Data security protection method based on dynamic environment perception and storage medium
By combining dynamic environmental awareness and hardware security chips, risks are detected in real time and key data is proactively destroyed, solving the problem of insufficient protection of traditional encryption schemes under complex attacks and achieving efficient data security protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-26
- Publication Date
- 2026-03-27
AI Technical Summary
Traditional passive encryption schemes are difficult to effectively protect against complex attack methods and cannot proactively address security threats such as device loss and unauthorized cracking.
A data security protection method based on dynamic environment awareness is adopted. Key pairs are generated through hardware security chips, risk events are detected in real time and a comprehensive risk score is calculated. If the risk score is high, the key data is erased and multiple rounds of overwriting are performed to ensure that the data is irreversibly invalidated.
It enables the proactive destruction of key data before data is illegally obtained or cracked, blocking data leakage paths and providing proactive data security protection. It complies with national cryptographic standards and has high reliability and compliance.
Smart Images
Figure CN121744394A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data security technology, and in particular to a data security protection method and storage medium based on dynamic environment awareness. Background Technology
[0002] In the digital age, software data faces multiple security threats, including device loss, unauthorized hacking, and data tampering. Traditional passive encryption solutions are increasingly inadequate in dealing with complex attack methods, necessitating a proactive data security solution. Summary of the Invention
[0003] The technical problem to be solved by the present invention is to provide a data security protection method and storage medium based on dynamic environment awareness, which can realize proactive data security protection.
[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a data security protection method based on dynamic environment awareness, comprising: The data to be protected is encrypted to obtain the ciphertext. Based on real-time collected environmental perception data, risk events are detected, and a comprehensive risk score is calculated based on the risk weights corresponding to the detected risk events. When a data access request is received, if the current comprehensive risk score is less than the preset risk threshold, the encrypted data is decrypted to obtain the data to be protected; otherwise, the key data is erased and the key cache in memory is overwritten multiple times.
[0005] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.
[0006] The beneficial effects of this invention are as follows: by sensing environmental risks in real time, it proactively destroys relevant key data before the data is potentially illegally obtained or cracked, making all protected data irreversibly invalid, blocking the data leakage path, changing passive encryption to active protection, and thus achieving proactive data security protection. Attached Figure Description
[0007] Figure 1 This is a flowchart of a data security protection method based on dynamic environment awareness according to the present invention; Figure 2 This is a flowchart of the method according to Embodiment 1 of the present invention. Detailed Implementation
[0008] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.
[0009] Definitions: Digital envelopes are a hybrid encryption technology that combines symmetric encryption (efficient encryption and decryption) with asymmetric encryption (secure key distribution). Its core logic is: symmetric keys encrypt data, ensuring encryption and decryption efficiency; asymmetric keys are used to encrypt the symmetric keys, solving the security issues of symmetric key transmission and storage. The final result, "encrypted data + encrypted symmetric key," is called a digital envelope, which guarantees data confidentiality while avoiding the risk of symmetric key leakage.
[0010] Geo-fencing is a new application of LBS (Location Based Services) that defines geographical boundaries using virtual fences. It can trigger automatic notifications and alerts when a mobile device enters, leaves, or moves within a specific area.
[0011] Please refer to Figure 1 A data security protection method based on dynamic environment awareness includes: The data to be protected is encrypted to obtain the ciphertext. Based on real-time collected environmental perception data, risk events are detected, and a comprehensive risk score is calculated based on the risk weights corresponding to the detected risk events. When a data access request is received, if the current comprehensive risk score is less than the preset risk threshold, the encrypted data is decrypted to obtain the data to be protected; otherwise, the key data is erased and the key cache in memory is overwritten multiple times.
[0012] As can be seen from the above description, the beneficial effects of the present invention are as follows: by sensing environmental risks in real time, the relevant key data is proactively destroyed before the data is potentially illegally obtained or cracked, making all protected data irreversibly invalid and blocking the data leakage path from the root.
[0013] Furthermore, the encryption of the data to be protected to obtain ciphertext includes: A device key pair is generated using a hardware security chip, the key pair including a public key and a private key; When the data to be protected is obtained, a file encryption key is generated; The data to be protected is encrypted using the file encryption key to obtain ciphertext. The file encryption key is encrypted using the public key to obtain the key ciphertext; The encrypted data and key are stored in a preset storage medium, and a data encryption log is recorded.
[0014] As described above, based on digital envelope technology, fine-grained key management can be achieved, which not only ensures data confidentiality but also avoids the risk of file encryption key leakage.
[0015] Furthermore, the process of decrypting the encrypted data to obtain the data to be protected includes: Send the key ciphertext and data ciphertext to the hardware security chip; The hardware security chip decrypts the ciphertext of the key using the private key to obtain the file encryption key, and then decrypts the ciphertext of the data using the file encryption key to obtain the data to be protected. The decrypted data to be protected is returned to the application layer.
[0016] As described above, data security is ensured by implementing the decryption process through a hardware security chip.
[0017] Furthermore, after decrypting the encrypted data to obtain the data to be protected, the process further includes: After access to the data to be protected is complete, clear the cache of the data to be protected and the file encryption key temporarily stored in memory.
[0018] As described above, once the access is complete, a memory cleanup process is immediately triggered, overwriting the cache of plaintext data and file encryption keys temporarily stored in memory to ensure that no data remains.
[0019] Furthermore, the step of detecting risk events based on real-time collected environmental perception data and calculating a comprehensive risk score based on the risk weights corresponding to the detected risk events includes: Preset the risk weights for each risk event; Real-time collection of environmental perception data, and detection of risk events based on the environmental perception data; Calculate the comprehensive risk score based on the risk weights corresponding to the detected risk events; The environmental perception data includes equipment physical displacement data, equipment geographical location, power status data, software environment data, and user behavior data; the risk events include unauthorized violent movement of the equipment, the equipment geographical location exceeding the preset safe geographical area, abnormal power interruption, abnormal software environment, and abnormal user behavior.
[0020] As described above, by integrating multi-dimensional signals such as physical displacement, geofencing, software environment, and behavioral patterns, and through a weighted scoring mechanism, accurate risk assessment is achieved, effectively avoiding false triggers and missed triggers, and improving the reliability of proactive defense.
[0021] Furthermore, the physical displacement data of the device includes acceleration obtained by an accelerometer, angular velocity obtained by a gyroscope, and attitude parameters; If the peak acceleration exceeds the preset impact safety threshold, the acceleration exceeds the preset static safety threshold and the duration exceeds the preset first duration, the peak angular velocity exceeds the preset rotation safety threshold, or the attitude change rate exceeds the preset smooth operation threshold, then it is determined that the equipment has moved violently. If the device is not in a preset safe geographical area when it undergoes violent movement, or if no prior authorization instruction was received before the device undergoes violent movement, then the device is determined to have undergone unauthorized violent movement.
[0022] Furthermore, the power status data includes power connection status parameters and battery power supply parameters; If an abnormal power interruption is detected without a pre-disconnection command, and the disconnection time exceeds the preset second duration, or if the power interface is intermittently switched on and off, or if the connection between the battery and the motherboard is momentarily interrupted, or if the battery voltage is abnormally discharged, then an abnormal power interruption is determined to have occurred.
[0023] Furthermore, if it is detected that the device has enabled debugging mode, has been granted root privileges, or has been installed with suspicious monitoring or cracking tools, the software environment is deemed abnormal. If the number of decryption failures within a preset time window exceeds a preset failure threshold, or the access frequency during a preset non-working period is greater than or equal to a preset frequency threshold, then the user behavior is determined to be abnormal.
[0024] Furthermore, the step of detecting risk events based on real-time collected environmental perception data and calculating a comprehensive risk score based on the risk weights corresponding to the detected risk events further includes: If the overall risk score is greater than the preset risk threshold, the key data is erased and the key cache in memory is overwritten multiple times.
[0025] As described above, by thoroughly removing critical key materials from memory and secure storage areas, all protected data is irreversibly rendered invalid, thereby achieving data security protection.
[0026] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.
[0027] Example 1 Please refer to Figure 2Embodiment 1 of the present invention is a data security protection method based on dynamic environment awareness, applicable to scenarios with extreme requirements for end-of-life security of data, such as mobile office, industrial IoT, and highly sensitive data processing. This embodiment aims to perform high-strength encryption on static data in storage and innovatively integrates a multimodal dynamic awareness and adjudication mechanism. When the system determines through software policies that the operating environment is abnormal or faces the risk of physical loss, it will automatically trigger an instantaneous self-destruct process, completely erasing critical key materials in memory and secure storage areas, making all protected data irreversibly invalid, thereby achieving "last mile" protection for data security.
[0028] This method is based on a data security protection system and adopts a layered and decoupled architecture design. Each module has a clear responsibility and works together efficiently. It mainly includes the following three core modules: 1. GM Crypto Engine Module This module serves as the core of the system's data encryption, responsible for the encryption and decryption of all static and dynamically transmitted data, as well as data integrity verification. It is a fundamental component for ensuring data confidentiality.
[0029] Core algorithm selection: 1) Symmetric Encryption: Employs the SM4 algorithm and supports both CBC (Civic Block Chaining) and GCM (Galova / Counter Mode). GCM mode combines encryption and message authentication, simultaneously mitigating the risks of data leakage and tampering, making it suitable for high-security scenarios.
[0030] 2) Asymmetric encryption: Employs the SM2 elliptic curve public key cryptography algorithm, primarily used for digital signatures (ensuring the authenticity of the data source) and key negotiation (ensuring the security of the key distribution process), solving the security problem of key transmission in symmetric encryption.
[0031] 3) Hash Algorithm: The SM3 cryptographic hash algorithm is used for data integrity verification (verifying whether the data has been tampered with) and key derivation (generating subkeys from the master key), providing underlying support for key system and data security.
[0032] This module utilizes SM2's "digital envelope" technology to generate a unique random file encryption key (FEK) for each independent data unit (such as a single file or database table block). Data is then encrypted using the SM4 algorithm and the FEK. Subsequently, the FEK is encrypted using the authorized device's SM2 public key, forming a "digital envelope." Finally, the module stores "encrypted data + encrypted FEK." Decryption requires first decrypting the FEK using the corresponding SM2 private key, and then using the FEK to decrypt the data. This design enables fine-grained key management, supports flexible access control, and ensures that the leakage of a single key does not affect the security of other data.
[0033] The SM2 digital envelope technology in this embodiment solves the security, compliance, and scalability issues of traditional digital envelopes through three major innovations: localization of national cryptographic algorithms, fine-grained key management, and hardware-level security closed-loop. Especially in the scenario of device loss, it achieves ultimate protection of "key destruction → permanent data invalidation" through a self-destruct mechanism. Its design not only complies with national cryptographic standards, but also becomes a "last mile" security solution for highly sensitive data scenarios through dynamic sensing and hardware collaboration.
[0034] 2. Dynamic Context-Awareness & Decision Module This module serves as the system's "risk perception center," collecting multi-dimensional environmental signals from inside and outside the device in real time. Through its built-in strategy engine, it assesses and determines whether to trigger the self-destruct process, making it the core of proactive defense.
[0035] The sensing signal sources include: 1) Physical displacement sensor: Connects to the device's accelerometer and gyroscope to monitor whether the device undergoes unauthorized violent movement (such as forced disassembly or removal from a fixed area) and triggers a displacement risk warning.
[0036] 2) Geo-fencing: Combining GPS, Wi-Fi hotspot positioning and base station positioning, a safe geographical area (such as corporate office park, data center server room) is preset. When the device is located outside the area, a geographical risk warning is triggered.
[0037] 3) Power Status Monitoring: Monitors the device's power connection status and battery power supply in real time, and detects abnormal power interruptions (such as power outages caused by forceful disassembly or forced plugging and unplugging of the power supply) to trigger hardware security risk warnings.
[0038] 4) Software environment detection: Detect whether the device has enabled debugging mode (such as ADB debugging on Android, developer mode on iOS) through the system's underlying interface, whether it has been rooted / jailbroken (gaining the highest system privileges), and whether suspicious monitoring or cracking tools have been installed, to avoid performing decryption operations in an insecure software environment.
[0039] 5) Abnormal Behavior Detection: Record and analyze user decryption operation behavior, such as multiple decryption failures in a short period of time (incorrect password, failure to pass permission verification), high-frequency access to sensitive data outside of working hours, etc., and use them as weighting factors in risk assessment.
[0040] This module employs a multi-factor fusion adjudication strategy. Abandoning the traditional single-signal triggering model, the software embeds a configurable strategy engine that assigns differentiated risk weights to different sensing signals. The core criterion for determining the weight of a risk event is the degree of threat it poses to data security; the more direct the threat (easily leading to key leakage or unauthorized data acquisition), the higher the weight; conversely, the lower the weight. For example, high-weight (direct threat) events such as "Root / jailbreak detected" have a weight of 90%, and "leaving the geofence" has a weight of 80%; low-weight (indirect threat) events such as "3 decryption failures" have a weight of 40%. The adjudication engine only issues a self-destruct command when multiple risk events are combined (e.g., "leaving the geofence + 3 decryption failures," total weight 120%) or a single high-weight risk event is triggered (e.g., "Root / jailbreak detected," weight 90%), and the overall risk score exceeds a preset risk threshold (e.g., 100%), significantly reducing false positives and false negatives.
[0041] 3. Security Key Management and Self-Destruct Module This module serves as the "key security core" of the system, responsible for the entire lifecycle management of key generation, storage, use, and destruction, and is a key execution component for implementing the self-destruct function.
[0042] This embodiment employs a three-tiered key structure: Device Master Key → User Key → File Encryption Key (FEK). The upper-level keys are used to encrypt and protect the lower-level keys: the Device Master Key (MK) is generated and stored by a hardware security chip (such as a TPM / TCM / cryptographic card), protecting all user keys; the User Key (UK) is bound to the user's identity, protecting all FEKs under that user; the FEK is directly used for data encryption. This hierarchical design ensures the security and scalability of the key system; the leakage of a single-level key does not affect the overall security.
[0043] All keys (especially the device master key and user key) reside inside the hardware security chip (cryptography card / TCM / TPM). The hardware chip directly performs encryption and decryption operations only during decryption. The plaintext key never leaves the hardware security area, completely blocking the risk of software layer key theft.
[0044] Upon receiving the self-destruct command from the adjudication module, this module immediately sends a "secure erase" command to the hardware security chip, triggering the following irreversible operation: The hardware chip erases the device master key (MK) in its secure storage area, severing the "root" of the entire key system. Since both the user key and FEK are encrypted and protected by MK, after MK is destroyed, all lower-level keys cannot be decrypted, which is equivalent to the entire key system becoming invalid.
[0045] At the same time, the module calls the system memory cleanup interface to clear all temporary cache areas related to the key in memory through multiple rounds of overwriting (such as alternating overwriting with 0x00, 0xFF, and random numbers), thus avoiding key leakage caused by memory dump attacks.
[0046] The entire process is completed at the hardware level, with the time controlled in the millisecond range (<10ms). The hardware erasure uses physical-level unrecoverable technology (such as melting the storage unit and clearing the encrypted storage area). Even if the attacker obtains the storage medium, they will not be able to recover any valid key. All encrypted data is permanently "locked" and cannot be decrypted.
[0047] The core workflow of this method includes three major scenarios: initialization and encryption, decryption and access, and self-destruction triggering. Each process is interconnected to ensure data security throughout its entire lifecycle.
[0048] like Figure 2 As shown, this method includes the following steps: S1: Encrypt the data to be protected to obtain the ciphertext.
[0049] Specifically, this step includes the following steps: S101: Generate a device key pair through a hardware security chip, the key pair including a public key and a private key.
[0050] Specifically, when the system starts up for the first time, it automatically detects the hardware security chip (such as TPM / TCM / cryptographic card), and the hardware security chip generates an SM2 key pair (public key + private key). The SM2 private key is permanently stored in the chip's secure area and cannot be exported.
[0051] Furthermore, the hardware security chip can also generate a master key MK, which protects all user keys UK.
[0052] S102: When the data to be protected is obtained, generate a file encryption key.
[0053] Specifically, when a user uploads or generates data, the encryption engine module automatically generates a random file encryption key FEK. In this embodiment, the user key UK is bound to the user's identity, protecting all file encryption keys FEK under that user.
[0054] S103: Encrypt the data to be protected using the file encryption key to obtain the ciphertext.
[0055] The encryption engine module uses the SM4 algorithm (GCM mode) and the file encryption key FEK to encrypt the data to be protected, generating ciphertext.
[0056] S104: Encrypt the file encryption key using the public key to obtain the key ciphertext. The encryption engine module uses the SM2 private key to encrypt the file encryption key FEK, generating key ciphertext to form a digital envelope.
[0057] S105: Store the encrypted data and encrypted key to a preset storage medium and record a data encryption log.
[0058] The system stores the "encrypted data + encrypted key" to a specified storage medium (such as a local hard drive or encrypted USB flash drive) and records the data encryption log (including encryption time, data identifier, and FEK ID).
[0059] S2: Based on real-time collected environmental perception data, detect risk events and calculate a comprehensive risk score according to the risk weights corresponding to the detected risk events.
[0060] This process includes the following steps: S201: Preset the risk weights for each risk event.
[0061] S202: Collect environmental perception data in real time, and detect risk events based on the environmental perception data.
[0062] The environmental perception data includes equipment physical displacement data, equipment geographical location, power status data, software environment data, and user behavior data; the risk events include unauthorized violent movement of the equipment, the equipment geographical location exceeding the preset safe geographical area (leaving the geofence), abnormal power interruption, abnormal software environment, and abnormal user behavior.
[0063] In this embodiment, the risk weight corresponding to "unauthorized violent movement of the device" can be 60%, the risk weight corresponding to "leaving the geofence" can be 80%, the risk weight corresponding to "abnormal power interruption" can be 60%, the risk weight corresponding to "abnormal software environment" (such as detecting root / jailbreak) can be 90%, and the risk weight corresponding to "abnormal user behavior" can be 40%.
[0064] The detection methods for each risk event are as follows: a. Unauthorized violent movement of the equipment First, determine if the device has been moved violently, and then determine if the violent movement is authorized.
[0065] In this embodiment, the physical displacement data of the device includes acceleration obtained by an accelerometer, angular velocity obtained by a gyroscope, and attitude parameters; by determining whether abnormal acceleration, abnormal angular velocity, or abnormal attitude changes are detected, it is determined whether the device has moved violently.
[0066] 1. Acceleration-related parameters (1) Instantaneous impact acceleration: detects sudden high acceleration values within a short period of time (millisecond level), corresponding to the "forced disassembly" scenario (such as when violently disassembling the equipment shell, the impact or pulling of the tool on the equipment will generate an instantaneous impact). If the detected acceleration peak exceeds the preset impact safety threshold (which can be configured according to the equipment type, such as the threshold for industrial equipment may be higher than that for office equipment), it is determined to be an acceleration anomaly.
[0067] (2) Continuous linear acceleration: Detects whether the device has a continuous, unexpected linear speed change, corresponding to the scenario of "being taken away from a fixed area" (such as when the device is taken away from the office area without authorization, it will generate a continuous translational acceleration, rather than a low acceleration state of being stationary or moving slightly normally). If the detected acceleration exceeds the preset static safety threshold and the duration exceeds the preset first duration (such as 5 seconds), it is determined to be an acceleration abnormality.
[0068] 2. Angular velocity and attitude-related parameters (1) Abnormal angular velocity: Detect whether the rotational angular velocity of the equipment around the X / Y / Z axes exceeds the normal range, corresponding to the abnormal posture in "forced disassembly" (such as the need to twist the equipment parts during disassembly, which will generate unauthorized high angular velocity rotation). If the detected peak angular velocity exceeds the preset rotation safety threshold (such as rotation angle > 30° per second), it is determined to be an abnormal angular velocity.
[0069] (2) Attitude change rate: detects the rate of change of the overall attitude of the equipment (such as tilt angle and placement direction) and distinguishes between "normal movement" (such as a user smoothly picking up the equipment in the office area) and "violent movement" (such as the equipment being suddenly thrown or violently shaken). If the detected attitude change rate exceeds the preset stable operation threshold, it is judged as an abnormal attitude change.
[0070] In other words, if the peak acceleration exceeds the preset impact safety threshold, the acceleration exceeds the preset static safety threshold and the duration exceeds the preset first duration, the peak angular velocity exceeds the preset rotation safety threshold, or the attitude change rate exceeds the preset stable operation threshold, then it is determined that the equipment has moved violently.
[0071] Whether drastic movement is authorized requires a comprehensive judgment based on displacement parameters, other sensing signals, and preset authorization rules. Specifically, the system needs to pre-configure an "authorized movement baseline" to clearly define which drastic movements are legal scenarios, and movements exceeding the baseline are considered unauthorized. The core dimensions of the authorization baseline include: 1. Geofencing Authorization: If drastic movement occurs within a preset safe geographical area (such as an enterprise office park or data center server room) and there are no other risk signals (such as normal software environment or no decryption failure records), it is considered authorized (e.g., staff disassembling equipment for maintenance in the server room is considered authorized drastic movement); if drastic movement is accompanied by "equipment exceeding the geofence" (e.g., being taken out of the office area), it is directly considered unauthorized.
[0072] 2. User behavior authorization: If the system has received a "user authorization instruction" before the violent movement occurs (such as the user initiating a "device movement request" through password / biometrics, recording the authorization period and movement range), then even if violent displacement is detected, it will be determined as authorized; if there is no prior authorization instruction and multiple violent displacements occur in a short period of time (such as three consecutive impact accelerations exceeding the standard within 1 minute), it will be determined as unauthorized.
[0073] In other words, if the device is not in a preset safe geographical area when it moves violently, or if the device has not received a prior authorization instruction before it moves violently, then the device is determined to have moved violently without authorization.
[0074] b. The device's geographical location exceeds the preset safe geographical area (leaves the geofence). By combining GPS, Wi-Fi hotspot positioning, and base station positioning, a safe geographical area (such as an enterprise office park or data center) is preset. If the device is detected to be located outside the area, it is determined that a "leaving the geofence" risk event has occurred.
[0075] Furthermore, the system will dynamically adjust the priority of the positioning method based on the device's current environment (determined through software environment detection, power status, and other auxiliary signals). Specifically, when the device is indoors (such as in a data center or office), and the software detects that "the device is connected to the office Wi-Fi and the power supply is stable," it automatically increases the priority of "Wi-Fi hotspot positioning" (GPS is easily blocked indoors and has low accuracy), thus avoiding false "overshoot" due to weak GPS signals.
[0076] When the equipment is outdoors (such as when employees are carrying the equipment around the park), the system detects a "stable movement posture" through physical displacement sensors and automatically prioritizes "GPS + base station positioning" (outdoor Wi-Fi coverage is weak) to ensure the accuracy of the positioning coordinates and avoid misjudgments caused by Wi-Fi signal gaps.
[0077] By dynamically adapting the scenario-based priority of multi-source positioning, the accuracy of positioning judgment is improved.
[0078] c. Abnormal power interruption In this embodiment, abnormal power outages include "forced unplugging and plugging of the power supply" and "power outage caused by violent disassembly".
[0079] The detection parameters used by power status monitoring to determine abnormal power interruptions include: 1. Power connection status parameters: If an instantaneous disconnection of AC power is detected (without a pre-disconnection command and the disconnection time exceeds the preset second duration) or the power interface is intermittently switched on and off within a short period of time (e.g., within 30 seconds), it is considered that a "forced power disconnection" has occurred.
[0080] 2. Battery power supply parameters: If a momentary interruption in the connection between the battery and the motherboard is detected (accompanied by a strong signal from the displacement sensor) or the battery voltage drops rapidly to the power-off threshold (abnormal discharge), it is considered that a "power outage caused by violent disassembly" has occurred.
[0081] 3. System command coordination parameters: When a power interruption is detected, if there are no pre-power-off signals such as user shutdown or hibernation, normal operation is ruled out. Furthermore, all parameter determinations must be confirmed in conjunction with other signals such as physical displacement to avoid misjudgments.
[0082] In other words, if an abnormal power interruption is detected without a pre-disconnection command, and the disconnection time exceeds the preset second duration, the power interface is intermittently switched on and off for a short period of time, the connection between the battery and the motherboard is momentarily interrupted, or the battery voltage is abnormally discharged, then an abnormal power interruption is determined to have occurred.
[0083] d. Software environment abnormality The system detects whether the device has enabled debugging mode (such as ADB debugging on Android or developer mode on iOS) through the underlying system interface, whether it has been rooted / jailbroken (gaining the highest system privileges), and whether suspicious monitoring or cracking tools have been installed. If so, the software environment is determined to be abnormal.
[0084] e. Abnormal user behavior.
[0085] Record and analyze user decryption behavior, such as multiple decryption failures within a short period of time or frequent access to sensitive data outside of working hours, and determine that the user behavior is abnormal.
[0086] Specifically, for multiple decryption failures within a short period of time, the device records the timestamp of the decryption request and the result in real time, sets a time window (e.g., 5 minutes) and a failure count threshold (e.g., 3 times), counts the number of password errors / permission verification failures within the window, and determines an anomaly if the number of failures exceeds the preset failure count threshold.
[0087] For high-frequency access to sensitive data outside of working hours, specifically, the device presets working hours (e.g., 9:00-18:00), records the access timestamps of sensitive data, and counts the access frequency during non-working hours. If the frequency is greater than or equal to the preset frequency threshold (e.g., ≥5 times within 1 hour), it is judged as abnormal.
[0088] In other words, if the number of decryption failures within a preset time window exceeds a preset failure threshold, or the access frequency during a preset non-working period is greater than or equal to a preset frequency threshold, then the user's behavior is determined to be abnormal.
[0089] S203: Calculate the comprehensive risk score based on the risk weights corresponding to the detected risk events.
[0090] In this embodiment, the risk weights corresponding to the detected risk events are added together to obtain a comprehensive risk score.
[0091] S3: When a data access request is received, determine whether the current comprehensive risk score is less than the preset risk threshold. If yes, proceed to step S4; otherwise, proceed to step S5.
[0092] In this embodiment, the dynamic environment perception and adjudication module runs continuously, collecting environmental perception data in real time and updating the comprehensive risk score every 500ms.
[0093] When a user initiates a data access request (such as opening an encrypted file), the system first calls the dynamic environment awareness and adjudication module to obtain the current comprehensive risk score.
[0094] S4: Decrypt the encrypted data to obtain the data to be protected.
[0095] Specifically, the system sends the encrypted key to the hardware security chip. The hardware security chip decrypts the encrypted key using the SM2 private key to obtain the file encryption key FEK (this process is completed within the chip; the plaintext FEK is not exported). The hardware security chip uses the file encryption key FEK to decrypt the encrypted data using the SM4 algorithm to obtain the data to be protected, and then returns the decrypted data to the application layer for user access.
[0096] Furthermore, after the user finishes accessing the system (such as closing a file), the system immediately triggers a memory cleanup process to overwrite the plaintext data temporarily stored in memory and the FEK cache, ensuring that no data remains.
[0097] S5: Erase the key data and overwrite the key cache in memory in multiple rounds.
[0098] Specifically, the dynamic environment awareness and adjudication module generates a self-destruct command, including a timestamp and signature (to prevent tampering), and sends the self-destruct command and its signature to the key management and self-destruct module. After verifying the validity of the self-destruct command signature, the key management and self-destruct module sends a secure erase command to the hardware security chip. Upon receiving the secure erase command, the hardware security chip erases the internally stored key data. In this embodiment, since both the user key and the file encryption key FEK are encrypted and protected by the master key MK, after the master key MK is destroyed, all lower-level keys cannot be decrypted. Therefore, the hardware security chip can erase only the master key MK. In other embodiments, all key data, including the master key MK, key pairs, and the file encryption key FEK, can be erased.
[0099] Simultaneously, the key cache in memory is overwritten multiple times. Specifically, the system memory cleanup interface is called to clear all temporary caches related to keys in memory through multiple overwrites (such as alternating overwrites with 0x00, 0xFF, and random numbers), thus preventing key leakage caused by memory dump attacks.
[0100] Then, the system records the self-destruct event log (including the self-destruct command trigger time, risk signal type, and comprehensive risk score) and stops the decryption service. After that, all encrypted data will be permanently undecryptable due to the failure of the key system.
[0101] Furthermore, after step S2, if the comprehensive risk score is greater than or equal to the preset risk threshold, then step S5 is also executed immediately.
[0102] This embodiment has the following characteristics: 1. Compliance and Independent Control: The core cryptographic operation unit strictly adopts commercial cryptographic algorithms (national cryptographic algorithms) approved by the State Cryptography Administration to ensure that the technical system complies with domestic security standards and achieves independent control of key links.
[0103] 2. Proactive Defense: Transform passive encryption into proactive protection. By sensing environmental risks in real time, the core key is proactively destroyed before the data is potentially illegally obtained or cracked, thus blocking the data leakage path at the source.
[0104] 3. Transient and irrecoverable: The self-destruct process is designed for the key system, completing critical operations within milliseconds and ensuring that key materials cannot be recovered by any software or hardware means through a hardware-level erasure mechanism, thus guaranteeing permanent data security.
[0105] 4. Low invasiveness and high reliability: It provides a standard API interface, which supports rapid integration with existing application systems without large-scale modification of the original business logic; at the same time, the self-destruct logic has a built-in multi-verification mechanism to effectively avoid false triggering and ensure stable system operation.
[0106] Example 2 This embodiment is a computer-readable storage medium corresponding to the above embodiments, on which a computer program is stored. When the program is executed by a processor, it implements the various steps of the data security protection method based on dynamic environment awareness as described in the above embodiments, and can achieve the same technical effect, which will not be repeated here.
[0107] In summary, the data security protection method and storage medium based on dynamic environment awareness provided by this invention place the most critical key storage (device master key, SM2 private key) and self-destruct execution (hardware erasure) in hardware security chips such as TPM / TCM, ensuring that the self-destruct action cannot be bypassed or tampered with; the software layer provides flexible risk assessment capabilities through dynamic awareness and policy adjudication, achieving the dual advantages of "hardware ensuring security and software improving applicability".
[0108] Breaking away from the traditional single triggering method that relies solely on the number of password attempts, this approach integrates multi-dimensional signals such as physical displacement, geofencing, software environment, and behavioral patterns. Through a weighted scoring mechanism, it achieves accurate risk assessment, effectively avoiding false triggers (such as those on normal mobile devices) and missed triggers (such as those in complex attack scenarios), thereby improving the reliability of proactive defense.
[0109] From key generation (generated by hardware chip), use (internal hardware computation, plaintext not exported), distribution (SM2 asymmetric encryption) to destruction (hardware erasure), the entire process is based on the SM2 / SM3 / SM4 national cryptographic algorithm system, realizing closed-loop security management of the key lifecycle, meeting domestic information security compliance requirements, and ensuring independent controllability of technology.
[0110] It provides standardized API interfaces for application developers (such as the encryption interface Encrypt(), the decryption interface Decrypt(), and the self-destruction status query interface GetDestructionStatus()). Developers do not need to understand the underlying encryption logic and self-destruction mechanism. They can achieve data security protection simply by calling the interface, which greatly reduces the difficulty of system integration and is compatible with various existing business systems (such as OA, CRM, and industrial control software).
[0111] This invention organically integrates the national cryptographic algorithm system, hardware security chip, multimodal environmental perception and intelligent adjudication strategy, and achieves deep synergy between data encryption and instantaneous self-destruction function, fundamentally solving the core security pain point of "data leakage after device loss".
[0112] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.
Claims
1. A data security protection method based on dynamic environment awareness, characterized in that, include: The data to be protected is encrypted to obtain the ciphertext. Based on real-time collected environmental perception data, risk events are detected, and a comprehensive risk score is calculated based on the risk weights corresponding to the detected risk events. When a data access request is received, if the current comprehensive risk score is less than the preset risk threshold, the encrypted data is decrypted to obtain the data to be protected; otherwise, the key data is erased and the key cache in memory is overwritten multiple times.
2. The data security protection method based on dynamic environment awareness according to claim 1, characterized in that, The encryption of the data to be protected, resulting in ciphertext, includes: A device key pair is generated using a hardware security chip, the key pair including a public key and a private key; When the data to be protected is obtained, a file encryption key is generated; The data to be protected is encrypted using the file encryption key to obtain ciphertext. The file encryption key is encrypted using the public key to obtain the key ciphertext; The encrypted data and key are stored in a preset storage medium, and a data encryption log is recorded.
3. The data security protection method based on dynamic environment awareness according to claim 2, characterized in that, The process of decrypting the encrypted data to obtain the data to be protected includes: Send the key ciphertext and data ciphertext to the hardware security chip; The hardware security chip decrypts the ciphertext of the key using the private key to obtain the file encryption key, and then decrypts the ciphertext of the data using the file encryption key to obtain the data to be protected. The decrypted data to be protected is returned to the application layer.
4. The data security protection method based on dynamic environment awareness according to claim 1, characterized in that, After decrypting the encrypted data to obtain the data to be protected, the process further includes: After access to the data to be protected is complete, clear the cache of the data to be protected and the file encryption key temporarily stored in memory.
5. The data security protection method based on dynamic environment awareness according to claim 1, characterized in that, The process of detecting risk events based on real-time collected environmental perception data and calculating a comprehensive risk score based on the risk weights corresponding to the detected risk events includes: Preset the risk weights for each risk event; Real-time collection of environmental perception data, and detection of risk events based on the environmental perception data; Calculate the comprehensive risk score based on the risk weights corresponding to the detected risk events; The environmental perception data includes equipment physical displacement data, equipment geographical location, power status data, software environment data, and user behavior data; the risk events include unauthorized violent movement of the equipment, the equipment geographical location exceeding the preset safe geographical area, abnormal power interruption, abnormal software environment, and abnormal user behavior.
6. The data security protection method based on dynamic environment awareness according to claim 5, characterized in that, The physical displacement data of the device includes acceleration obtained by an accelerometer, angular velocity obtained by a gyroscope, and attitude parameters; If the peak acceleration exceeds the preset impact safety threshold, the acceleration exceeds the preset static safety threshold and the duration exceeds the preset first duration, the peak angular velocity exceeds the preset rotation safety threshold, or the attitude change rate exceeds the preset smooth operation threshold, then it is determined that the equipment has moved violently. If the device is not in a preset safe geographical area when it undergoes violent movement, or if no prior authorization instruction was received before the device undergoes violent movement, then the device is determined to have undergone unauthorized violent movement.
7. The data security protection method based on dynamic environment awareness according to claim 5, characterized in that, The power status data includes power connection status parameters and battery power supply parameters; If an abnormal power interruption is detected without a pre-disconnection command, and the disconnection time exceeds the preset second duration, or if the power interface is intermittently switched on and off, or if the connection between the battery and the motherboard is momentarily interrupted, or if the battery voltage is abnormally discharged, then an abnormal power interruption is determined to have occurred.
8. The data security protection method based on dynamic environment awareness according to claim 5, characterized in that, If the device is detected to be in debug mode, has been granted root privileges, or has been installed with suspicious monitoring or cracking tools, the software environment is deemed abnormal. If the number of decryption failures within a preset time window exceeds a preset failure threshold, or the access frequency during a preset non-working period is greater than or equal to a preset frequency threshold, then the user behavior is determined to be abnormal.
9. The data security protection method based on dynamic environment awareness according to claim 1, characterized in that, The step of detecting risk events based on real-time collected environmental perception data and calculating a comprehensive risk score based on the risk weights corresponding to the detected risk events further includes: If the overall risk score is greater than the preset risk threshold, the key data is erased and the key cache in memory is overwritten multiple times.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-9.