A method for security management of enterprise data

Abstract

The application discloses a kind of security management methods of enterprise data, comprising: according to the characteristics of enterprise data, algorithm is selected, key is generated using algorithm, and the key generated is image steganography;The key after image steganography is segmented into several image fragments, and different image fragments are distributed by content distribution network, to constitute multi-path transmission;After receiving all the image fragments distributed by different content distribution networks, the image is reorganized, and the key is extracted according to the reorganized image;Identify the file type constituted by enterprise data, determine the initial image steganography carrier of file;According to initial image steganography carrier, generate carrier state table, real-time monitor network state and security threat, switch and partition image steganography carrier, encode dynamic key as PNG image alpha channel noise by image steganography, disperse risk using multi-path transmission, combine SSIM value verification and retransmission mechanism, ensure the integrity and reliability of key transmission.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security, in particular to a security management method for enterprise data. BACKGROUND

[0002] In the field of enterprise data security management, with the rapid development of information technology and the acceleration of enterprise digital transformation, the amount of data generated by enterprises is growing explosively, and the types of data are becoming increasingly diversified, covering customer information, transaction data, financial data, and research and development data, and other key information. These data are not only the core assets of enterprise operation, but also the key support for market competitiveness and innovation capability. However, the centralized storage and transmission of data also pose serious security challenges. How to ensure the security, integrity and reliability of enterprise data during transmission and storage has become an important problem to be solved.

[0003] Traditional data encryption methods, such as symmetric encryption and asymmetric encryption, can ensure the security of data to a certain extent, but the management and transmission of keys have become a problem. As the key to encryption and decryption, once the key is leaked or tampered with, it will lead to the collapse of the entire encryption system. Therefore, how to securely transmit and store the key has become a key link in data encryption technology. SUMMARY

[0004] The application provides a security management method for enterprise data, which encodes a dynamic key into the alpha channel noise of a PNG image through image steganography, disperses risks using multi-path transmission, combines SSIM value verification and retransmission mechanism to ensure the integrity and reliability of key transmission.

[0005] The application provides a security management method for enterprise data, which includes:

[0006] S101, selecting a key generation algorithm according to the characteristics of enterprise data, generating a key using the selected key generation algorithm, and performing image steganography on the generated key, wherein the image steganography is converting the key into binary data and embedding the binary data into the alpha channel of a PNG image;

[0007] S102, dividing the key after image steganography into a plurality of image fragments, distributing different image fragments through a content distribution network to form a multi-path transmission;

[0008] S103, after receiving all image fragments distributed by different content distribution networks, recombining the images, and extracting the key according to the recombined images;

[0009] S104, identifying the file type constituted by enterprise data, generating a selection index according to the file type, size, importance and transmission environment, and determining the image steganography carrier of the key based on the selection index;

[0010] S105, generating a carrier state table according to the determined image steganographic carrier, monitoring network state and security threats in real time, switching and partitioning the image steganographic carrier based on the monitored network state and security threats.

[0011] Preferably, the receiving end receives different image fragments, splices the received image fragments using an algorithm, places the image fragments one by one according to their row and column position information in the original image, forms a complete steganographic image, extracts the key according to the complete steganographic image, extracts the information on the alpha channel from the steganographic image, reads the alpha channel data of the PNG image through the image processing library, decodes the extracted noise information according to the reverse process of the encoding rule, restores the binary sequence, and finally obtains the original key.

[0012] Preferably, the specific method of performing switching is: in the initial stage, the system splits the key into several segments and steganographically embeds them in different positions of the main carrier and the backup carrier, before switching the carrier, a carrier state snapshot is generated, when the carrier is switched, the system sends switching instructions to the nearest content distribution network node, the content distribution network node then propagates the instructions to other nodes, and then the receiving end determines the position of each key segment by calculating the hash value of the file after receiving the carrier data, the receiving end extracts the corresponding key segments from different carriers and recombines them into a complete key.

[0013] Preferably, the method for partitioning the carrier is:

[0014] S201, partitioning the carrier by isolation, different carriers using different transmission protocols;

[0015] S202, inserting false steganographic information in each carrier and splitting the key into several segments, arranging the several key segments in a staggered manner, and inserting the staggered key segments into the carrier containing false steganographic information;

[0016] S203, real-time monitoring of the carrier, if a cross-carrier attack is detected, immediately cutting off the carrier transmission and tracing the attack source.

[0017] Preferably, the carrier is partitioned by isolation using a dual isolation strategy of physical isolation and logical isolation, the physical isolation refers to isolating the carrier at the storage layer, and the logical isolation refers to isolating the carrier at the transmission layer, different carriers using different transmission protocols.

[0018] Preferably, the formula for calculating the joint security strength according to the physical isolation and the logical isolation is: wherein, is the joint security strength, is the security strength of physical isolation, a security strength for logical isolation, a practical coupling times for cross-carrier attacks, a maximum coupling times for cross-carrier attacks, and the joint security strength is calculated multiple times, if the value of the joint security strength decreases, the parameters are repaired, otherwise, if the value of the joint security strength increases or remains unchanged, the parameters are not repaired.

[0019] Preferably,

[0020] S301, according to the file type, extracting content features, according to the importance of the carrier data, dividing the security level, according to the content features and the security level, calculating the steganographic capacity, the content features divide the file into high-entropy region and low-entropy region;

[0021] S302, embedding the key fragments into the high-entropy region, inserting the noise into the low-entropy region, and distributing the carrier file embedding the key fragments and the noise to different transmission paths according to the isolation strategy of step S201.

[0022] Preferably, the content features include gray level histogram entropy value, geometric element density and inter-frame difference standard deviation.

[0023] Preferably, the formula for calculating the gray level histogram entropy value is: wherein, is the gray level histogram entropy value, represents the probability of occurrence of pixel value i, 0 and 255 represent the extreme value of pixel gray value range respectively; according to the calculated gray level histogram entropy value, set the entropy value threshold, if the gray level histogram entropy value is greater than or equal to the preset entropy value threshold, mark it as a high-entropy region, if the gray level histogram entropy value is less than the preset entropy value threshold, mark it as a low-entropy region.

[0024] Preferably, the formula for calculating the geometric element density is: wherein, represents the density of geometric elements, represents the number of lines, A represents the area of the region; according to the geometric element density, set the density threshold, if the calculated geometric element density is greater than or equal to the preset density threshold, mark it as a high-entropy region, if the calculated geometric element density is less than the preset density threshold, mark it as a low-entropy region.

[0025] One or more technical solutions provided in the application have at least the following technical effects or advantages: the steganography encodes the dynamic key as the alpha channel noise of the PNG image, disperses the risk by using the multi-path transmission, combines the SSIM value verification and the retransmission mechanism, ensures the integrity and reliability of the key transmission, improves the security and reliability of the key transmission in the enterprise data security management, prevents the key from being monitored or intercepted during the transmission process, at the same time, through the multi-modal carrier dynamic switching mechanism, the optimal steganography carrier is automatically selected and seamlessly switched according to the real-time network condition, carrier availability and security threat during the file export process, the compatibility, security and efficiency of the key transmission are ensured, and the demand of the enterprise for large batch data export is met.

[0026] Through physical isolation and logical isolation, no data interaction or reverse inference path is realized between the carriers, the security of the whole is ensured when a single carrier is attacked, the horizontal penetration path between the carriers is completely blocked, and the absolute security of the key distribution during the large batch data export process is ensured.

[0027] Through the dynamic adjustment mechanism of content feature extraction and steganography embedding, the concealment and cross-carrier defense capability of steganography are improved, and the balance between transmission efficiency and security is optimized, and the problem of insufficient concealment of the static steganography strategy in the complex enterprise environment is solved. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 A flowchart of a security management method for enterprise data of the application;

[0029] Figure 2 A flowchart of partitioning the carriers of the application;

[0030] Figure 3 A flowchart of dividing the carriers into high-entropy regions and low-entropy regions. DETAILED DESCRIPTION

[0031] In order to facilitate the understanding of the present application, the present application will be described more fully below with reference to the accompanying drawings; the preferred embodiments of the present application are shown in the drawings, but the present application can be realized in many different forms, and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0032] It should be noted that the terms "vertical", "horizontal", "up", "down", "left", "right" and similar expressions used herein are only for the purpose of illustration, and are not the only embodiments.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting upon the application; the use herein of the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0034] Embodiment one: Figure 1 is a flowchart of an enterprise data security management method according to an embodiment of the application, comprising:

[0035] S101, according to the characteristics of enterprise data, select a key generation algorithm, use the selected key generation algorithm to generate a key, and perform image steganography on the generated key, the image steganography being to convert the key into binary data and embed the binary data into the PNG image alpha channel;

[0036] Specifically, the characteristics of enterprise data include data type, data volume and encryption time period, the data type refers to customer information, transaction data, financial data and research and development data, the data volume refers to the data volume of different data types in a specific time period, the specific time period for which the data needs to be encrypted is determined according to the use frequency and security requirements of enterprise data, a dynamic key is generated by using a pseudo-random number generator (CSPRNG) combined with a time stamp and a random seed, the network time protocol (NTP) server in the enterprise is synchronized with the national time service center to ensure the accuracy of the time stamp, the random seed is obtained from the hardware random number generator in the enterprise, the length of the key is determined to be 256 bits according to industry specifications and security standards, the time interval is set, the current time stamp and the random seed obtained from the hardware random number generator are used as input to pass to the CSPRNG algorithm, and the CSPRNG algorithm operates according to the preset rules and parameters to generate a key of a specified length.

[0037] The generated key is image steganography, which is to convert the key into binary data, and map the binary data into PNG image alpha channel noise pattern, the PNG image alpha channel as a hidden carrier of key information, for example, a continuous 8-bit binary number is mapped to an alpha channel in the range of 0-255, and a continuous 8-bit binary number is selected as a mapping unit, because 8-bit binary numbers can represent 256 different combinations from 00000000 (decimal 0) to 11111111 (decimal 255), which corresponds to the transparency value in the range of 0-255 on the PNG image alpha channel, each different 8-bit binary combination is assigned a specific transparency change pattern, for the binary number 00000000, set its corresponding transparency value to 0, indicating complete transparency; for 11111111, the corresponding transparency value is 255, indicating complete opacity, and the intermediate binary combination, such as 01010101, determines its corresponding transparency value according to a certain algorithm (such as converting the binary number to decimal and then mapping it to the transparency value according to a predetermined function relationship) to ensure that different binary combinations correspond to different transparency change patterns, and the correspondence is uniquely determined; the generated key is converted into a binary sequence, and the binary sequence of the key is divided into groups of 8 bits each, for each group of 8-bit binary numbers, find its corresponding alpha channel transparency value, and the generated key is a series of binary data representing alpha channel transparency change instructions; use PNG image as the carrier of image steganography, embed the encoded key into the PNG image through image processing software SecretPixel, open the PNG image using SecretPixel, enter the channel editing mode of the image, find the alpha channel, and according to the encoded binary data (generated key), apply each binary data to the corresponding pixel of the alpha channel according to the principle of uniform distribution, save the image after setting the transparency value, at this time the image has embedded key information, that is, the image is steganography.

[0038] S102, the key after image steganography is divided into several image fragments, and different image fragments are distributed through a content distribution network to form a multi-path transmission.

[0039] Further, the width and height of the steganographic image key (PNG image) are recorded, the PNG image after steganography is divided into several fragments, the number of divided fragments is determined according to network conditions, if the network bandwidth is sufficient and the security requirement is high, the number of fragments is increased, if the network condition is poor, the number of fragments is reduced, the PNG image is divided into multiple fragments using Photoshop, each divided fragment contains alpha channel noise information; using the multi-node characteristics of the content distribution network (CDN), using a random number generator to distribute different image fragments to each CDN node, according to the real-time load of the node, dynamically distribute the image fragments to the node with lower load, transmit the distributed image fragments through different CDN nodes at the same time, that is, multi-path transmission, set the upper limit of the number of fragments allocated by each node, generate a fragment allocation table, record the ID, belonging node uniform resource locator (URL), one-time token and expiration time of each fragment, in the process of transmitting the image fragments, use short access links and one-time tokens to reduce the risk of being hijacked, generate a unique URL for each fragment, the URL contains a timestamp and a hash signature, use a one-time token (JWT) to set a short validity period for the link, the link will expire after the token expires, the receiving end obtains the fragment allocation table and simultaneously sends a request to multiple CDN nodes, uses asynchronous IO technology to download the fragments in parallel, and performs parallel transmission.

[0040] S103, after receiving all image fragments distributed by different content distribution networks, the image is recombined, and the key is extracted according to the recombined image;

[0041] Specifically, the receiving end receives the image fragments sent from different CDN nodes through a receiving program, splices the received images using an image matrix reconstruction algorithm, places the fragments one by one in the correct position according to the row and column position information of each fragment in the original image, forms a complete steganographic PNG image, extracts the key according to the complete steganographic PNG image, extracts the information on the alpha channel from the steganographic PNG image, reads the alpha channel data of the PNG image through the image processing library OpenCV to obtain a matrix containing noise information, decodes the extracted noise information according to the reverse process of the encoding rule, restores the binary sequence, parses the restored binary sequence according to a specific format, removes possible padding bits or check bits and other additional information, and finally obtains the original key.

[0042] The structural similarity (SSIM) of the PNG image is calculated before and after transmission, and the formula for calculating the structural similarity is: wherein, represents the complete steganographic image before transmission, represents the image spliced by the receiving end, and respectively represent the local mean of the stego image before transmission and the image after reception, respectively represent the local variance of the stego image before transmission and the image after reception, respectively represent the local covariance of the stego image before transmission and the image after reception, and are constants, which are used to avoid numerical instability caused by zero denominator, the calculated structural similarity is used to evaluate the degree of change of the image in the transmission process, the SSIM threshold is set, if the SSIM value of the image after transmission is greater than the preset SSIM threshold, it indicates that the image has been tampered with or intercepted in the transmission process, the receiving end triggers the retransmission mechanism and requests the sending end to resend the PNG image fragments encoded by the key.

[0043] S104, the file type of the enterprise data is identified, selection indexes are generated according to the file type, size, importance and transmission environment, and the image steganography carrier of the key is determined based on the selection indexes;

[0044] Further, the file type of the enterprise data is identified by file extension, and the identified file type is classified into medical image files, industrial design files, general files, and image and video files. The medical image files need to retain high-precision pixel data and meta information, and DICOM format is selected as the carrier. The private tag field of the DICOM format is used to hide the key. The non-key parameters (such as view angle and material attribute) in the CAD file are selected as the steganographic space for the industrial design file. The general file is a PDF file and a Word file. The general file uses low-perception features such as text line spacing and character color fine-tuning to hide the key. The image and video files are PNG files and MP4 files. For the MP4 file, different resolutions are selected for transmission according to the network bandwidth, and steganography is performed in the specific area (edge-insensitive area) of the video frame. According to the type, size, importance and transmission environment of the file, a compatibility priority index, a security requirement level index and a transmission efficiency index are generated. The compatibility priority index includes the same format priority principle and the general format adaptation principle. For the same format priority principle, the exported file itself is a specific format (such as DICOM and CAD), and the same format is preferentially selected as the steganographic carrier. For example, if the exported file is a DICOM format medical image, the compatibility priority index will tend to select DICOM as the steganographic carrier. For the general format adaptation principle, the general document format (such as PDF and Word) needs to evaluate the software environment of the receiving device when considering compatibility. If the receiving party widely supports the PDF format, PDF is selected as one of the preferred carriers. If the receiving party mainly uses Word software for document processing, Word format is selected as a candidate carrier. The security requirement level index assigns carriers according to the importance index of the file. For industrial design files involving core enterprise secrets, CAD rendering streams and PDF are used as carriers, and the key is split into two parts and hidden in the two carriers. For files of general importance, a single carrier is selected for data hiding. The transmission efficiency index selects a carrier according to the file size. For small files, to improve transmission efficiency, lightweight carriers such as PNG and PDF are selected. For large industrial design files larger than 1GB, the files can be split into multiple CAD rendering stream segments and transmitted in a certain order and priority.

[0045] S105, according to the determined image steganographic carrier, a carrier state table is generated, the network state and security threats are monitored in real time, and the carrier is dynamically switched based on the monitored network state and security threats;

[0046] Specifically, on the basis of generating the initial carrier in step S104, a backup carrier is allocated according to the file type, for example: if the exported is medical image data, considering that it needs to retain high-precision pixel data and meta information, DICOM is selected as the main carrier, and PDF is selected as the backup carrier at the same time. A carrier status table is generated according to the steganographic capacity of the carrier, the transmission progress and the checksum. The system monitors the network state and security threats through network monitoring tools. The monitored network state includes network bandwidth, delay, packet loss rate and the like. The monitored security threats include network traffic and data packets. Whether to trigger switching is judged according to the monitored network state and security threats. When the bandwidth decreases, the switching mechanism is triggered, for example: when transmitting high-definition CAD rendering stream, if the network bandwidth decreases from 8Mbps to 3Mbps, the system will automatically judge that the current network condition cannot support the efficient transmission of high-definition CAD rendering stream, thereby triggering the switching mechanism. Once the security threat against the main carrier is detected, the system will forcibly switch to the backup carrier and encrypt the transmission channel, for example: when the security monitoring system finds abnormal network traffic against the DICOM carrier and judges that it is a man-in-the-middle attack, the system will immediately stop the transmission of the DICOM carrier, switch to the PDF carrier, and encrypt the transmission channel of the PDF carrier using the SSL / TLS protocol to ensure the security of the key transmission. The specific method of executing switching is: in the initial stage, the system will split the key into N segments and steganographically embed them in different positions of the main carrier and the backup carrier. Before switching the carrier, a carrier status snapshot is generated, which records the number of key segments that have been transmitted by the current main carrier and backup carrier, the checksum value and the transmission progress and the like. When the carrier is switched, the system sends the switching instruction to the nearest CDN node, which then rapidly transmits the instruction to other related nodes to ensure that all nodes can timely receive the switching instruction. Then, the receiver receives the carrier data and determines the position of each key segment by calculating the hash value of the file. The file hash value is like a unique identifier of the file. The receiver extracts the corresponding key segments from different carriers according to the pre-agreed rules and recombines them into a complete key.

[0047] The technical solutions in the embodiments of the present application have at least the following technical effects or advantages: the dynamic key is encoded into the alpha channel noise of the PNG image through steganography, the risk is dispersed through multi-path transmission, the SSIM value verification and retransmission mechanism are combined to ensure the integrity and reliability of the key transmission, the security and reliability of the key transmission in enterprise data security management are improved, and the key is prevented from being monitored or intercepted during transmission. At the same time, through the multi-modal carrier dynamic switching mechanism, the optimal steganographic carrier is automatically selected and seamlessly switched according to the real-time network condition, carrier availability and security threat during file export, the compatibility, security and efficiency of the key transmission are ensured, and the demand of enterprise for large amount of data export is met.

[0048] Embodiment two: based on the above embodiment one, when performing carrier switching, there is a cross-carrier association risk, the security isolation between carriers in the multi-format file package is missing, attackers can reverse crack the medical DICOM key through the steganographic layer in the CAD file, there is a horizontal penetration risk between carriers, as shown in Figure 2 .

[0049] S201, the carriers are isolated and partitioned, and different transmission protocols are used for different carriers;

[0050] Further, physical isolation and logical isolation double isolation strategies are used for different carriers. The physical isolation refers to isolating the carriers at the storage layer. According to the steganographic data carrier type and quantity, different virtual partitions are divided, and text, image and audio steganographic data are respectively distributed in independent virtual disk spaces, so that different virtual partitions are completely isolated and cannot interact with data through regular system operations. At the same time, an encryption algorithm (AES-256) is selected for each carrier file, an independent encryption key is generated by using a key management system (KMS) of different security domains, a key repository is established, the generated key is stored in association with the corresponding carrier file information, and the logical isolation refers to isolating the carriers at the transmission layer. Different transmission protocols are used for different carriers, different transmission time windows are set, and the formula for calculating the joint security strength according to the physical isolation and the logical isolation is: wherein, is the joint security strength, is the security strength of the physical isolation, is the security strength of the logical isolation, is the actual coupling times of the cross-carrier attack, that is, the number of times that the attacker attempts to attack other carriers after penetrating through one carrier, is the maximum possible coupling times of the cross-carrier attack, the joint security strength is calculated multiple times, the multiple calculation results are compared, if the joint security strength is reduced, the vulnerability needs to be immediately investigated, the affected parameters are repaired, and the security of the key is improved.

[0051] S202, inserting false steganographic information in each carrier and splitting the key into several fragments, arranging the several key fragments in a staggered manner, and inserting the staggered key fragments into the carrier containing the false steganographic information;

[0052] Specifically, in the text carrier, meaningless character paragraphs are inserted at certain intervals, in the image carrier, random pixel noise is uniformly distributed in various regions of the image, according to the length and complexity of the key, the key is divided into several segments, a non-continuous rule is set using a random number generator, and different key segments are hidden in different false steganographic information carriers according to the non-continuous rule, and the receiver combines the key segments in the correct order after obtaining all the carriers containing the key segments, and restores the complete dynamic key.

[0053] In some embodiments, a news report on the development of technology is taken as a text carrier, a text feature camouflage algorithm is developed, and meaningless character paragraphs are generated, such as "In the futuristic world, the technology of flying cars has advanced rapidly, but the traffic jams still exist in the sky." According to the rule of inserting a meaningless paragraph every 300 characters, the generated meaningless paragraph is inserted into the news report. After insertion, the text is carefully checked to ensure that the main content is still clear and readable, and the reading experience is not significantly affected. A cityscape photo is used as an image carrier, an image feature camouflage algorithm is used to generate random pixel noise, and the noise is evenly distributed in the sky, buildings, and streets of the photo. Adjust the density and intensity of the noise to make it look like natural flaws caused by light and other factors during the photo shoot, without affecting the overall visual effect of the photo. The key is split into 5 segments: "AB12", "CD34", "EF56", " " (empty segment, used to increase complexity), and " " (empty segment). Set the non-continuous order rule: set the order rule to "2 - 4 - 1 - 5 - 3". Choose 5 different carriers: file 1, file 2, file 3, file 4, and file 5. According to the order rule, hide the key segment "CD34" in file 2, " " in file 4, "AB12" in file 1, " " in file 5, and "EF56" in file 3. The specific hiding method is: in the text carrier, insert the key segment into the middle of a specific paragraph; in the image carrier, convert the key segment to binary data and hide it in the pixel value of the image. The sender sends the carrier with carrier feature camouflage and key segment misalignment to the receiver. After obtaining all the carriers, the receiver extracts the key segments from file 2, file 4, file 1, file 5, and file 3 according to the pre-known order rule "2 - 4 - 1 - 5 - 3", and then combines them into the complete dynamic key "AB12CD34EF56".

[0054] S203, real-time monitoring of the carrier, if a cross-carrier attack is detected, immediately cut off the carrier transmission and trace the attack source;

[0055] Further, the transmission log and the number of decryption attempts of each carrier and other information are collected and monitored in real time, and an abnormality detection rule library is established according to the detection result. When the monitoring system detects an abnormality, an alarm is triggered immediately to notify the security personnel and related systems to handle it. An attack tracing system is established to record the relevant information of all carriers, including the transmission time, source IP, operation record and the like, to form complete attack chain evidence. The security personnel analyzes the attack trace according to the recorded information, locates the attack entrance, determines the identity and attack means of the attacker, updates the attack trace result to the blacklist, and strictly limits the subsequent access to prevent attacks again.

[0056] The technical solutions in the embodiments of the present application have at least the following technical effects or advantages: through physical isolation and logical isolation, no data interaction or reverse inference path between carriers is realized, a single carrier being broken does not affect the overall security, the horizontal penetration path between carriers is completely blocked, and the absolute security of key distribution in the process of large amount of data export is ensured.

[0057] Embodiment three: the carrier prevents cross-carrier attacks through the security isolation strategy in the above-mentioned embodiment two, however, the embedding mode of steganographic information is still static preset. In this embodiment, under the carrier security isolation framework, the file context features are dynamically perceived, the embedding strategy of steganographic information is adaptively adjusted, and the concealment of steganography is improved, as shown in Figure 3 .

[0058] S301, according to the file type, the content features are extracted, the security levels are divided according to the importance of the carrier data, the steganographic capacity is calculated according to the content features and the security levels, and the content features divide the file into high-entropy regions and low-entropy regions;

[0059] Specifically, the file types include DICOM files, CAD files and video files and the like. The gray level histogram entropy value of the DICOM file is calculated, the gray level histogram entropy value reflects the distribution of pixel values in the image, and the formula for calculating the gray level histogram entropy value is: wherein, is the gray level histogram entropy value, the appearance probability of the pixel value i, 0 and 255 represent the extreme value of the pixel gray value range respectively, the entropy threshold is set according to the calculated gray level histogram entropy value, if the gray level histogram entropy value is greater than or equal to the preset entropy threshold, it is marked as a high-entropy region, the pixel value distribution of the high-entropy region is uniform, and the information uncertainty is high, if the gray level histogram entropy value is less than the preset entropy threshold, it is marked as a low-entropy region, the pixel value distribution of the low-entropy region is relatively concentrated, and the information uncertainty is low; the geometric element density of the CAD file is calculated, and the formula for calculating the geometric element density is: wherein, is the density of the geometric element, The number of lines is represented, A represents the area of the region, and a density threshold is set. If the calculated geometric element density is greater than or equal to the preset density threshold, it is indicated that the geometric elements in the region are relatively dense, and the region is marked as a high-entropy region. If the calculated geometric element density is less than the preset density threshold, it is indicated that the geometric elements in the region are relatively sparse, and the region is marked as a low-entropy region. The inter-frame difference standard deviation is calculated for a video file. The inter-frame difference reflects the degree of change between adjacent frames in the video, and the standard deviation is used to measure the dispersion degree of the inter-frame difference. The calculation formula of the inter-frame difference standard deviation is: wherein, The inter-frame difference standard deviation is represented by The pixel value of the t-th frame is represented by The average frame difference is represented by N, and a standard deviation threshold is set. If the calculated inter-frame difference standard deviation is greater than or equal to the preset standard deviation threshold, it is indicated that the inter-frame change in the region is large, which is a motion area, and the region is marked as a high-entropy region. If the calculated inter-frame difference standard deviation is less than the preset standard deviation threshold, it is indicated that the inter-frame change in the region is small, which is a static background area, and the region is marked as a low-entropy region. The above-mentioned gray scale histogram entropy value, geometric element density and inter-frame difference standard deviation are all content features.

[0060] The security level is divided according to the sensitivity of the data carried by the carrier and the importance of the business. If the carrier carries highly sensitive and important business data, it is divided into a high security level. If the carrier carries low-sensitive and general data, it is divided into a low security level. The steganographic capacity is calculated according to the extracted content features and the divided security level. The formula for calculating the steganographic capacity of the high-entropy region is: wherein, The steganographic capacity allocated to the high-entropy region is represented by The steganographic capacity allocation proportionality coefficient of the high-entropy region is represented by The maximum available steganographic capacity is represented by The formula for calculating the steganographic capacity of the low-entropy region is: wherein, The steganographic capacity allocated to the low-entropy region is represented by The steganographic capacity allocation proportionality coefficient of the low-entropy region is represented by

[0061] S302, the key fragment is embedded into the high-entropy region, the noise is inserted into the low-entropy region, and the carrier file embedded with the key fragment and the noise is distributed to different transmission paths according to the isolation strategy of step S201;

[0062] Further, the key fragment is embedded in a high-entropy region, which has high information complexity and randomness, and steganography operation is relatively difficult to be detected in it, for example: in the DICOM medical image, the lesion area often has rich texture and complex structure, the information entropy is high, and the hash fragment of the patient ID is suitable for embedding, by embedding information in the high-entropy region, the risk of being detected can be effectively reduced, and the reliability of steganography can be improved; insert noise into the low-entropy region, which is manifested as a uniform normal tissue region for the low-entropy region of the DICOM file, at this time, the redundant pixel blocks are generated by simulating the normal tissue texture, these redundant pixel blocks are similar to the normal tissue in vision, and can be well integrated into the image, without causing obvious abnormalities, for the CAD design file, the low-entropy region is the design part with regular structure, according to the overall design style, the redundant lines consistent with the design style are inserted, these redundant lines do not affect the design function and aesthetics on the premise, and provide a cover for the steganography information, for in the video, the static background area has low information change, and belongs to the low-entropy region, the noise frame consistent in illumination is inserted in the static background area, so that the noise frame and the surrounding background are consistent in illumination, and thus it is difficult to be detected, the carrier file embedded with the key fragment and the noise is distributed to different transmission paths according to the isolation strategy of step S201, the transmission process is monitored in real time, abnormal events in the transmission process are identified, the isolation strategy is adjusted according to the abnormal time, and if an attack on the low-entropy region is found, the steganography capacity of the low-entropy region of all carriers is reduced.

[0063] The technical solutions in the embodiments of the present application have at least the following technical effects or advantages: through content feature extraction, high-entropy region and low-entropy region division and dynamic adjustment mechanism, the concealment and cross-carrier defense capability of steganography are improved, and the balance between transmission efficiency and security is optimized, and the problem of insufficient concealment of static steganography strategy in complex enterprise environment is solved.

[0064] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for secure management of enterprise data, characterized in that, include: S101, Select a key generation algorithm based on the characteristics of the enterprise data, generate a key using the selected key generation algorithm, and perform image steganography on the generated key. The image steganography involves converting the key into binary data and embedding the binary data into the α channel of a PNG image. The characteristics of the enterprise data include data type, data volume, and encryption time period. S102, the key after image steganography is divided into several image fragments, and the different image fragments are distributed through the content delivery network to form multipath transmission; S103: After receiving all image fragments distributed by different content delivery networks, reassemble the images and extract the key based on the reassembled images; S104, identify the file types that constitute the enterprise data, generate selection indicators based on file type, size, importance and transmission environment, and determine the image steganography carrier of the key based on the selection indicators; File types are identified by file extensions, and compatibility priority indicators, security requirement level indicators, and transmission efficiency indicators are generated based on file type, size, importance, and transmission environment. The compatibility priority indicators follow the principles of prioritizing files with the same format and adapting to common formats. The security requirement level indicators identify the importance of files to the enterprise and allocate carriers based on the importance index. The transmission efficiency index is selected based on the file size; S105: Based on the determined image steganography carrier, generate a carrier status table, monitor network status and security threats in real time, and switch and partition the image steganography carrier based on the monitored network status and security threats. The specific method for performing the switch is as follows: In the initial stage, the system splits the key into several fragments and steganizes them in different locations on the primary and backup carriers. Before switching carriers, a carrier status snapshot is generated. When the carriers are switched, the system sends the switch instruction to the nearest content delivery network node, which then propagates the instruction to other nodes. After the receiving end receives the carrier data, it determines the location of each key fragment by calculating the hash value of the file. The receiving end extracts the corresponding key fragments from different carriers and reassembles them into a complete key. The method for partitioning the carrier is as follows: S201 isolates and partitions the carrier, with different carriers using different transmission protocols; S202, insert false steganographic information into each carrier and split the key into several fragments, arrange the several key fragments in a misaligned manner, and insert the misaligned key fragments into the carrier containing false steganographic information; S203: Monitor the carrier in real time. If a cross-carrier attack is detected, immediately cut off the carrier transmission and trace the source of the attack. The carrier status table includes the carrier's steganography capacity, transmission progress, and verification process.

2. The enterprise data security management method as described in claim 1, characterized in that, The receiving end receives different image fragments and stitches them together using an image matrix reconstruction algorithm. Based on the row and column position information of each image fragment in the original image, the image fragments are placed one by one to form a complete steganalysis image. The key is extracted based on the complete steganalysis image. Information on the alpha channel is extracted from the steganalysis image. The alpha channel data of the PNG image is read through an image processing library. According to the reverse process of the encoding rules, the extracted noise information is decoded to restore the binary sequence and finally obtain the original key.

3. The enterprise data security management method as described in claim 1, characterized in that, The carrier is isolated and partitioned using a dual isolation strategy of physical isolation and logical isolation. Physical isolation refers to the isolation of the carrier at the storage layer, while logical isolation refers to the isolation of the carrier at the transport layer. Different carriers use different transport protocols.

4. The enterprise data security management method as described in claim 3, characterized in that, The formula for calculating the joint security strength based on physical isolation and logical isolation is as follows: ,in, For joint security strength, For the security strength of physical isolation, For the security strength of logical isolation, This represents the actual number of couplings in a cross-carrier attack. To determine the maximum number of couplings for cross-carrier attacks, the joint security strength will be calculated and compared multiple times. If the value of the joint security strength decreases, the parameter will be corrected; otherwise, if the value of the joint security strength increases or remains unchanged, the parameter will not be corrected.

5. The enterprise data security management method as described in claim 1, characterized in that, S301: Extract content features based on file type, classify security levels based on the importance of carrier data, calculate steganography capacity based on content features and security levels, and divide files into high-entropy and low-entropy regions based on content features. S302, embed the key fragment into the high-entropy region, insert noise into the low-entropy region, and allocate the carrier file containing the embedded key fragment and noise to different transmission paths according to the isolation strategy of step S201.

6. The enterprise data security management method as described in claim 5, characterized in that, The content features include grayscale histogram entropy, geometric element density, and inter-frame difference standard deviation.

7. The enterprise data security management method as described in claim 6, characterized in that, The formula for calculating the entropy value of a gray-level histogram is: ,in, This represents the entropy value of the grayscale histogram. This represents the probability of pixel value i appearing, with 0 and 255 representing the extreme values ​​of the pixel grayscale value range, respectively. An entropy threshold is set based on the calculated grayscale histogram entropy value. If the grayscale histogram entropy value is greater than or equal to the preset entropy threshold, it is marked as a high-entropy region; if the grayscale histogram entropy value is less than the preset entropy threshold, it is marked as a low-entropy region.

8. The enterprise data security management method as described in claim 6, characterized in that, The formula for calculating the density of geometric elements is: ,in, Represents the density of geometric elements. Indicates the number of lines. This represents the area of ​​the region. A density threshold is set based on the density of geometric elements. If the calculated density of geometric elements is greater than or equal to the preset density threshold, it is marked as a high-entropy region. If the calculated density of geometric elements is less than the preset density threshold, it is marked as a low-entropy region.

Images