Multi-source data collaboration and sharing method and system of intelligent battle platform

Abstract

The invention discloses a multi-source data collaboration and sharing method and system for an intelligent battle platform, and relates to the technical field of battle data sharing. Multi-source data of the battle platform is acquired and fused to generate a trusted data base, and the trusted data base is deployed in a data insurance library; performing real-time risk assessment on the access application of the user through a context awareness strategy engine and generating an access control strategy; generating an access credential based on the access control strategy, and accessing a security data sub-library in the data insurance library through the access credential; the security data sub-library drives a data encapsulator to generate a fine-grained instruction based on the access credential and the strategy, performs data extraction and encapsulation on the trusted data base by using the fine-grained instruction, and generates a strategy binding type data object with an embedded self-destruction strategy; the access request is returned to the user through the same routing path; according to the method, a dynamic data differentiation and active defense system is constructed, so that refined management and control and safe sharing of the battle data are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of united front data sharing, and in particular to a multi-source data collaboration and sharing method and system of a smart united front platform. BACKGROUND

[0002] In the current data sharing practice of the smart united front platform, an access control mechanism based on role permission management is generally adopted, and limited data opening and sharing are realized in combination with data desensitization, API gateway and other technical means; This kind of method has achieved certain results in basic data security guarantee, but still faces some challenges in dealing with complex and variable actual business scenarios. First, the existing data sharing mode usually needs to provide full or larger range of data copies. This extensive data distribution mechanism makes it difficult to effectively track and manage the use of data after leaving the core storage area, and there is a certain risk of secondary diffusion. And the static permission management system based on fixed roles is difficult to adapt to the dynamic changes of business needs, and cannot be flexibly adjusted according to specific access scenarios, data sensitivity levels and real-time environmental factors, which often leads to mismatch between permission settings and actual needs in practice, which may affect the reasonable utilization efficiency of data resources. At the same time, the existing technical solutions have relatively limited recording and tracing capabilities for the data use process, and it is difficult to provide complete and reliable data flow evidence chain for subsequent audit analysis. These factors to some extent restrict the value mining and security guarantee of united front data elements; Therefore, it is of great significance to develop a multi-source data collaboration and sharing method of a smart united front platform. SUMMARY

[0003] The purpose of the present application is to provide a multi-source data collaboration and sharing method and system of a smart united front platform to solve the problems in the background art.

[0004] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme: a multi-source data collaboration and sharing method of a smart united front platform, comprising: Obtaining multi-source data of the united front platform, fusing the multi-source data based on a fusion device to generate a trusted data base, and deploying the trusted data base in a data vault; Through a scene perception strategy engine, real-time risk assessment is performed on the access application received by the data vault, and a dynamic access control strategy is generated; Based on the access control strategy, an access credential is generated, and based on the access credential, the user access application is guided to a secure data sub-library in the data vault; The secure data sub-library receiving the access credential generates fine-grained instructions based on a strategy-driven data packager, performs data extraction and packaging on the trusted data base based on the fine-grained instructions, and generates a policy-bound data object with an embedded self-destruction strategy. The policy-bound data object is returned to the user via the same routing path as the access application.

[0005] In a preferred embodiment, the step of obtaining multi-source data of the united front platform and fusing the multi-source data based on a fusioner to generate a trusted data base is: A data interface is constructed to access multi-source data from internal systems of the united front, government departments and public data sources, and convert the accessed multi-source data into a columnar storage format of the platform standard; An entity recognizer is constructed to determine entities based on preset matching rules and generate entity identifiers; An entity clustering is performed based on similarity calculation of the entity identifiers using a machine learning model to generate entity sets, and a united front object ID is assigned to each entity set; A unified data view of each entity is generated by fusing multi-dimensional information of the entity based on the united front object ID as an index, and a trusted data base is generated by combining unified data views of multiple entities.

[0006] In a preferred embodiment, the step of deploying the trusted data base in the data vault is: A logically isolated secure storage environment is constructed as a data vault, and an isolated storage space is generated in the data vault for placing the trusted data base; A plurality of pre-interaction zones are set up around the isolated storage space and dynamically connected with the trusted data base for data interaction; A plurality of secure data sub-libraries are constructed around the pre-interaction zones and dynamically connected with the plurality of pre-interaction zones for data interaction; Unstructured garbage data is filled in the global space of the data vault that is not occupied by the isolated storage space, pre-interaction zones and secure data sub-libraries, and the garbage data is composed of a large number of format-imitated but content-ineffective data.

[0007] In a preferred embodiment, the step of performing real-time risk assessment on access applications received by the data vault through the scenario-aware policy engine and generating dynamic access control policies is: A multi-dimensional feature extractor is constructed to extract multi-dimensional features of the application from the access application, including access subject attributes, requested data resource attributes and environmental context attributes; A risk evaluator is used to perform fusion calculation on the multi-dimensional features of the application based on a deep neural network model, output a risk assessment score and divide a risk level; Based on the risk level, a corresponding access control policy is dynamically generated by a policy generator, including data access range constraints, data desensitization rules and navigation token types.

[0008] In a preferred embodiment, the step of generating access credentials based on the access control policy, and directing the user to access the secure data sub-bank in the data vault based on the access credentials is: For the access application with a trusted risk assessment, generating a trusted credential containing the target secure data sub-bank coordinates and access permissions; For the access application with a suspicious or illegal risk assessment, generating a deceptive credential pointing to garbage data; Setting a routing verifier on the data vault for real-time verification of access credentials, and assigning different routing paths for different access credentials; According to the type of access credentials and the routing path, the access application is guided to the corresponding area in the data vault.

[0009] In a preferred embodiment, the secure data sub-bank receiving the access credentials generates fine-grained instructions based on the policy-driven data encapsulator, and extracts and encapsulates the trusted data base based on the fine-grained instructions to generate policy-bound data objects with self-destruction policies. The routing verifier sends the access credentials to the corresponding secure data sub-bank based on the routing path assigned to the access credentials; The policy-driven data encapsulator is built in the data security sub-bank, which decodes the access credentials and generates fine-grained instructions containing target unified object ID, data field range, desensitization level and usage constraints; The secure data sub-bank that generates fine-grained instructions randomly initiates an interaction application to a front-end interaction area, and constructs a temporary dynamic data channel from the trusted data base to the secure data sub-bank through the front-end interaction area; The secure data sub-bank transmits the fine-grained instructions to the front-end interaction area based on the temporary dynamic data channel, and the front-end interaction area extracts the corresponding data in the trusted data base based on the fine-grained instructions; The extraction operation includes indexing and positioning in the trusted data base with the target unified object ID as the primary key, positioning the target field in the entity set according to the data field range, and extracting the target field to the front-end interaction area in the form of data stream; The extracted data stream is transmitted to the secure data sub-bank through the temporary dynamic data channel, and the encapsulation operation is performed based on the policy-driven data encapsulator; The encapsulation operation includes desensitizing the data stream according to the desensitization level in the fine-grained instructions, and generating a self-destruction policy for the data stream based on the usage constraints, the self-destruction policy including the maximum forwarding number and the absolute survival time stamp, and the self-destruction policy is injected into the data stream as metadata to encapsulate and generate policy-bound data objects.

[0010] In a preferred embodiment, the step of returning the policy-bound data object to the user via the same communication path as the access application is: After the pre-interaction area and the security data sub-library complete the data flow interaction, the computing resources of the temporary dynamic data channel are released. The policy-bound data object is returned to the user in reverse through the routing path established for the corresponding access application.

[0011] The application also provides a multi-source data collaboration and sharing system of a smart United Front platform, comprising: A data fusion module: acquires multi-source data of the United Front platform, fuses the multi-source data to generate a trusted data base based on a fusion device, and deploys the trusted data base in a data vault; A policy decision module: connected with the data fusion module, performs real-time risk assessment on the access application received by the data vault through a scenario-aware policy engine and generates a dynamic access control policy; A credential and routing module: connected with the policy decision module, generates an access credential based on the access control policy, and guides the user's access application to the secure data sub-library in the data vault based on the access credential; A data encapsulation processing module: connected with the credential and routing module, generates fine-grained instructions based on a policy-driven data encapsulator upon receiving the access credential, performs data extraction and encapsulation on the trusted data base based on the fine-grained instructions, and generates a policy-bound data object with an embedded self-destruction policy; A secure return module: connected with the data encapsulation processing module, returns the policy-bound data object to the user via the same routing path as the access application.

[0012] In the above technical solution, the application provides the following technical effects and advantages: 1. The application realizes a dynamic and fine-grained data control mechanism through a policy-driven data encapsulation process. The system performs multi-dimensional real-time analysis on access requests based on a scenario-aware policy engine, generates fine-grained instructions containing data field ranges, desensitization levels, and usage constraints, and a policy-driven data encapsulator accurately extracts the required data from the trusted data base according to these instructions. Through dynamic desensitization, field trimming, and other technical means, a policy-bound data object containing only the minimum necessary information is generated. This mechanism ensures that data always maintains the principle of minimization during use, and each data object has an embedded usage policy, including the maximum number of forwarding times and the absolute survival time. At the same time, through this fine-grained data control method, the system ensures data availability while establishing a perfect data usage evidence chain, effectively supporting post-audit analysis and realizing traceable management of the entire data lifecycle. 2、The application realizes the organic unification of data sharing and safe control through the logical isolated data vault structure and the dynamic risk assessment mechanism, and the traditional data sharing platform often faces the problem of coexistence of data island and security risk, and it is difficult to balance efficiency and safety in cross-department cooperation, the scheme builds a three-dimensional data vault including a trusted data pedestal, a safe data sub-library and garbage data, realizes the isolation protection of core data at the physical level, at the same time, with the help of the scene perception strategy engine, the access request is multi-dimensional and real-time risk assessment, which can accurately identify legal access and potential threats, the design makes the system can guarantee normal data flow through trusted credentials, and can guide malicious access to garbage data through fraudulent credentials, effectively consume attacker resources and protect real data; The whole system realizes intelligent access control through the routing verifier and dynamic path selection, which significantly improves the active protection level of the system. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0014] Figure 1 The method flowchart of the present application.

[0015] Figure 2 The system block diagram of the present application.

[0016] Figure 3 The logic block diagram of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the technical scheme in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0018] Embodiment 1, please refer to Figure 1 and Figure 3 The multi-source data collaboration and sharing method of the intelligent united front platform described in this embodiment includes: S1, acquire the multi-source data of the united front platform, fuse the multi-source data based on the fusion device to generate a trusted data pedestal, and deploy the trusted data pedestal in the data vault; S2, real-time risk assessment is performed on the access application received by the data vault through the scene perception strategy engine, and a dynamic access control strategy is generated; S3, generating an access credential based on the access control strategy, and guiding the user to access the secure data sub-database in the data vault based on the access credential; S4, the secure data sub-database receiving the access credential generates fine-grained instructions based on the strategy-driven data packager, performs data extraction and packaging on the trusted data base based on the fine-grained instructions, and generates a policy-bound data object with an embedded self-destruction policy; S5, the policy-bound data object is returned to the user via the same routing path as the access application; As described above in steps S1-S5, in the current data sharing practice of the smart united front platform, an access control mechanism based on role permission management is generally adopted, and limited data opening and sharing are realized in combination with data desensitization, API gateway and other technical means; This method has achieved certain results in basic data security protection, but still faces some challenges in dealing with complex and variable actual business scenarios. First, the existing data sharing mode usually needs to provide full or large range of data copies. This extensive data distribution mechanism makes it difficult to effectively track and manage the use of data after it leaves the core storage area, and there is a certain risk of secondary diffusion. The static permission management system based on fixed roles is difficult to adapt to the dynamic changes of business needs, and cannot be flexibly adjusted according to specific access scenarios, data sensitivity levels and real-time environmental factors, which often leads to a mismatch between permission settings and actual needs in practice, which may affect the efficiency of rational use of data resources. At the same time, the existing technical solutions have limited recording and tracing capabilities for the data use process, making it difficult to provide complete and reliable data flow evidence chain for subsequent audit analysis. These factors to some extent restrict the value mining and security protection of united front data elements; The present application realizes a dynamic and fine-grained data management mechanism through a strategy-driven data packaging process. The system performs multi-dimensional real-time analysis on access requests based on a scene perception strategy engine, generates fine-grained instructions containing data field range, desensitization level and use constraints, and a strategy-driven data packager extracts the required data from the trusted data base according to these instructions, and generates a policy-bound data object containing only the minimum necessary information through dynamic desensitization, field trimming and other technical means. This mechanism ensures that data always remains minimal during use, and each data object has an explicit use policy, including the maximum number of forwarding times and the absolute survival time. At the same time, through this fine-grained data management method, the system establishes a perfect data use evidence chain while ensuring data availability, effectively supports post-audit analysis, and realizes whole-process traceable management of data life cycle; Through the logical isolation data vault structure and dynamic risk assessment mechanism, the organic unity of data sharing and safety control is realized. Traditional data sharing platforms often face the problem of coexistence of data island and security risk, and it is difficult to balance efficiency and safety in cross-department cooperation. The scheme builds a three-dimensional data vault including trusted data pedestal, safe data sub-bank and garbage data, realizes the isolation protection of core data at the physical level, at the same time, with the help of scene perception strategy engine, the access request is evaluated in multiple dimensions in real time, which can accurately identify legal access and potential threats. The design makes the system not only guarantee normal data flow through trusted credentials, but also guide malicious access to garbage data through fraudulent credentials, effectively consume attacker resources and protect real data; The whole system realizes intelligent access control through routing verifier and dynamic path selection, which significantly improves the active protection level of the system.

[0019] In one embodiment, the step S1 of acquiring multi-source data of the united front work platform and fusing the multi-source data based on the fusioner to generate a trusted data pedestal includes: S11, a data interface is constructed to access multi-source data from internal systems of the united front work, government departments and public data sources, and the accessed multi-source data is uniformly converted into a columnar storage format of the platform standard; S12, an entity recognizer is constructed to determine entities based on a preset matching rule to generate entity identifiers; S13, a machine learning model is used to perform entity clustering based on similarity calculation of entity identifiers to generate entity sets, and each entity set is assigned a united front object ID; S14, taking the united front object ID as an index, multi-dimensional information of each entity is fused to generate a unified data view of the entity, and a plurality of unified data views of entities are combined to generate a trusted data pedestal; As described in steps S11-S14, in the data collection and fusion stage, the system builds a unified access gateway as the only external data entry, which integrates multiple protocol adapters inside to access multi-source data from internal systems, government departments and public data sources. An entity identifier based on a multi-level matching rule engine calculates the identity of entities in multi-source data through progressive matching strategies. The identifier uses a three-level processing architecture. The first level uses a hash index engine to accurately match unique legal identifiers such as ID numbers and unified social credit codes. The second level uses fuzzy matching algorithms such as the Jaro-Winkler string similarity algorithm to perform fuzzy matching on text fields such as names and organization names, with a pre-set fuzzy matching threshold. The third level introduces a space-time correlation verifier that builds an entity behavior portrait by analyzing the entity's activity trajectory in the time dimension and the correlation in the space dimension, such as by comparing the entity's position and the unit it belongs to, to further confirm the entity's identity. Finally, a machine learning model generates an entity identifier with a confidence weight for each matching record. The machine learning model uses a hybrid neural network architecture based on deep learning, including a feature encoding layer, a relationship graph convolution layer, and a clustering optimization layer. The feature encoding layer uses the BERT model to convert entity attributes into a multi-dimensional feature vector. The relationship graph convolution layer captures the implicit relationships between entities through a 3-layer graph convolution network. The clustering optimization layer uses a deep embedding clustering algorithm to minimize the weighted sum of the clustering loss function and the distribution uniformity loss function, allowing similar entities to naturally cluster in the feature space. The model takes the generated entity identifier as input and can deeply mine the deep features of the United Front objects, such as learning a comprehensive feature vector of a United Front object from multi-dimensional data such as "social relationship network", "history of participating in United Front activities", "research achievements and professional field". Through training, the model can learn to judge that two feature vectors may differ in surface details such as unit department name, but their core features such as professional field and social relationship are highly consistent, and then cluster them into the same entity set. The similarity calculation uses a multi-dimensional weighted fusion algorithm that integrates text similarity, numerical similarity, categorical attribute similarity, and graph structure similarity.Text similarity is calculated using a hybrid method based on edit distance and character n-gram; numerical similarity adopts Euclidean distance measurement based on standard deviation normalization; categorical attribute similarity uses semantic distance calculation based on knowledge graph embedding; graph structure similarity compares the adjacency topological structure of entities in the relationship network to obtain the final similarity value, which is the weighted sum of the similarity of each dimension, and the weight coefficient is determined by grid search optimization. Based on the above steps, the collected multi-source data is clustered into multiple entity sets and assigned corresponding united front object IDs. First, attribute-level conflict detection and resolution are performed. When different data sources provide different values for the same attribute of the same entity, the system makes a comprehensive judgment based on the authority level of the data source, data freshness, and the distribution frequency of the value in the entire data, and automatically selects or fuses to generate the most trusted attribute value. At the same time, the dynamic behavior records with timestamps are time-integrated. The system identifies records describing the same event or continuous state, sorts and splices them according to their internal time logic, and forms complete behavior trajectories. On this basis, the system automatically constructs an entity association network, quantifies the complex relationships between entities into connection edges and weights by analyzing explicit connections such as joint participation in events, organizational affiliation, and cooperative publication of achievements, and calculating implicit associations based on behavior pattern similarity and spatial proximity. Finally, the system organizes and encapsulates the processed basic attributes, structured behavior trajectories, and entity association network according to the united front object ID to form a unified, multi-dimensional queryable unified data view as a trusted data base.

[0020] In one embodiment, the step S1 of deploying the trusted data base in the data vault includes: S15, constructing a logically isolated secure storage environment as a data vault, and generating an isolated storage space in the data vault for placing the trusted data base; S16, setting multiple pre-interaction zones around the isolated storage space, and dynamically connecting the pre-interaction zones with the trusted data base for data interaction; S17, constructing multiple secure data sub-libraries around the pre-interaction zones, and dynamically connecting the secure data sub-libraries with the multiple pre-interaction zones for data interaction; S18, filling unstructured garbage data in the global space of the data vault that is not occupied by the isolated storage space, the pre-interaction zone, and the secure data sub-library, the garbage data being composed of a large number of format-imitated but content-ineffective data; As described in steps S15-S18 above, in the data vault construction phase, the system first creates a logically isolated secure storage environment through hardware virtualization technology, and divides a dedicated isolated storage space inside it for storing the trusted data base. This space uses a dual mechanism of encrypted storage and access audit to ensure data static security. A plurality of pre-interaction zones are deployed around the isolated storage space. Each interaction zone is connected to the trusted data base through a dynamically authorized secure link. These links use session-level temporary keys for communication encryption to ensure the security isolation of the data interaction process. The pre-interaction zone and the trusted data base only have one-way interaction, and only support the trusted data base to transmit data to the pre-interaction zone. A plurality of secure data sub-libraries are distributed around the pre-interaction zone. Each secure data sub-library establishes a dynamic route with the pre-interaction zone. Based on the dynamic route, a data transmission channel is generated. The channel is configured with dynamic traffic monitoring and abnormal access blocking functions. Finally, the remaining space of the data vault is filled with unstructured garbage data. This environment generates massive simulation data records by simulating real data structures through a data pattern learning engine, and ensures the invalidity and non-reusability of data content by using a random content generation algorithm, forming a data maze covering the entire non-secure area.

[0021] In one embodiment, the step S2 of performing real-time risk assessment on the access application received by the data vault through the context-aware strategy engine and generating a dynamic access control strategy includes: S21, constructing a multi-dimensional feature extractor for extracting multi-dimensional features of the application from the access application, the multi-dimensional features of the application including access subject attributes, requested data resource attributes, and environmental context attributes; S22, performing fusion calculation on the multi-dimensional features of the application based on a deep neural network model through a risk assessment device, outputting a risk assessment score and dividing a risk level; S23, based on the risk level, dynamically generating a corresponding access control strategy through a strategy generator, the access control strategy including data access range constraints, data desensitization rules, and navigation token types; As described in steps S21-S23 above, a multi-dimensional feature extractor is constructed in the scenario-aware policy engine, and feature extraction is performed on the access application. The steps are as follows: the feature information of the access application is acquired through three special acquisition subunits, the user department role secret level information is extracted from the identity authentication system by the access subject attribute acquisition subunit, the data classification label and the sensitive level are obtained from the data directory service by the request data resource attribute acquisition subunit, and the access time source IP and the current threat intelligence are collected from the system monitoring service by the environment context attribute acquisition subunit. The multi-dimensional features of the application are evaluated by a risk evaluator, and the steps are as follows: receiving the multi-dimensional features of the application from the multi-dimensional feature extractor, performing fusion calculation through a three-layer perception network and outputting a risk evaluation score, wherein the first layer identifies the basic risk mode, such as the abnormal combination of accessing high-sensitive United Front figure archives during non-working hours; the second layer detects the complex risk scene, such as the behavior characteristics of a low-frequency user suddenly querying multiple United Front object associated networks; and the third layer evaluates the comprehensive risk index, and dynamically adjusts the risk threshold combined with the real-time United Front work focus; the policy generator executes differentiated policies according to the risk level: for low-risk access, a policy containing complete data field range and light desensitization rules is generated and a trusted navigation token is assigned; for medium-risk access, a policy limiting the data field range and strict desensitization rules is generated and a restricted navigation token is assigned; and for high-risk access, a fraud navigation token is assigned. All policy elements are instantiated in real time by the policy template engine and injected into the encrypted payload of the navigation token.

[0022] In one embodiment, the step S3 of generating an access credential based on the access control policy and guiding the user to access the secure data sub-library in the data vault based on the access credential includes: S31, for the access application with trusted risk evaluation, generating a trusted credential containing target secure data sub-library coordinates and access permissions; S32, for the access application with suspicious or illegal risk evaluation, generating a fraud credential pointing to garbage data; S33, setting a routing verifier on the data vault, for real-time verification of the access credential, and assigning different routing paths for different access credentials; S34, guiding the access application to the corresponding area in the data vault according to the access credential type and the routing path; As described in steps S31-S34 above, in the access control execution phase, the system executes the differentiated credential generation mechanism according to the risk level output by the situational awareness policy engine; for a trusted access application, the system generates a trusted credential containing the target security data sublibrary network coordinates and data access permissions through the credential encoder, wherein the network coordinates use a three-dimensional space encoding system to locate the specific position of the security data sublibrary in the data vault, and the data access permission specifies the accessible United Front object ID range and field operation permission in detail; for suspicious or illegal access applications, the system creates a virtual coordinate pointing to garbage data through the fake credential generator, which is randomly distributed and dynamically changed in the data vault space, and the routing verifier uses a two-factor verification architecture to realize intelligent allocation of the access path, first, the digital certificate verification module verifies the integrity and issuance source of the credential to ensure that the credential has not been tampered with; second, the path compliance analysis engine allocates the optimal transmission path for the trusted credential in combination with the current load state and security situation of the data vault, and the path directly connects the target security data sublibrary through an encrypted tunnel, and the fake credential is allocated an induced path containing multiple intermediate nodes, which will inject network delay and return simulated data gradually deviating from the authenticity; further, in the path allocation process, the system maintains a dynamic path table in real time, recording the state indicators of each path including delay time, success rate and security score; finally, the intelligent routing guide system executes path selection, which uses a weighted round-robin algorithm combined with real-time network state data to allocate appropriate data flow channels for different types of access requests. For trusted access, the system establishes a dedicated link to the target security data sublibrary and implements end-to-end encryption protection during transmission; for fake access, the system guides it to a specific area in the garbage data, and at the same time starts the behavior analysis module to record the interaction mode of the visitor.

[0023] In one embodiment, the security data sublibrary receiving the access credential generates fine-grained instructions based on the policy-driven data packager, and based on the fine-grained instructions, the trusted data base is subjected to data extraction and packaging to generate a policy-bound data object with an embedded self-destruction policy in step S4. S41, the routing verifier sends the access credential to the corresponding security data sublibrary based on the routing path allocated for the access credential; S42, a policy-driven data packager is built in the data security sublibrary, the access credential is parsed based on the policy-driven data packager, and fine-grained instructions containing the target United Front object ID, data field range, desensitization level and use constraints are generated; S43, the security data sublibrary generating the fine-grained instructions randomly initiates an interaction application to a front interaction area, and constructs a temporary dynamic data channel from the trusted data base to the security data sublibrary through the front interaction area; S44, the security data sub-library transmits the fine-grained instruction to the front interaction area based on the temporary dynamic data channel, and the front interaction area extracts corresponding data in the trusted data base based on the fine-grained instruction; S45, wherein the extraction operation includes index query and positioning in the trusted data base with the target unified front object ID as the primary key, positioning the target field in the entity set according to the data field range, and extracting the target field to the front interaction area in the form of data stream; S46, transmitting the extracted data stream to the security data sub-library through the temporary dynamic data channel, and performing encapsulation operation based on the strategy driven data encapsulator; S47, wherein the encapsulation operation includes desensitization operation on the data stream according to the desensitization level in the fine-grained instruction, and generating a self-destruction strategy of the data stream based on the use constraint, the self-destruction strategy including the maximum forwarding number and the absolute survival time stamp, and the self-destruction strategy is injected into the data stream as metadata to encapsulate and generate a policy bound data object; As described in steps S41-S47 above, when the route verifier delivers the access credential to the target security data sublibrary through the encrypted route path, the policy-driven data encapsulator initiates a multi-layer parsing process. In the credential parsing phase, the system processes the received access credential through a digital signature verification module. The module uses the public key corresponding to the credential issuing end to verify the digital signature of the credential, ensuring that the credential has not been tampered with during transmission and that the source is trustworthy. After verification, the system parses the core parameters stored in plaintext from the credential, including the united front object ID sequence, the field access bitmap, the desensitization rule identifier, and the usage constraint condition. Then, through the instruction compiler, the target united front object ID list is converted into a distributed query plan, the field authorization is mapped to columnar storage access rights, and the desensitization requirements are compiled into an executable function chain, finally generating fine-grained instructions containing complete operation semantics. The security data sublibrary selects the least loaded front-end interaction area through the intelligent scheduler and establishes a temporary dynamic data channel based on a one-time session key. This channel uses a double-end authentication mechanism and has an automatic timeout destruction feature. After receiving the fine-grained instructions, the front-end interaction area starts the distributed query engine. First, it locates the data shard where the target united front object ID is located in the global index of the trusted data base. Then, it uses columnar projection technology to accurately extract authorized fields, while starting a real-time monitor to ensure that the data extraction range strictly follows the instruction constraints. During the extraction process, it uses stream processing technology to convert the query results into a standard data stream that is continuously output, effectively controlling memory usage and supporting large-scale data processing. After the data stream is transmitted to the security data sublibrary through the temporary dynamic data channel, it enters a multi-layer processing pipeline. The dynamic desensitization engine performs hierarchical processing according to the instruction requirements, using partial mask algorithms for direct identifiers, generalization processing for indirect identifiers, and differential privacy protection for sensitive relationship data. At the same time, the policy compiler converts the usage constraints into machine-readable self-destruction policies, including a counter-based forwarding restriction mechanism and an absolute invalidation control based on a trusted time source. Finally, through the atomic encapsulator, the desensitized data stream is deeply bound with the self-destruction policy metadata. The digital signature ensures the indivisibility of the policy and the data, generating a policy-bound data object with complete lifecycle management capabilities. Based on this mechanism, it can prevent accidental leakage of united front multi-source data. Even if the united front multi-source data flows out, it has self-destruction capabilities, effectively preventing the risk of secondary diffusion.

[0024] In one embodiment, the step S5 of returning the policy-bound data object to the user via the same communication path as the access application includes: S51, after the front-end interaction area and the security data sublibrary complete the data stream interaction, releasing the computing resources of the temporary dynamic data channel; S52, multiplexing the policy-bound data object and returning it to the user in reverse through the route path established for the corresponding access application; As described above in steps S51-S52, in the data return phase, the system first performs a resource recycling process, after the current interactive area sends the data stream end identifier to the secure data sublibrary, the resource manager immediately triggers the disassembly program of the temporary dynamic data channel, the session key management module destroys the temporary key pair used in this communication, the network connection controller closes the special data port, and the memory buffer performs zero write operation to ensure that all temporary computing resources are completely released; then the system starts the data return process, the routing verifier retrieves the complete original transmission path in the path mapping table according to the routing path identifier recorded in the access application phase, including the sequence of gateway nodes passed through and the corresponding session parameters; load the policy binding type data object to the same routing path as the way, maintain the original encryption session state and security context, and pass through each intermediate node in turn according to the reverse path, and finally reach the original user end through the unified data service gateway; the whole return process strictly maintains the path symmetry, the transmission layer protocol parameters are completely consistent with the request phase, and the return mechanism based on path multiplexing not only ensures the consistency of data transmission, but also avoids the security risk and performance overhead caused by re-establishing the connection.

[0025] Embodiment 2, please refer to Figure 2 As shown in the figure, the multi-source data collaboration and sharing system of the smart united front platform described in this embodiment comprises: A data fusion module: acquires multi-source data of the united front platform, fuses the multi-source data based on a fusion device to generate a trusted data base, and deploys the trusted data base in a data vault; A policy decision module: connected with the data fusion module, performs real-time risk assessment on the access application received by the data vault through a scene perception policy engine and generates a dynamic access control policy; A credential and routing module: connected with the policy decision module, generates an access credential based on the access control policy, and guides the user to access the application to the secure data sublibrary in the data vault based on the access credential; A data encapsulation processing module: connected with the credential and routing module, the secure data sublibrary receiving the access credential generates fine-grained instructions based on a policy-driven data encapsulator, performs data extraction and encapsulation on the trusted data base based on the fine-grained instructions, and generates a policy binding type data object embedded with a self-destruction policy; A safe return module: connected with the data encapsulation processing module, returns the policy binding type data object to the user via the same routing path as the access application.

[0026] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for multi-source data collaboration and sharing in a smart united front platform, characterized in that, Acquire multi-source data from the United Front platform, fuse the multi-source data using a fusion device to generate a trusted data base, and deploy the trusted data base in a data vault; The context-aware policy engine performs real-time risk assessments on access requests received by the data vault and generates dynamic access control policies. Access credentials are generated based on access control policies, and users are guided to access the secure data sub-database in the data vault based on the access credentials. The security data sub-library that receives the access credentials generates fine-grained instructions based on the policy-driven data encapsulator. Based on the fine-grained instructions, it extracts and encapsulates data from the trusted data base, generating a policy-bound data object with an embedded self-destruct policy. The policy-bound data object is returned to the user via the same route as the access request.

2. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 1, characterized in that, The steps for acquiring multi-source data from the United Front platform and fusing the multi-source data to generate a trusted data base based on a fusion device are as follows: Build a data interface to access multi-source data from the United Front internal system, government departments and public data sources, and convert the accessed multi-source data into a unified columnar storage format that is the platform standard. An entity recognizer is constructed to determine entities from multi-source data based on preset matching rules and generate entity identifiers. A machine learning model is used to cluster entities based on the similarity calculation of entity identifiers to generate entity sets, and a United Front object ID is assigned to each entity set; Using the ID of the united front target as an index, a unified data view of the entity is generated by integrating multi-dimensional information of each entity, and a trusted data base is generated by combining the unified data views of multiple entities.

3. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 1, characterized in that, The steps for deploying the trusted data base in the data vault are as follows: Construct a logically isolated secure storage environment as a data vault, and generate an isolated storage space in the data vault to place a trusted data base; Multiple front-end interaction zones are set up around the isolated storage space and dynamically connected to the trusted data base for data interaction; Multiple secure data sub-libraries are built around the front-end interaction area and dynamically connected to the multiple front-end interaction areas for data interaction; Unstructured junk data is filled throughout the isolated storage space, the front-end interaction area, and the unoccupied data vault space of the secure data sub-database. This junk data consists of a large amount of data with simulated formats but invalid content.

4. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 1, characterized in that, The steps for performing real-time risk assessment on access requests received by the data vault and generating dynamic access control policies through a context-aware policy engine are as follows: Construct a multidimensional feature extractor to extract multidimensional features from access requests. These multidimensional features include access subject attributes, requested data resource attributes, and environmental context attributes. The risk assessor uses a deep neural network model to fuse and calculate the multidimensional features of the application, outputs a risk assessment score, and classifies the risk level. Based on the risk level, the corresponding access control policy is dynamically generated by the policy generator. The access control policy includes data access scope constraints, data anonymization rules, and navigation token types.

5. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 1, characterized in that, The steps for generating access credentials based on access control policies and guiding users to access the secure data sub-database in the data vault based on the access credentials are as follows: For access requests deemed trustworthy by risk assessment, generate trusted credentials containing the coordinates of the target security data sub-database and access permissions; For access requests that are deemed suspicious or illegitimate in the risk assessment, generate deceptive credentials pointing to spam data; Set up a route validator on the data vault to verify access credentials in real time and assign different routing paths to different access credentials; Access requests are directed to the corresponding area in the data vault based on the access credential type and routing path.

6. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 5, characterized in that, The steps for the security data sub-library that receives access credentials to generate fine-grained instructions based on a policy-driven data encapsulator, and then extracting and encapsulating data from the trusted data base based on these fine-grained instructions to generate a policy-bound data object with an embedded self-destruct policy are as follows: The route verifier sends the access credentials to the corresponding security data sub-database based on the route path assigned to the access credentials; A policy-driven data encapsulator is built into the data security sub-library. Based on the policy-driven data encapsulator, access credentials are decoded to generate fine-grained instructions containing the target united front object ID, data field range, desensitization level, and usage constraints. The security data sub-library that generates fine-grained instructions randomly initiates an interaction request to a front-end interaction area and constructs a temporary dynamic data channel from the trusted data base, through the front-end interaction area, to the security data sub-library. The security data sub-library transmits fine-grained instructions to the front-end interaction area via a temporary dynamic data channel. The front-end interaction area then extracts the corresponding data from the trusted data base based on these fine-grained instructions. The extraction operation includes indexing and locating the target united front object ID as the primary key in the trusted data base, locating the target field in the entity set according to the data field range, and extracting the target field to the front-end interaction area in the form of a data stream. The extracted data stream is transmitted to the secure data sub-database through a temporary dynamic data channel, and encapsulation is performed based on a policy-driven data encapsulator. The encapsulation operation includes desensitizing the data stream according to the desensitization level in the fine-grained instructions, and generating a self-destruction policy for the data stream based on usage constraints. The self-destruction policy includes the maximum number of forwardings and the absolute survival timestamp. The self-destruction policy is injected into the data stream as metadata for encapsulation to generate a policy-bound data object.

7. The method for multi-source data collaboration and sharing in a smart united front platform according to claim 6, characterized in that, The step of returning the policy-bound data object to the user via the same communication path as the access request is as follows: After completing the data flow interaction with the secure data sub-database in the front-end interaction area, the computing resources of the temporary dynamic data channel are released; The policy-bound data object is returned to the user in reverse, using the routing path established by the corresponding access request.

8. A multi-source data collaboration and sharing system for a smart united front platform, used to implement the multi-source data collaboration and sharing method for a smart united front platform as described in any one of claims 1-7, characterized in that, Data fusion module: acquires multi-source data from the United Front platform, fuses the multi-source data based on the fusion device to generate a trusted data base, and deploys the trusted data base in the data vault; Strategy Decision Module: Connected to the data fusion module, it uses a context-aware strategy engine to perform real-time risk assessment on access requests received by the data vault and generate dynamic access control policies. Credentials and Routing Module: Connects to the Policy Decision Module, generates access credentials based on access control policies, and guides users to access the secure data sub-database in the data vault based on the access credentials; Data encapsulation and processing module: Connected to the credential and routing module, it receives the access credential's secure data sub-library and generates fine-grained instructions based on the policy-driven data encapsulator. Based on the fine-grained instructions, it extracts and encapsulates data from the trusted data base and generates a policy-bound data object with an embedded self-destruct policy. Secure return module: Connected to the data encapsulation and processing module, it returns policy-bound data objects to the user via the same route path as the access request.

Images