A data exchange security verification method based on a trusted data space

Abstract

The application relates to the technical field of information security, in particular to a data exchange security verification method based on a trusted data space, which comprises the following steps: the request data is split into multiple data segments by identifying the punctuation marks of the request data, and logical expression words in each data segment are identified; parallel information in the data segments is identified; the data segments are split into several independent local information based on the parallel information; the privacy value of each independent local information is calculated; the corresponding security verification level of the local information is set based on the privacy value of the local information; and the security verification of each local information is carried out based on the security verification level, so that the overall verification loophole is avoided; and the privacy value and the verification level of each local information are dynamically evaluated, compliance is ensured, and the circulation efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a data exchange security verification method based on a trusted data space. BACKGROUND

[0002] In order to ensure the security of the network, the physical isolation method is adopted for data exchange in various fields at present, mainly including mobile medium copying, double network card host, FTP transmission, network gate transfer and data encryption and the like.

[0003] The prior art CN113553573A discloses a data security verification method, comprising: double verification of an access key by a key verification unit and a key verification server, and encryption and decryption processing of access data in the process of access, which can prevent data from being intercepted in the process of access, and double authentication can prevent the database from being accessed by hackers.

[0004] However, the traditional data exchange verification is mainly based on the security level division of the whole data block, and it is difficult to deal with unstructured or semi-structured data. For example, when the request data contains multi-dimensional logical expression (such as "acquiring user name and consumption record at the same time and performing cross analysis"), the existing method cannot accurately split the logical units in the data segment, resulting in coarse verification granularity and easy occurrence of "overprotection" or "verification vulnerability". SUMMARY

[0005] The present application relates to the technical field of information security, and in particular to a data exchange security verification method based on a trusted data space.

[0006] In order to achieve the above-mentioned purpose, the present application adopts the following technical scheme:

[0007] A data exchange security verification method based on a trusted data space, which specifically comprises the following steps:

[0008] Step 1: identifying the request data, and dividing the request data into a plurality of data segments according to the period marks in the request data, then splitting the data segments into a plurality of sub-elements, and identifying the logical expression words in the data segments in each sub-element, setting parallel information based on the logical expression words, and then splitting the corresponding data segments into a plurality of local information based on the parallel information;

[0009] Step 2: using the NIST privacy framework algorithm to divide the target information into dimensions, and calculating the privacy value of each local information;

[0010] Step 3: setting the security verification level of the local information according to the privacy value, and performing security verification of the local information in the trusted data space based on the security verification level, and performing data exchange.

[0011] As a further scheme of the present application, the method for dividing the request data into several data segments comprises:

[0012] Obtaining the request data, first identifying the punctuation marks in the request data, identifying the end-of-sentence marks in the request data according to the types of the punctuation marks, and pre-segmenting the request data according to the end-of-sentence marks to obtain a plurality of data segments;

[0013] The types of the punctuation marks include in-sentence marks and end-of-sentence marks, the in-sentence marks are used to separate in-sentence components, including commas, colons, semicolons, and the end-of-sentence marks are used to indicate the end of a sentence, including periods, question marks, and exclamation marks.

[0014] As a further scheme of the present application, when the request data is information data subjectively output by a requestor, the request data may be continuously output in a whole segment and the data structure may not be clearly divided, and in this case, the request data needs to be punctuated, wherein the punctuation refers to the structural division of the request data by using punctuation marks.

[0015] As a further scheme of the present application, the method for punctuating the request data comprises:

[0016] Based on the Internet technology, standard text data is collected in the Internet, the collected text data is cleaned, and the data obtained after the cleaning is taken as sample data, the sample data is first subjected to feature recognition to obtain text features, then the sample data is set as a training set and input into a specified algorithm model for training and adjustment to obtain a labeling training model, and then the request data is input into the labeling training model for re-punctuating the request data, wherein the text features include semantic features, grammatical features, and contextual features.

[0017] As a further scheme of the present application, the setting method of the parallel information comprises:

[0018] All the data segments are sequentially set as target analysis segments, based on the natural language processing technology, the target analysis segments are subjected to character-level and word-level feature extraction to obtain sub-elements, then logical expression words are identified in the sub-elements, and the sub-elements after the logical expression words are marked as parallel information, and the sentence components of the parallel information in the original request data are identified, wherein the logical expression words refer to words representing parallel logical relationships.

[0019] The parallel information in the sub-elements is identified, and the sub-elements other than the parallel information are re-spliced according to the position sequence, and the sentence spliced by the plurality of sub-elements is marked as a single data, wherein one sentence represents one single data.

[0020] The parallel information is acquired again, monomer data in front of the parallel information is identified, the monomer data is marked as target data, sentence components of the parallel information are acquired, corresponding sentence components in the target data are identified, and the corresponding sentence components in the target data are replaced by the parallel information to obtain new monomer data.

[0021] As a further scheme of the present application, the sub-element is subjected to a word meaning processing before being reassembled, and the specific word meaning processing method comprises:

[0022] The word meaning of the sub-element is identified in sequence, wherein the word meaning comprises a real word and a virtual word, the real word refers to a word having a definite lexical meaning and being capable of serving as a sentence component alone, and the virtual word refers to a word having no real lexical meaning and being incapable of serving as a sentence component alone;

[0023] If the sub-element is a real word, the sub-element is retained, otherwise, if the sub-element is a virtual word, the corresponding sub-element is deleted.

[0024] As a further scheme of the present application, the privacy value calculation method comprises:

[0025] All the local information is set as target information in sequence, the target information is subjected to dimension division by using the NIST privacy framework algorithm, the dimensions comprise identity recognizability, sensitivity level and use scenario, and a corresponding weight level is set for each dimension, wherein the weight level corresponding to the identity recognizability is 0.4, the weight level corresponding to the sensitivity level is 0.35, and the weight level corresponding to the use scenario is 0.25.

[0026] The privacy value of the target information is obtained by using the formula: privacy value = identity recognizability x 0.4 + sensitivity x 0.35 + scenario risk x 0.25.

[0027] As a further scheme of the present application, the security verification level setting method comprises:

[0028] The security verification level comprises a first risk level, a second risk level and a third risk level, when the privacy value is greater than or equal to X1, the security verification level corresponding to the local information is marked as the first risk level, when the privacy value is greater than or equal to X2 and less than X1, the security verification level corresponding to the local information is marked as the second risk level, and when the privacy value is less than X2, the security verification level corresponding to the local information is marked as the third risk level.

[0029] Further, for the protection of sensitive information: the first risk level > the second risk level > the third risk level.

[0030] As a further aspect of the present invention, based on the security verification level, local information is sequentially verified for security. When the local information shows that the verification has passed, data exchange is performed on the requested data in the trusted data space according to the data instruction of the requested data. Conversely, if the security verification of the local information shows that the verification has failed, a warning signal is generated and transmitted to the terminal device of the corresponding requester.

[0031] Compared with existing technologies, the advantages of this invention are:

[0032] This invention divides data segments by using punctuation at the end of sentences and identifies logical expression words in each segment, splitting the overall request data into multiple segments. It then identifies parallel information within these segments and, based on this parallel information, further divides each segment into several independent local information pieces. Privacy values ​​are then calculated for each independent local information piece, and based on these privacy values, corresponding security verification levels are set for each piece, preventing overall verification vulnerabilities. This invention ensures compliance while improving circulation efficiency by dynamically evaluating the privacy value and verification level of each local information piece.

[0033] This invention also enables rapid location of fault data by performing security verification on local information, further improving the efficiency of security verification and realizing the visualization and rapid tracing of security risks. Attached Figure Description

[0034] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0035] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0036] Reference Figure 1 A data exchange security verification method based on trusted data space, the method specifically includes the following steps:

[0037] Step 1: Identify the request data. When the information transmission module identifies the request data, it generates a segmentation signal and simultaneously transmits the request data to the semantic segmentation module. The semantic segmentation module identifies the segmentation signal and performs semantic recognition on the request data. Based on the semantic information, it segments the request data into multiple local information segments. Specific methods for segmenting the request data into multiple local information segments include:

[0038] S1: Obtain the request data, first identify the punctuation marks in the request data, according to the type of punctuation marks, identify the end-of-sentence marks in the request data, and pre-segment the request data according to the end-of-sentence marks to obtain a plurality of data segments, wherein the punctuation mark types include in-sentence marks and end-of-sentence marks, further, the in-sentence marks are used to separate the in-sentence components, and the in-sentence marks include commas, colons, semicolons, and the like, and the end-of-sentence marks are used to indicate the end of a sentence, including periods, question marks, and exclamation marks, etc.;

[0039] It needs to be further explained that when the request data is information data output by the requestor subjectively, at this time the request data may be continuously output in a whole segment and the data structure is not clear, at this time the request data needs to be punctuated, wherein the punctuation refers to structuring the request data by using punctuation marks, specifically, the method for punctuating the request data includes:

[0040] Based on the Internet technology, standard text data is collected in the Internet, the collected text data is data cleaned, and the data obtained after data cleaning is used as sample data, the sample data is first feature-recognized to obtain text features, and then the sample data is set as a training set and input into a specified algorithm model for training and adjustment to obtain a labeling training model, and then the request data is input into the labeling training model to re-punctuate the request data;

[0041] Wherein, the text features include semantic features, grammatical features, and contextual features, etc., the standard text data includes news, novels, and papers, etc., the artificial intelligence algorithm used in this embodiment is a recurrent neural network algorithm, and the specific algorithm processing process belongs to the prior art, which will not be described here;

[0042] S2: Arbitrarily select a data segment and mark it as a target analysis segment, take this target analysis segment as an example, based on natural language processing technology, perform character-level and word-level feature extraction on the target analysis segment to obtain sub-elements, then identify logical expression words in the sub-elements, and mark the sub-elements after the logical expression words as parallel information, wherein the logical expression word refers to a word representing a parallel logical relationship, including "and", "and", "and", "or", etc.

[0043] Identify the word meanings of the sub-elements in turn, wherein the word meanings include real words and virtual words, the real word refers to a word with a clear lexical meaning, which can independently serve as a sentence component (such as subject, predicate, object, etc.), and the virtual word refers to a word without a real lexical meaning, which cannot independently serve as a sentence component, such as adverbs, prepositions, auxiliary words, and modal words, etc.

[0044] If the sub-element belongs to a real word, the sub-element is retained; otherwise, if the sub-element belongs to a virtual word, the corresponding sub-element is deleted. Further, while identifying the word meaning, the parallel information in the original request data is identified and the sentence component is identified;

[0045] S3: Obtain the remaining sub-elements, identify the parallel information in the sub-elements, reassemble the sub-elements other than the parallel information in the order of positions, and mark the sentence assembled by the plurality of sub-elements as a single data, wherein one sentence represents one single data;

[0046] The parallel information is obtained again, the single data before the parallel information is identified, and the single data is marked as target data. The sentence component of the parallel information is obtained, and the corresponding sentence component in the target data is identified. After the corresponding sentence component in the target data is replaced by the parallel information, a new single data is obtained;

[0047] For example, the request data is "query the sales report of May 2025 and export it as PDF", and the logical expression word "and" is detected. At this time, the sub-element after the logical expression word is "export", and the parallel information "export" is obtained. At the same time, the parallel information belongs to the predicate component in the request data, and the virtual word "and" in the request data is deleted. After reassembling the sub-elements, the single data "query the sales report of May 2025" is obtained. In this single data, the predicate component is re-identified as "query", "export" is replaced by "query", and the subsequent logical word is combined to obtain another single data "export the sales report of May 2025 as PDF". At this time, the request data "query the sales report of May 2025 and export it as PDF" is divided into two single data "query the sales report of May 2025" and "export the sales report of May 2025 as PDF";

[0048] According to the above method, all data segments are divided into a plurality of single data. Then, one single data is set as one local information. At this time, the request data is divided into a plurality of local information;

[0049] Step 2: Perform privacy analysis on each local information to determine the privacy value of the local information. The specific judgment method of the privacy value includes:

[0050] An arbitrary local information is selected and marked as target information. Taking the target information as an example, the target information is divided into dimensions by using the NIST privacy framework algorithm. The specific dimensions include identity recognizability, sensitivity level, and use scenario. Meanwhile, a corresponding weight level is set for each dimension. In this embodiment, the weight level corresponding to the identity recognizability is 0.4, the weight level corresponding to the sensitivity level is 0.35, and the weight level corresponding to the use scenario is 0.25.

[0051] Then the privacy value of the target information is obtained by using the formula: privacy value = identity recognizability * 0.4 + sensitivity * 0.35 + scenario risk * 0.25;

[0052] All the local information is sequentially taken as the target information, and the privacy value of each local information is obtained by using the above method;

[0053] Step three: obtaining the privacy value of each local information, and setting the security verification level of the local information according to the privacy value, wherein the security verification level includes a first risk level, a second risk level and a third risk level, and for the protection of sensitive information, the first risk level > the second risk level > the third risk level;

[0054] Further, when the privacy value is greater than or equal to X1, the security verification level corresponding to the local information is marked as the first risk level, when the privacy value is greater than or equal to X2 and less than X1, the security verification level corresponding to the local information is marked as the second risk level, and when the privacy value is less than X2, the security verification level corresponding to the local information is marked as the third risk level, wherein X1 and X2 are both level thresholds, and the specific values of X1 and X2 are obtained by big data operation by those skilled in the art;

[0055] Step four: based on the security verification level, the security verification of the local information is sequentially performed, when the local information display verification passes, at this time, the data exchange of the request data is performed according to the data instruction of the request data in the trusted data space, otherwise, if the security verification of the local information display verification fails, a warning signal is generated and transmitted to the terminal equipment of the corresponding requester;

[0056] Further, the higher the security verification level of the local information, the higher the security of the corresponding security verification, and vice versa, when the security verification level of the local information is lower, the security of the corresponding security verification is lower.

[0057] The above is only a preferred specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any skilled person in the art can make equivalent replacement or change according to the technical solution and the inventive concept of the present application within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.

Claims

1. A data exchange security verification method based on a trusted data space, characterized in that, The method specifically comprises the following steps: Step one: identify the request data, and divide the request data into several data segments according to the end-of-sentence punctuation marks in the request data, then split the data segments into multiple sub-elements, identify the logical expression words in each sub-element, set parallel information based on the logical expression words, and then split the corresponding data segment into several local information based on the parallel information; The setting method of the parallel information comprises: All data segments are sequentially set as target analysis segments, and character-level and word-level features of the target analysis segments are extracted based on natural language processing technology to obtain sub-elements, then logical expression words are identified in the sub-elements, and the sub-elements after the logical expression words are marked as parallel information, and the sentence components of the parallel information in the original request data are identified, wherein the logical expression words refer to words representing parallel logical relationships; The parallel information in the sub-elements is identified, the sub-elements other than the parallel information are reassembled in order of position, and the sentence composed of the multiple sub-elements is marked as a single data, wherein one sentence represents one single data; The parallel information is obtained again, the single data before the parallel information is identified, and the single data is marked as target data, the sentence components of the parallel information are obtained, and the corresponding sentence components in the target data are identified, then the corresponding sentence components in the target data are replaced with the parallel information to obtain new single data, and one single data is set as one local information; Step two: all local information is sequentially set as target information, and the target information is divided into dimensions using the NIST privacy framework algorithm, and the privacy value of each local information is calculated, wherein the dimensions include identity recognizability, sensitivity level and use scenario, and the corresponding weight levels of each dimension are set, the weight level corresponding to the identity recognizability is 0.4, the weight level corresponding to the sensitivity level is 0.35, and the weight level corresponding to the use scenario is 0.25; The privacy value of the target information is obtained by using the formula: privacy value = identity recognizability x 0.4 + sensitivity x 0.35 + scenario risk x 0.25; Step three: set the security verification level of the local information according to the privacy value, and perform security verification and data exchange of the local information in the trusted data space based on the security verification level.

2. The data exchange security verification method based on trusted data space according to claim 1, characterized in that, The method for dividing the request data into several data segments comprises: Obtain the request data, identify the punctuation marks in the request data, identify the end-of-sentence punctuation marks in the request data according to the types of the punctuation marks, and pre-segment the request data according to the end-of-sentence punctuation marks to obtain multiple data segments; Wherein, the punctuation mark types include intra-sentence punctuation marks and end-of-sentence punctuation marks, the intra-sentence punctuation marks are used to separate intra-sentence components, including commas, colons and semicolons, and the end-of-sentence punctuation marks are used to indicate the end of a sentence, including periods, question marks and exclamation marks.

3. The method of claim 2, wherein, When the request data is information data subjectively output by the requester, the request data may be continuously output in a whole segment and the data structure may not be clearly divided, in which case the request data needs to be punctuated, wherein punctuating refers to structurally dividing the request data using punctuation marks.

4. The data exchange security verification method based on trusted data space according to claim 3, characterized in that, The method for punctuating the request data comprises: Based on the Internet technology, standard text data is collected in the Internet, the collected text data is cleaned, and the data obtained after the data cleaning is taken as sample data. The sample data is first subjected to feature recognition to obtain text features, and then an artificial intelligence algorithm is used to set the sample data as a training set and input into a specified algorithm model for training and adjustment to obtain a labeling training model. The request data is then input into the labeling training model for re-punctuation of the request data. The text features include semantic features, syntactic features and contextual features.

5. The method of claim 1, wherein, Before the sub-elements are reassembled, the sub-elements also need to be subjected to word meaning processing. The specific word meaning processing method comprises: The word meaning of the sub-elements is identified in sequence. The word meaning includes real words and virtual words. The real word refers to a word with a clear lexical meaning and capable of acting as a sentence component alone. The virtual word refers to a word without a real lexical meaning and incapable of acting as a sentence component alone. If the sub-element is a real word, the sub-element is retained. Otherwise, if the sub-element is a virtual word, the corresponding sub-element is deleted.

6. The method of claim 1, wherein, The method for setting the security verification level comprises: The security verification level includes a first risk level, a second risk level and a third risk level. When the privacy value is greater than or equal to X1, the security verification level of the local information is marked as the first risk level. When the privacy value is greater than or equal to X2 and less than X1, the security verification level of the local information is marked as the second risk level. When the privacy value is less than X2, the security verification level of the local information is marked as the third risk level. For the protection of sensitive information: the first risk level > the second risk level > the third risk level.

7. The data exchange security verification method based on trusted data space according to claim 6, characterized in that, Based on the security verification level, the local information is subjected to security verification in sequence. When the local information shows that the verification is passed, the request data is subjected to data exchange according to the data instruction of the request data in the trusted data space. Otherwise, if the security verification of the local information shows that the verification fails, a warning signal is generated and transmitted to the terminal device of the corresponding requester.

Images