Supply chain data security management method and system
By combining dynamic classification and hierarchical encryption transmission with context-aware permission verification and blockchain auditing and evidence storage, the problems of adaptability to changes in data sensitivity and disconnect between permissions in traditional supply chain data security management are solved, achieving efficient data security management and compliance auditing.
Patent Information
- Application Number
- CN202511203633.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-27
- Publication Date
- 2025-11-07
AI Technical Summary
Traditional supply chain data security management methods cannot adapt to the dynamic changes in the sensitivity of supply chain data with business scenarios. Encryption and access control are disconnected, resulting in low efficiency in auditing and tracing.
Dynamic classification and grading are achieved through multi-dimensional feature extraction and hierarchical analysis, layered encrypted transmission is performed based on sensitivity levels, and context-aware permission verification and blockchain audit and evidence storage are combined to achieve dynamic security management of data.
It improved the accuracy of data classification, avoided the risk of unauthorized access, increased access efficiency, and met the requirements of supply chain compliance audits.
Smart Images
Figure CN120915569A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data security, more particularly to a supply chain data security management method and system. BACKGROUND
[0002] A supply chain is a networked collaborative system composed of suppliers, manufacturers, distributors, logistics providers and end users. The secure circulation of data such as order information, production formula, inventory dynamics and logistics track is the core of ensuring the stable operation of the supply chain.
[0003] However, the traditional supply chain data security management has some shortcomings. The existing supply chain data security management method classifies data based on fixed rules, which cannot adapt to the dynamic changes of supply chain data sensitivity with business scenarios, and the encryption and permission are disconnected, only focusing on the confidentiality of the transmission stage, not dynamically associated with access permissions, and the efficiency of audit and traceability is low.
[0004] In view of this, the present application provides a supply chain data security management method and system to solve the above problems. SUMMARY
[0005] In order to overcome the above-mentioned defects of the prior art, the present application provides a supply chain data security management method and system to solve the problems in the above background.
[0006] The present application provides the following technical solution: a supply chain data security management method, comprising the following steps:
[0007] Step 1: dynamically classify and grade target data; obtain the comprehensive sensitivity score of target data through multi-dimensional feature extraction and analytic hierarchy process, and mark the target data as low, medium and high sensitivity levels respectively;
[0008] Step 2: layered encryption transmission based on different sensitivity levels of target data; encrypt the target data according to the sensitivity level of the target data by matching the corresponding national encryption algorithm combination, to generate a transmission data packet containing session key encryption information and integrity check value;
[0009] Step 3: context-aware permission verification; extract user context attributes based on attribute-based access control model, match permission policy library and trigger hierarchical approval process, and generate temporary access token;
[0010] Step 4: blockchain audit and evidence storage; collect the whole process operation log, and store it on the chain after SM3 hash calculation, support blockchain-based audit query and traceability.
[0011] Preferably, the target data includes procurement data, production data, logistics data and sales data, the procurement data includes procurement quantity, procurement category and procurement amount, the production data includes production quantity and production time, the logistics data includes logistics progress, logistics personnel and logistics time, and the sales data includes sales amount, sales quantity and sales personnel.
[0012] Preferably, the obtaining of the comprehensive sensitivity score of the target data by the multi-dimensional feature extraction and the analytic hierarchy process specifically includes:
[0013] Step S11, multi-dimensional feature extraction is performed on the target data.
[0014] Step S12, a sensitivity evaluation index system is constructed.
[0015] Step S13, a comprehensive sensitivity score is obtained by using the analytic hierarchy process.
[0016] Step S14, sensitivity grade division is performed based on the comprehensive sensitivity score.
[0017] Preferably, the multi-dimensional feature extraction of the target data in step S11 specifically includes:
[0018] The target data is divided into three feature levels, namely, first-level features, second-level features and third-level features; the first-level features are procurement data, production data, logistics data and sales data, the second-level features are data attributes, i.e., detailed data categories under the first-level features, and the third-level features are importance degree features, i.e., importance degrees of the second-level features, the importance degree features include regular features, temporary features and urgent features, the regular features correspond to an ordinary importance degree, the temporary features indicate that the corresponding second-level features are temporary data, and the urgent features correspond to an important importance degree.
[0019] Preferably, the construction of the sensitivity evaluation index system in step S12 specifically includes:
[0020] The weights of the first-level features, the second-level features and the third-level features are defined, the weight of the i th first-level feature is denoted as a i , the weight of the j th second-level feature under the i th first-level feature is denoted as b ij , and the weight of the k th third-level feature under the i th first-level feature and the j th second-level feature is denoted as c ijk .
[0021] Based on the Delphi method, experts score the weights of the first-level features, the second-level features and the third-level features, the score corresponds to the weight value, and the score is between 0 and 1; thereby obtaining the weight values of all data items in the first-level features, the second-level features and the third-level features.
[0022] Preferably, the step S13 adopts the analytic hierarchy process to obtain the comprehensive sensitivity score, and the comprehensive sensitivity score is specifically:
[0023] wherein, S represents the comprehensive sensitivity score, m represents the total number of data items in the first-level feature, n represents the total number of data items in the second-level feature under the ith first-level feature, s ijk represents the data item sensitivity score of the kth third-level feature under the ith first-level feature and the jth second-level feature.
[0024] Preferably, the step S14 is based on the comprehensive sensitivity score to divide the sensitivity level, and the step S14 is specifically:
[0025] The first threshold YU1 and the second threshold YU2 are set, if the comprehensive sensitivity score satisfies S≥YU1, it is a high sensitivity level; if the comprehensive sensitivity score satisfies YU2≤S<YU1, it is a medium sensitivity level; if the comprehensive sensitivity score satisfies S<YU2, it is a low sensitivity level.
[0026] Preferably, the step two is based on different sensitivity levels of the target data to perform hierarchical encryption transmission, and the step two is specifically:
[0027] Step 21, generating a session key; the sender node generates a temporary asymmetric key pair through the national encryption SM2 algorithm, including a private key SK session and a public key PK session .
[0028] Step 22, encrypting the data body; according to different sensitivity levels, a symmetric encryption algorithm is selected;
[0029] Step 23, for the medium sensitivity level data and the high sensitivity level data, the session key is encrypted, and the sender uses the public key PK B of the receiver node to perform SM2 encryption on the encryption key of the medium sensitivity level data and the high sensitivity level data, to obtain E(K)=SM2.Encrypt(K,PK B ); the public key PK B is authenticated through a CA certificate, and B represents the receiver;
[0030] Step 24, generating an integrity check value; performing SM3 hash value calculation on the data, and attaching to the encrypted data packet header; the SM3 hash value calculation is represented as: H=SM3.Hash(plaintext);
[0031] Step 25, constructing a transmission data packet, and the receiver performs decryption verification; the receiver uses the private key SK BThe encrypted key E(K) is decrypted to obtain the encryption key, the C is decrypted to obtain plaintext', H' is calculated as SM3.Hash(plaintext'), if H' = H, the verification is passed, otherwise the data packet is discarded and an alarm is triggered, and the abnormal log is recorded for storage.
[0032] Preferably, the step four carries out the specific steps of blockchain audit evidence storage as follows:
[0033] Step 41, collecting the whole process log; collecting each log field in each link of target data classification and grading, encrypted transmission, data access, the log field including data operation type, operation timestamp, operation node, operation user, data identification and operation result;
[0034] Step 42, generating log hash; calculating the SM3 hash of the format and content of each log;
[0035] Step 43, on-chain storage; synchronizing the log hash and the original log to the supply chain alliance chain through the blockchain node;
[0036] Step 44, audit query and traceability; querying through the blockchain, verifying the log integrity through the Merkle tree, and automatically generating an audit report if an abnormality is found.
[0037] A supply chain data security management system, comprising a target data classification and grading module, a hierarchical encryption transmission module, a context-aware permission verification module and a blockchain audit evidence storage module;
[0038] The target data classification and grading module is used for dynamically classifying and grading the target data; the target data is marked as low sensitive level, medium sensitive level and high sensitive level by multi-dimensional feature extraction and analytic hierarchy process to obtain the comprehensive sensitivity score of the target data;
[0039] The hierarchical encryption transmission module carries out hierarchical encryption transmission based on the different sensitivity levels of the target data; the target data is encrypted by matching the corresponding national secret algorithm combination according to the sensitivity level, to generate a transmission data packet containing session key encryption information and integrity check value;
[0040] The context-aware permission verification module is used for context-aware permission verification; the user context attribute is extracted based on the attribute-based access control model, the permission strategy library is matched and the hierarchical approval process is triggered to generate a temporary access token;
[0041] The blockchain audit evidence storage module is used for blockchain audit evidence storage; the whole process operation log is collected, and the SM3 hash is calculated and stored on the chain, supporting the audit query and traceability based on the blockchain.
[0042] The technical effects and advantages of the present application are as follows:
[0043] The present application is advantageous in dynamically calculating sensitivity scores by combining multi-dimensional features through dynamic classification and grading, solving the problem that traditional static classification cannot adapt to dynamic changes of supply chain data, and effectively improving classification accuracy. By setting up encryption and permission linkage, the risk of "encryption but unauthorized access" is avoided. By combining multi-dimensional attributes for dynamic verification of permissions through context-aware permission verification, and combining the grading approval process, the access efficiency in temporary collaboration scenarios is effectively improved, while unauthorized access events are greatly reduced. Through real-time on-chain of operation logs by blockchain audit evidence storage, the strict requirements of supply chain compliance audit are met. BRIEF DESCRIPTION OF DRAWINGS
[0044] Figure 1 The present application is a supply chain data security management method.
[0045] Figure 2 The present application is a supply chain data security management system structure diagram. DETAILED DESCRIPTION
[0046] The technical solutions in the present application will be described clearly and completely in conjunction with the drawings in the present application. In addition, the forms of each structure described in the following embodiments are only examples, and the supply chain data security management method and system involved in the present application are not limited to the forms of each structure described in the following embodiments. All other embodiments obtained by those skilled in the art without making creative efforts fall within the scope of protection of the present application.
[0047] As shown in Figure 1 The present application provides a supply chain data security management method, comprising the following steps:
[0048] Step 1, dynamically classifying and grading target data; obtaining target data comprehensive sensitivity scores through multi-dimensional feature extraction and analytic hierarchy process, and marking target data as low sensitivity level, medium sensitivity level and high sensitivity level; the target data is supply chain data; the purpose is to dynamically adjust the classification level according to the sensitivity of the target data, and to provide accurate basis for subsequent data encryption and permission control, and to lay a foundation;
[0049] Step two, layered encryption transmission based on different sensitivity levels of target data; according to the sensitivity level of the target data, the corresponding national secret algorithm combination is matched for encryption, and the transmission data packet containing the session key encryption information and the integrity check value is generated; the purpose is to realize the confidentiality and integrity double protection by using the national secret algorithm combination according to the sensitivity level, and the encryption process is associated with the subsequent permission verification, the high sensitive level data is double protected by layered encryption, the middle sensitive level data simplifies the encryption process but retains the integrity check, and the low sensitive level data reduces the calculation overhead, which balances the security and efficiency;
[0050] Step three, context-aware permission verification; the attribute-based access control model extracts user context attributes, matches the permission policy library and triggers the hierarchical approval process, and generates a temporary access token; the purpose is to dynamically verify the access permission combined with user attributes to prevent unauthorized operations;
[0051] Step four, block chain audit evidence; the whole process operation log is collected and stored in the chain after SM3 hash calculation, supporting blockchain-based audit query and traceability; the purpose is to realize the non-tamperable and fast traceability of the whole process operation log.
[0052] In this embodiment, it needs to be specifically pointed out that the target data includes procurement data, production data, logistics data and sales data, the procurement data includes but is not limited to procurement quantity, procurement category and procurement amount, etc., the production data includes but is not limited to production quantity and production time, etc., the logistics data includes but is not limited to logistics progress, logistics personnel and logistics time, etc., and the sales data includes but is not limited to sales amount, sales quantity and sales personnel, etc.
[0053] In this embodiment, it needs to be specifically pointed out that the target data comprehensive sensitivity score obtained by multi-dimensional feature extraction and analytic hierarchy process includes:
[0054] Step S11, multi-dimensional feature extraction is performed on the target data;
[0055] Step S12, a sensitivity evaluation index system is constructed;
[0056] Step S13, the analytic hierarchy process is used to obtain the comprehensive sensitivity score;
[0057] Step S14, sensitivity level division is performed based on the comprehensive sensitivity score.
[0058] In this embodiment, it needs to be specifically pointed out that the step S11 of multi-dimensional feature extraction of the target data is specifically:
[0059] The target data is divided into three feature levels, namely a first feature, a second feature and a third feature; the first feature is procurement data, production data, logistics data and sales data, the second feature is a data attribute, that is, a detailed category of data under the first feature, for example, the second feature under the procurement data is procurement quantity, procurement category and procurement amount, and the third feature is an importance degree feature, that is, the importance degree of the second feature, the importance degree feature includes a regular feature, a temporary feature and an urgent feature, the regular feature corresponds to an ordinary importance degree, the temporary feature means that the corresponding second feature is temporary data, and the urgent feature corresponds to an important importance degree;
[0060] The data items in the first feature, the second feature and the third feature are sorted, for example, the procurement data, the production data, the logistics data and the sales data can be sorted, and the procurement data, the production data, the logistics data and the sales data are all data items, that is, the procurement data is the first first feature, the production data is the second first feature, the logistics data is the third first feature, and the sales data is the fourth first feature.
[0061] In this embodiment, it needs to be specifically explained that the step S12 of constructing the sensitivity evaluation index system is specifically:
[0062] The weights of the first feature, the second feature and the third feature are defined, the weight of the i-th first feature is denoted as a i , the weight of the j-th second feature under the i-th first feature is denoted as b ij , and the weight of the k-th third feature under the i-th first feature and the j-th second feature is denoted as c ijk .
[0063] The weights of the first feature, the second feature and the third feature are scored by experts based on the Delphi method, the score corresponds to the weight value, and the score is between 0 and 1; opinions are collected from experts in different fields, the experts do not communicate with each other, the collected opinions are summarized and fed back to the experts, the experts make a second judgment on this basis, and the process is repeated until the opinions of all experts are consistent, so as to obtain the weight values of all data items in the first feature, the second feature and the third feature.
[0064] In this embodiment, it needs to be specifically explained that the step S13 of obtaining the comprehensive sensitivity score by using the analytic hierarchy process is specifically:
[0065] Wherein, S represents the comprehensive sensitivity score, m represents the total number of data items in the first feature, n represents the total number of data items in the second feature under the i-th first feature, and s ijkrepresents the data item sensitivity score of the kth tertiary feature under the jth secondary feature and the ith primary feature;
[0066] The score of the data sensitivity score ranges from 0 to 100 points, and the scoring method is:
[0067] Select several experts in the field to score independently, and do not communicate between experts. After each round of scoring is completed, the scoring results of each data item are counted, and the highest score and the lowest score of each data item are removed. The average value obtained by summing is the final score of the corresponding data item;
[0068] The higher the sensitivity score, the more important the data item is in the supply chain.
[0069] In this embodiment, it needs to be specifically pointed out that the step S14 of classifying the sensitivity level based on the comprehensive sensitivity score is specifically:
[0070] The first threshold YU1 and the second threshold YU2 are set. If the comprehensive sensitivity score satisfies S≥YU1, it is a high sensitivity level; if the comprehensive sensitivity score satisfies YU2≤S<YU1, it is a medium sensitivity level; if the comprehensive sensitivity score satisfies S<YU2, it is a low sensitivity level;
[0071] The specific values of the first threshold YU1 and the second threshold YU2 can be set by those skilled in the art, YU1 satisfies YU1≥75, and YU2 satisfies 55≤YU2≤60.
[0072] In this embodiment, it needs to be specifically pointed out that the step two is specifically based on different sensitivity levels of the target data to perform hierarchical encryption transmission, which is:
[0073] Step 21, generating a session key; the sender node generates a temporary asymmetric key pair through the national standard SM2 algorithm, including a private key SK session and a public key PK session , the private key is stored locally and is valid only for this session, and the public key is transmitted with the encrypted data packet;
[0074] Step 22, encrypting the data body; selecting a symmetric encryption algorithm according to different sensitivity levels;
[0075] Step 23, encrypting the session key for the medium sensitivity level data and the high sensitivity level data, and the sender uses the public key PK B of the receiver node to encrypt the encryption key of the medium sensitivity level data and the high sensitivity level data through SM2, to obtain E(K)=SM2.Encrypt(K,PK B ); the public key PK B is authenticated through a CA certificate, and B represents the receiver;
[0076] Step 24, generating an integrity check value; performing SM3 hash value calculation on the data, and appending to the encrypted data packet header; the SM3 hash value calculation is expressed as: H = SM3.Hash(plaintext);
[0077] Step 25, constructing a transmission data packet, and performing decryption verification by the receiving party; the receiving party uses the private key SK B to obtain the encryption key, and uses the key to decrypt C to obtain plaintext', calculates H' = SM3.Hash(plaintext'), and if H' = H, the verification is passed, otherwise the data packet is discarded and an alarm is triggered, and is recorded as an abnormal log for storage.
[0078] In the embodiment, it needs to be specifically explained that the step 22 selects a symmetric encryption algorithm according to different sensitivity levels, which is specifically:
[0079] For high-sensitive level data, SM4 algorithm is used to encrypt the data, the SM4 algorithm has a key length of 128 bits, and the key is a private key SK session , and the ciphertext is C = SM4.Encrypt(plaintext, SK session );
[0080] For medium-sensitive level data, SM4 algorithm is used to encrypt the data, and the key is a randomly generated 128-bit temporary key K, and the ciphertext C = SM4.Encrypt(plaintext, K) is obtained;
[0081] For low-sensitive level data, SM4 algorithm can be selected for encryption or not encrypted, and only the integrity of the data is checked.
[0082] In the embodiment, it needs to be specifically explained that the step three is specifically for context-aware permission verification, which is:
[0083] Step 31, extracting user context attributes; the attributes of the user include inherent attributes, dynamic attributes, and business-related attributes; the inherent attributes are the role, department, number, etc. of the user, for example, if the user is a procurement manager, the role of the user is a procurement manager, the department is a procurement department, and the number is an employee number; the dynamic attributes are the login time, login IP, login device type, and login network environment, etc. of the user; the business-related attributes are the operation type and the data sensitivity level of the accessed data, etc. of the user;
[0084] Step 32, matching the permission policy library to obtain the corresponding permissions of the user; the permission policy library includes the permission operations corresponding to different users;
[0085] Step 33, triggering a dynamic approval process; if the data accessed by the user is high-sensitive level data, a dynamic approval process is automatically triggered;
[0086] Step 34, performing permission execution and log recording; after the dynamic approval process is verified, the user obtains corresponding data access permission, and when the dynamic approval process is not verified, the access log is automatically recorded and the alarm information is pushed to the security administrator; the alarm information mode includes but is not limited to SMS notification and email notification; the access log includes but is not limited to access user ID, access time, and reason for failure of verification, etc.
[0087] Through multi-dimensional attribute matching and dynamic approval, the inefficiency or overreach risk caused by one-size-fits-all permission is avoided, and the temporary and cross-organizational complex scenarios in supply chain collaboration are adapted.
[0088] In this embodiment, it needs to be specifically pointed out that the dynamic approval process specifically includes:
[0089] Step 331, the user submits an approval request, which includes but is not limited to user access reason and access data purpose, etc.
[0090] Step 332, according to the user role and the data sensitivity level of the accessed data, the approver is assigned according to the user role, and the approver is the direct superior of the user role.
[0091] Step 333, after the approver receives the approval notification, he needs to complete the dual identity verification before approving; the dual identity verification includes face recognition and SMS verification code recognition;
[0092] Step 334, if the approval is passed, a temporary access token is generated, and if the approval is not passed, the access is rejected, and the reason for the failure of the approval is recorded and the user is notified.
[0093] In this embodiment, it needs to be specifically pointed out that the specific steps of step four for blockchain audit storage are:
[0094] Step 41, collecting the whole process log; collecting each log field in each link such as target data classification and grading, encrypted transmission, data access, etc., the each log field includes but is not limited to data operation type, operation timestamp, operation node, operation user, data identifier and operation result, etc.
[0095] Step 42, generating a log hash; performing SM3 hash calculation on the format content of each log to ensure that the log is tamper-proof;
[0096] Step 43, performing upper chain storage; synchronizing the log hash and the original log to the supply chain alliance chain through the blockchain node; the supply chain alliance chain adopts a practical Byzantine fault tolerance consensus mechanism, wherein each block contains a block header and a log entry, and the block header includes a previous block hash and a timestamp;
[0097] Step 44, audit query and traceability; authorized auditors query through the blockchain, verify the log integrity through the Merkle tree, and if an abnormality is found, an audit report is automatically generated, the audit report includes the abnormal time, the abnormal node, the user and the operation chain, and the abnormality such as accessing high sensitive level data at non-working time;
[0098] The purpose is to ensure the log credibility through the non-tamperability of the blockchain, quickly verify the log integrity through the Merkle tree, and realize second-level traceability through multi-dimensional query conditions, so as to solve the low efficiency problem of traditional audit relying on manual log retrieval.
[0099] As shown in Figure 2 The present application provides a supply chain data security management system, which comprises a target data classification and grading module, a hierarchical encryption transmission module, a context-aware permission verification module and a blockchain audit storage module.
[0100] The target data classification and grading module is used for dynamic classification and grading of target data; the target data is marked as low sensitive level, medium sensitive level and high sensitive level by multi-dimensional feature extraction and analytic hierarchy process to obtain the target data comprehensive sensitivity score.
[0101] The hierarchical encryption transmission module performs hierarchical encryption transmission based on different sensitivity levels of the target data; the target data is encrypted by matching the corresponding national secret algorithm combination according to the sensitivity level of the target data, to generate a transmission data packet containing session key encryption information and integrity check value.
[0102] The context-aware permission verification module is used for context-aware permission verification; the user context attributes are extracted based on the attribute-based access control model, the permission strategy library is matched and the grading approval process is triggered to generate a temporary access token.
[0103] The blockchain audit storage module is used for blockchain audit storage; the whole-process operation log is collected and stored on the chain after SM3 hash calculation, and the audit query and traceability based on the blockchain are supported.
[0104] Finally: the above only describes the preferred embodiments of the present application and does not limit the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
[0105] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A method for supply chain data security management, characterized in that: Comprise the following steps: Step one, dynamic classification of target data; through multi-dimensional feature extraction and analytic hierarchy process to obtain the comprehensive sensitivity score of target data, and mark the target data as low sensitivity level, medium sensitivity level and high sensitivity level respectively; Step two, layered encryption transmission based on different sensitivity levels of target data; according to the sensitivity level of target data, match the corresponding national secret algorithm combination for encryption, generate transmission data packet containing session key encryption information and integrity check value; Step three, context-aware permission verification; extract user context attributes based on attribute-based access control model, match permission policy library and trigger hierarchical approval process, and generate temporary access token; Step four, block chain audit and evidence storage; Collect the whole process operation log, and chain storage after SM3 hash calculation, support blockchain-based audit query and traceability.
2. The supply chain data security management method of claim 1, wherein: The target data includes procurement data, production data, logistics data and sales data, the procurement data includes procurement quantity, procurement category and procurement amount, the production data includes production quantity and production time, the logistics data includes logistics progress, logistics personnel and logistics time, and the sales data includes sales amount, sales quantity and sales personnel.
3. The supply chain data security management method of claim 2, wherein: The multi-dimensional feature extraction of target data in step S11 comprises: Step S11, multi-dimensional feature extraction of target data; Step S12, construct sensitivity evaluation index system; Step S13, obtain the comprehensive sensitivity score by analytic hierarchy process; Step S14, sensitivity level division based on comprehensive sensitivity score.
4. The supply chain data security management method of claim 3, wherein: The multi-dimensional feature extraction of target data in step S11 comprises: The target data is divided into three feature levels, namely first-level feature, second-level feature and third-level feature; the first-level feature is procurement data, production data, logistics data and sales data, the second-level feature is data attribute, that is, detailed category of first-level feature, and the third-level feature is importance degree feature, that is, importance degree of second-level feature, the importance degree feature includes regular feature, temporary feature and emergency feature, the regular feature corresponds to ordinary importance degree, the temporary feature means that the corresponding second-level feature is temporary data, and the emergency feature corresponds to important importance degree.
5. The supply chain data security management method of claim 4, wherein: The sensitivity evaluation index system in step S12 comprises: The weights of the primary features, secondary features, and tertiary features are defined, and the weight of the i-th primary feature is denoted as a i , the weight of the j-th secondary feature under the i-th primary feature is denoted as b ij , and the weight of the k-th tertiary feature under the i-th primary feature and the j-th secondary feature is denoted as c ijk . Based on Delphi method, the weights of first-level feature, second-level feature and third-level feature are scored by experts, the score corresponds to the weight value, and the score is between 0 and 1; so as to obtain the weight value of all data items in first-level feature, second-level feature and third-level feature.
6. The supply chain data security management method of claim 5, wherein: The comprehensive sensitivity score obtained by analytic hierarchy process in step S13 comprises: wherein S represents the comprehensive sensitivity score, m represents the total number of data items within the primary feature, n represents the total number of data items within the secondary feature under the i-th primary feature, s ijk represents the data item sensitivity score of the k-th tertiary feature under the i-th primary feature and the j-th secondary feature.
7. The supply chain data security management method of claim 6, wherein: The sensitivity level division based on comprehensive sensitivity score in step S14 comprises: Set first threshold YU1 and second threshold YU2, if the comprehensive sensitivity score satisfies S>YU1, it is high sensitivity level; if the comprehensive sensitivity score satisfies YU2≤S<YU1, it is medium sensitivity level; if the comprehensive sensitivity score satisfies S<YU2, it is low sensitivity level.
8. The supply chain data security management method of claim 7, wherein: The step two is a hierarchical encryption transmission based on different sensitivity levels of target data, and specifically includes the following steps: Step 21, generating a session key; the sender node generates a temporary asymmetric key pair through the national secret SM2 algorithm, including a private key SK session and the public key PK session ; Step 22, encrypting the data body; and selecting a symmetric encryption algorithm according to different sensitivity levels; Step 23, for medium sensitive level data and high sensitive level data, session key encryption is performed, and the sender uses the public key PK of the receiver node B The encryption key of the medium sensitive level data and the high sensitive level data is SM2 encrypted to obtain E(K) = SM2. Encrypt(K, PK B );The public key PK B B represents the receiver through CA certificate authentication Step 24, generating an integrity check value; calculating an SM3 hash value of the data and attaching the SM3 hash value to a header of the encrypted data packet; the SM3 hash value calculation is represented as H = SM3.Hash(plaintext); Step 25, construct a transmission data packet, the receiver decrypts and verifies; the receiver uses a private key SK B Decrypt E(K) to get the encryption key, use the key to decrypt C to get plaintext', calculate H' = SM3.Hash(plaintext'), if H' = H, the verification is passed, otherwise, discard the data packet and trigger an alarm, and record as an abnormal log for storage.
9. The supply chain data security management method of claim 8, wherein: The step four is a blockchain audit and evidence storage, and the specific steps are as follows: Step 41, collecting full-process logs; collecting log fields in each link of target data classification and grading, encryption transmission, and data access, the log fields including data operation type, operation timestamp, operation node, operation user, data identifier, and operation result; Step 42, generating a log hash; performing SM3 hash calculation on the format and content of each log; Step 43, performing on-chain storage; synchronizing the log hash and the original log to a supply chain alliance chain through a blockchain node; Step 44, audit query and traceability; querying through the blockchain, verifying the integrity of the log through a Merkle tree, and automatically generating an audit report if an abnormality is found.
10. A supply chain data security management system for using the supply chain data security management method according to any one of claims 1-9, characterized by: The system includes a target data classification and grading module, a hierarchical encryption transmission module, a context-aware permission verification module, and a blockchain audit and evidence storage module. The target data classification and grading module is used for dynamically classifying and grading target data; the target data is marked as low-sensitive, medium-sensitive, and high-sensitive by extracting multi-dimensional features and using the analytic hierarchy process to obtain a comprehensive sensitivity score of the target data; The hierarchical encryption transmission module performs hierarchical encryption transmission based on different sensitivity levels of target data; the target data is encrypted by matching a corresponding national secret algorithm combination according to the sensitivity level of the target data, to generate a transmission data packet containing session key encryption information and an integrity check value; The context-aware permission verification module is used for context-aware permission verification; the user context attributes are extracted based on an attribute-based access control model, the permission policy library is matched, and a hierarchical approval process is triggered to generate a temporary access token; The blockchain audit and evidence storage module is used for blockchain audit and evidence storage; The full-process operation logs are collected, SM3 hash calculation is performed, and the logs are stored on the chain, supporting blockchain-based audit query and traceability.