Assistant secretary applet trusted data sharing system

Abstract

The invention discloses an assistant secretary applet trusted data sharing system, and relates to the technical field of data sharing. Through cooperative work of all the modules, credibility verification, integrity protection, behavior tracing, identity authentication, access control, privacy desensitization and management monitoring of the whole data sharing process are ensured, end-to-end safe and efficient guarantee is achieved, and then the problems that in the prior art, data credibility is insufficient, the safety risk is high, and operation is not traceable can be solved; the validity of a digital certificate is dynamically ensured through the data source verification module, data counterfeiting and denial behaviors are effectively prevented in combination with a PKI framework and an end-to-end trust chain, tampering resistance in the transmission and storage process is realized through the data integrity protection module, and the security risk is greatly reduced; the dynamic identity authentication system integrates living body detection and biological feature recognition, forgery attacks are resisted with high precision, and cross-organization identity credibility is enhanced.

Description

Technical Field

[0001] This invention relates to the field of data sharing technology, and more specifically to a trusted data sharing system for an assistant secretary mini-program. Background Technology

[0002] The "Assistant Secretary" mini-program refers to a WeChat mini-program positioned as an "assistant secretary," aiming to provide users with convenient auxiliary services through digital means. Its functions vary depending on the scenario. Data sharing refers to the exchange, sharing, and use of data resources between different organizations, departments, or individuals based on legal authorization and standardized processes, in order to improve data utilization efficiency and social benefits. Its core lies in achieving data flow and collaboration through technological means, while ensuring data security and compliance.

[0003] Existing trusted data sharing systems for assistant secretary mini-programs typically employ traditional API calls, direct database connections, or simple encrypted transmission methods to achieve data interaction between different entities. While these systems can meet basic data transmission needs to a certain extent, they have significant limitations in ensuring the end-to-end trustworthiness of data. In summary, existing systems struggle to effectively verify the authenticity and integrity of data sources, lack robust mechanisms to prevent security risks such as tampering and repudiation during data flow, and cannot clearly trace the operational trajectory of data throughout the sharing chain. Furthermore, in complex and ever-changing cross-organizational collaboration scenarios, existing technologies often fall short in dynamic trusted authentication of participant identities and fine-grained, flexibly adjustable access control capabilities. These deficiencies result in a low level of data trustworthiness assurance in existing systems, making it difficult to meet the needs of application scenarios with high requirements for data authenticity, integrity, and auditability of operational behavior. Therefore, a more comprehensive trusted data sharing mechanism is urgently needed to address these issues. To this end, we propose a trusted data sharing system for assistant secretary mini-programs. Summary of the Invention

[0004] The purpose of this invention is to address the following issues mentioned in the background: the difficulty in effectively verifying the authenticity and integrity of data sources; the lack of robust mechanisms to prevent security risks such as tampering and repudiation that may occur during data flow; the inability to clearly trace the operational trajectory of data throughout the entire sharing chain; the insufficient dynamic and reliable authentication of participant identities and fine-grained, flexibly adjustable access control capabilities in complex and ever-changing cross-organizational collaboration scenarios; and the low level of data trustworthiness assurance in existing systems, making it difficult to meet the needs of application scenarios with high requirements for data authenticity, integrity, and auditability of operational behavior. Therefore, this invention provides a trusted data sharing system for assistant secretary mini-programs.

[0005] To achieve the above objectives, the present invention specifically adopts the following technical solution:

[0006] A trusted data sharing system for assistant secretary mini-programs includes:

[0007] The data source verification module uses digital signatures and certificate mechanisms to ensure the authenticity of the data provider and the initial integrity of the data.

[0008] The data integrity protection module uses hash algorithms and encryption technology to detect and prevent any tampering in real time during data transmission and storage.

[0009] The operation audit trail module uses distributed logging technology to fully capture and store all data access, modification, and sharing operations, enabling end-to-end behavior tracing.

[0010] The dynamic identity authentication system, based on multi-factor authentication and real-time token mechanism, dynamically verifies the credibility of participants' identities in cross-organizational collaborations;

[0011] The fine-grained access control module supports an attribute- and role-based policy engine, allowing administrators to flexibly configure permission rules to adapt to data sharing needs in different scenarios.

[0012] The data anonymization module integrates differential privacy and anonymization technologies to automatically identify and process sensitive information before data sharing, ensuring privacy compliance requirements.

[0013] The system management portal provides centralized policy configuration, real-time monitoring and alarm functions, and displays the system's operating status and security posture through a visual dashboard.

[0014] Furthermore, the digital signature and certificate mechanism is based on a public key infrastructure (PKI) framework, combined with asymmetric encryption algorithms (such as RSA or ECC), and relies on trusted certificate authorities (CAs) for authentication and key management to build an end-to-end trust chain.

[0015] Furthermore, the data source verification module also includes a real-time certificate revocation status checking unit, which is used to dynamically verify the validity of digital certificates. The real-time certificate revocation status checking unit is based on the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL) mechanism, and dynamically confirms the certificate status by querying the revocation database of the Certificate Authority (CA) in real time. The real-time certificate revocation status checking unit integrates lightweight protocol optimization technology to reduce query latency and supports an automatic alarm mechanism. When a certificate anomaly is detected, it immediately triggers a security policy update to maintain the integrity and real-time performance of the end-to-end trust chain.

[0016] Furthermore, the data integrity protection module uses blockchain distributed ledger technology to store hash values, ensuring the immutability of data during transmission and storage.

[0017] Furthermore, the operation audit trail module supports real-time abnormal behavior detection and alarm functions. When unauthorized operations are detected, a notification mechanism is automatically triggered. The real-time abnormal behavior detection and alarm function is based on an artificial intelligence behavior analysis engine and real-time stream processing technology. It combines historical log data to train a machine learning model, automatically establishes a normal operation baseline, and detects deviation behaviors to ensure efficient identification of abnormal activities within millisecond latency. At the same time, it integrates an adaptive rule engine to support dynamic policy updates. When a new threat pattern is detected, it automatically optimizes the detection logic and pushes notifications to the administrator terminal in real time through the alarm center to enhance the system's proactive defense capabilities and response timeliness.

[0018] Furthermore, the dynamic identity authentication system integrates biometric recognition as a supplementary element to multi-factor authentication, enhancing identity credibility in cross-organizational collaboration. Biometric recognition, based on liveness detection sensors (including infrared imaging or 3D structured light technology), captures and verifies the user's biometric data (such as fingerprints, facial features, or iris scans) in real time. A unique biometric template is generated through a feature extraction engine and compared at high speed with pre-stored templates, ensuring high accuracy (false recognition rate below 0.01%) and low latency (response time in milliseconds) in the authentication process. Simultaneously, the dynamic identity authentication system integrates an anti-spoofing mechanism to resist forgery attacks using photos, videos, or silicone molds.

[0019] Furthermore, the fine-grained access control module includes a context-based conditional policy engine, which allows for dynamic adjustment of permission rules based on data sensitivity and user environment. The context-based conditional policy engine uses the attribute-based access control (ABAC) model, combined with real-time environment awareness technology, to dynamically evaluate user context factors (such as geographical location, device security status, operation time, and network environment), and automatically generate and execute permission decision rules. In addition, the context-based conditional policy engine integrates a machine learning-driven risk assessment module, which calculates access risk scores in real time by analyzing historical access patterns and data sensitivity levels (such as public, internal, and confidential). When the score exceeds a preset threshold, it automatically triggers a permission downgrade or blocking mechanism.

[0020] Furthermore, the data anonymization module employs k-anonymization technology to process personal identity information, ensuring that shared data meets privacy regulations. k-anonymization technology uses generalization (e.g., converting precise age to age ranges) and suppression (e.g., hiding rare attribute values) techniques to ensure that each record in the dataset contains at least k-1 indistinguishable records. The k-value setting module allows for dynamic adjustment of the privacy protection strength (range 3-100) based on data sensitivity and, in conjunction with differential privacy technology, injects controllable noise (ε value 0.1-1.0), achieving a balance between statistical availability and privacy protection. The anonymization processing throughput reaches millions of records per second with a latency of less than 50 milliseconds.

[0021] Furthermore, the visualization dashboard is based on real-time data stream processing technology to dynamically render key indicators; it provides multi-dimensional data views and supports penetrating analysis by organizational structure, data type, and time range; it has a built-in intelligent alarm engine that can automatically trigger risk visualization prompts based on preset thresholds or abnormal behavior patterns; it integrates an audit log visualization component to intuitively display the entire operation trajectory in the form of a timeline; and it also provides an automatic compliance report generation function to meet the audit requirements of different regulatory agencies.

[0022] Furthermore, it also includes an end-to-end encryption module for protecting data confidentiality by applying the AES-256 encryption algorithm during data transmission.

[0023] The beneficial effects of this invention are as follows:

[0024] 1. This invention dynamically ensures the validity of digital certificates through the real-time certificate revocation status check unit of the data source verification module. Combined with the PKI framework and end-to-end trust chain, it effectively prevents data forgery and repudiation. The data integrity protection module uses blockchain technology to store hash values, achieving immutability during transmission and storage, and significantly reducing security risks.

[0025] 2. The operation audit and tracking module of this invention is based on an AI behavior analysis engine and real-time stream processing. It detects abnormal operations in milliseconds, automatically triggers alarms and updates policies, ensuring that the entire operation trajectory is clear and traceable. The dynamic identity authentication system integrates liveness detection and biometric recognition, which resists forgery attacks with high accuracy (false recognition rate less than 0.01%) and enhances cross-organizational identity credibility.

[0026] 3. The context condition policy engine of the fine-grained access control module of this invention combines the ABAC model and machine learning risk assessment to dynamically adjust permission rules and adapt to changing scenarios; the data anonymization processing module uses k-anonymization and differential privacy technology to maintain data statistical availability while ensuring privacy compliance (such as meeting GDPR and other regulations), with a processing throughput of millions of records per second and a latency of less than 50 milliseconds, thus improving sharing efficiency.

[0027] 4. The visualization dashboard of the system management portal of this invention provides real-time monitoring, multi-dimensional analysis and intelligent alarms, integrates audit log timeline display, automatically generates compliance reports, and the end-to-end encryption module uses the AES-256 algorithm to ensure data confidentiality. The overall system supports efficient operation and maintenance and supervision requirements and meets the needs of high auditability application scenarios.

[0028] 5. This invention achieves dynamic and reliable authentication of participants' identities and adjustment of permissions through dynamic identity authentication and fine-grained access control, reducing collaboration friction. At the same time, data anonymization and encryption mechanisms ensure privacy and security, promote efficient data flow and collaboration, and enhance social benefits. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the modules of the shared system in this invention;

[0030] Figure 2 This is a flowchart of the process of the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0032] Please see Figure 1 - Figure 2 This invention provides a trusted data sharing system for assistant secretary mini-programs, comprising:

[0033] The data source verification module ensures the authenticity of the data provider and the initial integrity of the data through digital signatures and certificate mechanisms. By setting up the data source verification module, the reliable verification of the data source can be achieved, effectively preventing data tampering and forgery.

[0034] The data integrity protection module uses hash algorithms and encryption technology to detect and prevent any tampering in real time during data transmission and storage. By setting up the data integrity protection module, the integrity of data can be monitored and protected throughout the entire process, effectively ensuring the security of data during transmission and storage.

[0035] The operation audit trail module uses distributed logging technology to fully capture and store all data access, modification, and sharing operations, enabling end-to-end behavior tracing. By setting up the operation audit trail module, the end-to-end behavior tracing can be visualized and audited, effectively supporting compliance checks and security incident investigations.

[0036] The dynamic identity authentication system, based on multi-factor authentication and real-time token mechanisms, dynamically verifies the credibility of participants' identities in cross-organizational collaborations. By setting up a dynamic identity authentication system, dynamic verification of identity credibility can be achieved, effectively preventing identity impersonation and unauthorized access.

[0037] The fine-grained access control module supports attribute- and role-based policy engines, allowing administrators to flexibly configure permission rules to adapt to data sharing needs in different scenarios. By setting the fine-grained access control module, precise control over data access can be achieved, effectively preventing data leakage and unauthorized operations.

[0038] The data anonymization module integrates differential privacy and anonymization technologies to automatically identify and process sensitive information before data sharing, ensuring privacy compliance requirements. By setting up data encryption and anonymization modules, comprehensive data privacy protection can be achieved, effectively meeting compliance requirements and reducing risks.

[0039] The system management portal provides centralized policy configuration, real-time monitoring, and alarm functions. It displays the system's operating status and security posture through a visual dashboard. By setting up the system management portal, centralized control and real-time visual monitoring of system management can be achieved, effectively improving operational efficiency, security response capabilities, and compliance audit support.

[0040] This system, through the collaborative work of its various modules, ensures trusted verification, integrity protection, behavior traceability, identity authentication, access control, privacy desensitization, and management monitoring throughout the entire data sharing process, achieving end-to-end security and efficiency. This, in turn, solves problems such as insufficient data trustworthiness, high security risks, and untraceable operations in existing technologies.

[0041] In this embodiment, preferably, the digital signature and certificate mechanism is based on a Public Key Infrastructure (PKI) framework, combined with asymmetric encryption algorithms (such as RSA or ECC), and relies on trusted Certificate Authorities (CAs) for authentication and key management to build an end-to-end trust chain. This enables efficient identity authentication, data integrity verification, and non-repudiation during data sharing, ensuring all operations are based on trusted entities. The PKI framework's key pair management mechanism facilitates secure communication between the data provider and receiver, effectively preventing man-in-the-middle attacks and certificate forgery risks. Furthermore, by combining a Real-time Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP), certificate validity is dynamically verified to address potential security threats. This establishes a complete trust chain from the data source to the terminal, providing a solid security foundation for the entire system and supporting trusted data exchange in large-scale cross-organizational collaborations.

[0042] In this embodiment, preferably, the data source verification module further includes a real-time certificate revocation status checking unit for dynamically verifying the validity of digital certificates. This unit, based on the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL) mechanism, dynamically confirms the certificate status by querying the Certificate Authority's (CA) revocation database in real time, preventing expired certificates from being used for malicious access. Furthermore, the real-time certificate revocation status checking unit integrates lightweight protocol optimization technology to reduce query latency, ensuring rapid response to authentication requests in high-concurrency scenarios. It also supports an automatic alarm mechanism, triggering security policy updates immediately when certificate anomalies are detected to maintain the integrity and real-time performance of the end-to-end trust chain. This enables an automated security response mechanism, immediately executing predefined policies such as blocking suspicious connections or initiating secondary verification upon detecting certificate anomalies. Seamless integration with the operation audit and tracing module automatically records all revocation events and related operation logs, supporting post-event auditing and real-time monitoring. Simultaneously, the optimized lightweight protocol maintains low-latency performance under high-load scenarios, ensuring the smoothness of the authentication process and avoiding system bottlenecks.

[0043] In this embodiment, preferably, the data integrity protection module uses blockchain distributed ledger technology to store hash values, ensuring the immutability of data during transmission and storage. This enables permanent recording and verifiability of data, ensuring that all hash value changes are fully recorded and provided with non-repudiable proof through distributed ledger technology; effectively preventing any unauthorized modification of data during transmission and storage; and, combined with blockchain consensus mechanisms (such as PoW or PoS), enhancing the overall security and trustworthiness of the system.

[0044] In this embodiment, preferably, the operation audit trail module supports real-time abnormal behavior detection and alarm functions. When an unauthorized operation is detected, a notification mechanism is automatically triggered. The real-time abnormal behavior detection and alarm function is based on an artificial intelligence behavior analysis engine and real-time stream processing technology. It combines historical log data to train a machine learning model, automatically establishes a normal operation baseline, and detects deviation behaviors to ensure efficient identification of abnormal activities within millisecond latency. At the same time, it integrates an adaptive rule engine to support dynamic policy updates. When a new threat pattern is detected, it automatically optimizes the detection logic and pushes notifications to the administrator terminal in real time through the alarm center to enhance the system's proactive defense capabilities and response timeliness. This enables automated security incident response and intelligent decision support. Through deep learning models, it analyzes anomaly patterns in real time, predicts potential threats, and automatically executes predefined response strategies, such as isolating affected systems or initiating emergency recovery processes. Simultaneously, this function seamlessly integrates with dynamic identity authentication systems. When an identity verification anomaly is detected, it automatically strengthens authentication requirements or triggers secondary verification to ensure real-time maintenance of identity credibility. Combined with a fine-grained access control module, it dynamically adjusts permission rules to restrict the scope of suspicious operations, effectively preventing data leakage and spread. Furthermore, the machine learning model self-optimizes its detection algorithm based on continuously collected log data, reducing false alarm rates and improving detection accuracy, maintaining millisecond-level response efficiency in high-concurrency environments. Through a visual audit dashboard, administrators can monitor alarm events, response status, and threat trends in real time, supporting one-click operations such as log export or policy rollback to enhance compliance audit efficiency and system resilience.

[0045] In this embodiment, preferably, the dynamic identity authentication system integrates biometric recognition as a supplementary element to multi-factor authentication, enhancing identity credibility in cross-organizational collaboration. Biometric recognition, based on liveness detection sensors (including infrared imaging or 3D structured light technology), captures and verifies the user's biometric data (such as fingerprints, facial features, or iris scans) in real time. A unique biometric template is generated through a feature extraction engine and compared at high speed with pre-stored templates, ensuring high accuracy (false recognition rate below 0.01%) and low latency (response time in milliseconds) in the authentication process. Simultaneously, the dynamic identity authentication system integrates an anti-spoofing mechanism to resist forgery attacks such as photos, videos, or silicone molds. This enables dynamic liveness biometric authentication, using multimodal sensor fusion technology (such as combining heart rate detection and micro-expression analysis) to determine the activity and authenticity of the user's biometric features in real time. Furthermore, this anti-spoofing mechanism integrates a generative adversarial network (GAN) detection engine to automatically identify and block attacks based on deepfake technology. Through linkage with a fine-grained access control module, data access permission levels are dynamically adjusted based on biometric authentication confidence levels, achieving risk-adaptive identity management.

[0046] In this embodiment, preferably, the fine-grained access control module includes a context-based conditional policy engine, which allows for dynamic adjustment of permission rules based on data sensitivity and user environment. The context-based conditional policy engine uses the attribute-based access control (ABAC) model and combines it with real-time environment awareness technology to dynamically evaluate user context factors (such as geographical location, device security status, operation time, and network environment), automatically generate and execute permission decision rules. Furthermore, the context-based conditional policy engine integrates a machine learning-driven risk assessment module, which calculates access risk scores in real time by analyzing historical access patterns and data sensitivity levels (such as public, internal, and confidential). When the score exceeds a preset threshold, it automatically triggers a permission downgrade or blocking mechanism. This enables a dynamic, risk-adaptive access control mechanism, effectively preventing unauthorized access and data leakage. Seamless integration with a dynamic identity authentication system allows for dynamic adjustment of authentication strength based on real-time risk assessment scores (e.g., automatically activating multi-factor authentication or two-factor authentication in high-risk scenarios). Simultaneously, combined with an operation audit trail module, it automatically records all permission decisions, change events, and related contextual information, supporting post-event auditing and compliance checks. Furthermore, the fine-grained access control module integrates a policy backtracking engine, allowing administrators to view historical permission rule change trajectories through the system management portal, facilitating problem investigation, policy optimization, and audit report generation. Based on machine learning models, the risk assessment algorithm is continuously optimized, automatically identifying new threat patterns and updating detection rules by analyzing large-scale access log data, improving the system's adaptability and accuracy in complex environments. Ultimately, this constructs an end-to-end intelligent access control system, achieving a balance between security and flexibility in cross-organizational collaboration for data sharing.

[0047] In this embodiment, preferably, the data anonymization module employs k-anonymization technology to process personally identifiable information, ensuring that shared data meets privacy regulations. k-anonymization technology uses generalization (e.g., converting precise age to age ranges) and suppression (e.g., hiding rare attribute values) techniques to ensure that each record in the dataset contains at least k-1 indistinguishable records. The k-value setting module allows dynamic adjustment of the privacy protection strength (range 3-100) based on data sensitivity and, in conjunction with differential privacy technology, injects controllable noise (ε value 0.1-1.0) to achieve a balance between statistical availability and privacy protection. The anonymization processing throughput reaches millions of records per second with a latency of less than 50 milliseconds. This enables a dynamic balance between privacy protection and data availability. Through an adaptive k-value algorithm, the optimal privacy parameters are automatically calculated based on the data usage scenario (e.g., statistical analysis or machine learning training), maximizing data value while protecting user privacy. Simultaneously, this module integrates a real-time sensitive data identification engine, utilizing natural language processing (NLP) technology to automatically detect personally identifiable information (PII) in unstructured text, ensuring comprehensive anonymization coverage.

[0048] In this embodiment, preferably, the visual dashboard is based on real-time data stream processing technology to dynamically render key indicators; it provides multi-dimensional data views and supports penetrating analysis by organizational structure, data type, and time range; it has a built-in intelligent alarm engine that can automatically trigger risk visualization prompts based on preset thresholds or abnormal behavior patterns; it integrates an audit log visualization component to intuitively display the entire operation trajectory in the form of a timeline; it also provides an automatic compliance report generation function to meet the audit requirements of different regulatory agencies; thus enabling...

[0049] In this embodiment, preferably, it further includes: an end-to-end encryption module, used to apply the AES-256 encryption algorithm to protect data confidentiality during data transmission. By setting the end-to-end encryption module, unauthorized access and data leakage can be prevented.

[0050] The working principle and usage process of this invention include the following steps:

[0051] Data submission and source verification: The data provider submits data through the system management portal. The data source verification module is activated immediately and performs digital signature verification and certificate status verification on the submitter based on the PKI framework (the certificate validity is confirmed by the OCSP / CRL real-time inspection unit). If the verification is successful, the system generates an initial integrity hash value containing a timestamp and synchronizes it to the blockchain ledger storage of the data integrity protection module. If the certificate is abnormal or the signature is invalid, an alarm is automatically triggered and data access is blocked.

[0052] Dynamic identity authentication and permission binding: When a recipient requests access to data, the dynamic identity authentication system initiates a multi-factor authentication process (including biometric liveness detection) and verifies the credibility of the identity with a real-time token; after successful authentication, the fine-grained access control module dynamically evaluates the user context (such as device security status and data sensitivity) based on the ABAC policy engine and generates real-time access permission rules; high-risk operations automatically trigger permission downgrade or secondary authentication requirements.

[0053] Secure transmission and integrity protection: Authorized data is transmitted with AES-256 encryption through an end-to-end encryption module; the data integrity protection module calculates the hash value in real time throughout the transmission process and compares it with the initial hash stored in the blockchain every millisecond; if a hash value offset is detected (such as data tampering), the transmission is immediately interrupted and a security event log is generated and pushed to the operation audit trace module.

[0054] Privacy desensitization and compliant sharing: Before data sharing, the data desensitization module automatically scans sensitive fields and applies k-anonymization (dynamic k value 3-100) and differential privacy (ε value 0.1-1.0) technologies to process personal identity information; the desensitized data is then verified a second time by the policy engine to ensure that the output results meet the privacy compliance requirements of the target scenario.

[0055] End-to-end auditing and real-time monitoring: The operation audit tracking module records data access, de-identification, and sharing operations throughout the entire process, and uses an AI behavior analysis engine to detect abnormal patterns (such as high-frequency unauthorized requests) in real time; when a threat is detected, it automatically triggers an alarm in the system management portal and marks the risk trajectory on the visual dashboard; administrators can trace the entire operation through the timeline and export a compliance audit report with one click.

[0056] Dynamic policy optimization and system maintenance: The system continuously analyzes audit logs and access patterns based on machine learning models, automatically updates risk detection rules and the ABAC policy library, and allows administrators to dynamically adjust certificate revocation policies, de-identification parameters or access control thresholds through the system management portal, thereby achieving closed-loop optimization of security policies and improving system resilience.

[0057] Through the above process, this system achieves trusted management and control throughout the entire lifecycle, from data access, identity authentication, secure transmission, privacy processing to shared auditing, effectively addressing the risks of data tampering, unauthorized access, and privacy leaks in cross-organizational collaboration, while ensuring operational traceability and compliance.

[0058] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A trusted data sharing system for an assistant secretary mini-program, characterized in that, include: The data source verification module uses digital signatures and certificate mechanisms to ensure the authenticity of the data provider and the initial integrity of the data. The data integrity protection module uses hash algorithms and encryption technology to detect and prevent any tampering in real time during data transmission and storage. The operation audit trail module uses distributed logging technology to fully capture and store all data access, modification, and sharing operations, enabling end-to-end behavior tracing. The dynamic identity authentication system, based on multi-factor authentication and real-time token mechanism, dynamically verifies the credibility of participants' identities in cross-organizational collaborations; The fine-grained access control module supports an attribute- and role-based policy engine, allowing administrators to flexibly configure permission rules to adapt to data sharing needs in different scenarios. The data anonymization module integrates differential privacy and anonymization technologies to automatically identify and process sensitive information before data sharing, ensuring privacy compliance requirements. The system management portal provides centralized policy configuration, real-time monitoring and alarm functions, and displays the system's operating status and security posture through a visual dashboard.

2. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The digital signature and certificate mechanism is based on a public key infrastructure (PKI) framework, combined with asymmetric encryption algorithms (such as RSA or ECC), and relies on trusted certificate authorities (CAs) for authentication and key management to build an end-to-end chain of trust.

3. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The data source verification module also includes a real-time certificate revocation status checking unit, which is used to dynamically verify the validity of digital certificates. The real-time certificate revocation status checking unit is based on the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL) mechanism and dynamically confirms the certificate status by querying the revocation database of the Certificate Authority (CA) in real time. Furthermore, the real-time certificate revocation status check unit integrates lightweight protocol optimization technology to reduce query latency and supports an automatic alarm mechanism. When a certificate anomaly is detected, it immediately triggers a security policy update to maintain the integrity and real-time performance of the end-to-end trust chain.

4. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The data integrity protection module uses blockchain distributed ledger technology to store hash values, ensuring the immutability of data during transmission and storage.

5. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The operation audit and tracing module supports real-time abnormal behavior detection and alarm functions. When unauthorized operations are detected, a notification mechanism is automatically triggered. The real-time abnormal behavior detection and alarm function is based on an artificial intelligence behavior analysis engine and real-time stream processing technology. It combines historical log data to train a machine learning model, automatically establishes a baseline for normal operations, and detects deviation behaviors to ensure efficient identification of abnormal activities within millisecond latency. At the same time, it integrates an adaptive rule engine to support dynamic policy updates. When a new threat pattern is detected, it automatically optimizes the detection logic and pushes notifications to the administrator terminal in real time through the alarm center to enhance the system's proactive defense capabilities and response timeliness.

6. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The dynamic identity authentication system integrates biometric recognition as a supplementary element to multi-factor authentication, enhancing identity credibility in cross-organizational collaboration. Biometric recognition, based on liveness detection sensors (including infrared imaging or 3D structured light technology), captures and verifies the user's biometric data (such as fingerprints, face, or iris) in real time. A unique biometric template is generated through a feature extraction engine and compared at high speed with pre-stored templates to ensure high accuracy (false recognition rate less than 0.01%) and low latency (response time in milliseconds) in the authentication process. At the same time, the dynamic identity authentication system integrates an anti-spoofing mechanism to resist forgery attacks such as photos, videos, or silicone molds.

7. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The fine-grained access control module includes a context-based conditional policy engine, which allows for dynamic adjustment of permission rules based on data sensitivity and user environment. The context-based conditional policy engine uses the attribute-based access control (ABAC) model and combines it with real-time environment awareness technology to dynamically evaluate user context factors (such as geographical location, device security status, operation time, and network environment), automatically generate and execute permission decision rules. Furthermore, the context-based conditional policy engine integrates a machine learning-driven risk assessment module, which calculates access risk scores in real time by analyzing historical access patterns and data sensitivity levels (such as public, internal, and confidential). When the score exceeds a preset threshold, it automatically triggers a permission downgrade or blocking mechanism.

8. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The data anonymization module uses k-anonymization technology to process personal identity information, ensuring that shared data meets privacy regulations. k-anonymization technology uses generalization (e.g., converting precise age to age range) and suppression (e.g., hiding rare attribute values) techniques to ensure that each record in the dataset has at least k-1 indistinguishable records. The k-value setting module allows for dynamic adjustment of the privacy protection strength (range 3-100) based on data sensitivity, and works in conjunction with differential privacy technology to inject controllable noise (ε value 0.1-1.0), achieving a balance between statistical availability and privacy protection. The data anonymization process achieves a throughput of millions of records per second with a latency of less than 50 milliseconds.

9. The trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, The visualization dashboard is based on real-time data stream processing technology and dynamically renders key indicators; it provides multi-dimensional data views and supports penetrating analysis by organizational structure, data type and time range. It features a built-in intelligent alarm engine that can automatically trigger visual risk alerts based on preset thresholds or abnormal behavior patterns; it integrates an audit log visualization component to intuitively display the entire operation trajectory in a timeline format; and it also provides an automatic compliance report generation function to meet the audit requirements of different regulatory agencies.

10. A trusted data sharing system for an assistant secretary mini-program according to claim 1, characterized in that, Also includes: An end-to-end encryption module is used to protect data confidentiality by applying the AES-256 encryption algorithm during data transmission.

Images