, for each security policy p i , define its evaluation function Evaluate(p i ,Information), where Information is the latest security related information collected. The evaluation function analyzes the security policy p i The evaluation result (p i ).

[0097] Update and optimize security policies based on the assessment results:

[0098] If EvaluationResult(p i )<acceptableLevel (acceptableLevel is the acceptable evaluation level threshold), then for security policy p i Modify or re-enact them. For example, when a new data leakage vulnerability targeting a specific platform emerges, check whether the existing data encryption and access control policies can prevent the vulnerability. If not, promptly adjust the encryption algorithm, access permission settings, and other security policy contents to improve the effectiveness of cross-platform data security management.

[0099] In summary,

[0100] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A cross-platform data security management method, characterized in that: The specific steps include: Step 1: First, carefully classify the data transmitted and stored across platforms, dividing it into different categories based on its sensitivity, purpose, and business domain. Step 2: Use a multi-factor authentication mechanism that combines passwords, SMS verification codes, fingerprint recognition, and facial recognition to verify user identity; Step 3: During data transmission and storage, layered encryption is used. For the transport layer, encryption protocols are used to encrypt data based on the network protocols supported by different platforms. Step 4: Use hash algorithm to calculate the summary of data; Step 5: Regularly perform security vulnerability checks on cross-platform applications and systems; Step 6: Establish a cross-platform security audit system to audit user operations, data access records, and security incidents on different platforms; Step 7: Regularly update and optimize cross-platform security policies.

2. A cross-platform data security management method according to claim 1, characterized in that: In step 1, carefully classify the data transmitted and stored across platforms. The data is divided into different categories based on its sensitivity, purpose, and business domain. Specifically, the following categories are included: Highly sensitive data, moderately sensitive data, general data (such as public product introductions and FAQs); Then, the data classification labeling model is introduced: let the data set be D = {d1, d2, ..., d n }, where d i Represents the i-th data object; For each data object d i , define its classification label set C i ={c i1 ,c i2 ,…,c im }, where c ij Indicates d i The j-th classification label; The classification model M is constructed by machine learning algorithm, and the feature vector F(d i ), output its classification label set C i , that is, C i =M(F(d i )).

3. A cross-platform data security management method according to claim 2, characterized in that: In step 2, let the user set be U = {u1,u2,…,u s }, for each user u i , define its authentication factor set A i ={a i1 ,a i2 ,…,a it }, where a ij Indicates u i The jth authentication factor; construct the identity authentication function Auth(u i ,A input ), where A input A set of authentication factors entered by the user; when Auth(u i ,A input )=true, it means user u i Pass identity authentication; Define the role set R = {r1, r2, ..., r p }, each character r j Assigned a set of permissions P j ={p j1 ,p j2 ,…,p jq }, where p jk Represents r j The kth permission of user u i With the character r j Through the assignment relationship Assign(u i ,r j ) to associate; let the access request be Request(u i ,o,a), where o represents the target object and a represents the operation; Access control decision function AccessControl(Request(u i ,o,a)) is calculated as follows: First, according to Assign(u i ,r j ) Find user u i The corresponding role set R user ={r j1 ,r j2 ,…,r jl }, then check each character r jm The permission set P jm Does it contain the permission to perform operation a on the target object o? If there is a r j m makes p jkm =(o,a), then AccessControl(Request(u i ,o,a))=true, access is allowed; otherwise, return false, access is denied.

4. A cross-platform data security management method according to claim 3, characterized in that: In step 3, let the transmitted data be D transmit , the encryption function is Encrypt transmit (D transmit ,K transmit ), where K transmit Encryption keys for the transport layer; Through this encryption function, the original data D t ransmit is encrypted into ciphertext C t ransmit=Encrypt transmit (D transmit ,K transmit ) for transmission; At the storage layer, a combination of file-level encryption based on a key management system and database field-level encryption is used to address the storage formats and characteristics of different platforms. For file storage, let the file be F and the file encryption function be Encrypt file (F,K file ), where K file is the file encryption key, and the encrypted file is F encrypted =Encrypt file (F,K file ); For database storage, let the field in the database table be Field and the field encryption function be Encrypt field (Field,K field ), where K field The encrypted field value is Eiold-E ∞ omot(Eiold,K...)Field encrypted =Encrypt field (Field,K field ); In terms of key management, a key hierarchy is introduced, and the master key is set as MasterKey. The transport layer encryption key K is generated by the key derivation function KDF (MasterKey, salt, info) transmit , file encryption key K file and field encryption key K field ; Among them, salt is a randomly generated salt value used to increase the randomness of the key; info is additional data containing key information.

5. A cross-platform data security management method according to claim 4, characterized in that: In step 4, let the data be D, the hash function be Hash(D), and the calculated data digest be Digest = Hash(D); At the data receiving or consuming end, the hash digest of the received or read data is recalculated and compared with the original digest; Define the integrity verification function IntegrityCheck(D received ,Digest original ), where D received For the received data, Digest original is a summary of the original data; Calculating Digest received =Hash(D received ), if Digest received =Digest original , then IntegrityCheck(D received ,Digest original )=true, indicating that the data integrity is not damaged; otherwise, it returns false, indicating that the data has been tampered with.

6. A cross-platform data security management method according to claim 5, characterized in that: In step five, a combination of static analysis and dynamic analysis is used; Static analysis analyzes the source code or binary code of an application to construct an abstract model of the program's control flow graph, data flow graph, and call graph. It uses lexical analysis, syntax analysis, semantic analysis, and data flow analysis to identify potential vulnerabilities in the code. Suppose the static analysis tool is SAST, the input code is Code, the static analysis function is SAST(Code), and the output potential vulnerability set Vulnerabilities static =SAST(Code); Dynamic analysis technology simulates attack scenarios while the application is running to detect SQL injection, session management flaws, and cross-site scripting runtime vulnerabilities; Let the dynamic analysis tool be DAST, the operating environment be Environment, the application be App, and the dynamic analysis function be DAST(App, Environment); Output runtime vulnerability collection Vulnerabilities dynamic =DAST(App,Environment); Combine the vulnerability sets obtained from static analysis and dynamic analysis to obtain the total vulnerability set Vulnerabilities = Vulnerabilities static ∪Vulnerabilities dynamic ; For detected vulnerabilities, establish a vulnerability repair priority ranking model.

7. A cross-platform data security management method according to claim 6, characterized in that: In step 6, let the audit log set be Log = {l1,l2,…,l q }, where l i Represents the i-th audit log; Each audit log record contains the operation time Time(l i )、Operation User User(l i )、Operation objectObject(l i )、Operation typeAction(l i ), operation result Result(l i )information; Construct the security audit query function AuditQuery(condition), where condition is the query condition; Use machine learning algorithms to analyze audit log data in real time and build normal behavior models; Assume that the normal behavior data set is NormalData={n1,n2,…,n r }, build a normal behavior model through clustering algorithm or anomaly detection algorithm normal ; In the real-time monitoring process, the newly generated operation behavior data new , calculate its difference with the normal behavior model Model normal Deviation(Data new ,Model normal ); If Deviation(Data new ,Model normal )>threshold, the behavior is determined to be abnormal and a security alert is triggered.

8. A cross-platform data security management method according to claim 7, characterized in that: In step seven, a security policy update team is established to collect the latest security vulnerability information, changes in industry security standards, and legal and regulatory requirements. Based on this information, the team will evaluate the effectiveness of the existing security policy.

Images