A data labeling method, system, device, and medium

Abstract

The application provides a data marking method, system, device and medium, and belongs to the technical field of data security protection, wherein the method establishes a data grading classification strategy library, and selects a three-level marking mode according to a low, medium and high security level. The low level places the type and grade mark after splicing in front of the data; the medium level inserts the data alternately by combining the type key encryption offset value after splicing the mark; and the high level uses the type and grade key XOR to obtain the encryption key to encrypt the data, and splices the mark information to form the output. The data marking mode involved in the application can be applied to multiple fields, marks the data of the corresponding field, realizes accurate marking of data grading classification, adopts the adaptive marking mode of different levels, guarantees the data identifiability, provides differentiated protection according to the security requirement, improves the data management security and flexibility, and is convenient for the grading management and control and security protection of the data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security protection, and particularly relates to a data marking method, system, device and medium. BACKGROUND

[0002] Today, with the rapid popularization of cloud computing, big data and artificial intelligence, enterprises and related institutions have to collect, store, share and destroy massive data every day. The data protection means mainly rely on boundary isolation, access control, encryption or post-audit, which is difficult to continuously track the security attributes of data in the whole life cycle. Once the data leaves the original system, the original security policy will be invalid, resulting in out-of-control data.

[0003] The related technology usually uses full encryption or full plaintext marking for all data, resulting in low processing efficiency of low-sensitive data and insufficient security of high-sensitive data. This leads to the fact that the protection strength is not designed according to the difference of data sensitivity, low-sensitive data bears unnecessary encryption overhead, and high-sensitive data has the risk of leakage due to the fact that the protection strength is not targeted to be improved, resulting in the coexistence of inefficiency and insecurity.

[0004] When encrypting, collecting, storing and sharing data, the data usually needs to be marked. The marking usually uses data preposition plaintext label, which is easy to be maliciously deleted or tampered with, resulting in the fact that the subsequent processing link cannot identify the data attribute, and further causing misoperation or information leakage. Some technologies store the marking in an independent database, and when the data is transmitted, backed up or the database fails, the marking is easy to be disconnected from the data, and the data type and level cannot be traced. Some markings are based on external system association, and once the external system is abnormal, the binding relationship between the data and the marking is invalid, which destroys the continuity and traceability of data monitoring. SUMMARY

[0005] The application provides a data marking method, which realizes the coverage of data from low to high full security level by hierarchical strategy, differential marking and encryption binding, takes into account the marking efficiency and security, and reduces the data leakage risk.

[0006] The method comprises the following steps:

[0007] Step S101: establishing a data hierarchical classification strategy library;

[0008] Step S102: classifying and determining the input data according to the data hierarchical classification strategy library to obtain the type identification, type key, level identification and level key corresponding to the input data;

[0009] Step S103: According to the security level represented by the grade identifier obtained in step S102, the input data is divided into a low security level, a medium security level or a high security level, and a first level data marking method, a second level data marking method or a third level data marking method is selected accordingly;

[0010] Step S104: When the first level data marking method is selected, the type identifier obtained in step S102 and the grade identifier are spliced in sequence to form a first level data mark, and the first level data mark is placed in front of the input data together with the marking type information to form first output data;

[0011] Step S105: When the second level data marking method is selected, the type identifier and the grade identifier obtained in step S102 are spliced to form a second level data mark, and the second level data mark is divided into a plurality of marking blocks according to a preset length; a plurality of offset values smaller than the length are generated according to the length of the input data, and each offset value is encrypted using the type key obtained in step S102 to form offset ciphertext; according to a preset initial insertion position, the marking block and the corresponding offset ciphertext are alternately inserted into the input data to form second output data;

[0012] Step S106: When the third level data marking method is selected, the type key obtained in step S102 is XORed with the grade key to obtain an encryption key, and the input data is encrypted using the encryption key to generate input data ciphertext; the marking type information and the input data ciphertext are spliced to form third output data.

[0013] Further, step S101 further comprises: based on the use scenario, adding self-defined information, and generating a unique association identifier for each added self-defined information;

[0014] The type key and the grade key are set with a creation time, a valid time length and an update trigger condition. In the key life cycle, the key security is checked regularly according to a preset key strength verification algorithm, and if it is lower than the security threshold, the regeneration process is triggered;

[0015] When the input data source involves different business domains and system domains, the classification and grading method of the external domain is converted into the type identifier, the grade identifier and the corresponding key recognized by the system by analyzing the cross-domain identifier carried by the data, so as to realize unified marking adaptation of cross-domain data;

[0016] The type identifier, the grade identifier and the key information are mapped to different storage nodes according to the data content hash calculation result by using a data hash value segmentation storage method.

[0017] Further, step S102 specifically comprises:

[0018] extracting a data feature vector from the received input data to be processed;

[0019] The first-level judgment is made based on the extracted feature vector through a data hierarchical classification strategy library, each rule in the data hierarchical classification strategy library corresponding to a type identifier or a level identifier in the data hierarchical classification strategy library; if the first-level judgment does not match a unique result, a second-level judgment is started, a pre-trained classification model is called, the input is defined as a feature vector, and the output is a probability distribution of a type identifier or a level identifier;

[0020] The multi-level classification judgment results are fused; if the results of the data hierarchical classification strategy library and the classification model are abnormal, the results of a high-trust source are selected according to the trust level of the data source;

[0021] The finally determined type identifier, type key, level identifier, and level key are stored in association with the feature vector of the input data in a local cache.

[0022] It should be further explained that step S103 specifically includes:

[0023] When judging the security level of the input data, at least one of the risk assessment result of the current system running environment, the data sensitivity score, and the user permission level is used to adjust the judgment threshold of the security level;

[0024] When the security level judgment result is in the critical region of adjacent levels, at least two of the field matching result of the input data, the confidence of the classification model, and the trust level of the data source are combined to determine the final security level by a weighted scoring method;

[0025] The historical judgment data are analyzed, and the judgment accuracy rates corresponding to each type identifier and level identifier are counted; when the judgment accuracy rate of a certain type or level is lower than a preset threshold, the judgment logic optimization process of the type or level is triggered; the optimization process includes at least one of adjusting the field matching rule, updating the classification model parameters, and adding the judgment factors.

[0026] It should be further explained that step S104 further includes the following steps:

[0027] Before generating the first-level data tag, a timestamp and a random disturbance string are created, and the timestamp and the disturbance string are concatenated and then irreversibly transformed to form a one-time tag prefix;

[0028] The one-time tag prefix is sequentially concatenated with the type identifier and the level identifier, and then an integrity verification segment is appended;

[0029] Before placing the first-level data tag in the input data, a position offset indication code is generated according to the content of the first several bytes of the input data;

[0030] The one-time tag prefix, integrity check segment, random noise gap length value, and first output data are encapsulated into a logical unit and a version number tag is attached. The version number tag is incremented only when the policy library is updated, so that the old version tag can be immediately identified and isolated in the new environment.

[0031] It should be further explained that step S105 specifically includes:

[0032] Before segmenting the second-level data markers, the format characteristics of the input data are identified, and the position information is also identified. Based on the position information, the segment length is adjusted to avoid the value of the marker position, so that the segmentation point of the marker block falls on a non-format key position.

[0033] When generating offset values, the input data is scanned to identify the interval distance of repeated fields and the distribution density of data segments containing sensitive fields.

[0034] After inserting the marked blocks and offset ciphertext into the input data, extract the original data fragments of a preset number of bytes before each insertion position and the original data fragments of a preset number of bytes after each insertion position. Combine and encode these two fragments to generate fragment association information. Concatenate the fragment association information corresponding to all insertion positions in the insertion order and append it to the end of the second output data.

[0035] Add two fields to the tag type information. The first field is the block management field, which records the total number of tag blocks and the sequential number of each block. The second field is the traceability field, which records the hardware identifier and processing timestamp of the data processing node. After concatenating these two fields with the original tag type information, insert them into the input data along with the tag blocks.

[0036] It should be further explained that step S106 specifically includes:

[0037] After generating the encryption key, an expiration flag is added to the encryption key. The expiration flag records the validity period of the key and the generation time. When the validity period is exceeded, a new encryption key is generated by XOR operation of the type key and the level key, and the old key automatically becomes invalid.

[0038] During the process of encrypting input data to generate ciphertext, verification information for the encryption process is generated simultaneously, and the verification information is stored in association with the ciphertext.

[0039] Add an encryption algorithm identifier to the tag type information. The encryption algorithm identifier is used to indicate the type of encryption algorithm used to generate the ciphertext of the input data, so that the decryption end can match the corresponding decryption algorithm.

[0040] The tag type information, input data ciphertext, and verification information are encapsulated according to a preset hierarchical structure to form the third output data with hierarchical encapsulation.

[0041] This application also provides a data tagging system, the system comprising:

[0042] The strategy library building module is used to establish a data hierarchical classification strategy library;

[0043] The hierarchical classification and determination module is used to classify and determine the input data according to the data hierarchical classification strategy library, and obtain the type identifier, type key, level identifier and level key corresponding to the input data;

[0044] The security level routing module is used to divide input data into low security level, medium security level or high security level according to the security level represented by the level identifier, and select the first level data marking method, the second level data marking method or the third level data marking method accordingly.

[0045] The first-level explicit tagging module is used to concatenate the type identifier and the level identifier in sequence to form the first-level data tag when the first-level data tagging method is selected. The first-level data tag, along with the tag type information, is placed before the input data to form the first output data.

[0046] The second-level block embedding tag module is used to concatenate the type identifier and the level identifier to form a second-level data tag when the second-level data tagging method is selected. The second-level data tag is then divided into multiple tag blocks according to a preset length. Several offset values ​​smaller than the length are generated based on the length of the input data. Each offset value is encrypted using the type key to form offset ciphertext. According to the preset initial insertion position, the tag blocks and the corresponding offset ciphertexts are alternately inserted into the input data to form the second output data.

[0047] The three-level implicit encryption tagging module is used to XOR the type key and the level key to obtain the encryption key when the third-level data tagging method is selected. The encryption key is used to encrypt the input data to generate the input data ciphertext. The tag type information is concatenated with the input data ciphertext to form the third output data.

[0048] According to another embodiment of this application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the data tagging method.

[0049] According to yet another embodiment of this application, a storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the data marking method.

[0050] As can be seen from the above technical solutions, the present invention has the following advantages:

[0051] The data tagging method provided by this invention divides data into low, medium, and high security levels and matches different tagging strengths. This invention employs low-level direct tagging, medium-level embedded encryption offset, and high-level full data encryption, avoiding the need for a uniform encryption protection mode. This provides stronger security for highly sensitive data and reduces unnecessary processing overhead for low-sensitive data.

[0052] In this invention, all levels of tags are directly linked to the input data, while the rest are pre-defined, embedded, or encrypted. This avoids the loss of association caused by the separation of tags and data, ensuring that the data's type and level can always be identified during transmission, storage, and use. This invention generates unique identifiers and type / level keys for each data type and level, avoiding issues such as type misjudgment and access violation caused by duplicate identifiers or mixed keys, thus improving the accuracy of data management.

[0053] This invention employs simple splicing for low-level tags while maintaining efficient processing; for mid-level tags, it uses block embedding and offset encryption to ensure a certain level of security without affecting basic data availability; and for high-level tags, it uses full encryption to prioritize confidentiality, achieving a balance between security and efficiency in different scenarios and ensuring secure and controllable data. Attached Figure Description

[0054] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 Flowchart of the data labeling method;

[0056] Figure 2 This is a schematic diagram of an example of a first-level data labeling implementation.

[0057] Figure 3 This is a schematic diagram of an embodiment of second-level data labeling;

[0058] Figure 4 This is a schematic diagram of an example of a third-level data labeling system;

[0059] Figure 5 This is a schematic diagram of an electronic device. Detailed Implementation

[0060] The data tagging method provided by this invention can classify and categorize data hierarchically. Specifically, hierarchical classification can be implemented during data storage and can also be used for hierarchical classification and protection of data during transmission. The data tagging method involved in this invention can be applied to specific fields to achieve hierarchical classification of data.

[0061] Specifically, in government data management, resident identity information, government service processing data, and policy document data can be tagged. For example, resident identity card information is high-security data and uses a third-level data tagging method, encrypting it with an encryption key to ensure that when it circulates within the government system or is shared with other departments, only authorized systems with the level key and type key can decrypt and view it, preventing the leakage of sensitive identity information. Policy documents related to government information disclosure are low-security data and use a first-level data tagging method, appending a type identifier and level identifier to the beginning of the document, facilitating quick identification and classification display by the government platform.

[0062] For financial data, such as user bank account transaction data, credit rating data, and financial product design data, this data tagging method can be used. Large transaction data from bank accounts, which falls under a high security level, is encrypted using a Level 3 data tagging method to ensure the security of transaction data during transmission within the bank's internal systems and with payment institutions or regulatory agencies, preventing the illegal theft and alteration of transaction information. Promotional materials for financial products, which fall under a low security level, are tagged using a Level 1 data tagging method, adding type identifiers such as financial product promotional material and rating identifiers to facilitate categorized storage and retrieval by the financial institution's internal document management system.

[0063] In the education sector, student registration information, exam paper data, and teaching resource data can be tagged. Student registration information contains sensitive content such as ID numbers and home addresses, and is classified as high-security data. It is encrypted using a third-level data tagging method to ensure security during transfer between school departments and when reporting to education authorities. Ordinary teaching materials, exercise sets, and other teaching resources are classified as low-security data and are classified as first-level data tagging data. A type identifier, such as "teaching materials" and "grade identifier," is appended to the resource file to facilitate teachers' quick searching and categorization on the teaching platform.

[0064] This method can be applied to production process data, equipment operating parameter data, and product quality inspection data in industrial manufacturing. Core production process formula data belongs to a high security level and is encrypted using a third-level data tagging method to prevent leakage when the process formula is transmitted between the enterprise's R&D and production departments or shared with supply chain partners, thus protecting the enterprise's core technologies. Ordinary daily equipment operation log data belongs to a low security level and is encrypted using a first-level data tagging method, adding equipment operation log type and level identifiers to the beginning of the log file, which facilitates the factory's equipment management system to classify and store the logs and to quickly retrieve them during fault diagnosis.

[0065] In IoT scenarios, sensor data, device control command data, and device authentication data from various smart devices can be tagged. Real-time sensor data from power equipment in the smart grid (such as key parameters like voltage and current) is classified as high-security data and is encrypted using a third-level data tagging method to ensure data security during transmission between devices and the grid control center, preventing data tampering that could lead to grid failures. Ordinary status reporting data from smart home appliances (such as whether the appliance is on) is classified as low-security data and is tagged using a first-level data tagging method, with a type identifier (such as appliance status data) and a level identifier appended to the data. This allows users to view and categorize device status on the smart home management platform.

[0066] The data tagging method involved in this application will be described in detail below. Specific details such as particular system architectures and technologies are presented for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details.

[0067] It should be understood that, when used in this specification, the term "comprising" indicates the presence of the described feature, integral, step, operation, element, and / or component, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0068] The terms "one embodiment" or "some embodiments" used in this application mean that one or more embodiments of this application include the specific features, structures, or characteristics described in that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this application do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0069] In embodiments of the present invention, computer program code for performing the operations of the present invention can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer. In cases involving a remote computer, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (exemplarily using an Internet service provider for Internet connection).

[0070] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] Please see Figure 1 The diagram shows a flowchart of a data tagging method in a specific embodiment. The method includes:

[0072] Step S101: Establish a data classification strategy library.

[0073] In some embodiments, the data classification strategy module may be configured to classify data according to its business attributes, and the classification method may be configured according to the degree of impact of data leakage.

[0074] Optionally, business attributes can be categorized as user data, transaction data, product data, etc. The grading method can be no impact, slight impact, severe impact, etc.

[0075] In this embodiment, the generated type identifier can be a string containing a classification code, and the type key is a randomly generated fixed-length character sequence; the grade identifier can be a numeric code, and the grade key is another random character sequence.

[0076] In this embodiment, when information is stored in the policy library, it will be associated with the corresponding classification and grading rules. When the policy is adjusted, a new identifier and key will be regenerated to overwrite the old value.

[0077] In this way, by using preset classification and grading rules, a unique identifier and key are assigned to each data type and level, establishing a basic mapping relationship for data classification and grading, and supporting updates to adapt to rule changes.

[0078] Step S102: Based on the data classification strategy library, classify the input data according to its classification level to obtain the type identifier, type key, level identifier, and level key corresponding to the input data.

[0079] In some embodiments, the received data to be processed may include formats such as text, tables, and images. Field matching specifically involves extracting relevant fields from the data and comparing them with the feature fields of classification rules in the policy library. This embodiment may also employ a pre-trained text classification model to identify sensitive word patterns in the text and match them with hierarchical features in the policy library. After determination, the identifier and key for that type and level are directly retrieved from the policy library.

[0080] Therefore, by matching the features of the input data with the classification and grading rules in the policy library, the most suitable type and level can be found, and then the corresponding identifier and key can be obtained to achieve the binding of data with classification and grading attributes.

[0081] Step S103: Based on the security level represented by the level identifier obtained in step S102, divide the input data into low security level, medium security level or high security level, and select the first level data marking method, the second level data marking method or the third level data marking method accordingly.

[0082] In some embodiments, the security level classification standard represented by the level identifier can be preset as follows: the level identifier "1" corresponds to a low security level. Optionally, the low security level can be publicly available promotional materials, which have no impact if leaked.

[0083] "2" corresponds to the medium security level, which is optional. Internal work records will have a slight impact if leaked.

[0084] "3" corresponds to a high security level, which is optional and is the core user password. Its leakage would have serious consequences.

[0085] The first level of marking corresponds to a low level, the second level to a medium level, and the third level to a high level.

[0086] It can be seen that the security risk level of data is determined by the numerical value or code of the level identifier, and the corresponding marking method is selected according to the preset mapping relationship, so that the marking strength matches the security requirements and improves the rationality of the overall security strategy.

[0087] Step S104: When the first-level data marking method is selected, the type identifier and level identifier obtained in step S102 are concatenated in sequence to form the first-level data mark. The first-level data mark, together with the mark type information, is placed before the input data to form the first output data.

[0088] In some embodiments, a fixed separator is used when concatenating the type identifier and the level identifier. For example, the type identifier "ABF" and the level identifier "1" are concatenated to form "ABF-1"; the tag type information is descriptive text, which can be "first-level tag". The final output data format is "tag type information + ABF-1 + input data content", for example, "first-level tag: ABF-1 - functional introduction of product A".

[0089] This embodiment appends the data type and level information to the data header in plaintext, reflecting the data's classification and grading attributes, facilitating rapid identification, and improving the processing efficiency of low-sensitivity data.

[0090] In some specific embodiments, step S104 specifically includes the following steps:

[0091] Step S1041: Before generating the first-level data marker, create a timestamp and a random perturbation string, and then concatenate the timestamp and the perturbation string and perform an irreversible transformation to form a one-time marker prefix, so that the same type of identifier and level identifier will inevitably produce different marker appearances in different processing.

[0092] Step S1042: After sequentially concatenating the one-time tag prefix with the type identifier and the level identifier, an integrity verification segment is added. The verification segment is derived from the prefix, type identifier, and level identifier and is used to verify whether the tag has been tampered with or truncated in the subsequent extraction stage.

[0093] Step S1043: Before placing the first-level data marker in the input data, generate a position offset indicator code based on the first few bytes of the input data. The indicator code determines the length of the insertion gap between the first-level data marker and the input data. The gap is filled with random noise to prevent attackers from locating the marker by fixing the offset.

[0094] Step S1044: Encapsulate the one-time tag prefix, integrity check segment, random noise gap length value and first output data into a logical unit, and attach a one-time version number tag. The version number tag is incremented only when the policy library is updated, so that the old version tag can be immediately identified and isolated in the new environment.

[0095] As can be seen, the one-time tag prefix ensures that the same data type and level will have a completely different appearance each time it is processed, preventing replay and comparison-based attacks. The integrity check segment provides fast and verifiable integrity confirmation, allowing for the detection of truncation or tampering without decryption. The position offset indicator code and random noise gaps cause the tag insertion position to change, preventing attackers from locating or deleting tags in batches using fixed offsets. The version number tag implements hard isolation between policy library versions; old version tags immediately become invalid in the new policy environment, avoiding the risk of misidentification or downgrade caused by policy updates.

[0096] Step S105: When the second-level data marking method is selected, the type identifier and the level identifier obtained in step S102 are concatenated to form the second-level data mark. The second-level data mark is divided into multiple mark blocks according to a preset length. Several offset values ​​smaller than the length are generated according to the length of the input data. Each offset value is encrypted using the type key obtained in step S102 to form offset ciphertext. According to the preset initial insertion position, the mark blocks and the corresponding offset ciphertexts are alternately inserted into the input data to form the second output data.

[0097] In some embodiments, after the second-level data tags are concatenated, the preset block length can be set to 16 bytes. For example, the concatenated tags are 32 bytes, and the blocks are two 16-byte blocks. When the input data length is 200 bytes, two offset values ​​are generated. The offset values ​​are encrypted with a type key to obtain offset ciphertext. The system presets the initial insertion position to be the 10th byte of the data. The alternating insertion method is "tag block 1 + offset ciphertext 1 + input data fragment 1 + tag block 2 + offset ciphertext 2 + input data fragment 2", which finally forms mixed data.

[0098] Therefore, dividing the tag information into blocks and embedding it alternately with encrypted offset position information within the data not only prevents the tag from being easily stripped away, but also verifies the integrity of the tag through offset ciphertext, thereby enhancing the tag's resistance to tampering.

[0099] In one embodiment of the present invention, step S105 further includes the following steps:

[0100] S1051: Before segmenting the second-level data markers, first identify the format characteristics of the input data. For text data, extract the position information of newline characters and paragraph separators; for binary data, extract the position information of file header identifiers and data segment start identifiers. Based on the position information, adjust the segment length to avoid the identifier positions so that the segmentation point of the marker blocks falls on non-format key positions.

[0101] S1052: When generating offset values, the input data is scanned to identify the interval distance of repeated fields and the distribution density of data segments containing sensitive field identifiers;

[0102] S1053: After inserting the marker block and offset ciphertext into the input data, extract the original data segment of a preset number of bytes before each insertion position and the original data segment of a preset number of bytes after each insertion position, combine and encode these two segments to generate segment association information, and concatenate the segment association information corresponding to all insertion positions in the insertion order and append it to the end of the second output data.

[0103] This embodiment extracts and encodes fixed-length original data segments before and after the insertion position to generate segment association information. During parsing, the corresponding segment can be extracted and encoded again, and compared with the additional association information to verify whether the insertion process caused the data segment to be tampered with or broken. The core is the association encoding and verification logic of the data segments before and after the insertion position.

[0104] S1054: Add two fields to the tag type information. The first field is the block management field, which records the total number of tag blocks and the sequential number of each block. The second field is the traceability field, which records the hardware identifier and processing timestamp of the data processing node. After concatenating these two fields with the original tag type information, insert them into the input data along with the tag blocks.

[0105] This embodiment ensures that the parsing end can assemble the marker blocks in the original order through the block management field, and realizes the traceability of the marker processing process by recording the processing source and time of the marker insertion through the traceability processing node identifier and timestamp.

[0106] It can be seen that step S105 adjusts the length of the marker blocks by recognizing data format characteristics, guides the distribution of offset values ​​by combining data content characteristics, performs correlation coding verification on data segments before and after the insertion position, and adds block management and traceability fields to the marker type information, so that the second-level data markers can avoid key data structures and content areas during the insertion process, and ensure data integrity through correlation verification, while realizing orderly block splicing and processing traceability.

[0107] Step S106: When the third-level data marking method is selected, the type key and the level key obtained in step S102 are XORed to obtain the encryption key. The encryption key is used to encrypt the input data to generate the input data ciphertext. The marking type information is concatenated with the input data ciphertext to form the third output data.

[0108] In some embodiments, the type key and the level key are XORed to obtain the encryption key.

[0109] For example, the type key "01001101" and the level key "10110010" are XORed together. If the corresponding bits are the same, the result is 0; if they are different, the result is 1, resulting in the encryption key "11111111".

[0110] The input data is symmetrically encrypted using this key to generate ciphertext; the tag type information is the XOR result of the type identifier and the level identifier, and the final output is a combination of "tag type information + ciphertext".

[0111] This embodiment generates an encryption key by XORing the key, which encrypts the data itself. At the same time, the tag information is also XORed. Only authorized parties who possess the original key can decrypt the data and parse the tag to realize the data content, effectively preventing the leakage and misuse of highly sensitive data.

[0112] In some specific embodiments, step S106 specifically includes the following steps:

[0113] S1061: After generating the encryption key, add an expiration flag to the encryption key. The expiration flag records the validity period of the key and the generation time. When the validity period is exceeded, a new encryption key is generated by XOR operation of the type key and the level key, and the old key automatically becomes invalid.

[0114] This embodiment limits the usage period of encryption keys by using an expiration date identifier to avoid security risks caused by keys being valid for a long time. The validity period recorded by the expiration date identifier can be preset according to data security requirements. After the expiration date is exceeded, the encryption key must be regenerated using the currently valid type key and level key when decrypting, and the old key cannot be used for decryption.

[0115] S1062: During the process of encrypting input data to generate ciphertext, verification information of the encryption process is generated simultaneously. The verification information contains a feature digest of the data before encryption. The verification information is associated with the ciphertext and stored for verification of the integrity of the ciphertext during subsequent decryption.

[0116] This embodiment verifies the integrity of the encrypted data through verification information. Before encryption, the feature digest of the input data is extracted as verification information. During decryption, the features of the decrypted data are compared with the verification information. If they match, it means that the encrypted data has not been tampered with, ensuring that the decrypted data is consistent with the original data. The core is the consistency verification logic of the data features before and after encryption.

[0117] S1063: In addition to the XOR result of the type identifier and the level identifier, an encryption algorithm identifier is added to the tag type information. The encryption algorithm identifier is used to indicate the type of encryption algorithm used to generate the ciphertext of the input data, so that the decryption end can match the corresponding decryption algorithm.

[0118] This embodiment clearly identifies the encryption algorithm type through an encryption algorithm identifier. Different encryption scenarios may employ different encryption algorithms. The identifier uses a preset code to correspond to different implementations of symmetric or asymmetric encryption. The decryption end selects a matching decryption algorithm based on the identifier, avoiding decryption failure due to algorithm mismatch. The core is the mapping logic between algorithm type and identifier.

[0119] S1064: Encapsulate the tag type information, input data ciphertext, and verification information according to a preset hierarchical structure, where the tag type information serves as the outer layer guiding information, the input data ciphertext serves as the middle layer configuration content, and the verification information serves as the inner layer verification basis, forming the third output data of the hierarchical encapsulation.

[0120] This embodiment optimizes the structure of the third output data through layered encapsulation. The outer layer's tag type information guides the decryption end to quickly identify key information, the middle layer's encrypted data is protected as the core content, and the inner layer's verification information is used for final integrity verification. The layered structure makes the functions of each part of the data clear, facilitating the decryption end to parse it layer by layer.

[0121] In one embodiment of the present invention, based on step S101, the following will provide a possible embodiment and its specific implementation will be described in a non-limiting manner. Step S101 specifically includes:

[0122] S1011: Add custom information based on usage scenarios, generate a unique association identifier for each new custom information, and map the association identifier to the original type identifier and level identifier in multiple dimensions for subsequent data marking, association and traceability.

[0123] S1012: Set the creation time, validity period, and update trigger conditions for type keys and level keys. During the key lifecycle, the key security is checked periodically according to the preset key strength verification algorithm. If it falls below the security threshold, the regeneration process is automatically triggered.

[0124] S1013: When the input data source involves different business domains and system domains, the classification and hierarchical methods of external domains are converted into type identifiers, level identifiers and corresponding keys that can be recognized by this system by parsing the cross-domain identifiers carried in the data, so as to realize the unified labeling and adaptation of cross-domain data.

[0125] S1014: Adopts a storage method based on data hash value segmentation, which maps type identifier, level identifier, and key information to different storage nodes according to the hash calculation results of data content. At the same time, an index table is built, and the index pointer is adjusted according to the recent access frequency and access volume to improve the storage access efficiency of identifier and key.

[0126] This embodiment utilizes data hashing characteristics and access frequency adjustment to optimize the efficiency of identifier and key storage access, enabling identifier keys for frequently accessed data to be obtained more quickly, thereby improving the overall read and write performance of basic data tagging information.

[0127] Therefore, this embodiment improves the generation of data classification information by expanding the classification and grading dimensions, key management, cross-domain data adaptation, and storage optimization. It allows the data labeling basis to be configured according to the data scenario, ensuring the security of the identification key, adapting to cross-domain data, and improving storage access efficiency.

[0128] In one embodiment of the present invention, based on step S102, the following will provide a possible embodiment and its specific implementation will be described in a non-limiting manner. Step S102 specifically includes:

[0129] S1021: Extract the data feature vector from the received input data to be processed;

[0130] The feature vector includes at least one of the following: data field content, data format, data source, and data generation time.

[0131] S1022: Based on the extracted feature vector, the first-level judgment is performed through the data classification strategy library. Each rule in the data classification strategy library corresponds to a type identifier or level identifier in the data classification strategy library. If the first-level judgment does not match a unique result, the second-level judgment is initiated, and the pre-trained classification model is called. The input is defined as a feature vector, and the output is the probability distribution of the type identifier or level identifier.

[0132] S1023: Perform fusion processing on the multi-level classification judgment results; if there are anomalies in the results of the data hierarchical classification strategy library and classification model, then select the results from the high-trust sources according to the trust level of the data sources, or select the results with the highest weighted average probability according to the accuracy weight of historical judgment data.

[0133] S1024: Associate the finalized type identifier, type key, level identifier, level key with the feature vector of the input data and store them in the local cache.

[0134] In this embodiment, step S102 achieves adaptive hierarchical classification of input data through feature extraction and classification determination. When determining the final result, the determination result is associated with the feature vector and cached. The caching period is adjusted according to the data level to ensure that the data association information is synchronized when the strategy is updated.

[0135] In one embodiment of the present invention, based on step S103, the following will provide a possible embodiment and its specific implementation will be described in a non-limiting manner. Step S103 specifically includes:

[0136] S1031: When determining the security level of input data, adjust the security level determination threshold based on at least one of the following factors: the risk assessment results of the current system operating environment, the data sensitivity score, and the user permission level; the adjusted threshold is stored in association with the level identifier in the data classification strategy library.

[0137] S1032: When the security level determination result is in the critical area between adjacent levels, the final security level shall be determined by weighted scoring method, taking into account at least two of the following factors: field matching results of input data, confidence level of classification model, and trust level of data source.

[0138] S1033: Analyze historical judgment data and calculate the judgment accuracy corresponding to each type and level identifier; when the judgment accuracy of a certain type or level is lower than the preset threshold, trigger the judgment logic optimization process for that type or level; the optimization process includes at least one of the following operations: adjusting field matching rules, updating classification model parameters, and adding judgment factors.

[0139] S1034: When determining the security level, a risk coefficient is generated based on at least one environmental parameter among the transmission path, storage location, and access frequency of the input data; the risk coefficient is associated with the level identifier in the data classification strategy library and is used to correct the security level determination result.

[0140] Therefore, step S103 adjusts the security level threshold based on the system environment, data sensitivity, and user permissions; when the judgment result is in a critical region, a weighted score is applied by combining field matching, model confidence, and data source trust level; by analyzing historical judgment data, the logic for judging types or levels with low accuracy is optimized; and a real-time risk coefficient is introduced during the judgment process to correct the final security level result. This achieves precision and adaptability in security level judgment, ensuring both flexibility and accuracy in security level determination.

[0141] Furthermore, as a refinement and extension of the specific implementation of the above data tagging method embodiment, in order to illustrate a specific implementation process in this embodiment, the data tagging method specifically includes the following steps:

[0142] Based on the established data classification and grading strategy, the received data is classified into data level and category, data tags are added to the data, and data security is protected. The data tagging method is divided into three levels.

[0143] Specifically, as shown in Table 1, a type ID, type key, level ID, and level key are generated and stored for each data type and each data level. All IDs can be randomly generated and do not have any literal meaning related to data classification. The type ID, type key, level ID, and level key can be regenerated when the data classification strategy is adjusted.

[0144] Table 1: Data Hierarchy and Classification Corresponding Identifiers and Keys

[0145]

[0146] Using field matching, the received data is classified and identified according to a data classification strategy.

[0147] The determined data classification results generate data tags for the input data and output data with these tags. The data tag generation method has three levels:

[0148] In this embodiment, the first-level data tagging is used for data with low security levels and whose category can be intuitively determined through data content. A data tag of {Type ID||Level ID} is generated, and the tag type and data tag are added before the input data to form a structure like this: Figure 2 The labeled data shown is output.

[0149] The second level of data tagging in this embodiment is used for data with a medium level of security, which does not contain sensitive data and whose content makes it difficult to intuitively determine its category. For example... Figure 3 As shown, the generated data tags are {Type ID||Level ID}. The binary data of the data tags is divided into blocks to obtain {T_block1,T_block2,…,T_blockn}. Based on the length of the input data, n-1 data offset values ​​{Offset1,Offset2,…,Offset(n-1)} are generated, and the sum of all data offset values ​​is less than the length of the input data. All data offset values ​​are encrypted using the tag type key to obtain the ciphertext data offset values ​​{EnOffset1,EnOffset2,…,EnOffset(n-1)}. The data tag blocks and the ciphertext data offsets are inserted into the input data to obtain the output data with data tags. The system sets the initial insertion position of the first tag block. The tag type also contains the number of data tag blocks, n. The data offset values ​​are not fixed values ​​and are inserted into the data in ciphertext form, which prevents the insertion position of the data tag group from being arbitrarily obtained, thus avoiding the deletion of data tag information.

[0150] During data tag extraction, the first tag block and the first data offset ciphertext are obtained through the preset initial insertion position. The data offset ciphertext is decrypted using the key corresponding to the tag type to obtain the data offset plaintext. The second tag block and the second data offset ciphertext are obtained by counting data of length Offset1 from the end of the offset data ciphertext. All n tag blocks are obtained in sequence. After concatenating the n tag blocks, the complete data content of the data tag is obtained.

[0151] In this embodiment, data tags can be inserted multiple times into the original input data, so that only a portion of the data content is needed to extract the complete data tags.

[0152] The third-level data tag in this embodiment is used for data with a high security level that requires confidentiality protection. For example... Figure 4 As shown, based on the hierarchical classification of the input data, the corresponding type key and level key are determined. The type key and level key are XORed to obtain the encryption key. This encryption key is used to encrypt the input data, resulting in ciphertext. The tag type is then concatenated with the ciphertext to generate tagged output data. The tag type contains the XOR value of the corresponding type ID and level ID.

[0153] The third level of data tagging is implicit data tagging. The type and level of the data tag are represented by the encryption key used. Data tagging and data protection are completed simultaneously. During data tag extraction, the XOR value of the type ID and level ID is obtained from the tag type. Based on the locally recorded type ID, type key, level ID, and level key table, the specific type ID and level ID are determined. The corresponding type key and level key are used to decrypt the encrypted data. If decryption is successful, the data type and level are determined, and the original data is obtained.

[0154] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0155] The following are embodiments of the data tagging system provided by the present invention. This system and the data tagging methods of the above embodiments belong to the same inventive concept. For details not described in detail in the embodiments of the data tagging system, please refer to the embodiments of the above data tagging methods.

[0156] The system includes:

[0157] The strategy library building module is used to establish a data hierarchical classification strategy library;

[0158] The hierarchical classification and determination module is used to classify and determine the input data according to the data hierarchical classification strategy library, and obtain the type identifier, type key, level identifier and level key corresponding to the input data;

[0159] The security level routing module is used to divide input data into low security level, medium security level or high security level according to the security level represented by the level identifier, and select the first level data marking method, the second level data marking method or the third level data marking method accordingly.

[0160] The first-level explicit tagging module is used to concatenate the type identifier and the level identifier in sequence to form the first-level data tag when the first-level data tagging method is selected. The first-level data tag, along with the tag type information, is placed before the input data to form the first output data.

[0161] The second-level block embedding tag module is used to concatenate the type identifier and the level identifier to form a second-level data tag when the second-level data tagging method is selected. The second-level data tag is then divided into multiple tag blocks according to a preset length. Several offset values ​​smaller than the length are generated based on the length of the input data. Each offset value is encrypted using the type key to form offset ciphertext. According to the preset initial insertion position, the tag blocks and the corresponding offset ciphertexts are alternately inserted into the input data to form the second output data.

[0162] The three-level implicit encryption tagging module is used to XOR the type key and the level key to obtain the encryption key when the third-level data tagging method is selected. The encryption key is used to encrypt the input data to generate the input data ciphertext. The tag type information is concatenated with the input data ciphertext to form the third output data.

[0163] like Figure 5 As shown, this application also provides an electronic device, including a display module 103, a memory 102, a processor 101, and a computer program stored in the memory and executable on the processor 101, wherein the processor 101 executes the program to implement the steps of a data tagging method.

[0164] In embodiments of the present invention, electronic devices include, but are not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments described and / or claimed herein.

[0165] In this embodiment, processor 101 may be implemented using at least one of an application-specific integrated circuit, a programmable logic device, a field-programmable gate array, a processor, a controller, a microcontroller, a microprocessor, or an electronic unit designed to perform the functions described herein. In some cases, such an implementation may be implemented within a controller. For software implementation, implementations such as processes or functions may be implemented with separate software modules that allow the performance of at least one function or operation. Software code may be implemented by a software application (or program) written in any suitable programming language, and the software code may be stored in memory and executed by the controller.

[0166] The display module 103 is used to display information input by the user or information provided to the user. The display module 103 may include a display panel, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like.

[0167] The memory 102 can be used to store software programs and various data. The memory 102 may include high-speed random access memory, and may also include non-volatile memory, exemplarily at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0168] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the data marking method.

[0169] The storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, by way of example, be, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0170] In a storage medium, a readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0171] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data tagging method, characterized in that, The methods include: Step S101: Establish a data classification and categorization strategy library; Step S102: Based on the data classification strategy library, classify the input data according to its classification level to obtain the type identifier, type key, level identifier and level key corresponding to the input data; Step S103: Based on the security level represented by the level identifier obtained in step S102, divide the input data into low security level, medium security level or high security level, and select the first level data marking method, the second level data marking method or the third level data marking method accordingly. Step S104: When the first-level data tagging method is selected, the type identifier and the level identifier obtained in step S102 are concatenated in sequence to form the first-level data tag. The first-level data tag, together with the tag type information, is placed before the input data to form the first output data. Step S104 also includes the following steps: Before generating the first-level data label, a timestamp and a random perturbation string are created, and the timestamp and perturbation string are concatenated and then irreversibly transformed to form a one-time label prefix; After sequentially concatenating the one-time marker prefix with the type identifier and the level identifier, an integrity check segment is added. Before placing the first-level data markers in the input data, a position offset indicator code is generated based on the first few bytes of the input data. The one-time tag prefix, integrity verification segment, random noise gap length value and first output data are encapsulated into a logical unit and a version number tag is attached. The version number tag is incremented only when the policy library is updated, so that the old version tag can be immediately identified and isolated in the new environment. Step S105: When the second-level data marking method is selected, the type identifier and the level identifier obtained in step S102 are concatenated to form the second-level data mark. The second-level data mark is divided into multiple mark blocks according to a preset length. Several offset values ​​smaller than the length are generated according to the length of the input data. Each offset value is encrypted using the type key obtained in step S102 to form offset ciphertext. According to the preset initial insertion position, the mark blocks and the corresponding offset ciphertexts are alternately inserted into the input data to form the second output data. Step S106: When the third-level data marking method is selected, the type key and the level key obtained in step S102 are XORed to obtain the encryption key. The input data is encrypted using the encryption key to generate the input data ciphertext. The marking type information is concatenated with the input data ciphertext to form the third output data.

2. The data tagging method according to claim 1, characterized in that, Step S101 also includes: adding custom information based on the usage scenario, and generating a unique association identifier for each added custom information; Set the creation time, validity period, and update trigger conditions for type keys and level keys. During the key lifecycle, periodically check the key security according to the preset key strength verification algorithm. If it is lower than the security threshold, trigger the regeneration process. When the input data source involves different business domains and system domains, the classification and hierarchical methods of external domains are converted into type identifiers, level identifiers and corresponding keys that can be recognized by this system by parsing the cross-domain identifiers carried in the data, so as to achieve unified labeling and adaptation of cross-domain data. A storage method based on data hash value segmentation is adopted, which maps type identifier, level identifier, and key information to different storage nodes according to the hash calculation results of data content.

3. The data tagging method according to claim 1, characterized in that, Step S102 specifically includes: Extract data feature vectors from the received input data to be processed; Based on the extracted feature vectors, the first-level judgment is made through the data classification strategy library. Each rule in the data classification strategy library corresponds to a type identifier or level identifier in the data classification strategy library. If the first-level judgment does not match a unique result, the second-level judgment is initiated, which calls the pre-trained classification model, defines the input as a feature vector, and outputs the probability distribution of the type identifier or level identifier. The results of multi-level classification are fused; if there are anomalies in the results of the data hierarchical classification strategy library and the classification model, the results from the higher trust source are selected first according to the trust level of the data source. The finalized type identifier, type key, level identifier, level key, and feature vector of the input data are associated and stored in the local cache.

4. The data tagging method according to claim 1, characterized in that, Step S103 specifically includes: When determining the security level of input data, the threshold for determining the security level is adjusted based on at least one of the following factors: the risk assessment results of the current system operating environment, the data sensitivity score, and the user permission level. When the security level determination result is in the critical area of ​​adjacent levels, the final security level is determined by weighted scoring method by combining at least two of the following factors: field matching results of input data, confidence of classification model, and trust level of data source. Analyze historical judgment data and calculate the judgment accuracy for each type and level of identifier. When the judgment accuracy for a certain type or level is lower than a preset threshold, trigger the judgment logic optimization process for that type or level. The optimization process includes at least one of the following operations: adjusting field matching rules, updating classification model parameters, and adding judgment factors.

5. The data tagging method according to claim 1, characterized in that, Step S105 specifically includes: Before segmenting the second-level data markers, the format characteristics of the input data are identified, and the position information is also identified. Based on the position information, the segment length is adjusted to avoid the value of the marker position, so that the segmentation point of the marker block falls on a non-format key position. When generating offset values, the input data is scanned to identify the interval distance of repeated fields and the distribution density of data segments containing sensitive fields. After inserting the marked blocks and offset ciphertext into the input data, extract the original data fragments of a preset number of bytes before each insertion position and the original data fragments of a preset number of bytes after each insertion position. Combine and encode these two fragments to generate fragment association information. Concatenate the fragment association information corresponding to all insertion positions in the insertion order and append it to the end of the second output data. Add two fields to the tag type information. The first field is the block management field, which records the total number of tag blocks and the sequential number of each block. The second field is the traceability field, which records the hardware identifier and processing timestamp of the data processing node. After concatenating these two fields with the original tag type information, insert them into the input data along with the tag blocks.

6. The data tagging method according to claim 1, characterized in that, Step S106 specifically includes: After generating the encryption key, an expiration flag is added to the encryption key. The expiration flag records the validity period of the key and the generation time. When the validity period is exceeded, a new encryption key is generated by XOR operation of the type key and the level key, and the old key automatically becomes invalid. During the process of encrypting input data to generate ciphertext, verification information for the encryption process is generated simultaneously, and the verification information is stored in association with the ciphertext. Add an encryption algorithm identifier to the tag type information. The encryption algorithm identifier is used to indicate the type of encryption algorithm used to generate the ciphertext of the input data, so that the decryption end can match the corresponding decryption algorithm. The tag type information, input data ciphertext, and verification information are encapsulated according to a preset hierarchical structure to form the third output data with hierarchical encapsulation.

7. A data tagging system, characterized in that, The system is used to implement the data tagging method as described in any one of claims 1 to 6; The system includes: The strategy library building module is used to establish a data hierarchical classification strategy library; The hierarchical classification and determination module is used to classify and determine the input data according to the data hierarchical classification strategy library, and obtain the type identifier, type key, level identifier and level key corresponding to the input data; The security level routing module is used to divide input data into low security level, medium security level or high security level according to the security level represented by the level identifier, and select the first level data marking method, the second level data marking method or the third level data marking method accordingly. The first-level explicit tagging module is used to concatenate the type identifier and the level identifier in sequence to form the first-level data tag when the first-level data tagging method is selected. The first-level data tag, along with the tag type information, is placed before the input data to form the first output data. The second-level block embedding tag module is used to concatenate the type identifier and the level identifier to form a second-level data tag when the second-level data tagging method is selected. The second-level data tag is then divided into multiple tag blocks according to a preset length. Several offset values ​​smaller than the length are generated based on the length of the input data. Each offset value is encrypted using the type key to form offset ciphertext. According to the preset initial insertion position, the tag blocks and the corresponding offset ciphertexts are alternately inserted into the input data to form the second output data. The three-level implicit encryption tagging module is used to XOR the type key and the level key to obtain the encryption key when the third-level data tagging method is selected. The encryption key is used to encrypt the input data to generate the input data ciphertext. The tag type information is concatenated with the input data ciphertext to form the third output data.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the data tagging method as described in any one of claims 1 to 6.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the data tagging method as described in any one of claims 1 to 6.

Images