Digitization-based office document security encryption method and system, and storage medium

Abstract

The application discloses an office document security encryption method and system based on digitization and a storage medium, and comprises the following steps: constructing a regular expression library to identify sensitive fields in office document data, sorting terminal logs, grouping sensitive fields of the same to-be-analyzed address into the same sensitive field group, calculating a data sensitivity value of the to-be-analyzed address and setting an encryption level for the to-be-analyzed address, analyzing file data in the to-be-analyzed address in a historical analysis period, constructing an update file group and an update time sequence of the update file group, judging whether the update time sequence has obvious periodicity, if yes, marking the update file group as a regular update group, calculating an update period of the regular update group and marking high-frequency period files and common files, obtaining the update period of the high-frequency period files and the creation duration of the common files, calculating a preset update weight of the to-be-analyzed address in combination with a sensitive field proportion, calculating a data sensitivity value according to the preset update weight, and dynamically adjusting the encryption level.

Description

Technical Field

[0001] This invention relates to the field of digital office technology, specifically to a method, system, and storage medium for secure encryption of digital office documents. Background Technology

[0002] In today's digital office environment, the number of electronic documents generated and stored by enterprises and organizations has surged, often containing large amounts of sensitive information such as personally identifiable data, financial reports, or trade secrets. Ensuring the security of these office documents and preventing data breaches has become a core challenge in the field of information security.

[0003] Traditional document encryption methods typically rely on static, uniform encryption strategies. In terms of dynamic data management, existing technologies do not fully consider the update behavior and time characteristics of files. Data in office documents is constantly updated over time, with varying update frequencies and cycles. However, existing encryption methods often ignore these dynamic characteristics and cannot flexibly adjust encryption strategies based on file update frequencies and cycles. For frequently updated files, using a high-strength, fixed encryption method will significantly increase encryption and decryption time with each update, severely impacting system performance and increasing the complexity of data management.

[0004] To address the aforementioned problems, this invention proposes a digital-based method, system, and storage medium for secure encryption of office documents. Summary of the Invention

[0005] The purpose of this invention is to provide a method, system, and storage medium for secure encryption of digital office documents, in order to solve at least one of the aforementioned problems in the prior art.

[0006] The objective of this invention can be achieved through the following technical solutions: A method for securely encrypting digital office documents includes the following steps: Based on the identified sensitive fields in the office document data, calculate the data sensitivity value of the address to be analyzed at the current analysis time point; The encryption level is set based on the obtained data sensitivity value of the address to be analyzed; Obtain file data of the address to be analyzed within the historical analysis period, mark frequently updated files and stable files, filter similar updated files, and construct updated file groups; Construct update time series for updated file groups, analyze the periodicity of update time series, mark regular update groups, and calculate update period; Based on the update cycle of the regular update group, mark the high-frequency regularly updated files and ordinary files in the address to be analyzed at the current analysis time point, calculate the preset update weight, and dynamically adjust the encryption level.

[0007] As a further aspect of the present invention: the data sensitivity value is expressed in the following manner: A regular expression library is built to identify sensitive fields in office document data at the current analysis time point. Sensitive fields with the same logical address are grouped into the same sensitive field group, and the logical address containing the sensitive field is marked as the address to be analyzed. The data sensitivity value of the address to be analyzed within the current data analysis period is calculated by formula.

[0008] As a further aspect of the present invention: the method for setting the encryption level is as follows: If the data sensitivity value of the address to be analyzed is greater than or equal to the high sensitivity threshold, the encryption level of the address to be analyzed is set to high encryption. If it is less than the high sensitivity threshold but greater than or equal to the low sensitivity threshold, the encryption level of the address to be analyzed is set to medium encryption. If it is less than the low sensitivity threshold, the encryption level of the address to be analyzed is set to low encryption.

[0009] As a further aspect of the present invention: the method for obtaining the updated file group is as follows: Group different versions of the same frequently updated file into an update file group, and mark the time of each generation of modification update signal as the update time between the version files; Compare two stable files of the same file type. If at least one stable file has a cleanup time, and the ratio of the overlap time between the two stable files' lifespans to the lifespan of either stable file is not 1, calculate the interval between the two stable files. If the interval is less than or equal to the interval threshold, the two stable files are grouped into the same update file group.

[0010] As a further aspect of the present invention: the method for obtaining the high-frequency update file and the stable file is as follows: For each file within the address to be analyzed, obtain the file's update time difference ΔLMT. If ΔLMT > 0, generate a modification update signal. If the number of times the same file generates modification update signals within the historical analysis period is greater than or equal to the number threshold, the file is marked as a high-frequency update file; otherwise, the file is marked as a stable file.

[0011] As a further aspect of the present invention: the method for obtaining the regular update group is as follows: Substitute the potential period Tcan into the autocorrelation coefficient formula to calculate the autocorrelation coefficient R(Tcan). If the autocorrelation coefficient R(Tcan) is greater than or equal to the autocorrelation coefficient threshold, the updated file group is marked as a regular update group. The potential period is obtained as follows: Get all update times in the update file group, take the average of two adjacent update times whose update interval is less than or equal to the interval threshold, use the average as the new update time, and remove the original two update times from the update file group; Construct an interval time series of the update time of the updated file group, perform a discrete Fourier transform on the interval time series to obtain the frequency domain sequence X(k). If a prominent peak appears in the frequency domain sequence X(k), the frequency f corresponding to the peak is the potential periodic frequency, and the potential period Tcan=1 / f.

[0012] As a further aspect of the present invention: the method for obtaining the preset update weight is as follows: Data processing is performed on the byte length of sensitive fields in high-frequency periodic files and the update cycle of the high-frequency regular update group to obtain the ratio of sensitive fields to update cycles in high-frequency periodic files. Data processing is performed on the byte length of all sensitive fields in ordinary files and the creation time to obtain the ratio of sensitive fields to creation time in ordinary files. Combining the obtained data, the preset update weight of the file to be analyzed at the current analysis time point is calculated.

[0013] As a further aspect of the present invention: the method for obtaining the high-frequency periodic file and the ordinary file is as follows: If the update cycle of a regular update group is less than or equal to the update duration threshold, the regular update group is marked as a high-frequency regular update group. All file data within the address to be analyzed at the current analysis time point are obtained. If a file belongs to a high-frequency regular update group, the file is marked as a high-frequency periodic file; otherwise, the file is marked as a regular file.

[0014] As a further aspect of the present invention: a digital office document security encryption system, comprising: Sensitive Identification Module: Based on the sensitive fields identified in the office document data, calculates the data sensitivity value of the address to be analyzed at the current analysis time point; Encryption segmentation module: Sets the encryption level based on the obtained data sensitivity value of the address to be analyzed; Behavior analysis module: Obtains file data of the address to be analyzed within the historical analysis period, marks frequently updated files and stable files, filters similar updated files, and constructs updated file groups; Periodicity determination module: Constructs the update time series of the update file group, analyzes the periodicity of the update time series, marks the regular update group and calculates the update period; Encryption optimization module: Based on the update cycle of the regular update group, it marks the high-frequency regularly updated files and ordinary files in the address to be analyzed at the current analysis time point, calculates the preset update weight, and dynamically adjusts the encryption level.

[0015] As a further aspect of the present invention: a storage medium comprising a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the digital office document security encryption method.

[0016] The beneficial effects of this invention are: 1. This invention identifies sensitive fields in office document data by constructing a regular expression library, efficiently organizes terminal logs, and categorizes sensitive information from the same address for easier management. By calculating data sensitivity values, it initially filters and quantifies sensitivity, providing a precise basis for subsequent encryption level classification. Setting encryption levels and matching differentiated encryption strategies ensures data security while balancing system performance, effectively preventing the leakage of sensitive information and improving the overall security level.

[0017] 2. This invention analyzes file data within the address to be analyzed, marks frequently updated and stable files, constructs updated file groups and determines periodicity, and can accurately identify regularly updated files. Based on the update cycle and the proportion of sensitive fields, it calculates preset update weights and data sensitivity values, and then dynamically adjusts the encryption level. This method effectively improves the intelligence level of data management, ensures data security, optimizes encryption strategies, achieves a balance between security and performance, and enhances the pertinence and effectiveness of data protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a digital office document security encryption method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of the steps for obtaining the preset update weight in the digital office document security encryption method provided in Embodiment 2 of the present invention; Figure 3 This is a flowchart of a digital office document security encryption system provided in Embodiment 3 of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] Example 1 like Figure 1 As shown in the figure, the digital office document security encryption method provided in this embodiment of the invention specifically includes the following steps: Step 1: Build a regular expression library to identify sensitive fields in office document data, organize terminal logs, group sensitive fields from the same address to be analyzed into the same sensitive field group, and calculate the data sensitivity value of the address to be analyzed. In some embodiments, common sensitive information formats are collected and organized, context association rules are added to build a regular expression library, office document data is obtained at the current analysis time point, the data information is compared with the built regular expression library, sensitive fields in the office document data at the current analysis time point are identified, and the sensitive fields are analyzed within the current data analysis cycle. The current data analysis period refers to a fixed-duration period for analyzing data, starting from the current analysis time point. The current analysis time point is also the end point of the previous data analysis period. Obtain the terminal logs corresponding to the office documents. The terminal logs include the write time, clear time and logical address of all data in the office documents. Sensitive fields with the same logical address are grouped into the same sensitive field group, and the logical addresses containing sensitive fields are marked as addresses to be analyzed. Based on any sensitive field group, the sensitive fields are sorted according to the data writing time of the sensitive fields and marked with a serial number i, i=1, 2, 3...m, where m represents the total number of sensitive fields in the sensitive field group at the current analysis time point; Based on a regular expression library and terminal logs, field information for several sensitive fields in office document data is obtained. This field information includes preset sensitivity weights corresponding to the sensitive fields. Byte length of sensitive fields ; Through formula The data sensitivity value S of the address to be analyzed, where the sensitive field group is located, is calculated within the current data analysis period. WT represents the preset update weight of the address to be analyzed, and LZ represents the total byte length of all data within the address to be analyzed where the sensitive field group is located. It should be noted that different types of sensitive fields have different preset sensitivity weights, which represent the sensitivity of the field itself. The data sensitivity value is calculated by accumulating the sensitivity of different sensitive fields. The purpose of the data sensitivity value is to quantify the sensitivity of the data in the address to be analyzed. Step 2: Based on the obtained data sensitivity values, set the encryption level for the address to be analyzed; In some embodiments, all sensitive field groups are traversed, the data sensitivity value of each address to be analyzed in the current data analysis period is calculated, and the encryption level analysis is performed on the data in the address to be analyzed based on the data sensitivity value. Specifically, based on any address to be analyzed, the data sensitivity value of the address to be analyzed is compared with the high sensitivity threshold and the low sensitivity threshold respectively; If the data sensitivity value of the address to be analyzed is greater than or equal to the high sensitivity threshold, the encryption level of the address to be analyzed will be set to high encryption. If the data sensitivity value of the address to be analyzed is less than the high sensitivity threshold and greater than or equal to the low sensitivity threshold, the encryption level of the address to be analyzed is set to medium encryption. If the data sensitivity value of the address to be analyzed is less than the low sensitivity threshold, the encryption level of the address to be analyzed will be set to low encryption. It should be noted that the address to be analyzed must contain a group of sensitive fields, therefore the data sensitivity value of the address to be analyzed is always greater than 0; Based on the encryption level of each address to be analyzed, an encryption strategy is selected to encrypt the data; For example, if the encryption level of the address to be analyzed is low-level encryption, the AES-128 encryption algorithm can be used in combination with a random salt value to encrypt the data. The encryption key is stored in a key block storage method. The AES-128 encryption algorithm uses a symmetric encryption method, and the same key is used for encryption and decryption. The random salt value is a randomly generated meaningless string. In the encryption process, it is combined with the original data to generate different ciphertexts. For example, if the encryption level of the address to be analyzed is medium encryption, the SM4 encryption algorithm can be used in combination with the HMAC-SHA3 message authentication code to encrypt the data, and the encryption key can be managed by the key hash index. The SM4 encryption algorithm adopts a 32-round iterative encryption structure and performs data encryption operation with a 128-bit block length and a 128-bit key length. For example, if the encryption level of the address to be analyzed is high encryption, the SM9 algorithm can be used in combination with hardware fingerprint binding to encrypt the data, and key segmentation encryption can be used to manage the key. The SM9 algorithm uses the user's identifier as the public key, and the hardware fingerprint refers to the unique feature of the device hardware, which has high security. The technical solution of this invention is as follows: a regular expression library is constructed to identify sensitive fields in office document data, terminal logs are organized, sensitive fields of the same address to be analyzed are grouped into the same sensitive field group, the data sensitivity value of the address to be analyzed is calculated, sensitive data is initially screened and its sensitivity is quantified, providing a basis for subsequent encryption level classification, encryption level is set for the address to be analyzed based on the obtained data sensitivity value, and differentiated encryption strategies are matched according to the data sensitivity to balance security and performance.

[0022] Example 2 like Figure 1 As shown in the embodiment of the present invention, the method for secure encryption of digital office documents further includes the following steps: Step 3: Analyze the file data within the address to be analyzed during the historical analysis period, obtain file log records, mark frequently updated files and stable files, and filter out similar updated files among the stable files to construct an updated file group; In some embodiments, the data stored in the address to be analyzed is further analyzed within the data analysis cycle, based on any address to be analyzed; Specifically, several detection time points are selected within the historical analysis period. The historical analysis period refers to a time period starting from the creation time of the address to be analyzed and ending at the current analysis time point. The interval between the detection time points is the same. Based on any detection time point, all file data within the address to be analyzed are traversed at the detection time point to obtain the log records of the file data in the file system. The log records include the file creation time, the file's last modified time (LMT) at the detection time point, and the file's clearing time. The interval between the file creation time and the clearing time is marked as the file's survival period. For each file in the address to be analyzed, the last modification time (LMT) of the file at adjacent detection time points within the survival period is obtained, the difference is calculated and the absolute value is processed to obtain the file update time difference ΔLMT. If ΔLMT>0, it indicates that the file has been modified and updated between adjacent detection time points, generating a modification and update signal. The number of times the same file generates modification and update signals within the historical analysis period is obtained and compared with the number threshold. If the number of times a file generates modification and update signals is greater than or equal to the number threshold, the file is marked as a high-frequency update file; If the number of times a file generates modification and update signals is less than a threshold, the file is marked as a stable file. Tag-based high-frequency update files treat the file data of the same high-frequency update file at each time a modification update signal is generated as an independent file, and mark the version number of each independent file according to the time sequence of the generation of the modification update signal. Different version files of the same high-frequency update file are grouped into an update file group, and the time of each generation of the modification update signal is marked as the update time between the version files. Based on the labeled stable files, compare any two stable files of the same type within the historical analysis period. If at least one of the two stable files has a cleanup time, and the ratio of the overlap time between the survival time of the two stable files to the survival time of any one of the two stable files is not 1, then it is determined that the two stable files have a temporal relationship, with the stable file with the earlier creation time having a higher temporal sequence. It should be noted that in two stable files with a temporal relationship, the stable file with the earlier creation time also has an earlier deletion time, and at least one of the two stable files has a deletion time. Therefore, the stable file with the earlier creation time must have a deletion time. For any two stable files of the same type that have a temporal relationship, the difference between the clearing time of the earlier stable file and the creation time of the later stable file is calculated and the absolute value is taken to obtain the interval between the two stable files. The interval is then compared with an interval threshold. If the interval duration is less than or equal to the interval duration threshold, it indicates that there is writing of the same type of stable file when the stable file is cleared. The two stable files are determined to be the same type of update file, and the two stable files are classified into the same update file group. The clearing time of the stable file with the earlier time sequence in the two stable files is marked as the update time between the two stable files. Traverse all files within the address to be analyzed to obtain several updated file groups; Step 4: Construct the update time series of the update file group, determine whether there is obvious periodicity in the update time series, and if so, mark the update file group as a regular update group and calculate the update period of the regular update group. In some embodiments, based on any update file group, all update times in the update file group are obtained, the difference between two time-adjacent update times is calculated and the absolute value is taken to obtain the update interval duration, and the obtained update interval duration is compared with the interval duration threshold. If the update interval is less than or equal to the interval threshold, the average of the two update times is taken and used as the new update time. The original two update times are then removed from the update file group. Iterate through all update times in the update file group until there are no two update times whose update interval is less than or equal to the interval threshold. It should be noted that when two updates are too close together, they can be considered as a single modification or update, thus reducing the impact of multiple modifications and updates within a very short period on subsequent analysis. For any given updated filegroup, construct an update time series for the updated filegroup based on all update times within the updated filegroup, and label it as follows. , where n represents the total number of update times within the updated file group; Calculate the time interval between two adjacent update times. ,in This represents the update time of the a-th update within the updated filegroup, where a = 1, 2, 3...n-1; constructing the time sequence of update intervals. ; Using the Discrete Fourier Transform formula Perform a Discrete Fourier Transform on the time interval sequence ΔT, where x(n) are the elements in the time interval sequence ΔT, N=n-1 is the sequence length, k represents the frequency index, and j represents the imaginary unit. After Fourier transform, the frequency domain sequence X(k) is obtained; It should be noted that the amplitude |X(k)| of the frequency domain sequence X(k) reflects the relative intensity of different frequency components in the original time series; If a prominent peak appears in the frequency domain sequence X(k), it is determined that the update time series has a certain degree of periodicity. The frequency f corresponding to the peak is the potential periodic frequency. ; According to the formula Calculate the autocorrelation coefficient R(m) of the time series at intervals, where is the mean of the time series interval, m is the time delay, and the value range is 0≤m≤N-1; Potential cycle Substituting the time delay into the autocorrelation coefficient formula, the autocorrelation coefficient is calculated. The obtained autocorrelation coefficient Compare with the autocorrelation coefficient threshold; If the autocorrelation coefficient If the value is less than the autocorrelation coefficient threshold, it indicates that the updated time series has no obvious periodicity. If the autocorrelation coefficient If the autocorrelation coefficient is greater than or equal to the threshold, it indicates that the update time series has a significant periodicity. The updated file group is marked as a regular update group, and the update period of the regular update group is the potential periodicity. ; Step 5: Based on the regular update group update cycle, mark high-frequency periodic files and ordinary files, obtain the update cycle of high-frequency periodic files and the creation time of ordinary files, calculate the preset update weight of the address to be analyzed by combining the proportion of sensitive fields, calculate the data sensitivity value according to the preset update weight, and dynamically adjust the encryption level. like Figure 2 As shown, the specific steps for obtaining the preset update weight are as follows; In some embodiments, based on the pattern update group of the label, the update period of the pattern update group is obtained and compared with the update duration threshold; If the update cycle of a regular update group is greater than the update duration threshold, it indicates that the file data in the regular update group has a long lifespan. If the update cycle of a regular update group is less than or equal to the update duration threshold, it indicates that the file data in the regular update group has a short lifespan. The encryption level can be appropriately reduced to facilitate the reading of file data, and the regular update group can be marked as a high-frequency regular update group. Based on any address to be analyzed, obtain all file data within the address to be analyzed at the current analysis time point, and determine whether the file belongs to any high-frequency regular update group; If a file belongs to a high-frequency, regularly updated group, mark the file as a high-frequency periodic file; If a file does not belong to a frequently updated group, mark the file as a regular file; Traverse all files within the address to be analyzed at the current analysis time point to obtain several high-frequency periodic files and several ordinary files; Mark all high-frequency periodic files with serial numbers c, c=1, 2, 3...b, where b represents the number of high-frequency periodic files in the address to be analyzed at the current analysis time point; Based on a high-frequency periodic file with any tag, obtain the byte length of all sensitive fields within the file, and then compare it with the total byte length of all sensitive fields within the address to be analyzed to obtain the sensitive field ratio (MZ) of the high-frequency periodic file. c ; Obtain the update cycle of the high-frequency periodic file's high-frequency regular update group, and compare it with the update duration threshold to obtain the update cycle ratio (TG) of the high-frequency periodic file. c ; Based on the marked ordinary files, obtain the sum of the byte lengths of all sensitive fields in all ordinary files, and compare it with the total byte length of all sensitive fields in the address to be analyzed to obtain the sensitive field ratio of the ordinary file in MS. Obtain the average creation time of all ordinary files between their creation time and the current analysis time. Then, calculate the average creation time by comparing it with the update time threshold to obtain the creation time ratio (TC) of ordinary files. Through formula The preset update weight WT of the file to be analyzed at the current analysis time point is calculated, where This represents the basic preset update weights for office document data; It should be noted that the preset update weight is dynamically calculated by integrating the sensitivity of frequently updated files, update cycle characteristics, and the proportion of sensitive data and creation time of ordinary files. It is used for the subsequent allocation and dynamic adjustment of encryption levels, so that the encryption strategy can comprehensively consider the data's sensitive attributes, update frequency, storage time and other multi-dimensional characteristics, achieve more refined encryption level management, and balance data security and access efficiency. The encryption level of office document data at different logical addresses is allocated and dynamically adjusted based on the calculated preset update weight and data sensitivity value. It should be noted that the purpose of the steps described is to dynamically optimize the encryption strategy, improve protection for files with long storage time and a high proportion of sensitive data, and conversely reduce encryption complexity to improve access efficiency. The technical solution of this invention is as follows: Analyze file data within the address to be analyzed during a historical analysis period, obtain file log records, mark high-frequency update files and stable files, filter out similar update files among stable files, construct update file groups, construct update time series of update file groups, determine whether there is obvious periodicity in the update time series, if so, mark the update file group as a regular update group, calculate the update period of the regular update group, mark high-frequency periodic files and ordinary files based on the update period of the regular update group, obtain the update period of high-frequency periodic files and the creation time of ordinary files, calculate the preset update weight of the address to be analyzed in combination with the proportion of sensitive fields, calculate the data sensitivity value according to the preset update weight, and dynamically adjust the encryption level.

[0023] Example 3 like Figure 3 As shown in the figure, the digital office document security encryption system provided in this embodiment of the invention specifically includes the following modules: Sensitive Identification Module: Based on the sensitive fields identified in the office document data, calculates the data sensitivity value of the address to be analyzed at the current analysis time point; Encryption segmentation module: Sets the encryption level based on the obtained data sensitivity value of the address to be analyzed; Behavior analysis module: Obtains file data of the address to be analyzed within the historical analysis period, marks frequently updated files and stable files, filters similar updated files, and constructs updated file groups; Periodicity determination module: Constructs the update time series of the update file group, analyzes the periodicity of the update time series, marks the regular update group and calculates the update period; Encryption optimization module: Based on the update cycle of the regular update group, it marks the high-frequency regularly updated files and ordinary files in the address to be analyzed at the current analysis time point, calculates the preset update weight, and dynamically adjusts the encryption level.

[0024] Example 4 This embodiment provides a storage medium that includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the digital office document security encryption method described in the above embodiment.

[0025] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0026] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for secure encryption of digital office documents, characterized in that: Includes the following steps: Based on the sensitive fields in the identified office document data, calculate the data sensitivity value of the address to be analyzed at the current analysis time point; The encryption level is set based on the obtained data sensitivity value of the address to be analyzed; Obtain file data of the address to be analyzed within the historical analysis period, mark frequently updated files and stable files, filter similar updated files, and construct updated file groups; The updated file group is obtained in the following way: Group different versions of the same frequently updated file into an update file group, and mark the time of each generation of modification update signal as the update time between the version files; Compare two stable files of the same file type. If at least one stable file has a cleanup time, and the ratio of the overlap time between the two stable files' lifespans to the lifespan of any stable file is not 1, calculate the interval between the two stable files. If the interval is less than or equal to the interval threshold, the two stable files are grouped into the same update file group. Construct update time series for updated file groups, analyze the periodicity of update time series, mark regular update groups, and calculate update period; Based on the update cycle of the regular update group, mark the high-frequency regularly updated files and ordinary files in the address to be analyzed at the current analysis time point, calculate the preset update weight, and dynamically adjust the encryption level; The preset update weight is obtained as follows: Data processing is performed on the byte length of sensitive fields in high-frequency periodic files and the update cycle of the high-frequency regular update group to obtain the ratio of sensitive fields to update cycles in high-frequency periodic files. Data processing is performed on the byte length of all sensitive fields in ordinary files and the creation time to obtain the ratio of sensitive fields to creation time in ordinary files. Combining the obtained data, the preset update weight of the file to be analyzed at the current analysis time point is calculated. The methods for obtaining the high-frequency periodic files and ordinary files are as follows: If the update cycle of a regular update group is less than or equal to the update duration threshold, the regular update group is marked as a high-frequency regular update group. All file data within the address to be analyzed at the current analysis time point are obtained. If a file belongs to a high-frequency regular update group, the file is marked as a high-frequency periodic file; otherwise, the file is marked as a regular file.

2. The digital-based office document security encryption method according to claim 1, characterized in that, The method for obtaining the data sensitivity value is as follows: A regular expression library is built to identify sensitive fields in office document data at the current analysis time point. Sensitive fields with the same logical address are grouped into the same sensitive field group, and the logical address containing the sensitive field is marked as the address to be analyzed. The data sensitivity value of the address to be analyzed within the current data analysis period is calculated by formula.

3. The digital-based office document security encryption method according to claim 1, characterized in that, The method for setting the encryption level is as follows: If the data sensitivity value of the address to be analyzed is greater than or equal to the high sensitivity threshold, the encryption level of the address to be analyzed is set to high encryption. If it is less than the high sensitivity threshold but greater than or equal to the low sensitivity threshold, the encryption level of the address to be analyzed is set to medium encryption. If it is less than the low sensitivity threshold, the encryption level of the address to be analyzed is set to low encryption.

4. The digital-based office document security encryption method according to claim 1, characterized in that, The methods for obtaining the high-frequency update files and stable files are as follows: For each file within the address to be analyzed, obtain the file's update time difference ΔLMT. If ΔLMT > 0, generate a modification update signal. If the number of times the same file generates modification update signals within the historical analysis period is greater than or equal to the number threshold, the file is marked as a high-frequency update file; otherwise, the file is marked as a stable file.

5. The digital-based office document security encryption method according to claim 1, characterized in that, The method for obtaining the regular update group is as follows: Substitute the potential period Tcan into the autocorrelation coefficient formula to calculate the autocorrelation coefficient R(Tcan). If the autocorrelation coefficient R(Tcan) is greater than or equal to the autocorrelation coefficient threshold, the updated file group is marked as a regular update group. The potential period is obtained as follows: Get all update times in the update file group, take the average of two adjacent update times whose update interval is less than or equal to the interval threshold, use the average as the new update time, and remove the original two update times from the update file group; Construct an interval time series of the update time of the updated file group, perform a discrete Fourier transform on the interval time series to obtain the frequency domain sequence X(k). If a prominent peak appears in the frequency domain sequence X(k), the frequency f corresponding to the peak is the potential periodic frequency, and the potential period Tcan=1 / f.

6. A digital-based office document security encryption system, wherein the system is used to implement the encryption method as described in any one of claims 1-5, characterized in that, include: Sensitive Identification Module: Based on the sensitive fields identified in the office document data, calculates the data sensitivity value of the address to be analyzed at the current analysis time point; Encryption segmentation module: Sets the encryption level based on the obtained data sensitivity value of the address to be analyzed; Behavior analysis module: Obtains file data of the address to be analyzed within the historical analysis period, marks frequently updated files and stable files, filters similar updated files, and constructs updated file groups; Periodicity determination module: Constructs the update time series of the update file group, analyzes the periodicity of the update time series, marks the regular update group and calculates the update period; Encryption optimization module: Based on the update cycle of the regular update group, it marks the high-frequency regularly updated files and ordinary files in the address to be analyzed at the current analysis time point, calculates the preset update weight, and dynamically adjusts the encryption level.

7. A storage medium, characterized in that... The storage medium includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the digital office document security encryption method according to any one of claims 1-5.

Images