Information encryption management method and system

Abstract

The invention belongs to the technical field of data security and passwords, and provides an information encryption management method and system. After the system receives the access request, calling user historical behaviors, and calculating behavior baseline stability; obtaining a time deviation degree based on the difference between the current access time and the historical time distribution, obtaining a geographic deviation degree based on the difference between the source address and the geographic attribution, combining the time deviation degree and the geographic deviation degree into a comprehensive deviation degree, and modulating according to the behavior baseline stability to obtain a context disturbance factor. Fusing the context disturbance factor with the static risk index of the target data to obtain a session risk calibration value; and mapping the key length to the step set according to the session risk calibration value to obtain a final key length, and performing encryption. According to the method, the encryption strength can be adaptively improved when abnormal access occurs, the performance is kept under normal access, and the method has real-time performance, context sensing and good generalization ability.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security and cryptography, and in particular to an information encryption management method and system. BACKGROUND

[0002] Existing encryption strategies are mostly based on static rules or fixed key lengths, which are difficult to reflect the dynamic changes of user access behavior in time, space, device and other dimensions. Static strategies are slow to respond when abnormal access occurs, and may be overly conservative under normal access, making it difficult to balance "security-performance". Traditional anomaly recognition relies on fixed rule libraries, which are insufficient in the face of new threats and cross-scene migration capabilities.

[0003] Therefore, there is an urgent need for a unified quantitative framework that combines historical behavior baseline and current access disturbance, couples dynamic risk with static sensitivity of accessed data, and then automatically and finely determines the encryption strength of this time. SUMMARY

[0004] To solve the technical problem of static encryption and context disconnection that is difficult to balance security performance, the present application provides the following technical solutions.

[0005] An information encryption management method, comprising: receiving an access request containing a user identifier, a request time, a source address and a device fingerprint, and obtaining a set of historical access times and a set of historical source addresses of the user; obtaining a behavior baseline stability based on the weighted combination of historical access time dispersion, address change degree and geographical dispersion; calculating time deviation and geographical deviation and combining them into a comprehensive deviation according to the weight; modulating the comprehensive deviation according to the behavior baseline stability to obtain a context disturbance factor; fusing the context disturbance factor with the target data static risk index to generate a session risk calibration value; mapping the key length to a preset ladder set according to the session risk calibration value to obtain the final key length, and calling an encryption algorithm to complete the encryption of the target data.

[0006] Preferably, the historical access time dispersion is obtained by bucketing statistics or kernel density estimation on the historical time axis, and the time deviation is determined based on the surprise degree of the current access time in the historical time distribution or the statistical distance from the historical time distribution.

[0007] Preferably, the geographical deviation degree is obtained by calculating the distance between the longitude and latitude obtained by the current source address resolution and the geographical centroid or main distribution cluster of the historical source location, or by calculating the city, country, autonomous region distribution difference; the weight of the geographical deviation degree is reduced in a mobile cellular or public network environment, and the weight is increased in a fixed private line or data center environment.

[0008] Preferably, the historical time dispersion degree, address change degree and geographical dispersion degree are subjected to interval normalization processing before being synthesized to obtain the behavior baseline stability; and the weight parameters for synthesizing the behavior baseline stability and the comprehensive deviation degree are adaptively updated according to historical samples through offline training or online learning.

[0009] Preferably, the generation of the session risk calibration value suppresses extreme abnormalities, amplifies the medium-low interval, and sets at least two risk threshold intervals to trigger different key strength and optional secondary authentication strategies.

[0010] Preferably, the key length ladder set includes at least two groups of symmetric cipher strength, preferably including AES-128, AES-192, AES-256 or a national cipher algorithm with the same strength; and the key length ladder set can be finely adjusted by the key derivation strength, rotation period or iteration number under the same algorithm.

[0011] Preferably, for consecutive requests in the same session, the session risk calibration value is smoothed based on a sliding window; when the session risk calibration value rises and crosses the threshold, the final key length is immediately upgraded; when the session risk calibration value falls, the downgrading is performed by using a delay or hysteresis strategy, so as to avoid frequent jitter.

[0012] Preferably, after the final key length is generated, the minimum strength, key update period and random source compliance are checked, and if the check fails, a strategy override is performed; and the decision trajectory of the behavior baseline stability, the time deviation degree, the geographical deviation degree, the context disturbance factor, the session risk calibration value and the final key length is recorded, which is used for auditing, tracing and strategy optimization.

[0013] In a second aspect, an information encryption management system includes a processor and a memory, and the memory stores computer program instructions which, when executed by the processor, implement the information encryption management method.

[0014] The present application has the following beneficial effects: The present application improves the calculation efficiency and stability by quantifying the context disturbance in real time for each access and dynamically determining the encryption strength; and improves the context perception capability by introducing the time, address and geographical three-dimensional dispersion to form the behavior baseline stability, forming a closed loop from the user behavior baseline to the current deviation and then to the session risk. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 This is a method flow chart of steps S1 to S5 in an information encryption management method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0017] Reference Figure 1 , an information encryption management method includes steps S1 to S5, specifically as follows: S1: Receive an access request containing user ID, request time, source address, and device fingerprint, and obtain the user's historical access time set and historical source address set.

[0018] In an embodiment of the present invention, after receiving an access request containing user identification, request time, source address and device fingerprint, the system extracts fields such as user identification, request time, source IP and device fingerprint from historical access logs such as access gateways, business applications and security audits, and then obtains the user's historical access time set and historical source location set, aggregates and deduplicates by session ID and user ID, unifies the timeline and coding specifications, eliminates obvious crawler and noise samples, and forms a traceable and consistent clean data set as input for subsequent calculations.

[0019] The system standardizes all time fields to UTC while retaining the original time zone for auditing purposes. It also derives features such as hour, weekday, and is_holiday from timestamps, and constructs individual historical time series using a rolling historical window (preferably 90 days) to ensure comparability and accumulativeness across regions and schedules. For historical records, the system assigns exponentially decaying weights based on the time distance from the current moment to emphasize the representativeness of recent behavior, improve the model's adaptability to changing behavioral patterns, and avoid lags caused by over-reliance on long-term data. The system parses the source IP address into an ASN, / 24 subnet, longitude and latitude, and city / country code, and identifies whether it is in a shared egress, proxy, or VPN scenario. Such network features are appropriately downgraded in subsequent measurements to avoid misidentifying infrastructure characteristics as anomalies. The system parses the source IP address into an ASN, / 24 subnet, longitude and latitude, and city / country code, and identifies whether it is in a shared egress, proxy, or VPN scenario. Such network features are appropriately downgraded in subsequent measurements to avoid misidentifying infrastructure characteristics as anomalies. The system constructs a device vector using browser fingerprints, TLS fingerprints, OS information, and jailbreak or root status, and calculates similarity with the user's daily devices in the past seven days as an additional clue for subsequent risk assessment; when the similarity is low, the system will pay more attention to the joint deviation of time and geographic dimensions.

[0020] S2: The behavioral baseline stability is obtained by weighted synthesis based on the historical access time dispersion, address change and geographical dispersion.

[0021] In one embodiment, by performing bucket statistics or kernel density estimation on the historical access time axis, the distribution of the historical access time in each time period is obtained, and then the dispersion of the historical access time is calculated.

[0022] In one embodiment, the frequencies of occurrence and switching of different source addresses (such as / 24 subnets, ASNs, etc.) in historical accesses are counted, and the address change degree is calculated by linear combination or weighted transfer rate.

[0023] In one embodiment, the source addresses of historical visits are geographically clustered (eg, using the DBSCAN / HDBSCAN algorithm), and the geographical dispersion is calculated by combining the average radius with the inter-cluster distance or using the complement of the silhouette coefficient.

[0024] In one embodiment, after interval normalization processing, the historical access time dispersion, address change, and geographic dispersion are synthesized according to preset weight parameters to obtain the behavioral baseline stability, which reflects the stability and regularity of the user's historical access behavior. It can be expressed as: Where, is the user's behavioral baseline stability, The weight of the historical access time dispersion, is the historical access time dispersion, is the weight of the address change degree, is the address change degree, is the weight of geographical dispersion, is the geographical dispersion.

[0025] In addition, when individual historical samples are sparse or missing, the system uses the organization / department template distribution instead. The value is set to a neutral to low value to adopt a conservative strategy; quantile clipping and missing value interpolation are performed at the same time to ensure that the evaluation remains robust and reliable during the cold start phase.

[0026] S3: Calculate the time deviation and geographical deviation and combine them according to the weights to form a comprehensive deviation.

[0027] In one embodiment, the time deviation is calculated based on the surprise (i.e., low probability) of the current access time in the historical time distribution or the statistical distance (such as KL divergence or Euclidean distance) from the historical time distribution. This value reflects the degree of deviation between the current access time and the user's historical schedule. For special times such as holidays and nighttime, separate templates are created to reduce false positives.

[0028] In one embodiment, the geographic deviation is calculated by calculating the distance between the longitude and latitude obtained by parsing the current source address and the geographic centroid or main distribution cluster of the historical source, or by calculating the distribution differences of cities, countries, and autonomous regions.

[0029] At the same time, the system automatically adjusts the weight of geographic deviation according to the network environment (such as mobile cellular, public Wi-Fi, fixed dedicated line, etc.).

[0030] In one embodiment, the temporal deviation and the geographical deviation are linearly combined according to preset weight parameters to obtain a comprehensive deviation. This value comprehensively reflects the overall abnormality of the current access in both time and space dimensions. That is, it satisfies the following relationship: Where, is the comprehensive deviation, is the weight of time deviation, is the time deviation, is the weight of geographic deviation, is the geographical deviation.

[0031] S3: Modulate the comprehensive deviation according to the behavioral baseline stability to obtain a context disturbance factor.

[0032] In the embodiments of the present application, the context disturbance factor is generated by modulating the comprehensive deviation degree according to the behavior baseline stability. Specifically, when the behavior baseline stability is small, it indicates that the user's historical behavior is volatile, and at this time the context disturbance factor responds more strongly to the anomaly; on the contrary, when the behavior baseline stability is large, it indicates that the user's historical behavior is stable, and at this time the context disturbance factor responds weakly to the anomaly. In this way, the system can achieve more cautious handling of unstable users and not overreact to stable users.

[0033] The above context disturbance factor is expressed by a relationship as follows: In the formula, is the context disturbance factor, is the comprehensive deviation degree, is the behavior baseline stability of the user, and k is a hyperparameter, is the exponential function with e as the base.

[0034] In addition, the static risk index of the target data is obtained from the data classification management platform, and a weight is added according to the business scenario (such as data landing, transmission or backup). The higher the static risk index, the higher the session risk triggered by the same context disturbance.

[0035] S4: The context disturbance factor is fused with the target data static risk index to generate a session risk calibration value.

[0036] In one embodiment, the context disturbance factor is fused with the target data static risk index obtained from the data classification / policy platform to generate a session risk calibration value. In the fusion process, the system can adopt a moderate growth strategy to avoid the upper bound from being saturated too quickly, ensuring that the session risk calibration value can accurately reflect the risk level of the current access. At the same time, the system sets at least two risk threshold intervals to trigger different key strengths and optional secondary authentication strategies.

[0037] The above session risk calibration value satisfies the relationship as follows: In the formula, is the session risk calibration value, is the context disturbance factor, is the static risk index.

[0038] In order to reduce the influence of fluctuations in a short period of time on the key strength, the continuous risk values in the same session are smoothed by exponential weighted moving average. When the risk value rises across the threshold, the key strength immediately rises, and when the risk value drops, a delayed rollback strategy is adopted to avoid frequent switching.

[0039] In addition, the dominant factors and key intermediate variables (such as time deviation, geographical deviation, etc.) in the session risk assessment process are recorded to form a traceable decision path. These records can be used for real-time linkage of access control and post-audit analysis, realizing governance closed loop and strategy optimization.

[0040] S5: mapping the key length to a preset set of steps according to the session risk rating value to obtain a final key length, and calling an encryption algorithm to complete encryption of the target data.

[0041] In one embodiment, the key length is mapped to a preset set of steps (such as AES-128, AES-192, AES-256, or a national encryption algorithm with the same strength) according to the session risk rating value. During the mapping process, fine-grained adjustment can be made according to actual needs through key derivation strength, rotation period, or iteration number, etc.

[0042] Further calling an encryption algorithm library, generating a session key according to the final determined key length, and encrypting the target data. During the encryption process, the minimum strength, key update period, and random source compliance are checked to ensure the compliance and robustness of the encryption operation.

[0043] The key length is expressed by the following relationship: In the formula, is the final key length, is the original key length, is the session risk rating value, is a hyperparameter.

[0044] It should be noted that the weights, parameters, and risk thresholds involved in each of the above steps are jointly optimized, and the combination of offline training and online feedback is adopted to minimize the calculation overhead and latency under the premise of achieving a certain safety recall rate, and version management and regular retraining are used to maintain coordination with business scenarios.

[0045] The system includes a processor and a memory, and the memory stores computer program instructions which, when executed by the processor, implement the information encryption management method according to the first aspect of the application.

[0046] The system also includes a communication bus and a communication interface, as well as other components well known to those skilled in the art, the settings and functions of which are known in the art, and therefore will not be described here.

[0047] This paper dynamically adjusts encryption strength by establishing a baseline stability of user behavior, calculating a comprehensive deviation, and generating a contextual perturbation factor and session risk calibration value. This method not only improves the system's real-time and context-aware capabilities, but also adaptively increases encryption strength when abnormal access occurs, maintaining system performance under normal access conditions, and providing a strong guarantee for data security in intelligent warehousing platforms.

[0048] It should be noted that those skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the appended claims.

Claims

1. An information encryption management method, characterized in that: include: Receive an access request containing a user ID, request time, source address, and device fingerprint, and obtain the user's historical access time set and historical source address set; The behavioral baseline stability is obtained by weighted synthesis based on the historical access time dispersion, address change and geographical dispersion; Calculate the time deviation and geographical deviation and combine them according to the weights to form a comprehensive deviation; Modulating the comprehensive deviation according to the behavioral baseline stability to obtain a contextual disturbance factor; The context perturbation factor is integrated with the static risk index of the target data to generate a session risk calibration value. Based on the session risk calibration value, the key length is mapped to a preset step set to obtain the final key length, and the encryption algorithm is called to complete the encryption of the target data.

2. The information encryption management method according to claim 1, characterized in that: The historical access time dispersion is obtained by performing bucket statistics or kernel density estimation on the historical time axis, and the time deviation is determined based on the surprise of the current access time in the historical time distribution or the statistical distance from the historical time distribution.

3. The information encryption management method according to claim 1, characterized in that: The geographic deviation is obtained by calculating the distance between the longitude and latitude obtained by parsing the current source address and the geographic centroid or main distribution cluster of the historical source, or by calculating the distribution differences of cities, countries, and autonomous regions; the weight of the geographic deviation is reduced in a mobile cellular or public network environment, and increased in a fixed dedicated line or data center environment.

4. The information encryption management method according to claim 1, characterized in that: The historical time dispersion, address change and geographic dispersion are interval-normalized before synthesizing the behavioral baseline stability; the weight parameters used for synthesizing the behavioral baseline stability and comprehensive deviation are adaptively updated through offline training or online learning based on historical samples.

5. The information encryption management method according to claim 1, characterized in that: The generation of the session risk calibration value suppresses extreme anomalies, amplifies medium and low intervals, and sets at least two risk threshold intervals to trigger different key strengths and optional secondary authentication strategies.

6. The information encryption management method according to claim 1, characterized in that: The key length ladder set includes at least two levels of block cipher strength, preferably including AES-128, AES-192, AES-256 or equally strong national secret algorithm levels; and can be fine-grainedly adjusted through key derivation strength, rotation period or number of iterations under the same algorithm.

7. The information encryption management method according to claim 1, characterized in that: For continuous requests within the same session, the session risk calibration value is smoothed based on a sliding window; when the session risk calibration value rises and crosses a threshold, the final key length is immediately upgraded, and when the session risk calibration value falls back, a delay or hysteresis band strategy is used to downgrade it to avoid frequent jitters.

8. The information encryption management method according to claim 1, characterized in that: After generating the final key length, the minimum strength, key update cycle, and random source compliance are verified. If they are not met, policy override is executed. The behavioral baseline stability, time deviation, geographic deviation, context disturbance factor, session risk calibration value, and the decision trajectory of the final key length are recorded for auditing, tracing, and policy optimization.

9. An information encryption management method system, characterized in that: include: A processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the information encryption management method according to any one of claims 1 to 8 is implemented.

Images