Information encryption management method and system

Abstract

The present application belongs to the field of data security and cryptography, and proposes an information encryption management method and system. After receiving an access request, the system calls user historical behavior, calculates behavior baseline stability; based on the difference between the current access time and the historical time distribution, the time deviation degree is obtained, and based on the difference between the source address or the geographical attribution, the geographical deviation degree is obtained, which is combined into a comprehensive deviation degree, and the context disturbance factor is obtained according to the behavior baseline stability modulation. The context disturbance factor and the target data static risk index are fused to obtain the session risk calibration value; according to the session risk calibration value, the key length is mapped to the ladder set to obtain the final key length, and encryption is performed. The present application can adaptively improve the encryption strength when abnormal access occurs, and maintain the performance under normal access, with real-time, context awareness and good generalization ability.

Description

Technical Field

[0001] This invention relates to the fields of data security and cryptography, and in particular to an information encryption management method and system. Background Technology

[0002] Existing encryption strategies are mostly based on static rules or fixed key lengths, making it difficult to reflect the dynamic changes in user access behavior across time, space, and device dimensions. Static strategies are slow to respond to abnormal access and may be overly conservative under normal access conditions, resulting in a trade-off between security and performance. Traditional anomaly detection relies on fixed rule bases, which are insufficient in the face of new threats and cross-scenario migration capabilities.

[0003] Therefore, there is an urgent need for a unified quantitative framework that integrates historical behavioral baselines with current access disturbances, coupling dynamic risks with the static sensitivity of the accessed data, and thus automatically and finely determining the encryption strength for this access. Summary of the Invention

[0004] To address the technical problem of static encryption being disconnected from context and making it difficult to balance security performance, this invention provides the following technical solution.

[0005] An information encryption management method, comprising:

[0006] Receive access requests containing user identifier, request time, source address and device fingerprint, and obtain the user's historical access time set and historical source address set;

[0007] The behavioral baseline stability is obtained by weighting and synthesizing historical access time dispersion, address change and geographical dispersion.

[0008] Calculate the time deviation and geographical deviation, and combine them according to their weights to form the overall deviation.

[0009] Based on the stability of the behavioral baseline, the overall deviation is modulated to obtain the context perturbation factor;

[0010] By fusing contextual perturbation factors with the static risk index of the target data, a session risk calibration value is generated.

[0011] Based on the session risk rating, the key length is mapped to a preset ladder set to obtain the final key length, and the encryption algorithm is called to complete the encryption of the target data.

[0012] Preferably, the historical access time dispersion is obtained by performing bucket statistics or kernel density estimation on the historical time axis, and the time deviation is determined based on the degree of surprise of the current access time in the historical time distribution or the statistical distance from the historical time distribution.

[0013] Preferably, the geographical deviation degree is obtained by calculating the distance between the longitude and latitude obtained by the current source address resolution and the geographical centroid or main distribution cluster of the historical source location, or by calculating the city, country, autonomous region distribution difference; the weight of the geographical deviation degree is reduced in a mobile cellular or public network environment, and the weight is increased in a fixed private line or data center environment.

[0014] Preferably, the historical time dispersion degree, address change degree and geographical dispersion degree are subjected to interval normalization processing before being synthesized to obtain the behavior baseline stability; and the weight parameters for synthesizing the behavior baseline stability and the comprehensive deviation degree are adaptively updated through offline training or online learning according to historical samples.

[0015] Preferably, the generation of the session risk calibration value suppresses extreme abnormalities, amplifies the medium-low interval, and sets at least two risk threshold intervals to trigger different key strength and optional secondary authentication strategies.

[0016] Preferably, the key length ladder set includes at least two groups of block cipher strength, preferably including AES-128, AES-192, AES-256 or a national secret algorithm of the same strength; and the key length ladder set can be finely adjusted under the same algorithm by key derivation strength, rotation period or iteration number.

[0017] Preferably, for consecutive requests in the same session, the session risk calibration value is smoothed based on a sliding window; when the session risk calibration value rises and crosses the threshold, the final key length is immediately upgraded, and when the session risk calibration value falls, a delay or hysteresis band strategy is used to downgrade, so as to avoid frequent jitter.

[0018] Preferably, after the final key length is generated, the minimum strength, key update period and random source compliance are checked, and if not satisfied, a strategy override is performed; and the decision trajectory of the behavior baseline stability, the time deviation degree, the geographical deviation degree, the context disturbance factor, the session risk calibration value and the final key length is recorded for auditing, tracing and strategy optimization.

[0019] In a second aspect, an information encryption management system includes a processor and a memory, the memory storing computer program instructions that, when executed by the processor, implement any of the information encryption management methods.

[0020] The present application has the following advantages:

[0021] The present application improves the calculation efficiency and stability by quantifying the context disturbance in real time for each access and dynamically determining the encryption strength; and improves the ability of context perception by introducing the time, address and geographical three-dimensional dispersion to form the behavior baseline stability, forming a closed loop from the user behavior baseline to the current deviation and then to the session risk. Attached Figure Description

[0022] Figure 1 This is a flowchart of steps S1-S5 in an information encryption management method according to an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0024] Reference Figure 1 An information encryption management method includes steps S1-S5, as detailed below:

[0025] S1: Receive an access request containing user ID, request time, source address and device fingerprint, and obtain the user's historical access time set and historical source address set.

[0026] In this embodiment of the invention, after receiving an access request containing user identifier, request time, source address and device fingerprint, the system extracts fields such as user identifier, request time, source IP and device fingerprint from historical access logs such as access gateway, business application and security audit, and then obtains the user's historical access time set and historical source location set, aggregates and deduplicates by session ID and user ID, unifies the timeline and encoding standard, removes obvious crawler and noise samples, and forms a traceable and consistent clean dataset as input for subsequent calculations.

[0027] Among them, the system unifies all time fields to UTC and retains the original time zone field for audit, while deriving features such as hour, weekday, is_holiday from the timestamp, and establishing individual historical time series with a rolling history window (preferably 90 days) to ensure comparability and accumulability across regions and across work scenes. For historical records, the system assigns exponential decay weights according to the time interval from the current time to emphasize the representativeness of recent behavior and improve the adaptive ability of the model to behavior pattern changes, while avoiding lag caused by over-reliance on long-term data. The system resolves the source IP into ASN, / 24 subnet, latitude and longitude, and city and country code, and marks whether it is in a shared export, proxy or VPN scenario; in subsequent metrics, these network forms are appropriately down-weighted to avoid misjudging infrastructure characteristics as anomalies. The system resolves the source IP into ASN, / 24 subnet, latitude and longitude, and city and country code, and marks whether it is in a shared export, proxy or VPN scenario; in subsequent metrics, these network forms are appropriately down-weighted to avoid misjudging infrastructure characteristics as anomalies. The system uses browser fingerprint, TLS fingerprint, OS information, and jailbreak or root status to form a device vector, and calculates the similarity with the user's commonly used device in the past 7 days as an additional clue for subsequent risk assessment; when the similarity is low, the system will pay more attention to the joint deviation of time and geographic dimensions.

[0028] S2: Based on the historical access time dispersion, address change degree and geographical dispersion, the behavior baseline stability is obtained by weighted synthesis.

[0029] In one embodiment, by bucketing statistics or kernel density estimation on the historical access time axis, the distribution of historical access time in each time period is obtained, and then the historical access time dispersion is calculated.

[0030] In one embodiment, the frequency and switching of different source addresses (such as / 24 subnet, ASN, etc.) in historical access are counted, and the address change degree is calculated by linear combination or weighted transition rate.

[0031] In one embodiment, the source addresses of historical access are geographically clustered (such as using DBSCAN / HDBSCAN algorithm), and the average radius and inter-cluster distance or the complement of the silhouette coefficient are used to reflect the light hi, and the geographical dispersion is calculated.

[0032] In one embodiment, after interval normalization of the above historical access time dispersion, address change degree and geographical dispersion, the behavior baseline stability is obtained by synthesizing according to the preset weight parameter, which reflects the stability and regularity of the user's historical access behavior. The relationship is expressed as:

[0033]

[0034] In the formula, For the stability of the user's behavior baseline, The weight of historical access time dispersion, For historical visit time dispersion, As the weight of address change, For address change degree, The weight for geographical dispersion. Geographical dispersion.

[0035] Additionally, when individual historical samples are sparse or missing, the system uses an organizational / department template distribution as a substitute and... The values ​​were set to neutral to low to adopt a conservative strategy; at the same time, quantile pruning and missing value imputation were performed to ensure that the assessment remained robust and reliable during the cold start phase.

[0036] S3: Calculate the time deviation and geographical deviation and combine them according to their weights to form the overall deviation.

[0037] In one embodiment, the time deviation is calculated based on the surprise factor (i.e., low probability value) of the current access time in the historical time distribution or the statistical distance (such as KL divergence, Euclidean distance, etc.) from the historical time distribution. This value reflects the degree of deviation between the current access time and the user's historical routine. For special modes such as holidays and nighttime, separate templates are created to reduce false alarms.

[0038] In one embodiment, the geographical deviation is calculated by measuring the distance between the latitude and longitude obtained from the current source address resolution and the geographical centroid or main distribution cluster of the historical source location, or by measuring the distribution differences of cities, countries, autonomous regions, etc.

[0039] At the same time, the system automatically adjusts the weight of geographical deviation based on the network environment (such as mobile cellular, public Wi-Fi, fixed leased lines, etc.).

[0040] In one embodiment, the temporal deviation and geographical deviation are linearly combined according to preset weighting parameters to obtain the comprehensive deviation. This value comprehensively reflects the overall degree of anomaly of the current visit in both temporal and spatial dimensions. That is, it satisfies the following relationship:

[0041]

[0042] In the formula, For the overall deviation, As the weight of time deviation, For time deviation, As the weight of geographical deviation, Geographical deviation.

[0043] S3: modulating the comprehensive deviation degree according to the behavior baseline stability to obtain a context disturbance factor.

[0044] In the embodiment of the application, the comprehensive deviation degree is modulated according to the behavior baseline stability to generate the context disturbance factor. Specifically, when the behavior baseline stability is small, it indicates that the historical behavior of the user is volatile, and at this time, the context disturbance factor responds more strongly to the anomaly; on the contrary, when the behavior baseline stability is large, it indicates that the historical behavior of the user is stable, and at this time, the context disturbance factor responds weakly to the anomaly. In this way, the system can achieve more cautious handling of unstable users and no overreaction to stable users.

[0045] The above context disturbance factor is expressed by a relationship as follows:

[0046]

[0047] In the formula, is the context disturbance factor, is the comprehensive deviation degree, is the behavior baseline stability of the user, and k is a hyperparameter, is an exponential function with e as the base.

[0048] In addition, the static risk index of the target data is obtained from the data classification management platform, and a weight is added according to the business scenario (such as data landing, transmission or backup). The higher the static risk index, the higher the session risk triggered by the same context disturbance.

[0049] S4: fusing the context disturbance factor and the static risk index of the target data to generate a session risk calibration value.

[0050] In one embodiment, the context disturbance factor is fused with the static risk index of the target data obtained from the data classification / policy platform to generate a session risk calibration value. In the fusion process, the system can adopt a moderate growth strategy to avoid the upper bound from being saturated too quickly, ensuring that the session risk calibration value can accurately reflect the risk level of the current access. At the same time, the system sets at least two risk threshold intervals to trigger different key strengths and optional secondary authentication strategies.

[0051] The above session risk calibration value satisfies the relationship as follows:

[0052]

[0053] In the formula, is the session risk calibration value, is the context disturbance factor, is the static risk index.

[0054] To reduce the impact of short-term fluctuations on key strength, the continuous risk indicators within the same session are exponentially weighted moving average smoothed. When the risk value rises across the threshold, the key is immediately upgraded, and when the risk value drops, a delayed rollback strategy is adopted to avoid frequent switching.

[0055] In addition, the dominant factors and key intermediate variables (such as time deviation, geographical deviation, etc.) in the session risk assessment process are recorded to form a traceable decision path. These records can be used for real-time linkage of access control and post-audit analysis, realizing governance closed loop and strategy optimization.

[0056] S5: According to the session risk rating value, the key length is mapped to a preset set of steps to obtain the final key length, and an encryption algorithm is called to complete the encryption of the target data.

[0057] In one embodiment, the key length is mapped to a preset set of steps (such as AES-128, AES-192, AES-256, or a national encryption algorithm with the same strength) according to the session risk rating value. During the mapping process, fine-grained adjustments can be made according to actual needs through key derivation strength, rotation period, or iteration number, etc.

[0058] Further call the encryption algorithm library, generate session key according to the final determined key length, and encrypt the target data. In the encryption process, the minimum strength, key update period, and random source compliance are checked at the same time to ensure the compliance and robustness of the encryption operation.

[0059] The key length relationship is expressed as:

[0060]

[0061] In the formula, is the final key length, is the original key length, is the session risk rating value, is the hyperparameter.

[0062] It should be noted that the weights, parameters, and risk thresholds involved in each of the above steps are jointly optimized, and the combination of offline training and online feedback is used to minimize the computational overhead and latency while achieving the specified safety recall rate. Through version management and regular retraining, it maintains coordination with business scenarios.

[0063] The system includes a processor and a memory, and the memory stores computer program instructions that, when executed by the processor, implement the information encryption management method according to the first aspect of the application.

[0064] The system also includes other components well known to those skilled in the art, such as a communication bus and a communication interface, the arrangement and function of which are known in the art, and thus will not be described here.

[0065] The application realizes dynamic adjustment of encryption strength by constructing user behavior baseline stability, calculating comprehensive deviation degree, generating context disturbance factor and session risk calibration value. The method not only improves the real-time performance and context awareness ability of the system, but also adaptively improves the encryption strength when abnormal access occurs, and maintains the system performance under normal access, thereby providing a strong guarantee for data security of the intelligent warehousing platform.

[0066] It should be noted that, for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of the present application. Therefore, the protection scope of the present application patent should be subject to the appended claims.

Claims

1. An information encryption management method characterized by comprising: The method comprises the following steps: Receiving an access request containing a user identifier, a request time, a source address and a device fingerprint, and obtaining a historical access time set and a historical source address set of the user; Based on the historical access time dispersion, address change degree and geographical dispersion, the behavior baseline stability is obtained by weighted synthesis; the historical access time dispersion is obtained by statistical binning or kernel density estimation on the historical time axis; the frequency of occurrence and switching of different source addresses in the historical access are counted, and the address change degree is calculated by linear combination or weighted transition rate; the source addresses of the historical access are geographically clustered, and the geographical dispersion is calculated by combining the average radius and the distance between clusters; the time deviation degree and the geographical deviation degree are calculated and combined by weight to obtain the comprehensive deviation degree; the time deviation degree is determined based on the probability of the current access time in the historical time distribution or the statistical distance of the historical time distribution; the geographical deviation degree is calculated by the distance between the longitude and latitude obtained by resolving the current source address and the geographical centroid or main distribution cluster of the historical source address, or by the distribution difference of cities, countries and autonomous regions; The context disturbance factor is obtained by modulating the comprehensive deviation degree according to the behavior baseline stability; the context disturbance factor is expressed by the following relationship: wherein, is a contextual perturbation factor, is a comprehensive deviation, is a user's behavior baseline stability, k is a hyperparameter, is an exponential function with base e; The session risk calibration value is generated by fusing the context disturbance factor and the target data static risk index; the session risk calibration value satisfies the following relationship: wherein is a session risk score, is a contextual perturbation factor, is a static risk index; According to the session risk calibration value, the final key length is mapped to the preset ladder set to obtain the final key length, and the encryption algorithm is called to complete the encryption of the target data; wherein the final key length satisfies the following relationship: wherein is the final key length, is the original key length, is the session risk rating value, is the hyperparameter.

2. The information encryption management method of claim 1, wherein The historical time dispersion, address change degree and geographical dispersion are interval normalized before being synthesized to obtain the behavior baseline stability; the weight parameters used to synthesize the behavior baseline stability and the comprehensive deviation degree are updated adaptively according to the historical samples through offline training or online learning.

3. The information encryption management method of claim 1, wherein The key length ladder set includes at least two groups of symmetric cipher strengths, including AES-128, AES-192, AES-256 or the national cipher algorithm strength of the same level; and the key derivation strength, rotation period or iteration number can be used for fine-grained adjustment under the same algorithm.

4. The information encryption management method of claim 1, wherein For the continuous session risk calibration value in the same session, smoothing is performed based on the sliding window; when the session risk calibration value rises across the threshold, the final key length immediately upgrades, and when the session risk calibration value falls, the delay or hysteresis band strategy is used to downgrade.

5. The information encryption management method of claim 1, wherein After generating the final key length, the minimum strength, key update period and random source compliance are checked, and if they do not meet the requirements, the strategy is covered; and the decision trajectory of the behavior baseline stability, time deviation degree, geographical deviation degree, context disturbance factor, session risk calibration value and final key length is recorded for auditing, tracing and strategy optimization.

6. An information encryption management system characterized by comprising: The method comprises the following steps: A processor and a memory, the memory stores computer program instructions, when the computer program instructions are executed by the processor, the information encryption management method according to any one of claims 1-5 is realized.

Images