Data security management and control method, system and equipment based on data label and medium

Abstract

The invention provides a data security management and control method, system and device based on a data label and a medium, and relates to the technical field of data security, the method comprises the following steps: capturing an access request for target data, and analyzing access subject information and an access object identifier used for positioning the target data from the access request; according to the access object identifier, querying a mapping relationship stored in a pre-constructed independent label knowledge base, and obtaining a structured data label corresponding to the target data; generating a data security protection strategy based on the structured data label and the access subject information; and according to the data security protection strategy, executing a corresponding security protection operation on the access request to control the access to the target data. According to the method, the independent label knowledge base which is separated from the original data and contains the classification and grading labels is established, the classification and grading labels of the independent label knowledge base are inquired through the mapping relation, the precisely matched security policy is generated, and data security management and control based on data classification and grading are achieved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a data security management method, system, device, and medium based on data tags. Background Technology

[0002] With the advancement of digital and intelligent transformation in the power sector, business entities are becoming more service-oriented and business applications are becoming more open. Data, as a key production factor, has been integrated into various fields such as power, energy, and government affairs, leading to increasingly prominent data security risks. As the number of business entities increases, the sharing of power data across industries and enterprises is becoming more frequent, making the secure management of data sharing and flow difficult. To strengthen the security protection of data sharing and flow and reduce the security risks brought about by data sharing, the industry currently mainly adopts data security measures such as data classification and grading, access control, data anonymization, and watermarking for traceability to protect target data.

[0003] Existing data security management solutions often disconnect data classification and grading from encryption and anonymization technologies, making it difficult to generate effective protection strategies after deployment and hindering the effectiveness of security measures. Furthermore, modifying the data storage and access structure of business databases to store classification and grading information presents complex challenges and could disrupt the stability of existing systems. Therefore, addressing the security risks associated with data sharing and flow, and maximizing the timeliness of data security protection based on data classification and grading information, has become a pressing issue. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, the present invention provides a data security management method based on data tags, comprising: Capture access requests to target data, and parse the access subject information and the access object identifier used to locate the target data from the access requests; Based on the access object identifier, query the mapping relationship stored in the pre-built independent tag knowledge base to obtain the structured data tag corresponding to the target data; the structured data tag shall contain at least the classification identifier and the hierarchical identifier of the target data; Data security protection strategies are generated based on structured data tags and access subject information; Based on the data security protection strategy, corresponding security protection operations are performed on access requests to control access to the target data.

[0005] Preferably, the construction process of an independent tag knowledge base includes: Acquire basic information about multiple data objects that will become target data. The basic information includes data attribute information used to characterize the data itself and data carrier information used to locate the data storage entity. Based on the preset data classification and grading strategy, corresponding structured data tags are generated based on basic information; the structured data tags include at least a data classification identifier and a data grading identifier; Structured data tags are stored independently, and a mapping relationship between structured data tags and corresponding data objects is established to build an independent tag knowledge base.

[0006] Preferably, based on a preset data classification and grading strategy, corresponding structured data tags are generated based on basic information, including: The data attribute information and data carrier information are combined according to a predefined tag architecture, and the data classification identifier and data classification identifier determined according to the classification and grading strategy are embedded to generate the corresponding structured data tags.

[0007] Preferably, the structured data tags are stored independently, and a mapping relationship between the structured data tags and the corresponding data objects is established, including: Structured data tags are stored in a dedicated database that is independent of the original storage location of the data objects; In a dedicated database, a unique identifier for each data object is associated with and bound to the corresponding structured data tag to establish a mapping relationship; Based on structured data tags and mapping relationships, construct an independent tag knowledge base.

[0008] Preferably, a data security protection strategy is generated based on structured data tags and access subject information, including: By comparing and analyzing the access subject information with the pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained. By integrating dynamic risk coefficients with classification and grading identifiers in structured data labels, contextualized data security protection strategies are generated.

[0009] Preferably, the access subject information is compared and analyzed with a pre-set risk assessment model to obtain a dynamic risk coefficient characterizing the risk level of the access request, including: Based on the historical behavior data corresponding to the access subject information, an unsupervised learning algorithm is used to train and generate a baseline model of the subject's normal behavior. Real-time behavioral features are extracted from the information of the accessing subjects, and the real-time behavioral features are compared with the baseline model of the subjects' normal behavior to calculate the degree of behavioral deviation. By inputting the behavioral deviation degree together with the classification and grading labels in the structured data into a pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained.

[0010] Preferably, the safety protection operation includes at least one of the following: Desensitization strategies for specific levels or categories of data or specific access subjects; Encryption strategies for specific levels or categories of data or specific access subjects; Watermarking strategies targeting specific levels or categories of data or specific access subjects; Access control policies for specific levels or categories of data or specific access subjects.

[0011] Preferably, after constructing an independent tag knowledge base, the method further includes: Listen for data change events in the database where the data object resides; Based on data change events, the corresponding structured data tags in the independent tag database are updated in real time to maintain the consistency of the mapping relationship.

[0012] Preferably, after constructing an independent tag knowledge base, the method further includes: When critical operations such as tag creation, modification, or mapping relationship adjustment occur in structured data tags, the record information of the critical operations is synchronized to the blockchain network for evidence storage.

[0013] Preferably, smart contracts are deployed on a blockchain network, and the smart contracts are coded with pre-defined compliance rules; When critical operations trigger compliance rules, smart contracts automatically issue alerts, generate audit events, or initiate approval processes.

[0014] Based on the same inventive concept, the present invention also provides a data security management and control system based on data tags, the system comprising: The access request capture module is used to capture access requests to target data, and parse the access subject information and the access object identifier used to locate the target data from the access request. The structured data tag acquisition module is used to query the mapping relationship stored in a pre-built independent tag knowledge base based on the access object identifier, and obtain the structured data tag corresponding to the target data; the structured data tag contains at least the classification identifier and the hierarchical identifier of the target data; The protection strategy generation module is used to generate data security protection strategies based on structured data tags and access subject information; The protection operation execution module is used to perform corresponding security protection operations on access requests in accordance with data security protection policies, so as to control access to target data.

[0015] Preferably, the system also includes an independent tag knowledge base construction module, used for: Acquire basic information about multiple data objects that will become target data. The basic information includes data attribute information used to characterize the data itself and data carrier information used to locate the data storage entity. Based on the preset data classification and grading strategy, corresponding structured data tags are generated based on basic information; the structured data tags include at least a data classification identifier and a data grading identifier; Structured data tags are stored independently, and a mapping relationship between structured data tags and corresponding data objects is established to build an independent tag knowledge base.

[0016] Preferably, the independent tag knowledge base construction module is specifically used for: The data attribute information and data carrier information are combined according to a predefined tag architecture, and the data classification identifier and data classification identifier determined according to the classification and grading strategy are embedded to generate the corresponding structured data tags.

[0017] Preferably, the independent tag knowledge base construction module is specifically used for: Structured data tags are stored in a dedicated database that is independent of the original storage location of the data objects; In a dedicated database, a unique identifier for each data object is associated with and bound to the corresponding structured data tag to establish a mapping relationship; Based on structured data tags and mapping relationships, construct an independent tag knowledge base.

[0018] Preferably, the protection strategy generation module is specifically used for: By comparing and analyzing the access subject information with the pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained. By integrating dynamic risk coefficients with classification and grading identifiers in structured data labels, contextualized data security protection strategies are generated.

[0019] Preferably, the protection strategy generation module is specifically used for: Based on the historical behavior data corresponding to the access subject information, an unsupervised learning algorithm is used to train and generate a baseline model of the subject's normal behavior. Real-time behavioral features are extracted from the information of the accessing subjects, and the real-time behavioral features are compared with the baseline model of the subjects' normal behavior to calculate the degree of behavioral deviation. By inputting the behavioral deviation degree together with the classification and grading labels in the structured data into a pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained.

[0020] Preferably, the safety protection operation includes at least one of the following: Desensitization strategies for specific levels or categories of data or specific access subjects; Encryption strategies for specific levels or categories of data or specific access subjects; Watermarking strategies targeting specific levels or categories of data or specific access subjects; Access control policies for specific levels or categories of data or specific access subjects.

[0021] Preferably, the system also includes a tag library update module for: Listen for data change events in the database where the data object resides; Based on data change events, the corresponding structured data tags in the independent tag database are updated in real time to maintain the consistency of the mapping relationship.

[0022] Preferably, the system also includes a blockchain evidence storage module for: When critical operations such as tag creation, modification, or mapping relationship adjustment occur in structured data tags, the record information of the critical operations is synchronized to the blockchain network for evidence storage.

[0023] Preferably, the blockchain evidence storage module is specifically used for: Smart contracts are deployed on a blockchain network, and these smart contracts contain pre-defined compliance rules. When critical operations trigger compliance rules, smart contracts automatically issue alerts, generate audit events, or initiate approval processes.

[0024] Based on the same inventive concept, the present invention also provides an electronic device, comprising: at least one processor and a memory; wherein the memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, a data security management method based on data tags as described above is implemented.

[0025] Based on the same inventive concept, the present invention also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements the data security management method based on data tags as described above.

[0026] Compared with the closest existing technology, the present invention has the following beneficial effects: This invention provides a data security management method based on data tags, comprising: capturing access requests to target data; parsing access subject information and access object identifiers for locating the target data from the access requests; querying mapping relationships stored in a pre-built independent tag knowledge base according to the access object identifiers to obtain structured data tags corresponding to the target data; the structured data tags at least include a classification identifier and a hierarchical identifier for the target data; generating a data security protection strategy based on the structured data tags and access subject information; and performing corresponding security protection operations on the access requests according to the data security protection strategy to control access to the target data. This invention establishes an independent tag knowledge base containing classification and hierarchical tags, separate from the original data, without altering the existing business system and database structure. When data access occurs, the classification and hierarchical tags in the independent tag knowledge base are queried through mapping relationships, and the access requests are integrated to generate a precisely matched security strategy, achieving effective security management based on data classification and hierarchical classification, improving the effectiveness of protection and the feasibility of engineering implementation. Attached Figure Description

[0027] Figure 1 A flowchart illustrating the data security management method based on data tags provided by this invention; Figure 2 A flowchart illustrating a data security management method based on data tags, provided for a specific embodiment; Figure 3 A schematic diagram illustrating the logical relationship between dynamic behavioral profiling and risk perception provided by this invention; Figure 4 A schematic diagram of the architecture of the data security management method based on data tags provided by the present invention; Figure 5 This is a structural diagram of the data security management system based on data tags provided by the present invention; Figure 6 A structural diagram of a data security management system based on data tags provided for a specific embodiment; Figure 7 A structural diagram of a data security management system based on data tags, provided for another specific embodiment; Figure 8 A schematic diagram of the electronic device provided by the present invention. Detailed Implementation

[0028] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0029] Example 1: This invention provides a data security management method based on data tags, specifically, Figure 1 A flowchart illustrating the data security management method based on data tags provided in this embodiment of the invention is shown in the figure, including the following steps: S101: Capture access requests to target data, and parse access subject information and access object identifiers used to locate target data from the access requests; S102: Based on the access object identifier, query the mapping relationship stored in the pre-built independent tag knowledge base to obtain the structured data tag corresponding to the target data; the structured data tag shall contain at least the classification identifier and the hierarchical identifier of the target data; S103: Generate data security protection strategies based on structured data tags and access subject information; S104: Based on the data security protection policy, perform corresponding security protection operations on the access request to control access to the target data.

[0030] This invention establishes an independent tag knowledge base, separate from the original data and containing classification and hierarchical tags, without altering the existing business system and database structure. When data access occurs, the classification and hierarchical tags in the independent tag knowledge base are queried through mapping relationships, and the access request is integrated to generate a precisely matched security policy. This achieves effective security control based on data classification and hierarchical management, improving the effectiveness of protection and the feasibility of engineering implementation.

[0031] In this embodiment, the data security capability unit captures data access requests at protection interception points (such as API (Application Programming Interface) gateways and database proxies), parses and extracts the access subject and access object. The access subject includes access address information, account information, permission information, device information, access method, etc., while the access object information includes database IP (Internet Protocol), database name, data table name, data field name, system / platform name, interaction interface name, interaction interface IP, etc.

[0032] This invention also includes a pre-built independent tag knowledge base, the specific construction process of which includes: Acquire basic information about multiple data objects that will become target data. The basic information includes data attribute information used to characterize the data itself and data carrier information used to locate the data storage entity. Based on the preset data classification and grading strategy, corresponding structured data tags are generated based on basic information; the structured data tags include at least a data classification identifier and a data grading identifier; Structured data tags are stored independently, and a mapping relationship between structured data tags and corresponding data objects is established to build an independent tag knowledge base.

[0033] In one specific implementation, according to a preset data classification and grading strategy, a corresponding structured data tag is generated based on basic information, including: combining data attribute information and data carrier information according to a predefined tag architecture, and embedding data classification identifiers and data grading identifiers determined according to the classification and grading strategy to generate a corresponding structured data tag.

[0034] In one specific implementation, the structured data tags are stored independently, and a mapping relationship between the structured data tags and the corresponding data objects is established, including: storing the structured data tags in a dedicated database independent of the original storage location of the data objects; in the dedicated database, associating and binding the unique identifier of each data object with the corresponding structured data tag to establish a mapping relationship; and constructing an independent tag knowledge base based on the structured data tags and the mapping relationship.

[0035] Obtaining basic information about multiple data objects that will become target data includes: establishing information channels for acquiring data objects, and obtaining basic information about data objects through one or more of the following three methods. The first method is to obtain data object traffic by mirroring network traffic; the second method is to establish a channel with the target data carrier and obtain data object information through active probing; the third method is to obtain data object information through target data design document information. These three methods can be combined or applied independently.

[0036] The collected basic information includes data attribute information characterizing the data itself and data carrier information for locating data storage entities. Specifically, the basic information originates from data carriers such as database instances and API interfaces of business systems or platforms, including the business domain to which the data belongs, physical storage location, logical data table structure, and field definitions. Metadata such as data deployment location, responsible department, dataset name, interface details, and field attributes are then extracted and structured. Simultaneously, behavioral logs of data access subjects (such as user accounts, application services, and IP terminals) are collected, with key dimensions including access sequence, operation frequency, action type (query, modification, download), requested data volume, sensitive data access sequence, and geographical location anomalies. Basic information of the data objects is then extracted, which uniquely identifies the target data carrier information and the data information. The extracted target data carrier information includes database information and interaction interface information. Database information may include the affiliated professional department, database type, database IP, and port number. Interaction interface information may include system / platform name, interface name, interface number, interface type, protocol, and interface address. The extracted target data information includes data table name, data field name, and data type.

[0037] After obtaining basic information, based on the enterprise's data classification and grading strategy, the system automatically matches and generates classification and grading identifiers for data objects. It then integrates basic data attributes with the classification and grading results to form structured data tags that uniquely represent data security attributes and business context. Specifically, according to the enterprise's data classification and grading rules, it batch imports the classification and grading information of data objects from the database and interactive interfaces, obtaining the field names of the data objects and the corresponding field categories and levels. It sets data tag patterns and generates corresponding tags based on the basic data information and classification and grading information. Data object tag information in the database must include at least the professional department, database name, database IP, data table name, data field name, data level, and data category. Target data tag information in the interactive interface must include at least the professional department, system / platform name, interface name, interface address, data field name, data level, and data category. The generated data tags are then stored independently of the original business data in a dedicated tag knowledge base. By establishing a two-way index mapping relationship between data assets and tags, the tags are ensured to be addressable and associative. A mechanism based on database log capture or API event triggering is adopted to achieve near real-time synchronization of tag information with changes in source data. The operation of tags is recorded and audited through blockchain to achieve the immutability and traceability of data tags and their change history, and key operation information of data tags is recorded on the blockchain.

[0038] Data tag information is stored independently in a data tag library, establishing a mapping relationship with the database and system containing the stored data. This allows for a unique association of specific data through data tags, and also enables the querying of tag information by accessing specific data. Data tag information for database and system interaction interfaces can be stored independently in tables, employing independent data tag library / table storage methods based on business departments, databases, and systems / platforms.

[0039] Preferably, after constructing an independent tag knowledge base, the method further includes: when key operations such as tag creation, modification, or mapping relationship adjustment occur in the structured data tags, the record information of the key operations is synchronized to the blockchain network for evidence storage. Specifically, smart contracts are deployed on the blockchain network, and these smart contracts are encoded with pre-defined compliance rules; when a key operation triggers the compliance rules, the smart contract automatically executes alerts, generates audit events, or initiates an approval process.

[0040] After constructing an independent tag knowledge base, the method also includes: listening to data change events in the database where the data object resides; and updating the corresponding structured data tags in the independent tag database in real time based on the data change events to maintain the consistency of the mapping relationship.

[0041] In some optional implementations, a synchronization relationship is established between tags and data objects, creating a data tag synchronization model led by data objects, where adjustments to the data object drive the synchronous update of the data tag library. One approach is to establish a synchronization query mechanism between the data tag library and the target database / system / platform; after data object information is adjusted, the tag library updates its information by querying its log system. A second approach involves manually synchronizing the data tag library information after adjustments to the business database, system / platform databases, interaction interfaces, or data information.

[0042] In some optional implementations, a lightweight blockchain node network is constructed as an audit and evidence storage layer. When critical operations occur in the tag knowledge base (such as tag creation, sensitivity level changes, or mapping relationship adjustments), information such as the transaction hash, operation type, target data identifier, new tag snapshot, timestamp, and operator's digital identity is persisted to the blockchain. A blockchain explorer-based audit query service is provided, supporting the tracing of the entire lifecycle of changes through data identifiers or tag content. All records are immutable and legally valid. Smart contracts are deployed on-chain to encode high-risk operation rules (such as "core trade secret data tags being modified outside of working hours"). Once triggered, these rules automatically execute alerts, generate audit events, or request secondary approval, achieving programmable compliance automation.

[0043] Building an independent tag knowledge base is a one-time / low-frequency operation. During the construction phase, it only needs to interact with the business database, and the interaction is read-only and minimally invasive. Information collection involves analyzing business database design documents, reading system tables, or listening to logs to obtain metadata such as data structure and location, without touching the business data itself. During change synchronization, it detects changes in table structure or data definitions by subscribing to the business database's log change stream, thereby triggering updates to the independent tag knowledge base. The purpose of building an independent tag knowledge base is to create and maintain a "security identity card" for each data object (or data asset).

[0044] After constructing an independent tag knowledge base, the mapping relationship stored in the pre-constructed independent tag knowledge base is queried based on the access object identifier to obtain the structured data tags corresponding to the target data.

[0045] Specifically, an interaction channel is established between data security capabilities and target databases, data tag libraries, and systems / platforms. Data security capabilities can access target databases, data tag libraries, and system / platform IP addresses on the network, and have permissions to query data tables in business databases and independent tag knowledge bases. Based on the object information accessed by the accessing subject, data security capabilities query the target data carrier information, analyze and extract the corresponding basic information of the accessed object, and locate and obtain the tag information of the corresponding data through the accessed object information, including database IP, database name, data table name, data field name, or system / platform name, interaction interface name, and interaction interface IP. Furthermore, based on the identification information of the accessed object (such as database name, table name, and interface address), the security capability unit queries the tag knowledge base to accurately match and obtain the corresponding data classification and grading tags and other metadata, performs tag association matching, and completes the conversion from data entities to security policy semantics.

[0046] Furthermore, based on structured data tags and access subject information, data security protection strategies are generated. These strategies include: dynamically generating precise data security protection strategies for target data at specific category levels, databases, or interaction interfaces, based on structured data tags and access subject information. Data security protection strategies may include de-identification, encryption, watermarking, and access control strategies for specific levels and categories of data, as well as de-identification, encryption, watermarking, and access control strategies for specific access subjects.

[0047] In some optional implementations, a data security protection strategy is generated based on structured data tags and access subject information, including: comparing and analyzing the access subject information with a pre-set risk assessment model to obtain a dynamic risk coefficient that characterizes the risk level of the access request; and integrating the dynamic risk coefficient with the classification and grading identifiers in the structured data tags to generate a contextualized data security protection strategy.

[0048] The process involves comparing and analyzing the access subject information with a pre-set risk assessment model to obtain a dynamic risk coefficient that characterizes the risk level of the access request. This includes: generating a baseline model of the subject's normal behavior based on historical behavioral data corresponding to the access subject information using an unsupervised learning algorithm; extracting real-time behavioral features from the access subject information and comparing these features with the baseline model to calculate the behavioral deviation; and inputting the behavioral deviation, along with the classification and grading labels from the structured data tags, into the pre-set risk assessment model to obtain a dynamic risk coefficient that characterizes the risk level of the access request.

[0049] Finally, based on the data security protection strategy, corresponding security protection operations are performed on access requests to control access to the target data. Specifically, after generating the security protection strategy, the data security capability distributes the relevant strategy to the corresponding data security capability execution unit to implement the corresponding protection measures. The data security capability unit is the final module that executes security capabilities under the policy drive, and may include various execution capabilities such as data encryption, data desensitization, data watermarking, and risk monitoring. Here, the data security capability execution unit can respond to adjustments in the data security protection strategy in real time and dynamically update the security protection strategy during operation.

[0050] Real-time security control of data access requests is a high-frequency triggered action. The system captures an access request at the gateway / proxy layer and parses out the access subject and object information. Then, using the access object identifier as a keyword, it queries an external independent tag knowledge base to obtain the corresponding security tags (classification, classification, etc.), performs tag and subject information fusion, generates a policy, and performs de-identification and blocking actions on the data stream at interception points such as the gateway / proxy. This entire real-time decision-making and execution chain forms a perfect bypass loop, completely bypassing the business database. The business database only needs to handle its original business queries and is unaware of the security control process.

[0051] To strengthen the security of data sharing and reduce the security risks associated with data sharing, the industry currently mainly adopts data security measures such as data classification and grading, access control, data anonymization, and watermarking for traceability to protect target data. However, these methods suffer from a disconnect between data classification and grading as a management measure and data security protection capabilities such as access control, data anonymization, and watermarking for traceability. This leads to difficulties in generating strategies after the deployment of security protection capabilities, hindering their effectiveness. Furthermore, directly adding classification and grading information to the target data alters the original data storage and access structure, making effective application difficult. The technical problem this invention aims to solve is overcoming the challenge that, due to the relatively fixed data storage structures of various types of data, data classification and grading are difficult to effectively integrate with security measures, thus hindering effective data security management based on data classification and grading.

[0052] Existing technologies directly add classification and hierarchical information to target data, which is an embedded and tightly coupled architecture. Security attributes, as part of the data (such as newly added fields and comments), are physically bound to the business data in the same storage space. This requires modifying the existing target database's table structure, API interface, or data model, potentially causing compatibility issues, performance degradation, and business interruptions. Therefore, it is highly invasive and carries high modification risks. Furthermore, because once written, it is difficult to modify frequently, resulting in poor practicality. Additionally, security capabilities (such as data masking and encryption engines) require each system to parse and identify specific fields or comments in the database, leading to complex adaptation and difficulty in establishing a unified strategy.

[0053] The independent tag knowledge base constructed in this invention employs a bypass, loosely coupled architecture. Security attributes are stored in a separate, dedicated knowledge base, logically linked to business data (through mapping relationships). This independent tag knowledge base is non-intrusive and requires zero modification, completely avoiding any impact on existing business systems and database structures. It only requires establishing external channel service logs or traffic to build and synchronize tags. Simultaneously, the tag knowledge base is an independent, flexibly definable, and extensible security attribute center, easily integrating and updating dynamic risk coefficients, access policies, compliance requirements, etc., in real time. By employing the techniques of "building an independent tag knowledge base" and "establishing mapping relationships," data security attribute management is decoupled from the high-cost, high-risk domain of business data storage. This lays the technical foundation for achieving accurate, dynamic, unified, and auditable execution of data security policies without modifying existing systems.

[0054] The data security management method based on data tags provided by the present invention will be described in detail below with reference to a specific embodiment. For example... Figure 2 The diagram shown is a flowchart illustrating a data security management method based on data tags in a specific embodiment.

[0055] S100, Data Asset Discovery and Information Extraction. Acquire basic information about the target data, which originates from data carriers such as database instances and API interfaces of the business system or platform. Specifically, this includes the business domain to which the data belongs, its physical storage location, logical data table structure, and field definitions. Then, extract and structure metadata such as data deployment location, responsible department, dataset name, interface details, and field attributes; and perform dynamic data risk perception based on behavioral profiles.

[0056] Furthermore, S100 includes: S100-1: Establish a channel for acquiring target data information. The first method is to acquire target data traffic through network mirroring; the second method is to establish a channel with the target data carrier and acquire target data information through active probing; the third method is to acquire target data information through target data design document information. These three methods can be combined or applied independently.

[0057] S100-2: Collect behavioral logs of data access subjects (such as user accounts, application services, IP terminals), with key dimensions including access time sequence, operation frequency, action type (query, modification, download), requested data volume, sensitive data access sequence, and geographical location changes.

[0058] Furthermore, unsupervised learning algorithms (such as Isolation Forest and Local Outlier Factor) are employed to train historical behavioral data, constructing a baseline model of the subject's normal behavior. When an access occurs, the deviation between the current operation sequence and the behavioral baseline is calculated in real time. Combined with the classification and grading results in the accessed data labels, a quantified dynamic risk coefficient is output through a pre-set risk assessment model. This coefficient serves as a key dynamic factor for strategy generation.

[0059] S100-3: Extract basic information of the target data. The basic information of the target data can uniquely identify the target data carrier information and data information. The extracted target data carrier information includes database information and interaction interface information. Database information may include the affiliated professional department, database type, database IP, port number, etc. Interaction interface information may include system / platform name, interface name, interface number, interface type, protocol, interface address, etc. The extracted target data information includes data table name, data field name, data type, etc.

[0060] S200, Data Tagging and Modeling. Based on the enterprise's data classification and grading strategy, it automatically matches and generates classification and grading identifiers for target data; it designs a unified data tag schema, integrating basic data attributes (such as department, database / table fields) with classification and grading results to form structured tags that can uniquely represent data security attributes and business context.

[0061] Furthermore, S200 includes: S200-1, Generate target data labels, import the classification and grading information of target data from the database and interactive interface in batches according to the enterprise data classification and grading rules, and obtain the field names of the target data and the category and level information of the corresponding fields.

[0062] S200-2, Set up data tagging mode to generate corresponding tags based on basic data information and classification / grading information. Target data tag information in the database must include at least the professional department, database name, database IP address, table name, field name, data level, and data category; target data tag information in the interactive interface must include at least the professional department, system / platform name, interface name, interface address, field name, data level, and data category.

[0063] For example, in a database, the data tag information for a certain field can be represented as DP.DB_NAME.DB_IP.data_sheet.data_Column.DTL.DTC, where DP represents the finance department, DB_NAME represents the database name CW_DB, DB_IP represents the IP address of the CW_DB database, data_sheet represents a table in the CW_DB database, data_Column represents a field name in the CW_DB database, DTL represents a field level in the CW_DB database, and DTC represents a field category in the CW_DB database. In a system interaction interface, a certain data tag information can be represented as DP.SYS.INT.INT_IP.data_Column.DTL.DTC, where DP represents the finance department, SYS represents the system name CWXT, INT represents an interface name in the CWXT system, INT_IP represents the IP address of an interface in the CWXT system, data_Column represents a field name in the INT interface, DTL represents a field level in the INT interface, and DTC represents a field category in the INT interface.

[0064] S300 features separate tag storage and mapping synchronization. Generated data tags are stored independently of the original business data in a dedicated tag knowledge base. A bidirectional index mapping relationship is established between data assets and tags to ensure tag addressability and associativity. A mechanism based on database log capture or API event triggering is used to achieve near real-time synchronization of tag information with changes in source data. Blockchain is used for operational notarization and audit traceability of tags, ensuring the immutability and traceability of data tags and their change history, and storing key operational information of data tags on the blockchain.

[0065] Furthermore, the S300 includes: S300-1, Separate storage of target data and its tags: The data tag information from step S202-2 is stored independently in an independent tag knowledge base. The stored information should at least include the descriptive information from step S202-2, and establish a mapping relationship with the database and system of the stored data information. It should be possible to uniquely associate specific data through data tags, and also to query its tag information by accessing specific data. Database and system interaction interface data tag information can be stored in independent tables, and an independent tag knowledge base / table storage method can be adopted according to the business department, database, system / platform.

[0066] In this invention, an independent tag knowledge base is established, and target data and its tags are stored separately. Queries are performed through mapping, giving target data and data tags relatively independent and optimized storage space, avoiding the security risks associated with directly manipulating the target database. Compared to the traditional method of directly storing tags in the target database, this effectively avoids business operation problems caused by modifying the original database. It is also easier to implement in engineering, especially for enterprises with a large number of operational systems where a non-separate approach to target data and tags is difficult to execute.

[0067] This invention establishes an independent tag knowledge base, separate from the original data and containing classification and hierarchical tags, without altering the existing business system and database structure. When data access occurs, the classification and hierarchical tags in the independent tag knowledge base are queried through mapping relationships, and the access request is integrated to generate a precisely matched security policy. This achieves effective data security management based on data classification and hierarchical classification, improving the effectiveness of protection and the feasibility of engineering implementation.

[0068] S300-2 establishes a synchronization relationship between tags and target data, creating a data tag synchronization model driven by target data, where adjustments to the target data drive the synchronous updates of the independent tag knowledge base. One approach is to establish a synchronization query mechanism between the independent tag knowledge base and the target database / system / platform; after adjustments to the target data, the tag base updates its information by querying its log system. The second approach involves manual synchronization of the independent tag knowledge base information after adjustments to the target database, system / platform databases, interaction interfaces, or data information.

[0069] S300-3 constructs a lightweight blockchain node network as an audit and evidence storage layer. When critical operations occur in the tag knowledge base (such as tag creation, sensitivity level changes, and mapping relationship adjustments), information such as the transaction hash, operation type, target data identifier, new tag snapshot, timestamp, and operator's digital identity are solidified into the blockchain. It provides audit query services based on a blockchain explorer, supporting the tracing of the entire lifecycle of changes through data identifiers or tag content. All records are immutable and legally valid.

[0070] S300-4 deploys smart contracts on the blockchain to encode high-risk operation rules (such as "the core trade secret data label is modified outside of working hours"). Once triggered, it automatically executes alarms, generates audit events, or requests secondary approval, thus achieving programmable compliance automation.

[0071] like Figure 3The diagram illustrates the logical relationship between dynamic behavioral profiling and risk perception provided by this invention. After data asset discovery and information extraction, dynamic risk coefficients are obtained through dynamic behavioral profiling and risk perception. Simultaneously, data classification and grading labels are obtained through data tagging and modeling. By combining the dynamic risk coefficients and data classification and grading labels, a protection strategy is intelligently generated and then executed.

[0072] S400, Security Context Awareness. The data security capability unit captures data access requests at protection interception points (such as API gateways and database proxies), parses and extracts real-time context information of the access subject (identity, permissions, device) and access object (database instance, table, field, interface).

[0073] Furthermore, the S400 includes: S400-1 establishes interaction channels between data security capabilities and the target database, independent tag knowledge base, and system / platform. The data security capabilities can access the target database, independent tag knowledge base, and system / platform IP address on the network, and have the permission to query data tables in the target database and independent tag knowledge base.

[0074] S400-2, when data security capabilities acquire target data information and perform target data protection, data security capabilities acquire access subject information and access object information. Here, data security capabilities may include data protection measures such as access control, data anonymization, data leakage prevention, data identification, and data encryption. Access subject information may include access address information, account information, permission information, device information, access method, etc. Access object information may include database IP, database name, data table name, data field name, system / platform name, interaction interface name, interaction interface IP, etc.

[0075] S400-3 provides data security capabilities based on the information of the object accessed by the accessing subject. It queries the information of the data carrier of the access target, analyzes and extracts the corresponding basic information of the accessed object, and can locate and obtain the tag information of the corresponding data through the accessed object information, including database IP, database name, data table name, data field name or system / platform name, interaction interface name, and interaction interface IP.

[0076] S500, Tag Association Matching. Based on the identification information of the accessed object (such as database name, table name, interface address), the security capability unit queries the tag knowledge base to accurately match and obtain the corresponding data classification and hierarchical tags and other metadata, completing the conversion from data entity to security policy semantics.

[0077] Furthermore, S500 includes: data security capabilities to obtain target data tag information. The data security capabilities obtain the basic information of the access object through step S400-3, further access the independent tag knowledge base, and query and extract all tag information of the target data through comparison and matching of the basic information of the target data, thereby obtaining the target data classification and grading information, and providing input information for the classification and grading management of the target data.

[0078] S600 intelligently generates and executes policies. Based on the acquired access context, data tag information, and dynamic risk coefficients, the policy engine synthesizes precise and contextualized data security policies (such as mandatory de-identification for high-risk access and enhanced watermarking for core data), and distributes them to the corresponding security capability execution units (such as encryption components, de-identification engines, and DLP modules) for real-time processing.

[0079] Furthermore, the S600 includes: S600-1: Data security capability generation security protection strategy. Based on the information obtained in step S205, and targeting specific category levels, databases, or interactive interfaces, a precise data security protection strategy can be dynamically generated. The data security capability protection strategy may include de-identification strategies, encryption strategies, watermarking strategies, and access control strategies for specific levels and categories of data, as well as de-identification strategies, encryption strategies, watermarking strategies, and access control strategies for specific access subjects.

[0080] S600-2: Data security capabilities issue security protection policies. After generating security protection policies, the data security capabilities issue the relevant policies to the corresponding data security capability execution units to implement the corresponding protection measures. The data security capability unit is the final module that executes security capabilities under policy-driven execution, and may include various execution capabilities such as data encryption, data desensitization, data watermarking, and risk monitoring. Here, the data security capability execution unit can respond to adjustments in the data security protection policies in real time and dynamically update the security protection policies during operation.

[0081] This invention employs a dynamic security protection method that matches target data information. It can flexibly adjust security protection strategies based on a combination of factors such as the access subject, access object, and protection requirements, accurately ensuring data security while maximizing data availability. This invention features dynamic adjustment based on specific factors such as target data, access subject, and protection requirements in different access scenarios, avoiding the risks of rigid or static security protection strategies that are difficult to adapt to different scenarios or even the effectiveness of protection measures. It exhibits good business adaptability.

[0082] like Figure 4The diagram shows the architecture of the data security management method based on data tags provided by this invention. Target data is stored in a database, a data tag library (i.e., an independent tag knowledge base) is used to store tags, and data security capabilities are used to capture basic information about access requests and tag mapping. Specific interactions include: S100: Obtaining basic data information; S200: Generating tags; S300: Storing tags; S400: Obtaining basic target data information; S500: Tag mapping; S600: Generating strategies.

[0083] Key protection points of this invention: 1. Decoupled tag mapping and storage architecture This method physically separates data tags (containing classification, grading, business context, and other information) from target data and associates them through a two-way mapping relationship, rather than embedding tags into the original database. The core value of this method and its system implementation (including a dedicated tag knowledge base and mapping relationship management module) lies in avoiding direct modifications to existing business system databases, thus overcoming the fundamental obstacle of implementing technical solutions in the complex IT environments of large enterprises.

[0084] 2. Blockchain-based trusted tag storage and audit traceability mechanism By writing the hashes, timestamps, and operator information of key lifecycle operations (creation, modification, etc.) of data tags into the blockchain, and leveraging its immutability to achieve trusted auditing, and using smart contracts to automate compliance checks, the core value of this "data tag + blockchain" combination method and its system modules lies in providing a legally valid and trusted chain of evidence for data security governance, enhancing the system's resistance to tampering and compliance. This represents a significant upgrade to traditional centralized auditing methods.

[0085] 3. A dual-drive intelligent strategy generation mechanism combining static and dynamic approaches The policy generation engine relies on both static data tags (data attributes) and dynamic behavioral risk perception (usage risk) as dual inputs. It analyzes user behavior profiles through machine learning, outputs dynamic risk coefficients, and then fuses these coefficients with tag information to generate contextualized security policies. The core value of this dual-driven policy generation method ("static tags + dynamic behavior") and its system implementation lies in upgrading security policies from static and fixed to dynamic and adaptive, effectively identifying and responding to internal threats and abnormal access behaviors, thus achieving intelligent security control.

[0086] Example 2: Based on the same inventive concept, this invention also provides a data security management and control system based on data tags, the structure of which is as follows: Figure 5 As shown, the system includes: The access request capture module 501 is used to capture access requests to target data and parse access subject information and access object identifier used to locate target data from the access request. The structured data tag acquisition module 502 is used to query the mapping relationship stored in the pre-built independent tag knowledge base according to the access object identifier, and obtain the structured data tag corresponding to the target data; the structured data tag contains at least the classification identifier and the hierarchical identifier of the target data; The protection strategy generation module 503 is used to generate data security protection strategies based on structured data tags and access subject information; The protection operation execution module 504 is used to perform corresponding security protection operations on access requests in accordance with the data security protection policy, so as to control access to target data.

[0087] Preferably, the system also includes an independent tag knowledge base construction module, used for: Acquire basic information about multiple data objects that will become target data. The basic information includes data attribute information used to characterize the data itself and data carrier information used to locate the data storage entity. Based on the preset data classification and grading strategy, corresponding structured data tags are generated based on basic information; the structured data tags include at least a data classification identifier and a data grading identifier; Structured data tags are stored independently, and a mapping relationship between structured data tags and corresponding data objects is established to build an independent tag knowledge base.

[0088] Preferably, the independent tag knowledge base construction module is specifically used for: The data attribute information and data carrier information are combined according to a predefined tag architecture, and the data classification identifier and data classification identifier determined according to the classification and grading strategy are embedded to generate the corresponding structured data tags.

[0089] Preferably, the independent tag knowledge base construction module is specifically used for: Structured data tags are stored in a dedicated database that is independent of the original storage location of the data objects; In a dedicated database, a unique identifier for each data object is associated with and bound to the corresponding structured data tag to establish a mapping relationship; Based on structured data tags and mapping relationships, construct an independent tag knowledge base.

[0090] Preferably, the protection strategy generation module is specifically used for: By comparing and analyzing the access subject information with the pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained. By integrating dynamic risk coefficients with classification and grading identifiers in structured data labels, contextualized data security protection strategies are generated.

[0091] Preferably, the protection strategy generation module is specifically used for: Based on the historical behavior data corresponding to the access subject information, an unsupervised learning algorithm is used to train and generate a baseline model of the subject's normal behavior. Real-time behavioral features are extracted from the information of the accessing subjects, and the real-time behavioral features are compared with the baseline model of the subjects' normal behavior to calculate the degree of behavioral deviation. By inputting the behavioral deviation degree together with the classification and grading labels in the structured data into a pre-set risk assessment model, a dynamic risk coefficient representing the risk level of the access request is obtained.

[0092] Preferably, the safety protection operation includes at least one of the following: Desensitization strategies for specific levels or categories of data or specific access subjects; Encryption strategies for specific levels or categories of data or specific access subjects; Watermarking strategies targeting specific levels or categories of data or specific access subjects; Access control policies for specific levels or categories of data or specific access subjects.

[0093] Preferably, the system also includes a tag library update module for: Listen for data change events in the database where the data object resides; Based on data change events, the corresponding structured data tags in the independent tag database are updated in real time to maintain the consistency of the mapping relationship.

[0094] Preferably, the system also includes a blockchain evidence storage module for: When critical operations such as tag creation, modification, or mapping relationship adjustment occur in structured data tags, the record information of the critical operations is synchronized to the blockchain network for evidence storage.

[0095] Preferably, the blockchain evidence storage module is specifically used for: Smart contracts are deployed on a blockchain network, and these smart contracts contain pre-defined compliance rules. When critical operations trigger compliance rules, smart contracts automatically issue alerts, generate audit events, or initiate approval processes.

[0096] The following detailed description, using a specific embodiment, illustrates a data security management system based on data tags provided by this invention. Figure 6 The diagram shown is a structural diagram of a data security management and control system based on data tags, according to a specific embodiment.

[0097] In this specific embodiment, the system is applied to an independent tag knowledge base and includes: a data information reading module 601, a data tag generation module 602, a data tag synchronization module 603, a blockchain notarization and auditing module 604, a data tag matching module 605, and a data security capability protocol adaptation module 606. Specifically, the data information reading module 601 is used to obtain basic information of the target data. Data information reading is achieved by analyzing the received and analyzed target data traffic, actively probing the target database or interaction interface information, or manually entering information such as database, system interaction interface, and data classification and grading. The module extracts and records information such as the database IP, database name, data table name, data field name, or system / platform name, interaction interface name, and interaction interface IP of the target data. Data tag generation module 602: Used to generate corresponding tag data tables from the data information obtained by the data information reading module. The data tag generation module generates corresponding data tables for business department, database IP, database name, data table name, data field name, data level, and data category. It also generates corresponding data tables for business department, system / platform name, interaction interface name, interaction interface IP, data field name, data level, and data category, which are read by data security capabilities for security control. The data tag generation module 602 includes a data tag analysis unit and a data tag storage unit. Data Tag Analysis Unit: Used to analyze the target data information obtained by the data information reading module. Through specific data formats, it enables customization of data formats such as business department, database IP, database name, data table name, system / platform name, interaction interface name, interaction interface IP, data field name, data level, and data category. Data tag storage unit: Used to store data tags in a specific format. The tag storage should create an index through KEY (key value) to realize mapping and association with the target data, such as data fields, so as to realize accurate mapping between target data and classification and grading, and support the formulation of accurate protection strategies based on classification and grading.

[0098] Data tag synchronization module 603: This module is used to interact with the target database and business system in real time. By interacting with the database and business system in real time, it obtains database logs and system interaction interface description information, and synchronizes the changed data information in a timely manner, updates the data tag information, and ensures the consistency between the data tags and the target data. Blockchain Evidence Storage and Auditing Module 604: This module enables trusted evidence storage and transparent auditing of data tag operations. It receives key operational information from the data tag synchronization module, writes its hash value and related metadata to the blockchain, and provides a blockchain-based audit query interface. This supports full lifecycle operation traceability and smart contract-driven automated compliance checks.

[0099] Data tag matching module 605: used for querying data security capabilities and data tags. When performing data protection, the data security capability obtains the basic information of the target data and matches the tag information through algorithms such as sequential search and binary tree search. It obtains the corresponding data category, level and other information from the independent tag knowledge base and generates a security protection strategy that is consistent with the protection requirements of the target data. Data security capability protocol adaptation module 606: It is mainly used for protocol adaptation between independent tag knowledge base and different data security capabilities. It is the basic module for supporting data security control of independent tag knowledge base. Data security capabilities include data encryption, data desensitization, data watermarking, risk monitoring and other categories. Through protocol adaptation, data security capabilities can communicate well with independent tag knowledge base.

[0100] This invention also provides a data security management and control system based on data tags, applied to data security capabilities. For example... Figure 7 The diagram shown is a structural diagram of a data security management system based on data tags, provided in another specific embodiment.

[0101] Data security protection strategy generation module 701: This module is mainly used to generate precise protection strategies for data security capabilities. It is one of the basic modules for data security control. After obtaining the basic information and classification and grading information of the target data from the independent tag knowledge base, it generates the corresponding security protection strategy and drives the data security capabilities to execute the corresponding protection measures.

[0102] Data security protection strategy distribution module 702: This module is mainly used to distribute precise protection strategies to the corresponding data security capabilities. It is one of the basic modules of data security control. It mainly takes the protection strategy generated by the data security protection strategy generation module, automatically adapts it to different data security capabilities, and then distributes it to ensure the execution of the strategy.

[0103] Example 3: Based on the same inventive concept, such as Figure 8As shown, the present invention also provides an electronic device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0104] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in a readable storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a data security management method based on data tags in the above embodiments.

[0105] Example 4: Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). This readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the readable storage medium here can include both the built-in storage medium within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the storage medium to implement the steps of the data security management method based on data tags in the above embodiments.

[0106] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A data security management method based on data tags, characterized in that, include: Capture access requests to target data, and parse access subject information and access object identifiers used to locate target data from the access requests; Based on the access object identifier, query the mapping relationship stored in the pre-built independent tag knowledge base to obtain the structured data tag corresponding to the target data; the structured data tag includes at least the classification identifier and the hierarchical identifier of the target data; Based on the structured data tags and the access subject information, a data security protection strategy is generated; Based on the data security protection strategy, corresponding security protection operations are performed on the access request to control access to the target data.

2. The method according to claim 1, characterized in that, The construction process of the independent tag knowledge base includes: Acquire basic information of multiple data objects that will become the target data, including data attribute information for characterizing the data itself and data carrier information for locating the data storage entity; Based on the preset data classification and grading strategy, corresponding structured data tags are generated based on the basic information; the structured data tags include at least a data classification identifier and a data grading identifier. The structured data tags are stored independently, and a mapping relationship between the structured data tags and the corresponding data objects is established to construct an independent tag knowledge base.

3. The method according to claim 2, characterized in that, The step of generating corresponding structured data tags based on the basic information according to a preset data classification and grading strategy includes: The data attribute information and the data carrier information are combined according to a predefined tag architecture, and the data classification identifier and data classification identifier determined according to the classification and grading strategy are embedded to generate corresponding structured data tags.

4. The method according to claim 2, characterized in that, The step of independently storing the structured data tags and establishing a mapping relationship between the structured data tags and corresponding data objects includes: The structured data tags are stored in a dedicated database that is independent of the original storage location of the data objects; In the dedicated database, a unique identifier for each data object is associated with and bound to the corresponding structured data tag to establish a mapping relationship; Based on the structured data tags and the mapping relationships, an independent tag knowledge base is constructed.

5. The method according to claim 1, characterized in that, The process of generating a data security protection strategy based on the structured data tags and the access subject information includes: The access subject information is compared and analyzed with a pre-set risk assessment model to obtain a dynamic risk coefficient that characterizes the risk level of the access request. By integrating the dynamic risk coefficient with the classification and grading identifiers in the structured data tags, a contextualized data security protection strategy is generated.

6. The method according to claim 5, characterized in that, The step of comparing and analyzing the access subject information with a pre-set risk assessment model to obtain a dynamic risk coefficient characterizing the risk level of the access request includes: Based on the historical behavior data corresponding to the access subject information, an unsupervised learning algorithm is used to train and generate a baseline model of the subject's normal behavior. Real-time behavioral features are extracted from the access subject information, and the real-time behavioral features are compared with the subject's normal behavioral baseline model to calculate the behavioral deviation. The behavioral deviation degree, along with the classification and grading identifiers in the structured data labels, are input into a pre-set risk assessment model to obtain a dynamic risk coefficient characterizing the risk level of the access request.

7. The method according to claim 1, characterized in that, The security protection operation includes at least one of the following: Desensitization strategies for specific levels or categories of data or specific access subjects; Encryption strategies for specific levels or categories of data or specific access subjects; Watermarking strategies targeting specific levels or categories of data or specific access subjects; Access control policies for specific levels or categories of data or specific access subjects.

8. The method according to claim 2, characterized in that, After constructing the independent tag knowledge base, the method further includes: Listen for data change events in the database where the data object resides; Based on the data change events, the corresponding structured data tags in the independent tag database are updated in real time to maintain the consistency of the mapping relationship.

9. The method according to claim 2 or 8, characterized in that, After constructing the independent tag knowledge base, the method further includes: When the structured data tags undergo critical operations such as tag creation, modification, or mapping relationship adjustment, the record information of the critical operations is synchronized to the blockchain network for evidence storage.

10. The method according to claim 9, characterized in that, Smart contracts are deployed on the blockchain network, and the smart contracts are encoded with pre-defined compliance rules; When the critical operation triggers the compliance rules, the smart contract automatically issues an alarm, generates an audit event, or initiates an approval process.

11. A data security management and control system based on data tags, characterized in that, The system includes: The access request capture module is used to capture access requests to target data and parse access subject information and access object identifier used to locate the target data from the access requests. The structured data tag acquisition module is used to query the mapping relationship stored in a pre-built independent tag knowledge base based on the access object identifier, and obtain the structured data tag corresponding to the target data; the structured data tag includes at least the classification identifier and the hierarchical identifier of the target data; The protection strategy generation module is used to generate a data security protection strategy based on the structured data tags and the access subject information; The protection operation execution module is used to perform corresponding security protection operations on the access request according to the data security protection strategy, so as to control access to the target data.

12. An electronic device, characterized in that, include: At least one processor and memory; The memory and processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the data security management method based on data tags as described in any one of claims 1 to 10 is implemented.

13. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the data security management method based on data tags as described in any one of claims 1 to 10.

Images