Devices, systems and methods for digital security authentication

Abstract

This invention relates to the field of data security storage and transmission technology, and discloses a device, system, and method for digital security authentication. It constructs a high-quality temporal feature set through data scenario association mapping and feature enhancement, laying the foundation for risk assessment and policy adaptation. A multi-dimensional risk factor coupled assessment system is built to achieve accurate determination of scenario-based risk levels. Then, based on the feature matching of transfer requirements, the transfer type is identified, and the adapted encryption policy parameters are dynamically output. Combined with the security adaptation indicators of transfer nodes, split storage is executed to complete the security management and control of the target transferred data. Therefore, this invention achieves dynamic adaptation between transfer scenarios and data security policies, solving the problems of underprotection and overprotection in traditional methods. It balances the security of authentication and transmission efficiency during data transfer, improves the adaptability and control accuracy in complex transfer scenarios, and provides a more scientific and practical security authentication solution for diverse transfer scenarios.

Description

Technical Field

[0001] This invention relates to the field of data security storage and transmission technology, and in particular to devices, systems and methods for digital security authentication. Background Technology

[0002] Throughout the entire data lifecycle, the scope, frequency, and impact on related businesses vary significantly in scenarios such as cross-border transmission, cross-departmental sharing, and internal archiving, resulting in diverse data flow patterns, including narrow-range, low-frequency flow and wide-range, high-frequency flow.

[0003] In this model, the data risk level dynamically changes with the coupling of multi-dimensional factors (scenario sensitivity, circulation scope, circulation frequency) in the circulation scenario, leading to prominent technical defects in traditional digital security authentication methods: First, existing technologies pre-set fixed security levels and encryption strategies based on the inherent attributes of the data itself, without considering the dynamic risk coupling of the circulation scenario. This results in insufficient response to changes in risk levels during circulation, easily leading to underprotection in high-risk circulation scenarios or overprotection in low-risk circulation scenarios. Second, no adaptation mechanism has been built for circulation requirements and encryption strategies. Authentication using a single encryption algorithm is difficult to balance the security requirements and transmission efficiency of different circulation scenarios (e.g., high-frequency cross-border circulation requires high security and low latency, while internal archiving requires low cost and high compatibility). Third, storage splitting relies solely on fixed thresholds, failing to adapt to the security status and load capacity of circulation nodes, leading to the risk of data fragment transmission delays or leaks during circulation.

[0004] Therefore, how to achieve accurate coupled assessment of multi-dimensional risks during the data scenario-based transfer process, and how to adapt dynamic security authentication and storage management to transfer needs, is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] This invention provides a device, system, and method for digital security authentication, aiming to solve the aforementioned technical problems.

[0006] To achieve the above objectives, the present invention provides a method for digital security authentication, comprising the following steps:

[0007] Obtain the basic attribute data and flow scenario feature data of the target flow data. For the basic attribute data and the flow scenario feature data, perform data scenario association mapping and feature enhancement to obtain an enhanced data scenario time series feature set.

[0008] Risk factors are quantified and coupled weights are calculated on the enhanced data scenario time series feature set to obtain scenario-based risk assessment results and output the scenario-based risk level at each transition time.

[0009] Extract flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data by matching the preset flow type feature template, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type.

[0010] Based on the enhanced data scenario time-series feature set, the security adaptation index of each transfer node is calculated. Combined with the scenario-based risk level and encryption strategy adaptation parameters, dynamic encryption and split storage for transfer node adaptation are performed to complete the security management of the target transfer data.

[0011] In one feasible implementation, the basic attribute data and the circulation scenario feature data specifically include: data attributes consisting of at least data type, sensitivity identifier, and data size, and circulation scenario features consisting of at least scenario sensitivity, circulation range, circulation frequency, and circulation node information.

[0012] In one feasible implementation, the steps of performing association mapping and feature enhancement of the data scenario to obtain an enhanced temporal feature set of the data scenario specifically include:

[0013] A data scenario association rule base is constructed, defining the association factors from data attribute features to scenario features. Association rules are mined using the Apriori algorithm, and rules with a confidence score ≥ 0.8 are included in the association rule base. The specific expression is as follows:

[0014]

[0015] In the formula, For the confidence level of the association rule, For data attribute features, As a scene feature, for and The combined support for Support level;

[0016] Based on the association rule base, feature cross-enhancement is performed, which cross-operates on data attribute features and scene features to generate several cross features and merges them with the original features to form an initial feature set;

[0017] The initial feature set is encapsulated in a temporal manner, and a temporal window is constructed by sorting by timestamp. The mean, variance, and trend slope of the features within each window are calculated to generate temporal derived features. The temporal derived features are combined with the initial feature set to form a temporal feature matrix, and the enhanced data scenario temporal feature set is output in the format {data ID, temporal feature matrix, timestamp sequence}.

[0018] In one feasible implementation, the steps of risk factor quantification and coupling weight calculation specifically include:

[0019] Core risk factors are extracted from the time-series features of enhanced data scenarios; wherein, the core risk factors include: scenario sensitivity quantification value S, circulation range quantification value R, circulation frequency quantification value F, data sensitivity identifier weight W, and cross-feature quantification value C;

[0020] First, calculate the subjective weights using the analytic hierarchy process. Then, the objective weights are calculated using the entropy weight method. To determine the combined coupling weight vector, the specific expression is:

[0021]

[0022] In the formula, For the combined coupling weight vector, Subjective weighting percentage , ;in, , , , , These represent the subjective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively. , , , , These represent the objective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively.

[0023] The specific expression for calculating the scenario-based risk assessment value is as follows:

[0024]

[0025] In the formula, Let t be the scenario-based risk assessment value. , Let i be the combined weight of the i-th risk factor. Let be the quantified value of the i-th risk factor at time t;

[0026] Risk levels are categorized based on risk assessment values. Low-risk L1 It is classified as medium risk L2. It is classified as high-risk L3. For extremely high risk (L4), output the scenario-based risk level at each transition moment.

[0027] In one feasible implementation, the step of extracting flow demand features from the enhanced data scenario time-series feature set and identifying the real-time flow type of the target data through matching with a preset flow type feature template specifically includes:

[0028] Extract flow requirement features from the time-series feature set of enhanced data scenarios; wherein, the flow requirement features include: flow frequency E, number of flow nodes N, flow delay requirement D, node cross-domain identifier G, and the node cross-domain identifier G is assigned a value of 1 or 0 depending on whether it is cross-domain.

[0029] Four preset circulation type feature templates are provided, including: a cross-border high-frequency circulation template with features E≥50, N≥3, D≤100ms, and G=1; a cross-department medium-frequency circulation template with features 20≤E<50, 2≤N<3, D≤300ms, and G=0; an internal low-frequency circulation template with features 5≤E<20, N=1, D≤500ms, and G=0; and an archive static circulation template with features E<5, N=1, D≤1000ms, and G=0.

[0030] Calculate the similarity between real-time workflow requirements and each template. The specific formula for calculating the similarity is as follows:

[0031]

[0032] In the formula, For feature similarity, , For the i-th component of the feature vector representing real-time flow demand, The i-th component of the template feature vector;

[0033] Select the one with the highest similarity and The template is used as the matching result to identify the real-time flow type of the target flow data; if After adjusting the delay requirements according to the closest template type, the real-time flow type of the target flow data is determined.

[0034] In one feasible implementation, the step of dynamically outputting the encryption strategy adaptation parameters corresponding to the real-time streaming type specifically includes:

[0035] Construct an encryption strategy adaptation matrix for circulation type and risk level; the encryption strategy adaptation matrix includes four types of adaptation parameters: algorithm type, key length, encryption mode, and delay threshold.

[0036] The core configuration of the adaptation matrix is ​​as follows:

[0037] Extremely high risk L4: SM2+SM4 hybrid encryption, SM4 key length = 256 bits, SM2 key length = 256 bits, SM4 encryption mode = GCM, latency threshold ≤ 100ms;

[0038] High-risk L3: SM4 encryption, key length = 192 bits, encryption mode = CCM, delay threshold ≤ 300ms;

[0039] Medium-risk L2: SM4 encryption, key length = 128 bits, encryption mode = CBC, latency threshold ≤ 500ms;

[0040] Low-risk L1: SM3 hash check, hash length = 256 bits, latency threshold ≤ 1000ms;

[0041] Based on the real-time flow type and scenario-based risk level, the corresponding encryption policy adaptation parameters are matched from the encryption policy adaptation matrix, and a parameter set is output. , , , ,in For algorithm type, This is the key length. Encryption mode, This is the delay threshold.

[0042] In one feasible implementation, the step of calculating the security adaptation index for each transfer node based on the enhanced data scenario temporal feature set specifically includes:

[0043] Based on the flow node information in the synchronous time-series data of the data scenario, the node security features including vulnerability scores and the number of historical security events are extracted, and the load features including CPU utilization and remaining bandwidth are extracted. The security adaptation index of the flow node is calculated by weighted summation.

[0044] The specific expression for the security adaptation index of the transfer node is as follows:

[0045]

[0046] In the formula, For the security adaptation index of the j-th transfer node, The higher the value, the better the fit. Score the vulnerabilities of the nodes. This refers to the number of historical security incidents for the node over the past three months. The maximum number of historical security events across all nodes. This represents the real-time CPU utilization of the node.

[0047] In one feasible implementation, the dynamic encryption step is performed, specifically including:

[0048] Call the national cryptographic algorithm library and load the encryption strategy adaptation parameters. , , , ;

[0049] Execute encryption processes for different algorithm types:

[0050] when At that time, according to Generate a 256-bit SM4 session key ,according to Encrypt target data flow and output ciphertext. Integrity verification label The SM2 algorithm is called to generate a 256-bit key pair, and the public key in the key pair is used. encryption Obtain the encryption result ; Initialize the vector , , , Encapsulate sequentially to generate the final encrypted data; when At that time, according to Generate SM4 key, press Encrypt data, output ciphertext and ;when At that time, a 256-bit hash calculation is performed on the data, and the output is a combination of the hash value and the original data.

[0051] In one feasible implementation, the split storage step of adapting the transfer node is performed, specifically including:

[0052] Calculate the data splitting threshold The expression is as follows:

[0053]

[0054] In the formula, The size of the encrypted data. Based on scenario-based risk levels, L1=1, L2=2, L3=3, L4=4. For safety adaptation indicators The number of qualified nodes, The average security compatibility index for qualified nodes;

[0055] By split threshold Split the encrypted data according to the formula get Each segment is assigned a unique ID and associated with the original data ID; among them... This represents the floor function;

[0056] Nodes are assigned based on the scenario-based risk level of the data segments, with high-risk segments of L3 and L4 data being allocated to [nodes / locations]. Highly adaptable nodes allocate low-to-medium risk segments of L2 and L1 data to Nodes;

[0057] A mapping table of record fragment IDs, node IDs, and storage paths is stored in a distributed metadata center.

[0058] In addition, to achieve the above objectives, the present invention also provides a digital security authentication apparatus, comprising: a memory, a processor, and a digital security authentication program stored in the memory and executable on the processor, wherein when the digital security authentication program is executed by the processor, it implements the steps of the digital security authentication method as described in any of the preceding claims.

[0059] Furthermore, to achieve the above objectives, the present invention also provides a digital security authentication system, comprising:

[0060] The feature acquisition module is used to acquire the basic attribute data and flow scenario feature data of the target flow data, and to perform data scenario association mapping and feature enhancement on the basic attribute data and the flow scenario feature data to obtain an enhanced data scenario time series feature set.

[0061] The risk quantification module is used to construct a multi-dimensional risk factor coupling assessment system, perform risk factor quantification and coupling weight calculation on the enhanced data scenario time series feature set, obtain scenario-based risk assessment results, and output the scenario-based risk level at each transition moment;

[0062] The encryption strategy generation module is used to extract flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data through preset flow type feature template matching, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type.

[0063] The encrypted storage module is used to calculate the security adaptation index of each transfer node based on the enhanced data scenario time-series feature set, and combine the scenario-based risk level and encryption strategy adaptation parameters to perform dynamic encryption and split storage adapted to the transfer node, thereby completing the security management of the target transfer data.

[0064] The beneficial effects of this invention are as follows: It proposes a device, system, and method for digital security authentication. By constructing a high-quality temporal feature set through data scenario association mapping and feature enhancement, it lays the foundation for risk assessment and policy adaptation. It also constructs a multi-dimensional risk factor coupled assessment system to achieve accurate determination of scenario-based risk levels. Furthermore, based on the feature matching of data transfer requirements, it identifies the transfer type, dynamically outputs adapted encryption policy parameters, and combines the security adaptation indicators of transfer nodes to perform split storage, thus completing the security management and control of the target transferred data. Therefore, this invention achieves dynamic adaptation between transfer scenarios and data security policies, solves the problems of underprotection and overprotection in traditional methods, balances the security of authentication and transmission efficiency during data transfer, improves the adaptability and control accuracy in complex transfer scenarios, and provides a more scientific and practical security authentication solution for diverse transfer scenarios. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating the digital security authentication method according to an embodiment of the present invention;

[0066] Figure 2 This is a schematic diagram of the structure of a digital security authentication system according to an embodiment of the present invention. Detailed Implementation

[0067] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0068] This invention provides a method for digital security authentication, referring to... Figure 1 .

[0069] In this embodiment, a method for digital security authentication includes the following steps:

[0070] S1: Obtain the basic attribute data and flow scenario feature data of the target flow data; perform data scenario association mapping and feature enhancement on the basic attribute data and the flow scenario feature data to obtain an enhanced data scenario time series feature set.

[0071] S2: Perform risk factor quantification and coupling weight calculation on the enhanced data scenario time series feature set to obtain scenario-based risk assessment results and output the scenario-based risk level at each transition time.

[0072] S3: Extract the flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data by matching the preset flow type feature template, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type.

[0073] S4: Based on the enhanced data scenario time-series feature set, calculate the security adaptation index of each transfer node, combine the scenario-based risk level and encryption strategy adaptation parameters, perform dynamic encryption and split storage for transfer node adaptation, and complete the security management of the target transfer data.

[0074] This embodiment provides a digital security authentication architecture comprising a data input layer, a feature processing layer, a risk assessment layer, a policy adaptation layer, and an execution control layer.

[0075] Specifically, the data input layer is used to acquire the data's own attributes (type, sensitivity identifiers, etc.) and flow scenario characteristics (sensitivity, scope, etc.) to form the original data foundation; the feature processing layer is used to mine the potential correlation between data and scenarios through association mapping, and feature enhancement improves the data dimension and quality, generating an enhanced time-series feature set; the risk assessment layer is used to quantify multi-dimensional risk factors based on the feature set, calculate the scenario-based risk level through combined weights, and clarify the authentication strength requirements; the policy adaptation layer is used to identify the flow type, match the corresponding encryption policy parameters, and determine the combination scheme of algorithm, key, mode, and delay; the execution control layer is used to execute dynamic encryption according to the encryption policy, and split the storage by combining node security adaptation indicators to complete the full-process security authentication and control.

[0076] Therefore, this invention, through multi-dimensional risk coupling assessment and dynamic adaptation mechanism, adjusts the authentication strategy in real time according to the circulation scenario, avoiding the limitations of fixed strategies. It can solve the problems of high-risk underprotection / low-risk overprotection in traditional solutions. By identifying the circulation type, it outputs differentiated encryption strategies, balancing the high security and low latency of cross-border high-frequency circulation with the low cost and high compatibility of internal archiving. This solves the problem that a single algorithm cannot balance security and efficiency. By calculating the node security adaptation index, it achieves the adaptation of split storage and node status, reducing the risk of transmission lag and leakage. This solves the problem of storage splitting not adapting to node status, providing a more scientific and practical security authentication solution for diverse circulation scenarios.

[0077] For example, the basic attribute data and circulation scenario feature data specifically include: data attributes consisting of at least data type, sensitivity identifier, and data size, and circulation scenario features consisting of at least scenario sensitivity, circulation scope, circulation frequency, and circulation node information.

[0078] In one feasible implementation, the steps of performing association mapping and feature enhancement of the data scenario to obtain an enhanced temporal feature set of the data scenario specifically include:

[0079] S11: Construct a data scenario association rule base, define the association factors from data attribute features to scenario features, mine association rules using the Apriori algorithm, and select rules with a confidence score ≥ 0.8 to include in the association rule base. The specific expression is as follows:

[0080]

[0081] In the formula, For the confidence level of the association rule, For data attribute features, As a scene feature, for and The combined support for The support level; this formula is a classic method for calculating the confidence level of association rules. The confidence level represents the probability that when data has attribute X, it also has scenario feature Y. The higher the value, the more reliable the association relationship.

[0082] S12: Perform feature cross-enhancement based on the association rule base, perform cross-operation on data attribute features and scene features, generate several cross features and merge them with the original features to form an initial feature set;

[0083] S13: Perform temporal encapsulation on the initial feature set, construct a temporal window by sorting by timestamp, calculate the mean, variance, and trend slope of the features within each window, generate temporal derived features, combine the temporal derived features with the initial feature set to form a temporal feature matrix, and output the enhanced data scenario temporal feature set in the format {data ID, temporal feature matrix, timestamp sequence}.

[0084] In this embodiment, a correlation factor between data attributes (X) and scene features (Y) is defined. The joint support and individual support are calculated using the Apriori algorithm. Rules with a confidence level ≥ 0.8 are selected to ensure the reliability of the correlation. After that, based on the association rule base, cross-operations are performed on data attribute features (such as sensitive identifier weights) and scene features (such as scene sensitivity) to generate complementary features to enrich the feature dimensions. Finally, a time series window (such as 5 circulation cycles) is constructed by sorting by timestamp. The mean, variance, and trend slope of the features within the window are calculated to capture the time series changes of data circulation and generate time series derived features. Finally, they are combined into a time series feature matrix.

[0085] Based on the above principles, this embodiment improves data quality and dimensionality through feature enhancement, making risk factor quantification more accurate and avoiding misjudgment of risk level due to single features. It can establish a mapping relationship between data attributes and scenario features through association rule mining, making subsequent strategy adaptation more in line with scenario needs.

[0086] In one feasible implementation, the steps of risk factor quantification and coupling weight calculation specifically include:

[0087] S21: Extract core risk factors from the time-series feature set of enhanced data scenarios; wherein, the core risk factors include: scenario sensitivity quantification value S, circulation range quantification value R, circulation frequency quantification value F, data sensitivity identifier weight W, and cross-feature quantification value C;

[0088] S22: First, calculate the subjective weights using the Analytic Hierarchy Process (AHP). Then, the objective weights are calculated using the entropy weight method. To determine the combined coupling weight vector, the specific expression is:

[0089]

[0090] In the formula, For the combined coupling weight vector, Subjective weighting percentage , This formula is a linear weighted calculation method for combined weights, which balances the guidance of industry experience and the objectivity of data by integrating subjective and objective weights; among which, , , , , These represent the subjective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively. , , , , These represent the objective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively.

[0091] S23: Calculate the scenario-based risk assessment value, the specific expression is as follows:

[0092]

[0093] In the formula, Let t be the scenario-based risk assessment value. , Let i be the combined weight of the i-th risk factor. Let be the quantified value of the i-th risk factor at time t. This formula is a weighted summation risk quantification model. By weighted summation of each risk factor, a comprehensive risk assessment value is obtained, realizing the coupled quantification of multi-dimensional risks.

[0094] S24: Classify scenario-based risk levels according to risk assessment values. Low-risk L1 It is classified as medium risk L2. It is classified as high-risk L3. For extremely high risk (L4), output the scenario-based risk level at each transition moment.

[0095] In this embodiment, five core risk factors are first extracted from the enhanced temporal feature set, and each factor is quantified (e.g., scenario sensitivity levels 1-4, sensitivity identifier weights 0.1-0.9). Then, subjective weights are determined by combining the analytic hierarchy process with industry security standards. Objective weights are determined based on historical data using the entropy weight method. The combined weights are obtained by weighting the components by α=0.6. Finally, the combined weights are multiplied by the corresponding risk factor quantification values ​​and summed to obtain the risk assessment value. ,according to , , , Risk is classified into four levels: L1-L4.

[0096] In the above process, by adopting multi-dimensional risk factors to cover data and scenarios, and using a combination of weights from the analytic hierarchy process (subjective weight) and the entropy weight method (objective weight) to balance industry experience and data objectivity, the risk level can be made more in line with actual needs. Furthermore, by quantifying the risk assessment value and clarifying the grading threshold, the subjectivity of traditional qualitative assessment is avoided, providing a precise basis for the adaptation of encryption strategies.

[0097] In practical applications, the extraction of the five core risk factors—scenario sensitivity quantification value S, circulation scope quantification value R, circulation frequency quantification value F, data sensitivity identifier weight W, and cross-feature quantification value C—can be determined using the following methods:

[0098] (1) The scene sensitivity quantification value S is expressed by extracting the scene sensitivity from the flow scene feature data. Specifically, low sensitivity → level 1, medium sensitivity → level 2, high sensitivity → level 3, and extremely high sensitivity → level 4. Then, levels 1-4 are normalized and mapped to the [0,1] interval (for example, the denominator is the level span and the numerator is the normalization formula of the ratio of the current level to the lowest level). For example, the cross-border payment scene belongs to the extremely high sensitivity level 4, and the calculated quantification value is (4-1) / 3=1. The internal office scene belongs to the low sensitivity level 1, and the calculated quantification value is (1-1) / 3=0.

[0099] (2) The quantitative value R of the circulation scope is expressed by extracting the circulation scope from the feature data of the circulation scenario. Specifically, according to the logic of "single node → cross-department → cross-enterprise → cross-border", the original circulation scope is classified into 4 standard levels, and then the quantitative value is calculated by the same normalization mapping method. For example, cross-department shared data (circulation scope level 2) has a quantitative value of (2-1) / 3≈0.33, and cross-border transmission data (circulation scope level 4) has a quantitative value of (4-1) / 3=1.

[0100] (3) The quantified value F of the circulation frequency is expressed by extracting the real-time circulation frequency from the circulation scenario feature data. Specifically, it is statistically analyzed in units of times / day, and the real-time circulation frequency is mapped to the [0,1] interval using the maximum value normalization method (the numerator is the real-time circulation frequency, and the denominator is the maximum circulation frequency). For example, when the historical maximum circulation frequency is 100 times / day and the real-time circulation frequency is 60 times / day, the calculated quantified value is 60 / 100=0.6. When the real-time circulation frequency is 15 times / day, the calculated quantified value is 15 / 100=0.15.

[0101] (4) The data sensitivity label weight W is quantified by the sensitivity label extracted from the basic attribute data. Specifically, it is divided into four standard levels: "no sensitivity → low sensitivity → medium sensitivity → high sensitivity". The direct assignment method is used, with W=0.1 for no sensitivity, W=0.3 for low sensitivity, W=0.6 for medium sensitivity, and W=0.9 for high sensitivity.

[0102] (5) The cross-feature quantization value C is expressed by the cross-feature values ​​extracted from the enhanced temporal feature set. Specifically, the cross-feature value is a derived feature generated by operating on the basic attribute data and the flow scenario feature data (e.g., data sensitivity identifier weight × scenario sensitivity level, data size normalization value × flow frequency normalization value), and the original cross-feature is mapped to the [0,1] interval using linear normalization. For example, if the original cross-feature value is 2.7, the maximum value is 3.6, and the minimum value is 0, then the quantized value of the cross-feature value is (2.7-0) / (3.6-0) = 0.75.

[0103] In one feasible implementation, the step of extracting flow demand features from the enhanced data scenario time-series feature set and identifying the real-time flow type of the target data through matching with a preset flow type feature template specifically includes:

[0104] S31: Extract flow demand features from the enhanced data scenario time-series feature set; wherein, the flow demand features include: flow frequency E, number of flow nodes N, flow delay requirement D, node cross-domain identifier G, and the node cross-domain identifier G is assigned a value of 1 or 0 depending on whether it is cross-domain.

[0105] S32: Preset 4 types of circulation type feature templates, including: cross-border high-frequency circulation template with features E≥50, N≥3, D≤100ms, G=1; cross-department medium-frequency circulation template with features 20≤E<50, 2≤N<3, D≤300ms, G=0; internal low-frequency circulation template with features 5≤E<20, N=1, D≤500ms, G=0; and archive static circulation template with features E<5, N=1, D≤1000ms, G=0.

[0106] S33: Calculate the similarity between real-time workflow requirements and each template. The specific formula for calculating the similarity is as follows:

[0107]

[0108] In the formula, For feature similarity, , For the i-th component of the feature vector representing real-time flow demand, The i-th component of the template feature vector;

[0109] S34: Select the most similar and The template is used as the matching result to identify the real-time flow type of the target flow data; if After adjusting the delay requirements according to the closest template type, the real-time flow type of the target flow data is determined.

[0110] In this embodiment, four types of flow requirement features—flow frequency (E), number of nodes (N), delay requirement (D), and node cross-domain identifier (G)—are first extracted from the enhanced time-series feature set to form a feature vector. Then, feature templates for four types of flow are defined, and the threshold range of each feature is clarified. The similarity between the real-time feature vector and the feature vector of each template is calculated using the cosine similarity formula to measure the degree of matching between the two. Templates with a similarity ≥ 0.8 are selected as the recognition result. If all are < 0.8, the closest template is matched after adjusting the delay requirement (e.g., D = 150ms is adjusted to ≤ 200ms to match the cross-border high-frequency template).

[0111] Therefore, this embodiment uses standardized templates and similarity quantification to make the identification of circulation types more accurate, which can avoid the inappropriate adaptation of encryption strategies due to type misjudgment (such as misjudging cross-border circulation as internal circulation and adopting a low-security strategy). At the same time, the template correction mechanism is used to adapt to non-standard circulation scenarios (such as scenarios between cross-border high frequency and cross-department medium frequency), which can improve the versatility of the solution.

[0112] In one feasible implementation, the step of dynamically outputting the encryption strategy adaptation parameters corresponding to the real-time streaming type specifically includes:

[0113] S35: Construct an encryption strategy adaptation matrix for circulation type and risk level; wherein, the encryption strategy adaptation matrix includes four types of adaptation parameters: algorithm type, key length, encryption mode, and delay threshold;

[0114] The core configuration of the adaptation matrix is ​​as follows:

[0115] Extremely high risk L4: SM2+SM4 hybrid encryption, SM4 key length = 256 bits, SM2 key length = 256 bits, SM4 encryption mode = GCM, latency threshold ≤ 100ms;

[0116] High-risk L3: SM4 encryption, key length = 192 bits, encryption mode = CCM, delay threshold ≤ 300ms;

[0117] Medium-risk L2: SM4 encryption, key length = 128 bits, encryption mode = CBC, latency threshold ≤ 500ms;

[0118] Low-risk L1: SM3 hash check, hash length = 256 bits, latency threshold ≤ 1000ms;

[0119] S36: Based on the real-time flow type and scenario-based risk level, match the corresponding encryption policy adaptation parameters from the encryption policy adaptation matrix and output the parameter set. , , , ,in For algorithm type, This is the key length. Encryption mode, This is the delay threshold.

[0120] In this embodiment, using circulation type (4 categories) and risk level (4 levels) as two dimensions, and based on industry security standards and performance test results, the encryption strategy parameters for each combination are determined. Then, by using real-time circulation type and scenario-based risk level, the corresponding parameter combination is located in the matrix. By adopting differentiated parameters corresponding to different risk levels and circulation types (e.g., cross-border high-frequency + L4 using hybrid encryption, internal low-frequency + L1 using hash verification), the security of high-risk scenarios is ensured while reducing resource consumption in low-risk scenarios. At the same time, the dual-dimensional matrix can cover all mainstream scenario combinations, avoiding under-protection or over-protection caused by mismatch between strategy and scenario.

[0121] In one feasible implementation, the step of calculating the security adaptation index for each transfer node based on the enhanced data scenario temporal feature set specifically includes:

[0122] S41: Based on the information of the flow nodes in the time-series data of the data scenario synchronization, extract the node security features including vulnerability scores and the number of historical security events, and the load features including CPU utilization and remaining bandwidth, and use weighted summation to calculate the security adaptation index of the flow nodes.

[0123] The specific expression for the security adaptation index of the transfer node is as follows:

[0124]

[0125] In the formula, For the security adaptation index of the j-th transfer node, The higher the value, the better the fit. Score the vulnerabilities of the nodes. This refers to the number of historical security incidents for the node over the past three months. The maximum number of historical security events across all nodes. This represents the real-time CPU utilization of the node.

[0126] In this embodiment, a vulnerability score for each flow node is extracted from the enhanced temporal feature set. According to the CVSS standard score of 0-10, the number of historical security incidents in the past 3 months Real-time CPU utilization 0-100%, then convert the vulnerability score to Historical security incident count converted CPU utilization converted to To ensure all features fall within the 0-1 range, the normalized features are weighted and summed with weights of 0.5, 0.3, and 0.2 to obtain the node safety adaptation index. A larger value indicates that the node is more suitable for the current data storage needs.

[0127] It's easy to understand that by using node security compatibility metrics to screen qualified and highly compatible nodes, high-risk data can be avoided from being stored on low-security nodes. At the same time, by incorporating CPU utilization into the evaluation metrics, nodes with excessive loads can be avoided, ensuring the stability of data transmission and storage.

[0128] In one feasible implementation, the dynamic encryption step is performed, specifically including:

[0129] S42: Call the national cryptographic algorithm library and load the encryption strategy adaptation parameters. , , , ;

[0130] S43: Perform encryption procedures for different algorithm types:

[0131] when At that time, according to Generate a 256-bit SM4 session key ,according to Encrypt target data flow and output ciphertext. Integrity verification label The SM2 algorithm is called to generate a 256-bit key pair, and the public key in the key pair is used. encryption Obtain the encryption result ; Initialize the vector , , , Encapsulate sequentially to generate the final encrypted data; when At that time, according to Generate SM4 key, press Encrypt data, output ciphertext and ;when At that time, a 256-bit hash calculation is performed on the data, and the output is a combination of the hash value and the original data.

[0132] In this embodiment, the national cryptographic algorithm library is invoked, and encryption strategy adaptation parameters are loaded. , , , The encryption algorithm and related parameters (such as key length and encryption mode) are initialized, followed by differentiated encryption processes: SM2+SM4 uses hybrid encryption, SM4 uses single encryption, and SM3 uses hash verification. Finally, the encrypted data (ciphertext or combined packets) is transmitted to the subsequent split storage stage. Thus, based on a standardized encryption process, key leakage or data tampering due to improper operation can be avoided, while the use of a unified encapsulation format ensures that the receiver can parse the data according to fixed rules, further balancing security and compatibility.

[0133] It should be noted that the design of the encryption process is highly dependent on the scenario, for example:

[0134] (1) SM2+SM4 hybrid encryption: adapted to L4 level extremely high risk scenarios (such as cross-border payment data), SM4 encryption ensures efficiency, and SM2 encryption key avoids key transmission leakage, providing double protection for data security.

[0135] (2) SM4 single encryption: adaptable to L3-L2 level risk scenarios (such as cross-departmental data sharing), balancing security strength and encryption efficiency, without the need for additional key encryption overhead.

[0136] (3) SM3 hash verification: It is suitable for low-risk scenarios at L1 level (such as internal office notices), only needing to verify data integrity (to avoid tampering), without encryption overhead, thus improving transmission efficiency.

[0137] In one feasible implementation, the split storage step of adapting the transfer node includes:

[0138] S44: Calculate the data splitting threshold The expression is as follows:

[0139]

[0140] In the formula, The size of the encrypted data. Based on scenario-based risk levels, L1=1, L2=2, L3=3, L4=4. For safety adaptation indicators The number of qualified nodes, The average security compatibility index for qualified nodes;

[0141] S45: By split threshold Split the encrypted data according to the formula get Each segment is assigned a unique ID and associated with the original data ID; among them... This represents the floor function;

[0142] S46: Assign nodes based on the scenario-based risk level of the fragments, allocating high-risk fragments of L3 and L4 data to [nodes / locations]. Highly adaptable nodes allocate low-to-medium risk segments of L2 and L1 data to Nodes;

[0143] S47: Record the mapping table of fragment ID, node ID and storage path, and store it in the distributed metadata center.

[0144] In this embodiment, the size of the encrypted data is first determined. Risk level quantification value L1=1, L2=2, L3=3, L4=4; Number of qualified nodes n: Average safety compatibility index of qualified nodes Calculate the splitting threshold T, then split the encrypted data according to T, calculate the number of fragments, assign a unique ID to each fragment and associate it with the original data ID, and finally allocate the L3-L4 level high-risk fragments to highly adaptable nodes. Low-to-medium risk segments in levels L1-L2 are allocated to qualified nodes. The association between fragment ID, node ID, and storage path is stored in a distributed metadata center for fragment location and assembly during data retrieval.

[0145] In the above implementation process, the dynamic splitting threshold is adjusted according to the data size and node status (e.g., large-size L4 level data is split into more fragments) to avoid fragments being too large and occupying node resources or too small and causing management redundancy. Nodes are allocated according to risk level to ensure that high-risk data is stored on nodes with higher security adaptation indicators, thereby reducing the risk of leakage. At the same time, the mapping table records the association between fragments and nodes, ensuring that all fragments can be quickly located when data is called, thus ensuring data integrity.

[0146] Therefore, this invention provides a digital security authentication method. Based on the basic attributes and flow scenario characteristics of the target flowing data, it obtains an enhanced temporal feature set through data scenario association mapping and feature enhancement. A risk level is output through multi-dimensional risk coupling assessment. Combined with flow type identification, encryption strategies are dynamically matched. Finally, through node-adaptive dynamic encryption and split storage, security authentication is completed throughout the entire data flow cycle. This solves the problems of under-protection and over-protection in traditional methods, balances the security of authentication and transmission efficiency during data flow, improves the adaptability and control accuracy in complex flow scenarios, and provides a more scientific and practical security authentication solution for diverse flow scenarios.

[0147] In some embodiments, an apparatus for digital security authentication is also provided, comprising: a memory, a processor, and a digital security authentication program stored in the memory and executable on the processor, wherein the digital security authentication program, when executed by the processor, implements the steps of the digital security authentication method as described in any of the preceding embodiments.

[0148] Other embodiments or specific implementations of the digital security authentication device of the present invention can be found in the above-described method embodiments, and will not be repeated here.

[0149] Reference Figure 2 , Figure 2 This is a schematic diagram of the structure of a digital security authentication system according to an embodiment of the present invention.

[0150] like Figure 2 As shown, the digital security authentication system proposed in this embodiment of the invention includes:

[0151] The feature acquisition module 10 is used to acquire the basic attribute data and the flow scenario feature data of the target flow data, and to perform data scenario association mapping and feature enhancement on the basic attribute data and the flow scenario feature data to obtain an enhanced data scenario time series feature set.

[0152] The risk quantification module 20 is used to construct a multi-dimensional risk factor coupling assessment system, perform risk factor quantification and coupling weight calculation on the enhanced data scenario time series feature set, obtain scenario-based risk assessment results, and output the scenario-based risk level at each transition moment;

[0153] The encryption strategy generation module 30 is used to extract flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data through preset flow type feature template matching, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type.

[0154] The encrypted storage module 40 is used to calculate the security adaptation index of each transfer node based on the enhanced data scenario time-series feature set, and combine the scenario-based risk level and encryption strategy adaptation parameters to perform dynamic encryption and split storage adapted to the transfer node, thereby completing the security management of the target transfer data.

[0155] Other embodiments or specific implementations of the digital security authentication system of the present invention can be found in the above-described method embodiments, and will not be repeated here.

[0156] It is understood that in the description of this specification, references to terms such as "one embodiment," "another embodiment," "other embodiments," or "first embodiment to Nth embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0157] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0158] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for digital security authentication, characterized in that, Includes the following steps: Obtain the basic attribute data and flow scenario feature data of the target flow data. For the basic attribute data and the flow scenario feature data, perform data scenario association mapping and feature enhancement to obtain an enhanced data scenario time series feature set. Risk factors are quantified and coupled weights are calculated on the enhanced data scenario time series feature set to obtain scenario-based risk assessment results and output the scenario-based risk level at each transition time. The steps for quantifying risk factors and calculating coupling weights specifically include: Core risk factors are extracted from the time-series features of enhanced data scenarios; wherein, the core risk factors include: scenario sensitivity quantification value S, circulation range quantification value R, circulation frequency quantification value F, data sensitivity identifier weight W, and cross-feature quantification value C; First, calculate the subjective weights using the analytic hierarchy process. Then, the objective weights are calculated using the entropy weight method. To determine the combined coupling weight vector, the specific expression is: In the formula, For the combined coupling weight vector, Subjective weighting percentage , ;in, , , , , These represent the subjective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively. , , , , These represent the objective weights of the scene sensitivity quantification value S, the circulation range quantification value R, the circulation frequency quantification value F, the data sensitivity identifier weight W, and the cross-feature quantification value C, respectively. The specific expression for calculating the scenario-based risk assessment value is as follows: In the formula, Let t be the scenario-based risk assessment value. , Let i be the combined weight of the i-th risk factor. Let be the quantified value of the i-th risk factor at time t; Risk levels are categorized based on risk assessment values. Low-risk L1 It is classified as medium risk L2. It is classified as high-risk L3. For extremely high risk (L4), output the scenario-based risk level at each transition moment; Extract flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data by matching the preset flow type feature template, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type. Specifically, the process involves extracting flow demand features from the enhanced data scenario time-series feature set, and identifying the real-time flow type of the target data through matching with a preset flow type feature template. Extract flow requirement features from the time-series feature set of enhanced data scenarios; wherein, the flow requirement features include: flow frequency E, number of flow nodes N, flow delay requirement D, node cross-domain identifier G, and the node cross-domain identifier G is assigned a value of 1 or 0 depending on whether it is cross-domain. Four preset circulation type feature templates are provided, including: a cross-border high-frequency circulation template with features E≥50, N≥3, D≤100ms, and G=1; a cross-department medium-frequency circulation template with features 20≤E<50, 2≤N<3, D≤300ms, and G=0; an internal low-frequency circulation template with features 5≤E<20, N=1, D≤500ms, and G=0; and an archive static circulation template with features E<5, N=1, D≤1000ms, and G=0. Calculate the similarity between real-time workflow requirements and each template. The specific formula for calculating the similarity is as follows: In the formula, For feature similarity, , For the i-th component of the feature vector representing real-time flow demand, The i-th component of the template feature vector; Select the one with the highest similarity and The template is used as the matching result to identify the real-time flow type of the target flow data; if After adjusting the delay requirements according to the closest template type, the real-time flow type of the target flow data is determined. Based on the enhanced data scenario time-series feature set, the security adaptation index of each transfer node is calculated. Combined with the scenario-based risk level and encryption strategy adaptation parameters, dynamic encryption and split storage for transfer node adaptation are performed to complete the security management of the target transfer data. The split storage step, which involves adapting the transfer nodes, specifically includes: Calculate the data splitting threshold The expression is as follows: In the formula, The size of the encrypted data. Based on scenario-based risk levels, L1=1, L2=2, L3=3, L4=4. For safety adaptation indicators The number of qualified nodes, The average security compatibility index for qualified nodes; By split threshold Split the encrypted data according to the formula get Each segment is assigned a unique ID and associated with the original data ID; among them... This represents the floor function; Nodes are assigned based on the scenario-based risk level of the data segments, with high-risk segments of L3 and L4 data being allocated to [nodes / locations]. Highly adaptable nodes allocate low-to-medium risk segments of L2 and L1 data to Nodes; A mapping table of record fragment IDs, node IDs, and storage paths is stored in a distributed metadata center.

2. The digital security authentication method as described in claim 1, characterized in that, The basic attribute data and circulation scenario feature data specifically include: data attributes consisting of data type, sensitivity identifier, and data size, and circulation scenario features consisting of scenario sensitivity, circulation scope, circulation frequency, and circulation node information; The steps involved in performing association mapping and feature enhancement on the data scenario to obtain the enhanced time-series feature set of the data scenario specifically include: A data scenario association rule base is constructed, defining the association factors from data attribute features to scenario features. Association rules are mined using the Apriori algorithm, and rules with a confidence score ≥ 0.8 are included in the association rule base. The specific expression is as follows: In the formula, For the confidence level of the association rule, For data attribute features, As a scene feature, for and The combined support for Support level; Based on the association rule base, feature cross-enhancement is performed, which cross-operates on data attribute features and scene features to generate several cross features and merges them with the original features to form an initial feature set; The initial feature set is encapsulated in a temporal manner, and a temporal window is constructed by sorting by timestamp. The mean, variance, and trend slope of the features within each window are calculated to generate temporal derived features. The temporal derived features are combined with the initial feature set to form a temporal feature matrix, and the enhanced data scenario temporal feature set is output in the format {data ID, temporal feature matrix, timestamp sequence}.

3. The digital security authentication method as described in claim 1, characterized in that, The steps for dynamically outputting the encryption strategy adaptation parameters corresponding to the real-time streaming type specifically include: Construct an encryption strategy adaptation matrix for circulation type and risk level; the encryption strategy adaptation matrix includes four types of adaptation parameters: algorithm type, key length, encryption mode, and delay threshold. The core configuration of the adaptation matrix is ​​as follows: Extremely high risk L4: SM2+SM4 hybrid encryption, SM4 key length = 256 bits, SM2 key length = 256 bits, SM4 encryption mode = GCM, latency threshold ≤ 100ms; High-risk L3: SM4 encryption, key length = 192 bits, encryption mode = CCM, delay threshold ≤ 300ms; Medium-risk L2: SM4 encryption, key length = 128 bits, encryption mode = CBC, latency threshold ≤ 500ms; Low-risk L1: SM3 hash check, hash length = 256 bits, latency threshold ≤ 1000ms; Based on the real-time flow type and scenario-based risk level, the corresponding encryption policy adaptation parameters are matched from the encryption policy adaptation matrix, and a parameter set is output. ,in For algorithm type, This is the key length. Encryption mode, This is the delay threshold.

4. The digital security authentication method as described in claim 3, characterized in that, Based on the enhanced data scenario time-series feature set, the steps for calculating the security adaptation index of each transfer node specifically include: Based on the flow node information in the synchronous time-series data of the data scenario, the node security features including vulnerability scores and the number of historical security events are extracted, and the load features including CPU utilization and remaining bandwidth are extracted. The weighted summation is used to calculate the security adaptation index of the flow node. The specific expression for the security adaptation index of the transfer node is as follows: In the formula, For the security adaptation index of the j-th transfer node, The higher the value, the better the fit. Score the vulnerabilities of the nodes. This refers to the number of historical security incidents for the node over the past three months. The maximum number of historical security events across all nodes. This represents the real-time CPU utilization of the node.

5. The digital security authentication method as described in claim 4, characterized in that, The dynamic encryption process includes the following steps: Call the national cryptographic algorithm library and load the encryption strategy adaptation parameters. ; Execute encryption processes for different algorithm types: when At that time, according to Generate a 256-bit SM4 session key ,according to Encrypt target data flow and output ciphertext. Integrity verification label The SM2 algorithm is called to generate a 256-bit key pair, and the public key in the key pair is used. encryption Obtain the encryption result ; Initialize the vector , , , Encapsulate sequentially to generate the final encrypted data; when At that time, according to Generate SM4 key, press Encrypt data, output ciphertext and ;when At that time, a 256-bit hash calculation is performed on the data, and the output is a combination of the hash value and the original data.

6. A digital security authentication device, characterized in that, include: A memory, a processor, and a digital security authentication program stored on the memory and executable on the processor, wherein the digital security authentication program, when executed by the processor, implements the steps of the digital security authentication method as claimed in any one of claims 1 to 5.

7. A digital security authentication system, characterized in that, A method for performing digital security authentication as described in any one of claims 1-5, comprising: The feature acquisition module is used to acquire the basic attribute data and flow scenario feature data of the target flow data, and to perform data scenario association mapping and feature enhancement on the basic attribute data and the flow scenario feature data to obtain an enhanced data scenario time series feature set. The risk quantification module is used to construct a multi-dimensional risk factor coupling assessment system, perform risk factor quantification and coupling weight calculation on the enhanced data scenario time series feature set, obtain scenario-based risk assessment results, and output the scenario-based risk level at each transition moment; The encryption strategy generation module is used to extract flow requirement features from the enhanced data scenario time-series feature set, identify the real-time flow type of the target data through preset flow type feature template matching, and dynamically output the encryption strategy adaptation parameters corresponding to the real-time flow type. The encrypted storage module is used to calculate the security adaptation index of each transfer node based on the enhanced data scenario time-series feature set, and combine the scenario-based risk level and encryption strategy adaptation parameters to perform dynamic encryption and split storage adapted to the transfer node, thereby completing the security management of the target transfer data.

Images