Data security management and control method and system based on evolutionary algorithm and opportunity constraint programming

Abstract

The invention discloses a data security management and control method and system based on an evolutionary algorithm and opportunity-constrained programming, and belongs to the technical field of data security. The method comprises the following steps: acquiring a to-be-encrypted data set, and extracting attribute features of each data in the data set; based on the attribute characteristics of the data, an evolutionary algorithm is adopted to carry out encryption category division on all the data of the to-be-encrypted data set, based on the encryption categories after data division, encryption algorithms are selected for different categories of to-be-encrypted data, and a secret key meeting a chance constraint programming model is solved for each category of to-be-encrypted data in an iterative optimization mode; and based on the selected encryption algorithm and the generated key, encrypting each file of each type of data to be encrypted. According to the invention, refined classification can be carried out on the data intelligently and automatically, and differentiated security policies and encryption schemes are dynamically generated and customized for different types of data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a data security management and control method and system based on an evolutionary algorithm and an opportunity constraint programming. BACKGROUND

[0002] With the rapid development of cloud computing, big data and Internet of Things technologies, the data managed and processed by enterprises and organizations is showing an explosive growth trend. In this context, data security has become a top priority. Traditional encryption methods usually adopt a "one-size-fits-all" strategy, i.e., a single, fixed encryption algorithm and key strength are used for the entire data set or all data types. However, this coarse-grained protection approach has significant drawbacks: it cannot provide security levels that match the differences in the intrinsic value of the data. For non-sensitive public data, overuse of high-strength encryption can result in unnecessary waste of computing resources, storage space and energy consumption; conversely, for core confidential data, if insufficient strength protection is applied, serious security risks will arise. SUMMARY

[0003] The present application provides a data security management and control method and system based on an evolutionary algorithm and an opportunity constraint programming, which can intelligently and automatically fine-tune the classification of data and dynamically generate and customize differentiated security strategies and encryption schemes for different categories of data.

[0004] The present application provides the following technical solutions: In a first aspect, a data security management and control method based on an evolutionary algorithm and an opportunity constraint programming is provided, comprising: obtaining a data set to be encrypted and extracting the attribute features of each data in the data set; based on the attribute features of the data, using an evolutionary algorithm to divide all data in the data set to be encrypted into encryption categories, wherein the fitness function of the evolutionary algorithm introduces a security constraint penalty term and a resource constraint penalty term; based on the encryption categories after data division and the pre-set security requirements and resource budget of the category, selecting an encryption algorithm for different categories of data to be encrypted, and solving the key that satisfies the opportunity constraint programming model for each category of data to be encrypted through an iterative optimization method; based on the selected encryption algorithm and the generated key, encrypting each file of each category of data to be encrypted.

[0005] Optionally, the attribute features include data type, data source, time sensitivity level and sensitivity level.

[0006] Optionally, the fitness function of the evolutionary algorithm is : ; ; ; ; in, For individuals in the evolutionary algorithm, it represents the encryption category of all data in the dataset to be encrypted; , and Security scores Accuracy score and complexity score The weighting coefficients, and These are safety constraint penalty items. and resource constraint penalty items Penalty coefficient; security score The accuracy score is the ratio of the sum of scores for correctly classifying all data points at the high sensitivity level to the total number of data points at the high sensitivity level. The complexity score represents the ratio of the number of correctly classified data points to the total number of data points. This represents a function value that is negatively correlated with the number of categories. The first probability threshold is set. The security score is greater than the first set security score. The number of individuals, For the total number of individuals, The set upper limit for hardware resources, The computing resources required for an individual to run encryption.

[0007] Optionally, based on the encryption categories after data partitioning and the preset security requirements and resource budgets for each category, an encryption algorithm is selected for the data to be encrypted in different categories, and a key satisfying the chance-constrained programming model is solved for each category of data to be encrypted through iterative optimization. Specifically: By using the pre-defined security requirements and resource budgets for each category as metadata, a set of data classification schemes with added metadata is obtained. ,in, m Indicates the number of categories. Indicates the first j Categories Indicates category The average sensitivity of all data within the system. This indicates that under the global resource constraint R, resources are allocated to the category. Resource allocation for subsequent encryption key generation and management; An encryption algorithm is selected based on the metadata of each category, and configurable parameters corresponding to the encryption algorithm are defined. It is used to control the key generation strength and the processing efficiency of the encryption algorithm; Category key As decision variables, they depend on the chosen encryption algorithm and configurable parameters. A search space is defined, and keys satisfying a chance-constrained programming model are solved iteratively. This model includes security constraints and resource constraints. During iteration, if the security constraints are not met, the configurable parameters are increased. If resource constraints are not met, the configurable parameters will be reduced. .

[0008] Optionally, the security constraint is: ; The resource constraints are as follows: ; in, For the set resource budget, Indicates the generation of the key The sum of all resources consumed throughout the entire process. Indicates use Category After the data is encrypted, the category Internal data security score, Set a security score for the second option. This represents the set second probability threshold. express The probability of.

[0009] Optionally, the step of encrypting each file of each type of data to be encrypted based on the selected encryption algorithm and the generated key specifically involves: based on the selected encryption algorithm and the generated key, each file of each type of data to be encrypted is fragmented and encrypted in parallel, and the encrypted fragments are then encrypted again using a hash algorithm before being written into the blockchain for evidence storage.

[0010] Optionally, when a user's access request for an encrypted file is received, the user's access rights are automatically verified by triggering a smart contract on the blockchain. If the verification fails, the request is rejected; if the verification succeeds, a predefined access control policy is automatically executed.

[0011] Secondly, a data security management system based on evolutionary algorithms and chance-constrained programming is provided, including: The data acquisition module is used to acquire the dataset to be encrypted and extract the attribute features of each data point in the dataset. The data classification module is used to classify all data in the dataset to be encrypted into encryption categories based on the attribute characteristics of the data and using an evolutionary algorithm. During the classification process, the fitness function of the evolutionary algorithm introduces security constraint penalty terms and resource constraint penalty terms. The encryption key generation module is used to select encryption algorithms for different categories of data to be encrypted based on the encryption categories after data division and the preset security requirements and resource budget of each category, and to solve for the key that satisfies the chance constraint programming model for each category of data to be encrypted through iterative optimization. The encryption module is used to encrypt individual files of each type of data to be encrypted, based on the selected encryption algorithm and the generated key.

[0012] Thirdly, a computer device is provided, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the steps of the data security management method based on evolutionary algorithms and chance-constrained programming as described in any one of the first aspects.

[0013] Fourthly, a computer-readable storage medium is provided for storing a computer program; when the computer program is executed by a processor, it implements the steps of the data security management method based on evolutionary algorithms and chance-constrained programming as described in any one of the first aspects.

[0014] Compared with the prior art, the beneficial effects of the present invention are: (1) This invention completely abandons the traditional one-size-fits-all encryption mode, uses evolutionary algorithms to intelligently classify data, and uses chance constraint planning to dynamically generate encryption keys for each category, ensuring that highly sensitive data receives the strongest protection, while low-sensitivity data adopts a more efficient encryption method to save resources. This on-demand allocation strategy maximizes the utilization efficiency of computing, storage and energy resources while strictly meeting the security bottom line.

[0015] (2) This invention performs refined classification by analyzing the multi-dimensional attributes of data, such as type, source, timeliness, and sensitivity, so that encryption and storage strategies can match the actual value of the data. This not only avoids the waste caused by over-allocating security resources to low-value data, but also prevents the risks caused by insufficient protection of high-value data.

[0016] (3) This invention creates an immutable, transparent and verifiable audit log system by placing access control logic and metadata fingerprints in a blockchain smart contract. Every data access attempt and its result is permanently recorded, greatly enhancing the transparency of data governance and effectively preventing the risk of log tampering after internal abuse or external attacks.

[0017] (4) The solution builds a strong defense capability through data fragmentation encryption, metadata integrity verification and decentralized access control. Even if a part is compromised, the attacker cannot obtain the complete data or tamper with the access records, thereby minimizing the impact of security incidents and significantly improving the overall security resilience and reliability of the system. Attached Figure Description

[0018] Figure 1 This is a flowchart of the data security management method based on evolutionary algorithms and chance-constrained programming of the present invention; Figure 2 This is a flowchart of the present invention, which uses an evolutionary algorithm to classify all data in the dataset to be encrypted into encryption categories. Figure 3 This is a flowchart of the encryption key generation and access control of the present invention. Detailed Implementation

[0019] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be used to limit the scope of protection of the present invention. It should be noted that the term "comprising" and any variations thereof in the specification, claims and the above-mentioned drawings of the present invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or devices.

[0020] Example 1 like Figure 1 As shown, a data security management method based on evolutionary algorithms and chance-constrained programming includes the following steps: Step S1: Obtain the dataset to be encrypted and extract the attribute features of each data point in the dataset.

[0021] Attribute characteristics include: data type, data source, timeliness level, and sensitivity level.

[0022] Step S1 specifically involves: designating the original dataset as dataset D, performing refined feature engineering on it, and transforming it into a format that the algorithm can understand and process. Each data point... All of them need to be parsed to extract a series of features that can define their essential attributes, thereby forming a multi-dimensional feature vector. The extraction method can refer to existing technologies. The dimensions of feature extraction include: data type (e.g., numerical, text, image, video, etc.), data source (e.g., generated from internal core systems, from external partners, or uploaded by end users), timeliness level (e.g., real-time streaming data requiring millisecond-level response, or batch historical data that can accept a certain delay), and sensitivity level (e.g., different levels such as public, internal, confidential, top secret, etc.).

[0023] Step S2: Based on the attribute characteristics of the data, an evolutionary algorithm is used to classify all data in the dataset to be encrypted into encryption categories. The fitness function of the evolutionary algorithm introduces security constraint penalty terms and resource constraint penalty terms.

[0024] like Figure 2 As shown, when using an evolutionary algorithm to classify encrypted data, the first step is individual encoding. In this embodiment, rule set encoding is used to encode individuals. Under this encoding, each individual in the population may be composed of several rules: "If the data sensitivity is high and the type is text, then classify it into category A"; "If the data source is external and the timeliness is real-time, then classify it into category B," and so on. The initial population consists of a large number of such randomly generated rule set individuals, thus providing a large amount of raw material for the subsequent evolutionary process.

[0025] The fitness function is calculated. Specifically, each individual, i.e., a set of classification rules, is applied to the training dataset or a representative sample set to perform its defined classification operation, thereby producing a specific classification result. The individual's performance is then comprehensively evaluated based on this result. Fitness Function This is a comprehensive indicator used to calculate the weighted score of the classification scheme across three dimensions: security, accuracy, and complexity. Furthermore, this scheme incorporates a penalty mechanism to ensure that the classification scheme meets a security level of at least [a certain threshold]. The probability is higher than The extent of this opportunity constraint, and its total resource consumption. Has the hard resource limit been exceeded? R Any violation of these two constraints will be penalized through a penalty coefficient. and (Usually set to a very large positive number), which translates into a huge reduction in fitness. This means that even an individual that scores highly on all three metrics but violates the constraints will eventually have a very low fitness and will be eliminated in the evolutionary process.

[0026] Fitness function of evolutionary algorithm for: ; in, For individuals in the evolutionary algorithm, it represents the encryption category of all data in the dataset to be encrypted; , and Security scores Accuracy score and complexity score The weighting coefficients are used to reflect the degree of emphasis placed on security, accuracy, and complexity. For example, when security is given greater importance, the weighting coefficients can be set to... , , , and These are safety constraint penalty items. and resource constraint penalty items The penalty coefficient is usually set to a very large positive number to ensure that the survival probability of an individual who violates the constraint is extremely low.

[0027] Security Score This is used to evaluate whether the rule set correctly assigns highly sensitive data to high-security-level categories. Specifically, it represents the ratio of the sum of scores for correctly classifying all highly sensitive data points to the total number of highly sensitive data points. For example, using a rule set... After classifying the dataset, for each data point with a true label that is highly sensitive... If correctly classified into the high-security category, the score is 1; if classified into the medium-security category, an intermediate score, such as 0.5, is given; if incorrectly classified into the low-security category, the score is 0.

[0028] Accuracy score This is used to evaluate the overall classification accuracy of a rule set, specifically representing the ratio of the number of correctly classified data points to the total number of data points. For example, when using a rule set... After classifying the training dataset, the classification results are compared with the true class labels of the data or the labels labeled by experts, and the ratio of the number of correctly classified data points to the total number of data points is determined as the accuracy score.

[0029] Complexity Score This is used to encourage models to choose simpler, more general rules, avoid overfitting, and improve interpretability; specifically, it represents a function value that is negatively correlated with the number of categories. This application addresses... There are no restrictions on the specific calculation method. You can refer to existing technologies. As long as the function value is higher when there are fewer rules in the rule set (i.e., fewer categories), it is acceptable.

[0030] Safety constraint penalty items Estimation is typically performed using a validation set, and an indicator function can be defined: for the rule set... Run on multiple subsets of the validation set to compute its Number of times: ; Safety constraint penalty items To what extent the constraints are not satisfied: ; in, The first probability threshold is set. The security score is greater than the first set security score. The number of individuals, For the total number of individuals, i.e., if Greater than Then the safety constraint penalty item The value is 0; otherwise, the penalty is proportional to the degree of deficiency.

[0031] Resource constraint penalty items During the calculation, a resource consumption model needs to be defined first. Estimate the computational resources required to run a single rule, such as CPU cycles and memory, and summarize them to obtain the entire rule set. resource consumption The formula for the resource constraint penalty term is: ; in, The set upper limit for hardware resources, The computational resources required for an individual to run encryption. If If the resource constraint penalty is zero, then the penalty amount is proportional to the amount exceeding the limit.

[0032] Evolutionary algorithms involve selection, crossover, and mutation. In selection, individuals with higher fitness have a higher probability of being chosen, allowing them to pass on their superior "genes," or rules, to the next generation. Crossover simulates sexual reproduction, where two selected parent individuals exchange some of their rules with a certain probability, producing entirely new offspring. This process can combine rules from different parent generations that excel at handling different data characteristics, resulting in more well-rounded offspring. Mutation introduces randomness, changing a condition or conclusion in a rule with a small probability, such as changing the data type from text to image, or altering the category label.

[0033] Finally, the iteration cycle stops when the evolutionary process meets the preset termination conditions, such as reaching the maximum number of generations or the fitness of the best individual in the population no longer showing significant improvement over multiple generations. At this point, the population has undergone multiple rounds of natural selection, gene recombination, and random mutation, and its overall fitness has been significantly optimized. The individual with the highest fitness is selected from the final generation, and the rule set it represents is decoded into the final data classification scheme. Thus, the original dataset D is divided into m data categories with differentiated security and resource requirements. .

[0034] Step S3: Based on the encryption categories after data division and the preset security requirements and resource budget of each category, select encryption algorithms for different categories of data to be encrypted, and solve for keys that satisfy the chance-constrained programming model for each category of data to be encrypted through iterative optimization.

[0035] like Figure 3 As shown, step S3 specifically includes the following sub-steps: Step S31: Use the preset security requirements and resource budgets for each category as metadata to obtain a set of data classification schemes with added metadata. ,in, m Indicates the number of categories. Indicates the first j Categories Indicates category The average sensitivity of all data within the system. This indicates that under the global resource constraint R, resources are allocated to the category. Resource quotas for subsequent encryption key generation and management.

[0036] Step S32: Select an encryption algorithm based on the metadata of each category, and define the configurable parameters corresponding to the encryption algorithm. It is used to control the strength of key generation and the processing efficiency of encryption algorithms.

[0037] Choose an encryption algorithm from the preset encryption algorithm library. The encryption algorithm is directly determined by the characteristics of the data category. For example, for highly sensitive categories that carry core corporate secrets, a very strong encryption algorithm is preferred to ensure long-term security; while for general sensitive data categories that circulate internally in large quantities, a very fast encryption algorithm is selected to meet the needs of high-throughput business.

[0038] Configurable parameters Corresponding to the encryption algorithm, for example, if a symmetric encryption algorithm such as AES is selected, parameters can be configured. The key length can be configured, and if an asymmetric encryption algorithm such as RSA is selected, the parameters can be further configured. It can be the length of the modulus.

[0039] Step S33: categorize key As decision variables, they depend on the chosen encryption algorithm and configurable parameters. A search space is defined, and keys satisfying a chance-constrained programming model are solved iteratively. This model includes security constraints and resource constraints. During iteration, if the security constraints are not met, the configurable parameters are increased. If resource constraints are not met, the configurable parameters will be reduced. .

[0040] The safety constraints are as follows: ; The resource constraints are: ; in, For the set resource budget, Indicates the generation of the key The sum of all resources consumed throughout the entire process. Indicates use Category After the data is encrypted, the category Internal data security score, Set a security score for the second option. This represents the set second probability threshold. express The probability of.

[0041] In this embodiment, the key It is itself a decision variable, but its search space is determined by the algorithm type and parameters. Definition. The entire generation process is transformed into an iterative optimization loop, the goal of which is to search for a specific key. This ensures that it simultaneously satisfies two stringent constraints: security constraints and resource constraints. In each iteration... In the middle, it will be based on the current parameters Perform a key generation operation to produce an intermediate key result. Subsequently, two crucial evaluations were conducted on this intermediate result: first, a security simulation evaluation, which estimated the actual level of security it could provide by analyzing the cryptographic properties of the key, such as randomness and its strength against brute-force and various cryptanalysis attacks. The calculation method for the security level can be determined based on existing technology, thereby calculating the probability that it meets security constraints; secondly, there is resource consumption auditing, which involves analyzing each step of the key generation algorithm, such as modular exponentiation and random number generation, to accurately estimate its overhead in terms of computation cycle, memory access, and storage space. .

[0042] Then, feedback and parameter adjustments are made based on the degree of constraint satisfaction. The above evaluation results directly guide the next search step, forming a closed-loop feedback loop. The system analyzes the current intermediate results. The degree of satisfaction of the two constraints: If the safety constraints are not sufficiently satisfied, that is, the estimated safety probability is lower than the given value. Then adjust the parameters. To enhance key strength; conversely, if resource constraints are challenged, i.e., resource consumption estimates are about to exceed the budget. Then adjust the parameters. To optimize efficiency. By continuously fine-tuning parameters. This allows the generated intermediate key result to be... It can infinitely approach or even fall directly into the feasible solution region defined by the two constraints.

[0043] Finally, when the iterative process meets the preset termination condition, for example, when a key that simultaneously satisfies all constraints is found. The loop stops when either the maximum allowed number of iterations has been reached or the optimization process has converged. For the finally generated candidate keys... The key must undergo rigorous verification and archiving. Verification may include strict checks on its cryptographic properties and running the key generation algorithm in a real-world environment to measure its resource consumption, ensuring that theoretical estimates match actual conditions. Once verification is successful, this key... That is, the data categories that are securely stored and have corresponding meaning. This binding provides a solid and compliant key foundation for the final data encryption steps.

[0044] Step S4: Based on the selected encryption algorithm and the generated key, encrypt each file of each type of data to be encrypted.

[0045] In this embodiment, based on the selected encryption algorithm and the generated key, each file of each type of data to be encrypted is fragmented and encrypted in parallel, and the encrypted fragments are encrypted again by a hash algorithm before being written into the blockchain for storage.

[0046] In some other embodiments, when a user's request to access an encrypted file is received, the user's access rights are automatically verified by triggering a smart contract on the blockchain. If the verification fails, the request is rejected; if the verification succeeds, a predefined access control policy is automatically executed.

[0047] Specifically, firstly, data is sharded and encrypted in parallel. Then, the intelligently categorized data types are obtained. The specific file within. For any large file to be processed. FDirectly encrypting the entire file is not only inefficient but also lacks flexibility in transmission, storage, and processing. Therefore, the data is first fragmented, dividing file F into... n Smaller, more organized data blocks The sharding strategy employs a load-balancing approach, ensuring that all shards are as uniform in size as possible, with only the last shard potentially being slightly smaller due to non-integer divisibility. Sharded data is thus more easily distributed and stored within a distributed storage system. Subsequently, the encryption engine determines the size of the file based on its category. Precisely select the exclusive encryption key generated in step S3. Then, using the encryption algorithm paired with the key, each data fragment is encrypted. Perform encryption operations to generate corresponding ciphertext fragments. At this point, the original plaintext data has been transformed into a set of ciphertext fragments that cannot be directly recognized.

[0048] Next, metadata generation and integrity assurance are performed. Encryption itself ensures data confidentiality, but to correctly decrypt and verify that the data has not been tampered with during storage and transmission in the future, a metadata system must be maintained. Before and after encryption, the system will generate metadata for the entire original file F and each plaintext fragment. The cryptographic hash value is calculated. These hash values ​​act like unique digital fingerprints for each data object; any minor alteration to the data will cause a drastic change in its hash value. Subsequently, this crucial metadata, including hash value, fragment size, fragment order, category, and corresponding key identifier or index, is itself encrypted or anonymized to form an encrypted metadata data packet. This is to prevent the metadata itself from leaking the structural information of the data content or becoming a breakthrough point for attackers.

[0049] Finally, access control and auditing are performed based on blockchain smart contracts. Traditional access control relies on centralized permission servers, which inherently carries the risk of a single point of failure. The encrypted metadata data is then... The hash pointer is anchored and stored on a blockchain network. The immutability and distributed consensus characteristics of the blockchain ensure the absolute trustworthiness of this data index. Simultaneously, an associated smart contract is deployed, whose core logic is encoded for different data categories. Predefined access control policies. For example, requests to access highly sensitive financial data categories ( The user address must exist in an authorized address list managed by the company's CFO and several directors; while requests for access to internal public document categories ( Users only need an address that has been authenticated by the company's employee identity verification system.

[0050] When a user attempts to access data, their request triggers a smart contract on the blockchain network. The contract code executes automatically, verifying the user's digital identity and permissions. If verification fails, the contract automatically rejects the request, leaving a permanent, non-repudiable rejection record on the blockchain. If verification succeeds, to more securely manage keys, the smart contract does not directly transmit encrypted data or keys. Instead, it executes predefined permission-granting logic: returning an authorization token to the user, allowing them to temporarily obtain the key or decryption service needed to decrypt a specific data fragment. From the access request and permission verification to the final authorization, everything is recorded as a transaction on the blockchain, forming a complete, trusted, and auditable security log for all relevant parties, thoroughly achieving knowability, controllability, and auditability of data access.

[0051] Example 2 A data security management system based on evolutionary algorithms and chance-constrained programming is provided, including: The data acquisition module is used to acquire the dataset to be encrypted and extract the attribute features of each data point in the dataset. The data classification module is used to classify all data in the dataset to be encrypted into encryption categories based on the attribute characteristics of the data and using an evolutionary algorithm. During the classification process, the fitness function of the evolutionary algorithm introduces security constraint penalty terms and resource constraint penalty terms. The encryption key generation module is used to select encryption algorithms for different categories of data to be encrypted based on the encryption categories after data division and the preset security requirements and resource budget of each category, and to solve for the key that satisfies the chance constraint programming model for each category of data to be encrypted through iterative optimization. The encryption module is used to encrypt individual files of each type of data to be encrypted, based on the selected encryption algorithm and the generated key.

[0052] For more detailed information on the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0053] Example 3 The present invention provides a computer device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the steps of the above-described data security management method based on evolutionary algorithms and chance-constrained programming.

[0054] For more detailed information on the above methods, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0055] Example 4 This invention provides a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the steps of the above-described data security management method based on evolutionary algorithms and chance-constrained programming.

[0056] For more detailed information on the above methods, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0057] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The systems, devices, and storage media disclosed in the embodiments are described simply because they correspond to the methods disclosed in the embodiments; relevant details can be found in the method section.

[0058] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0059] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A data security management method based on evolutionary algorithms and chance-constrained programming, characterized in that, include: Obtain the dataset to be encrypted and extract the attribute features of each data point in the dataset; Based on the attribute characteristics of the data, an evolutionary algorithm is used to classify all data in the dataset to be encrypted into encryption categories. The fitness function of the evolutionary algorithm introduces security constraint penalty terms and resource constraint penalty terms. Based on the encryption categories after data division and the preset security requirements and resource budgets of each category, encryption algorithms are selected for different categories of data to be encrypted, and keys that satisfy the chance-constrained programming model are solved for each category of data to be encrypted through iterative optimization. Based on the selected encryption algorithm and the generated key, each file of each type of data to be encrypted is encrypted.

2. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 1, characterized in that, The attribute characteristics include: data type, data source, timeliness level, and sensitivity level.

3. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 1, characterized in that, The fitness function of the evolutionary algorithm for: ； ； ； ； in, For individuals in the evolutionary algorithm, it represents the encryption category of all data in the dataset to be encrypted; , and Security scores Accuracy score and complexity score The weighting coefficients, and These are safety constraint penalty items. and resource constraint penalty items Penalty coefficient; security score The accuracy score is the ratio of the sum of scores for correctly classifying all data points at the high sensitivity level to the total number of data points at the high sensitivity level. The complexity score represents the ratio of the number of correctly classified data points to the total number of data points. This represents a function value that is negatively correlated with the number of categories. The first probability threshold is set. The security score is greater than the first set security score. The number of individuals, For the total number of individuals, The set upper limit for hardware resources, The computing resources required for an individual to run encryption.

4. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 1, characterized in that, Based on the encryption categories after data partitioning and the preset security requirements and resource budgets for each category, encryption algorithms are selected for different categories of data to be encrypted. Furthermore, a key satisfying a chance-constrained programming model is solved for each category of data to be encrypted through iterative optimization. Specifically: By using the pre-defined security requirements and resource budgets for each category as metadata, a set of data classification schemes with added metadata is obtained. ,in, m Indicates the number of categories. Indicates the first j Categories Indicate category The average sensitivity of all data within the system. This indicates that under the global resource constraint R, resources are allocated to the category. Resource allocation for subsequent encryption key generation and management; An encryption algorithm is selected based on the metadata of each category, and configurable parameters corresponding to the encryption algorithm are defined. It is used to control the key generation strength and the processing efficiency of the encryption algorithm; Category key As decision variables, they depend on the chosen encryption algorithm and configurable parameters. A search space is defined, and keys satisfying a chance-constrained programming model are solved iteratively. This model includes security constraints and resource constraints. During iteration, if the security constraints are not met, the configurable parameters are increased. If resource constraints are not met, the configurable parameters will be reduced. .

5. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 4, characterized in that, The security constraints are as follows: ; The resource constraints are as follows: ; in, For the set resource budget, Indicates the generation of the key The sum of all resources consumed throughout the entire process. Indicates use Category After the data is encrypted, the category Internal data security score, Set a security score for the second option. This represents the set second probability threshold. express The probability of.

6. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 1, characterized in that, The process of encrypting each file of each type of data to be encrypted based on the selected encryption algorithm and the generated key involves: for each file of each type of data to be encrypted, based on the selected encryption algorithm and the generated key, fragmenting and encrypting them in parallel, and then encrypting the encrypted fragments again using a hash algorithm before writing them to the blockchain for storage.

7. The data security management method based on evolutionary algorithm and chance-constrained programming according to claim 6, characterized in that, When a user requests access to an encrypted file, the system automatically verifies the user's access rights by triggering a smart contract on the blockchain. If the verification fails, the request is rejected; if the verification succeeds, the predefined access control policy is executed automatically.

8. A data security management and control system based on evolutionary algorithms and chance-constrained programming, characterized in that, include: The data acquisition module is used to acquire the dataset to be encrypted and extract the attribute features of each data point in the dataset. The data classification module is used to classify all data in the dataset to be encrypted into encryption categories based on the attribute characteristics of the data and using an evolutionary algorithm. During the classification process, the fitness function of the evolutionary algorithm introduces security constraint penalty terms and resource constraint penalty terms. The encryption key generation module is used to select encryption algorithms for different categories of data to be encrypted based on the encryption categories after data division and the preset security requirements and resource budget of each category, and to solve for the key that satisfies the chance constraint programming model for each category of data to be encrypted through iterative optimization. The encryption module is used to encrypt individual files of each type of data to be encrypted, based on the selected encryption algorithm and the generated key.

9. A computer device, characterized in that, It includes a processor and a memory; wherein, when the processor executes the computer program stored in the memory, it implements the steps of the data security management method based on evolutionary algorithm and chance constraint programming as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; when the computer programs are executed by a processor, they implement the steps of the data security management method based on evolutionary algorithms and chance-constrained programming as described in any one of claims 1-7.

Images