A data security monitoring method, device and medium

Abstract

The application provides a data security monitoring method and device and a medium, and relates to the technical field of data processing.The method comprises the following steps: a data user sends an acquisition request of a target field to a third party; the third party fills each encrypted field value corresponding to the target field into an intermediate field value with a fixed length; the third party splices the intermediate field value converted into an integer representation into a row vector; and the third party uses an invertible matrix to operate the row vector to obtain transmission data; the third party sends the transmission data, the invertible matrix after encryption and the key of the encryption operation to the data user; the data user decrypts the invertible matrix after encryption based on the key of the encryption operation, and uses an original key to decrypt the encrypted field value, so as to obtain a decrypted field value corresponding to the target field value; and the data user uses the decrypted field value to obtain an answer to a target question, thereby improving the use safety of an original data table.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a data security monitoring method, device and medium. BACKGROUND

[0002] In today's digital age, the role of data becomes particularly important. In the process of circulation, data faces serious security challenges. For a problem, multiple data providers' data may be used to connect multiple platforms' data, which is beneficial to the solution of the problem, but the security of data becomes particularly important. If the data of multiple data providers is directly placed on a third-party platform, the data providers may not trust the third party and worry about the misuse of data by the third-party platform; if the data usage party directly obtains data from multiple data providers, it is not convenient and the data is easy to leak. Therefore, how to ensure the safe use of data has been a problem to be explored. SUMMARY

[0003] In view of the above technical problems, the technical scheme adopted by the present application is:

[0004] According to the first aspect of the present application, a data security monitoring method is provided, which comprises the following steps:

[0005] The data provider encrypts the field value list corresponding to each field in the original data table, obtains the encrypted field value list and sends the encrypted field value list to the third party for storage; the field value list includes a plurality of field values;

[0006] The data usage party sends a request for obtaining a target field required by a target problem to the third party;

[0007] The third party fills each encrypted field value corresponding to the target field into an intermediate field value with a fixed length; and converts the intermediate field value into an integer representation; the fixed length is the maximum value in the byte length of the encrypted field value;

[0008] The third party splices the intermediate field value converted into an integer representation into a row vector; and uses an invertible matrix to operate the row vector to obtain transmission data, the number of rows of the invertible matrix being equal to the number of columns of the row vector;

[0009] The third party sends the transmission data, the length of the encrypted field value corresponding to the target field, the invertible matrix after the encryption operation and the encryption operation key to the data usage party;

[0010] The data usage party decrypts the invertible matrix after the encryption operation based on the encryption operation key to obtain the invertible matrix; and obtains the encrypted field value corresponding to the target field based on the invertible matrix, the transmission data and the length of the encrypted field value corresponding to the target field;

[0011] The data user obtains an original key of the encrypted field value from the data provider, and decrypts the encrypted field value using the original key to obtain a decrypted field value corresponding to the target field value;

[0012] The data user obtains an answer to the target question using the decrypted field value, and sends the encrypted answer to the third party; and the third party monitors the encrypted field value list and the encrypted answer.

[0013] According to a second aspect of the present application, a non-transitory computer readable storage medium is provided, which stores a computer program, and the computer program is loaded and executed by a processor to implement the method described above.

[0014] According to a third aspect of the present application, an electronic device is provided, which comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, and the processor implements the method described above when executing the computer program.

[0015] The present application has at least the following beneficial effects: the data provider encrypts the field value list corresponding to each field in the original data table, obtains the encrypted field value list, and sends the encrypted field value list to the third party for storage; the data user sends a request for obtaining a target field required by a target question to the third party; the third party fills each encrypted field value corresponding to the target field into an intermediate field value of a fixed length; converts the intermediate field value into an integer representation; splices the intermediate field value converted into the integer representation into a row vector; and obtains transmission data by operating the row vector using an invertible matrix. The third party sends the transmission data, the length of the encrypted field value corresponding to the target field, the invertible matrix after the encryption operation, and the key of the encryption operation to the data user. The data user decrypts the invertible matrix after the encryption operation based on the key of the encryption operation to obtain the invertible matrix; and obtains the encrypted field value corresponding to the target field based on the invertible matrix, the transmission data, and the length of the encrypted field value corresponding to the target field. The data user obtains the original key of the encrypted field value from the data provider, and decrypts the encrypted field value using the original key to obtain a decrypted field value corresponding to the target field value. The data user obtains an answer to the target question using the decrypted field value, and sends the encrypted answer to the third party; and the third party monitors the encrypted field value list and the encrypted answer. The present application encrypts the original data table of the data provider, and stores the encrypted data in the third party. The original key is provided from the data provider to the data user. The transmission security of the original data table is monitored in the whole process. The encrypted field value is operated by the third party and then transmitted to the data user, which further improves the use security of the original data table. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description only show some of the embodiments of the present application, and all other drawings obtained by those skilled in the art without creative effort based on these drawings also belong to the protection scope of the present application.

[0017] Figure 1 The flow chart of the data security monitoring method provided by the embodiment of the present application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described in the following with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative effort also belong to the protection scope of the present application.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar tasks, and do not necessarily mean a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0020] The embodiment of the present application provides a data security monitoring method, as shown in the figure, the method comprises the following steps: Figure 1

[0021] S100, the data provider encrypts the field value list corresponding to each field in the original data table, obtains the encrypted field value list and sends the encrypted field value list to the third party for storage; the field value list includes a plurality of field values.

[0022] Specifically, the data provider sends the encrypted field value list to the third party through a secure channel (such as HTTPS / TLS), and the third party stores the encrypted field value list and indexes by field. The data provider stores the original key, which is sent to the data user when requested.

[0023] S200, the data user sends a request for obtaining the target field required by the target problem to the third party.​

[0024] S300, the third party fills each encrypted field value corresponding to the target field with an intermediate field value of fixed length; and converts the intermediate field value into an integer representation.

[0025] Specifically, the length of each encrypted field value is recorded, each encrypted field value is converted into an integer representation, if the encrypted field value is less than the fixed length, bytes are supplemented at the end of the encrypted field value until the fixed length. If the encrypted field value is equal to the fixed length, no change is made.

[0026] The skilled person knows that any method of converting the intermediate field value into an integer representation in the prior art belongs to the protection scope of the present application, which will not be described here. The conversion of the intermediate field value into an integer is a basic and widely used prior art in cryptography. Many encryption algorithms are based on number theory and modular operation, and are executed in the integer domain. For example, the ciphertext generated by asymmetric encryption is essentially a large integer. The fixed length is equal to the maximum value of the byte length of all encrypted field values.

[0027] S400, the third party concatenates the intermediate field values converted into integer representations into a row vector; and performs operation on the row vector using a reversible matrix to obtain transmission data, the number of rows of the reversible matrix being equal to the number of columns of the row vector.

[0028] In an embodiment of the present application, all intermediate field values converted into integers are concatenated into a row vector; in another embodiment of the present application, the intermediate field values corresponding to a target field are concatenated into a row vector.

[0029] S500, the third party sends the transmission data, the length of the encrypted field value corresponding to the target field, the reversible matrix after the encryption operation, and the key of the encryption operation to the data user.

[0030] In another embodiment of the present application, S500 is replaced by: the third party sends the transmission data, the metadata after the encryption operation, the reversible matrix after the encryption operation, and the key of the encryption operation to the data user, the metadata at least including the length of the encrypted field value corresponding to the target field.

[0031] S600, the data user decrypts the reversible matrix after the encryption operation based on the key of the encryption operation to obtain the reversible matrix; and obtains the encrypted field value corresponding to the target field based on the reversible matrix, the transmission data, and the length of the encrypted field value corresponding to the target field.

[0032] S700, the data user obtains the original key of the encrypted field value from the data provider, and decrypts the encrypted field value using the original key to obtain the decrypted field value corresponding to the target field value.

[0033] Specifically, the third direction data provider sends a request for the data user to use the original key of the encrypted field value, the data provider audits the data user, and if the audit is successful, the third party sends the original key of the encrypted field value to the data user.

[0034] S800, the data user uses the decrypted field value to obtain the answer to the target question, and sends the encrypted answer to the third party; the third party monitors the encrypted field value list and the encrypted answer. Specifically, the third party monitors whether the encrypted field value list has been encrypted, and monitors whether the encrypted answer has been encrypted.

[0035] In summary, the data provider encrypts the field value list corresponding to each field in the original data table, obtains the encrypted field value list and sends it to the third party for storage, the data user sends a request for obtaining the target field required by the target question to the third party, the third party fills each encrypted field value corresponding to the target field into a fixed-length intermediate field value; and converts the intermediate field value into an integer representation, the third party concatenates the intermediate field value converted into an integer representation into a row vector; and uses an invertible matrix to operate the row vector to obtain transmission data, the third party sends the transmission data, the length of the encrypted field value corresponding to the target field, the invertible matrix after the encryption operation and the key of the encryption operation to the data user, the data user decrypts the invertible matrix after the encryption operation based on the key of the encryption operation to obtain the invertible matrix; and based on the invertible matrix, the transmission data and the length of the encrypted field value corresponding to the target field, obtains the encrypted field value corresponding to the target field, the data user obtains the original key of the encrypted field value from the data provider, and decrypts the encrypted field value using the original key to obtain the decrypted field value corresponding to the target field value, the data user uses the decrypted field value to obtain the answer to the target question, and sends the encrypted answer to the third party; the third party monitors the encrypted field value list and the encrypted answer, the original data table of the data provider is encrypted in the application, and the encrypted data is stored in the third party, the original key is provided from the data provider to the data user, the transmission security of the original data table is monitored in the whole process, and the third party transmits the encrypted field value to the data user after operation, which further improves the use security of the original data table.

[0036] Specifically, S400 uses an invertible matrix to operate the row vector to obtain transmission data, including:

[0037] S410, generating a reversible matrix M, the number of rows of the reversible matrix is equal to the number of columns of the row vector, the reversible matrix is reversible under mod p, and the prime number p is greater than 2 raised to the power of x, x is equal to 8 times b, b is a fixed length; mod is a modulo operation. Specifically, the number of rows of the reversible matrix is equal to the number of columns of the reversible matrix, which is equal to the number of columns of the row vector. It can be understood that the prime number p>2 8b A large enough p is used to avoid integer truncation caused by the modulo operation, and the integer range [0, 2 8b -1] is completely covered by p, without information loss, so that the data user can recover the encrypted field value. The reversible matrix is reversible under mod p, so that the integer ring of mod p constitutes a field.

[0038] Specifically, the data provider, the data user and the third party use the same byte sequence.

[0039] In an embodiment of the present application, the prime number p is equal to 2 raised to the power of y, y is equal to 8 times a, a is equal to the sum of b and 1, and p is set to 2 raised to the power of y, which is 8 times more than the number of bits, to ensure security.

[0040] S420, obtaining transmission data, the transmission data D is equal to the product of the row vector C, the reversible matrix M and mod p. D=CxMxmod p.

[0041] Further, S600 obtains the encrypted field value corresponding to the target field based on the reversible matrix, the transmission data and the length of the encrypted field value corresponding to the target field, and further comprises:

[0042] S610, obtaining the inverse matrix M -1 of the reversible matrix M.

[0043] S620, obtaining the row vector C, which is equal to the product of the transmission data, the inverse matrix of the reversible matrix and mod p. C=DxM -1 xmod p.

[0044] S630, obtaining the encrypted field value corresponding to the target field according to the length of the encrypted field value and the row vector.

[0045] Specifically, based on the row vector and the fixed length, an intermediate field value represented by an integer is obtained, and the intermediate field value is segmented based on the length of the encrypted field value to obtain the encrypted field value.

[0046] In summary, the third party generates a reversible matrix and obtains transmission data, the data user obtains the inverse matrix of the reversible matrix and obtains the row vector based on the inverse matrix, and the secure transmission of the transmission data is realized through p and the reversible matrix.

[0047] Specifically, the target field required for the target problem is obtained by the following steps:

[0048] Based on the preset prompt template, the preset prompt template and the target question are sent to the large model to obtain sub-questions of the target question output by the large model.

[0049] In an exemplary description of the present application, the preset prompt template is: as a senior data analyst, please split the target question into implementable sub-questions: target question: output requirements:

[0050] 1. Hierarchical decomposition (main problem→key factor→quantifiable sub-problem);

[0051] 2. Label the data type required by each sub-question (behavior / attribute / environment).

[0052] The sub-questions of the target question are sent to the large model to obtain the required fields of each sub-question, and the required fields of each sub-question are used as target fields.

[0053] Further, after obtaining the target fields required by the target question, it also includes: obtaining the field matching conditions of the target fields and the target function for solving the target question.

[0054] Further, after obtaining the target fields required by the target question, it also includes:

[0055] The final field value is obtained by screening the decryption field value corresponding to the target field using the field matching condition of the target field.

[0056] Based on the final field value and the target function, the answer to the target question is obtained.

[0057] Specifically, in S100, the field value list corresponding to each field in the original data table is encrypted to obtain an encrypted field value list, which also includes:

[0058] S110, extract the field value list according to the field from the original data table. In an exemplary description of the present application, the field "age", the field value list V corresponding to this field is {20, 30, 40}.

[0059] S120, generate an original key for each field. Specifically, the data provider generates a unique encryption key for each field, and in an embodiment of the present application, an original key for the field "age" is generated using AES-256.

[0060] At S130, each field value is encrypted based on the original key to obtain an encrypted field value, and the encrypted field values are assembled into an encrypted field value list. Specifically, each field value is serialized into bytes, and each byte is encrypted using AES-256 to obtain an encrypted field value. In an exemplary description of the present application, the field value list V={20, 30, 40} is encrypted: 20 is encrypted to obtain A1, 30 is encrypted to obtain A2, and 40 is encrypted to obtain A3, and the encrypted values are assembled to obtain the encrypted field value list {A1, A2, A3}.

[0061] In summary, the field value list is extracted from the original data table according to the field, the original key is generated for each field, each field value is encrypted based on the original key to obtain an encrypted field value, and the encrypted field values are assembled into an encrypted field value list.

[0062] Embodiments of the present application also provide a non-transitory computer readable storage medium, which can be arranged in an electronic device to save a computer program related to a method in the method embodiments, and the computer program is loaded and executed by the processor to implement the method provided by the above embodiments.

[0063] Embodiments of the present application also provide an electronic device, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, and the processor implements the method provided by the above embodiments when executing the computer program.

[0064] Embodiments of the present application also provide a computer program product comprising program code for causing an electronic device to perform the steps of the methods according to the various exemplary embodiments of the present application described above in the specification when the program product is executed on the electronic device.

[0065] Although some specific embodiments of the present application have been described in detail above, those skilled in the art should understand that the above examples are only for illustration, not for limiting the scope of the present application. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present application.

Claims

1. A method of monitoring data security, characterized by, The method comprises the following steps: The data provider encrypts the field value list corresponding to each field in the original data table, obtains the encrypted field value list, and sends the encrypted field value list to the third party for storage; the field value list comprises a plurality of field values; The data user sends a request for obtaining a target field required by a target question to the third party; The third party fills each encrypted field value corresponding to the target field into an intermediate field value with a fixed length, and converts the intermediate field value into an integer representation; the fixed length is the maximum value in the byte length of the encrypted field value; The third party splices the intermediate field value converted into the integer representation into a row vector, and obtains transmission data by performing operation on the row vector using a reversible matrix, the number of rows of the reversible matrix being equal to the number of columns of the row vector; The third party sends the transmission data, the length of the encrypted field value corresponding to the target field, the reversible matrix after the encryption operation, and the key of the encryption operation to the data user; The data user decrypts the reversible matrix after the encryption operation based on the key of the encryption operation, obtains the reversible matrix, and obtains the encrypted field value corresponding to the target field based on the reversible matrix, the transmission data, and the length of the encrypted field value corresponding to the target field; The data user obtains the original key of the encrypted field value from the data provider, and decrypts the encrypted field value using the original key to obtain a decrypted field value corresponding to the target field value; The data user obtains an answer to the target question using the decrypted field value, and sends the encrypted answer to the third party; The third party monitors the encrypted field value list and the encrypted answer.

2. The data security monitoring method of claim 1, wherein, The operation on the row vector using the reversible matrix to obtain the transmission data comprises: Generating the reversible matrix, the number of rows of the reversible matrix being equal to the number of columns of the row vector, the reversible matrix being reversible under mod p, and the prime number p being greater than 2 raised to the power of x, x being equal to 8 times b, b being the fixed length; mod is a modulus operation; Obtaining the transmission data, the transmission data being equal to the product of the row vector, the reversible matrix, and mod p.

3. The data security monitoring method of claim 2, wherein, The obtaining of the encrypted field value corresponding to the target field based on the reversible matrix, the transmission data, and the length of the encrypted field value corresponding to the target field further comprises: Obtaining the inverse matrix of the reversible matrix; Obtaining the row vector, the row vector being equal to the product of the transmission data, the inverse matrix of the reversible matrix, and mod p; Obtaining the encrypted field value corresponding to the target field according to the length of the encrypted field value and the row vector.

4. The data security monitoring method of claim 1, wherein, The target field required by the target question is obtained through the following steps: Based on the preset prompt word template, the preset prompt word template and the target question are sent to the large model to obtain the sub-questions of the target question output by the large model; The sub-questions of the target question are sent to the large model to obtain the required fields of each sub-question, and the required fields of each sub-question are taken as the target field.

5. The data security monitoring method of claim 4, wherein, After obtaining the target field required by the target question, the field matching condition of the target field and the target function for solving the target question are obtained.

6. The data security monitoring method of claim 5, wherein, After obtaining the target field required by the target question, the following steps are further included: The decrypted field value corresponding to the target field is filtered using the field matching condition of the target field to obtain a final field value; The answer to the target question is obtained based on the final field value and the target function.

7. The data security monitoring method of claim 1, wherein, The method further comprises encrypting a field value list corresponding to each field in the original data table to obtain an encrypted field value list, and comprises the following steps: extracting the field value list according to the field from the original data table; generating an original key for each field; encrypting each field value based on the original key to obtain an encrypted field value, and assembling the encrypted field values into an encrypted field value list.

8. The data security monitoring method of claim 2, wherein, The prime number p is equal to 2 raised to the power of y, y is equal to 8 times a, and a is equal to the sum of b and 1.

9. A non-transitory computer-readable storage medium, comprising: The storage medium stores a computer program, and the computer program is loaded and executed by the processor to implement the data security monitoring method of any one of claims 1-8.

10. An electronic device comprising: Processor, memory and computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the data security monitoring method of any one of claims 1-8.

Images