Data isolation and privacy protection method and system based on data security large model

Abstract

The invention discloses a data isolation and privacy protection method and system based on a data security large model, and relates to the technical field of data isolation and privacy protection. The method comprises the following steps of S1, collecting to-be-processed data, and performing cleaning, duplicate removal and format standardization processing on the data to obtain standardized data; by introducing the pre-trained data security large model, intelligent division and dynamic adjustment of data security levels are realized, the limitation of a traditional fixed isolation mode is changed, physical isolation, logic isolation or port isolation strategies can be matched for data of different security levels according to characteristics such as data sensitivity, use scenes and circulation ranges, and the security level of the data is improved. The method greatly improves the flexibility and accuracy of data isolation, combines a privacy risk assessment result output by a large model, specifically adopts a homomorphic encryption, differential privacy or data desensitization technology, and maximally retains the availability of data in different scenes.

Description

Technical Field

[0001] This invention belongs to the field of data isolation and privacy protection technology, and in particular relates to a data isolation and privacy protection method and system based on a large data security model. Background Technology

[0002] With the deepening development of the digital economy, data has become a core production factor, widely used in key areas such as finance, healthcare, and government affairs. In the process of data value mining, the frequency of data flow, sharing, and cross-scenario use has significantly increased. This has also created a rigid demand for data security isolation and privacy protection. It is crucial to ensure that data is not accessed or tampered with without authorization during multi-entity, multi-stage interactions, while also preventing the leakage of sensitive information such as user ID numbers, transaction records, and medical records. Balancing data availability and security has become a core challenge in the digital transformation of various industries.

[0003] Existing technical solutions suffer from a series of logically related technical defects due to their static and fragmented design: First, data isolation strategies lack dynamic adaptability. Security level classification relies on manually preset rules and fails to incorporate intelligent models to comprehensively assess dynamic characteristics such as data usage scenarios and circulation scope. Relying solely on fixed thresholds for level classification leads to excessive isolation of high-level data, wasting resources, and insufficient isolation of low-level data, making it vulnerable to attacks. Furthermore, the accuracy of isolation is lacking. Second, privacy protection technologies are disconnected from the state of data security. There is a lack of a quantitative assessment mechanism for the probability and value of privacy leaks. Applying uniform protection technologies to data of different security levels results in insufficient protection for high-risk data, making it susceptible to attacks. Third, the isolation and privacy protection modules are separate, with no data interaction or linkage adjustment. There is no real-time monitoring and dynamic feedback mechanism, making it impossible to track access logs after data isolation and usage status after privacy protection. It is difficult to adjust strategies in a timely manner when the data security status changes, resulting in security vulnerabilities throughout the entire lifecycle. Fourth, the model training is out of touch with actual security needs. Even when a simple machine learning model is introduced, the training samples only contain single security event data, without integrating data feature data, and there is no loss function to iteratively optimize parameters. The model has difficulty accurately extracting security features and cannot provide reliable decision support for isolation and privacy protection.

[0004] To address these issues, we provide a data isolation and privacy protection method and system based on a large data security model. Summary of the Invention

[0005] The purpose of this invention is to provide a data isolation and privacy protection method and system based on a large data security model, which solves the problems of insufficient accuracy in existing technologies, such as lack of dynamic adaptation in data isolation, disconnect between privacy protection and security status, lack of collaboration among separate modules, and lack of full lifecycle security control for model training that is out of touch with requirements.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution.

[0007] This invention relates to a data isolation and privacy protection method based on a large-scale data security model, comprising the following steps:

[0008] S1: Collect the data to be processed, perform cleaning, deduplication, and format standardization on the data to obtain standardized data;

[0009] S2: Standardized data is input into a pre-trained data security model. The data security model extracts security features from the data, including data sensitivity. Data usage scenario weight Data flow scope weight The data security level score L is calculated using formula (1), and the data is divided into three security levels: high, medium, and low based on the score L.

[0010] Formula (1): ;

[0011] S3: Configure the corresponding isolation policy based on the security level determined in step S2;

[0012] S4: The data security big model outputs the data privacy risk assessment results, calculates the privacy risk value R through formula (2), and processes the data using the corresponding privacy protection technology in combination with the data security level;

[0013] Formula (2): ;

[0014] S5: Real-time monitoring of the flow, access, and usage of isolated data.

[0015] The present invention is further configured such that, in step S1, data cleaning includes removing invalid data, correcting erroneous data, and standardizing the format to unify the data format according to preset XML and JSON data format specifications.

[0016] The present invention is further configured such that, in step S2, the training process of the large data security model includes collecting massive data security samples, including historical security event data and data feature data, using deep learning algorithms to train the samples, calculating the model loss value Loss through formula (3), and iteratively optimizing the model parameters until Loss converges;

[0017] Formula (3): ;

[0018] in, For the first The true label of each sample For the model to the first Predicted label for each sample, The sample number. .

[0019] The present invention is further configured such that, in step S3, the isolation strategy configuration rule is:

[0020] High-security data: Physical isolation is used to store data on a separate physical server, and the server is prohibited from connecting to the external network;

[0021] Medium-security level data: Logical isolation is used, and data access is restricted through virtual private networks and access control lists;

[0022] Low-security data: Port isolation is used to restrict data transmission only through preset TCP / UDP ports.

[0023] The present invention is further configured such that, in step S4, the privacy protection technology configuration rule is: when the data is of a high security level and the privacy risk value is... At that time, homomorphic encryption technology is used, and the data is encrypted using formula (4). Perform encryption to obtain ciphertext ;

[0024] Formula (4): ;

[0025] in, For the preset generator, It is a random number. It is a large prime number;

[0026] When the data is at a medium security level and At that time, differential privacy technology is used to add Laplace noise to the dataset using formula (5);

[0027] Formula (5): ;

[0028] in, This is the original data. For the data after adding noise, For function sensitivity, Budget for privacy;

[0029] When the data is of low security level and At that time, data anonymization technology was used to remove sensitive fields such as ID card number and mobile phone number from the data.

[0030] The present invention is further configured such that, in step S5, when a security risk is detected, the security level, isolation strategy, and privacy protection technology of the data are automatically adjusted. The security risk detection analyzes the data access logs in real time through a large data security model. When risk events such as unauthorized access or abnormal data flow are detected, the security level adjustment is triggered, and the data security level score is recalculated. Update isolation strategies and privacy protection technologies.

[0031] The present invention is further configured such that the deep learning algorithm adopts a hybrid model of Transformer and CNN-LSTM, the parameters are optimized by batch gradient descent during model training, the learning rate is set to 0.001-0.01, and the number of iterations is set to 100-200 rounds.

[0032] The present invention is further configured such that the homomorphic encryption technology employs partially homomorphic encryption or fully homomorphic encryption algorithms, and the privacy budget in differential privacy technology... The value range is 0.1-1.0, and the scale parameter of Laplace noise is... .

[0033] The present invention is further configured such that, in step S5, the indicators monitored in real time include data access IP address, access time, data transmission volume, and data operation type. When the indicators exceed a preset threshold, they are determined to be a security risk event.

[0034] A data isolation and privacy protection system based on a large data security model includes a data preprocessing module, a large data security model module, a dynamic isolation module, a privacy protection module, and a monitoring and adjustment module.

[0035] The data preprocessing module is used to collect data to be processed, perform cleaning, deduplication and format standardization operations, and output standardized data.

[0036] The data security big model module is pre-trained using massive data security samples. The data security big model module has built-in calculation logic corresponding to formulas (1), (2), and (3) to extract the security features of standardized data and calculate the data security level score. and privacy risk value It classifies security levels and assesses privacy risks, while monitoring data security status in real time;

[0037] The dynamic isolation module is communicatively connected to the data security big model module, receives the security level results output by the module, and performs physical isolation, logical isolation or port isolation operations according to the isolation policy configuration rules.

[0038] The privacy protection module is communicatively connected to the data security big data model module, and receives the security level and privacy risk value output by the receiving module. According to the privacy protection technology configuration rules, homomorphic encryption, differential privacy or data desensitization processing are performed, and the encryption and noise addition logic corresponding to the built-in formulas (4) and (5) is implemented.

[0039] The monitoring and adjustment module is communicatively connected to the data security big model module, the dynamic isolation module, and the privacy protection module, respectively. It receives monitoring data output by the data security big model module. When a security risk is detected, it triggers the dynamic isolation module to adjust its isolation strategy and the privacy protection module to adjust its privacy protection technology. At the same time, it notifies the data security big model module to recalculate the data security level score. and privacy risk value .

[0040] The present invention has the following beneficial effects.

[0041] This invention introduces a pre-trained large-scale data security model to achieve intelligent classification and dynamic adjustment of data security levels. It overcomes the limitations of traditional fixed isolation methods and can match physical isolation, logical isolation, or port isolation strategies for data of different security levels based on characteristics such as data sensitivity, usage scenarios, and circulation scope. This significantly improves the flexibility and accuracy of data isolation. Combined with the privacy risk assessment results output by the large-scale model, it employs homomorphic encryption, differential privacy, or data anonymization technologies in a targeted manner. While building a solid data privacy protection barrier, it maximizes the usability of data in different scenarios and avoids the problems of over-protection and under-protection leading to leakage caused by a single protection technology. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0043] Figure 1 This is the main flowchart of a data isolation and privacy protection method and system based on a large data security model.

[0044] Figure 2 This is a flowchart of a data isolation and privacy protection method based on a large data security model and a data preprocessing process in the system.

[0045] Figure 3 This is a flowchart illustrating a data isolation and privacy protection method based on a large data security model, as well as the configuration of security level assessment and isolation strategies within the system.

[0046] Figure 4 This is a flowchart of a data isolation and privacy protection method based on a large data security model, as well as a privacy risk assessment and protection technology in the system.

[0047] Figure 5This is a flowchart illustrating a data isolation and privacy protection method based on a large data security model, as well as real-time monitoring and dynamic adjustment within the system. Detailed Implementation

[0048] The technical solutions of the present invention will be described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, and not all embodiments.

[0049] Example 1

[0050] Please see Figure 1-5 This invention relates to a data isolation and privacy protection method and system based on a large-scale data security model, comprising the following steps:

[0051] S1: Collect the data to be processed, perform cleaning, deduplication, and format standardization on the data to obtain standardized data;

[0052] S2: Standardized data is input into a pre-trained data security model. The data security model extracts security features from the data, including data sensitivity. Data usage scenario weight Data flow scope weight The data security level score L is calculated using formula (1), and the data is divided into three security levels: high, medium, and low based on the score L.

[0053] Formula (1): ;

[0054] in, These are the coefficients for data sensitivity, usage scenario weight, and circulation scope weight, respectively. , , , ,when At that time, the data is at a high security level. At that time, the data was at a medium security level. At that time, the data was at a low security level;

[0055] S3: Configure the corresponding isolation policy based on the security level determined in step S2;

[0056] S4: The data security big model outputs the data privacy risk assessment results, calculates the privacy risk value R through formula (2), and processes the data using the corresponding privacy protection technology in combination with the data security level;

[0057] Formula (2): ;

[0058] in, For the first The probability of privacy breach threats occurring. For the first The value of losses caused by privacy breach threats, Threat category number, ;

[0059] S5: Real-time monitoring of the flow, access, and usage of isolated data.

[0060] Example 2

[0061] Core data processing for identity-related data:

[0062] Data preprocessing: The data preprocessing module collects core identity data, including personal ID numbers, facial feature association IDs, and fingerprint matching codes. During data processing, invalid data is first cleaned, with a focus on removing incorrectly formatted identity codes, such as ID numbers with fewer than 18 digits. Duplicate biometric association records are also deleted to prevent the same user's facial feature ID from being stored multiple times. Subsequently, the data storage format is standardized, converting all biometric association information into encrypted binary format for storage. Finally, standardized data with a well-defined structure and no redundancy is output.

[0063] Security Level and Risk Assessment: The data security big data model extracts features from standardized data, focusing on three core features. The first is data sensitivity. The sensitivity for uniqueness of identity identifiers is 0.95, and the sensitivity for the irreplaceability of biometric features is 0.98. The second category is the weight of usage scenarios. The weight for identity verification scenarios is set to 0.3, and the third category is the weight for the scope of circulation. For cross-system transmission scenarios, a weight of 0.3 is set, and the security level scoring formula is used. Perform the calculation, in the formula The value is 0.6. The value is 0.2. The value is 0.2, and The sum of is 1. Substituting the specific values ​​into the formula yields... Given the highly sensitive nature of identity data, practical applications will ensure that highly sensitive data is scored to a certain level. Ultimately, this type of data was determined to be of a high security level, and was also assessed using the privacy risk value formula. Assessing privacy risks, in the formula This represents the probability of identity theft, with a value of 0.9. The loss caused by identity theft is set to 1.1. Substituting this value into the calculation yields... The privacy risk of this type of data is determined to be extremely high.

[0064] Isolation and Protection: The dynamic isolation module employs a physical isolation strategy for high-security identity-related core data. Specifically, it stores the data on a separate, encrypted physical server. This server only retains an internal administrator's access port, completely disconnecting it from all external network connections to prevent unauthorized access. The privacy protection module uses high-strength homomorphic encryption technology, employing encryption formulas... The data is encrypted; in the formula... The value is 2. The value is 3. The value is 1000003. The value is a randomly generated integer. In subsequent identity verification processes, only the encrypted feature value is used for matching, and the original data is not decrypted to ensure that the original identity information is not leaked.

[0065] Monitoring Adjustment: The monitoring module tracks server access records in real time, allowing only pre-authorized designated management terminals to access the server through a dedicated interface. It also restricts data operation types, allowing only feature matching and prohibiting any form of data export or modification. When an unauthorized terminal attempts to establish a connection with the server, the system immediately disconnects the connection, freezes the terminal's temporary access permissions, and triggers an administrator alert via both SMS and email, prompting the administrator to promptly investigate the anomaly.

[0066] Example 3

[0067] Handling of sensitive transaction data:

[0068] Data Preprocessing: Sensitive transaction data is collected through the data preprocessing module, specifically covering user single transaction amount, payment account binding identifier, and counterparty association information. In the data cleaning stage, invalid transaction records are removed, including virtual transaction records used for system testing and transaction records of payment process failures, to ensure the authenticity of the data. Subsequently, transaction fields are standardized, with the transaction time format standardized as YYYY-MM-DDHH:MM:SS, the transaction amount unit standardized as yuan and retained to two decimal places, and the encoding rules of payment account identifiers standardized, finally outputting standardized data that conforms to business specifications.

[0069] Security Level and Risk Assessment: The data security big data model extracts the core characteristics of transaction data, the first of which is data sensitivity. Among them, the sensitivity for large transactions is 0.9, the sensitivity for payment account binding identifiers is 0.85, and the second category is usage scenario weight. For real-time payment scenarios, a weight of 0.35 is set; the third category is the weight for the scope of circulation. For cross-platform transaction scenarios, a weight of 0.35 is set, and the security level scoring formula is used. Calculation, in the formula The value is 0.6. The value is 0.2. The value is 0.2. Substituting the value, we get... Ultimately, this type of data was determined to be of medium to high security level, based on the privacy risk value formula. Assessing privacy risks, in the formula This represents the probability of funds being leaked, with a value of 0.8. The value representing the loss caused by the leakage of funds is taken as 1.05, and the calculation yields... The privacy risk of this type of data is considered to be high.

[0070] Isolation and Protection: The dynamic isolation module employs a logical isolation strategy for transaction data with medium to high security levels. Specifically, it establishes a dedicated virtual private network (VPN) as the transmission channel for transaction data and configures an access control list to allow only authorized IP addresses from the transaction processing and risk control systems to access this channel, prohibiting access from other IP addresses. The privacy protection module uses differential privacy technology, employing a noise addition formula... The formula processes the transaction amount. This represents the fluctuation range of the transaction amount, with a value of 500. The privacy budget is 0.5. After adding noise, it ensures that the authenticity of the transaction amount is not affected and can be used normally for transaction verification. At the same time, the payment account binding identifier is desensitized by hiding the core digits in the identifier. For example, the middle 8 digits of the 16-digit account identifier are hidden, and only the first and last 4 digits are kept.

[0071] Monitoring Adjustment: The monitoring module tracks the transmission rate of transaction data in real time, pre-sets normal transaction peaks, and immediately triggers an early warning mechanism when the data transmission rate exceeds the normal peak. Simultaneously, it tracks the operation frequency of individual accounts. When high-frequency trading operations are detected within a short period for the same account, a verification process is triggered. When transaction data is detected flowing to an unauthorized system, the system immediately blocks the data transmission link, re-encrypts all transaction data associated with that account using a homomorphic encryption formula, and simultaneously notifies the risk control department of the anomaly. The risk control department then verifies the authenticity of the transactions and determines whether there are risks such as fraud or theft.

[0072] Example 4

[0073] Behavioral data processing:

[0074] Data preprocessing: The data preprocessing module collects behavioral-related data, including user operation time trajectories, system function access records, and user preference category tags. During data cleaning, redundant records are removed, such as repeated access logs of the same page by the user, as well as invalid preference tags automatically generated by the system, to ensure data validity. Subsequently, the behavioral fields are standardized, with the timestamp format of the operation time trajectory being unified as YYYY-MM-DDHH:MM:SS.fff, the module coding rules in the system function access records being unified, and the naming conventions of the user preference category tags being unified, ultimately outputting standardized data with a unified structure.

[0075] Security Level and Risk Assessment: The big data security model extracts the core features of behavioral data, the first of which is data sensitivity. Among them, behavioral data strongly associated with personal identity has a sensitivity of 0.8, preference tags involving personal privacy have a sensitivity of 0.75, and the second category is usage scenario weight. For identity tracing scenarios, a weight of 0.3 is set; the third category is the weight for the scope of circulation. For third-party sharing scenarios, a weight of 0.3 is set, and the security level scoring formula is used. Calculation, in the formula The value is 0.5. The value is 0.25. The value is 0.25. Substituting the value, we get... Ultimately, this type of data was determined to be of medium security level, based on the privacy risk value formula. Assessing privacy risks, in the formula This represents the probability of privacy exposure, with a value of 0.7. The value representing the loss caused by privacy exposure is 1.0, and the calculation yields... The privacy risk level of this type of data is determined to be moderate.

[0076] Isolation and Protection: The dynamic isolation module employs a strategy combining logical isolation and port isolation for medium-security-level behavioral data. First, the behavioral data is stored in a dedicated database, which is configured with a designated access port, allowing only internal analysis systems to access the data through this port. Simultaneously, a Virtual Private Network (VPN) is established, authorizing only internal analysis terminals to access the VPN. This VPN restricts the range of terminals accessing the database, preventing external terminal access. When processing the behavioral data, the privacy protection module first removes personally identifiable fields, such as replacing user IDs with randomly generated anonymous identifiers, ensuring that the behavioral data cannot be associated with specific individuals. When statistical analysis of preferences among a small group of users is required, differential privacy formulas are used as a supplement. Add noise, in the formula This represents the range of fluctuation in the number of preference labels, with a value of 10. The privacy budget is set to 0.7, which is used to add noise to prevent the statistical results from being traced back to personal information.

[0077] Monitoring Adjustment: The monitoring module tracks the terminal types that access behavior data in real time, allowing only internal analysis terminals to access the data and prohibiting external terminals and personal terminals from accessing it. At the same time, it restricts the scope of data queries, prohibiting the query of a large number of users' complete behavior trajectories at once. For example, it prohibits querying the operation trajectory of more than 100 users within 30 days at one time. When an unauthorized terminal is detected attempting to export behavior data in batches, the system will immediately close the designated access port of the database, re-de-identify the generated query results, replace the anonymous identifiers and delete sensitive related information, and record the violation access log, including the IP address of the violation terminal, access time, operation content, etc., to facilitate subsequent source tracing and verification.

[0078] Example 5

[0079] Content-related privacy data processing:

[0080] Data Preprocessing: Content-based privacy data is collected through the data preprocessing module, including personal article drafts, one-on-one private communication records, and scanned copies of private documents. During the data cleaning stage, invalid content, such as blank article drafts and fake communication records used for testing, is removed to ensure the usability of the data. Subsequently, the content storage format is standardized: personal article drafts are standardized to DOCX, private communication records are standardized to TXT with UTF-8 encoding, and scanned copies of private documents are standardized to PDF and compressed. At the same time, a unique document code is added to all content data, and the final output is standardized data with a uniform format and identifiable characteristics.

[0081] Security Level and Risk Assessment: The data security big data model extracts the core characteristics of content-based data, the first of which is data sensitivity. The sensitivity of one-on-one private communication records is 0.85, and the sensitivity of scanned private documents is 0.8. The second category is the usage scenario weight. For content sharing scenarios, a weight of 0.3 is set; the third category is the weight for the scope of circulation. For cloud storage scenarios, a weight of 0.3 is set, and the security level scoring formula is used. Calculation, in the formula The value is 0.55. The value is 0.225. The value is 0.225. Substituting the value, we get... Ultimately, this type of data was determined to be of medium security level, based on the privacy risk value formula. Assessing privacy risks, in the formula This represents the probability of a privacy violation, with a value of 0.75. The value representing the loss caused by the violation of privacy rights is 1.08, which can be calculated as follows: The privacy risk level of this type of data is determined to be moderate.

[0082] Isolation and Protection: The dynamic isolation module employs a port isolation strategy for content data with medium security levels. A dedicated encrypted port is configured for the transmission and access of content data. This port uses the SSL / TLS encryption protocol, and all data transmitted through this port is encrypted. Port access permissions are also set, allowing only terminals that have passed two-factor authentication to access the port. Two-factor authentication includes account and password verification and dynamic verification code verification. Access to the port is only granted after both authentications are successful. The privacy protection module uses homomorphic encryption technology, employing encryption formulas... File-level encryption is applied to the content data; the formula is as follows: The value is 2. The value is 5. The value is 2000003. For randomly generated integers, separate access permissions can be set for different types of content data. For example, scanned copies of private documents can only be accessed by the document owner, drafts of personal articles can be authorized to specific users, and one-to-one private communication records can only be accessed by the communicating parties.

[0083] Monitoring Adjustment: The monitoring module tracks access permission changes for content data in real time, recording all permission change operations, including the person making the change, the time of the change, and the content of the change. Any unauthorized transfer of permissions is prohibited; for example, transferring access to private documents to other users without authorization is forbidden. The module also tracks the download frequency of individual documents. When a high frequency of downloads of the same document is detected within a short period, an alert mechanism is triggered. When an unauthorized user attempts to view private communication records, the system immediately revokes all access permissions for that user, re-encrypts the private communication record using homomorphic encryption, and sends a privacy alert to the owner of the communication record, informing them of the unauthorized access attempt and reminding them to check their account security.

[0084] Example 6

[0085] Statistical aggregate data processing:

[0086] Data preprocessing: The data preprocessing module collects statistical aggregated data, including characteristic statistical results of a certain group, business trend analysis reports, and classification summary information. During the data cleaning process, abnormal statistical values ​​are removed, including extreme values ​​that exceed reasonable ranges, such as data of people over 150 years old in the age statistics of a certain group, as well as data with calculation errors, such as data where the sum of the total values ​​does not match the sum of the individual values, to ensure the accuracy of the statistical data. Subsequently, the statistical dimensions are standardized, the way the statistical period is expressed is unified, such as unifying the monthly period to the natural month, the hierarchical division of the classification standard is unified, and the numerical units of the summary information are unified, finally outputting standardized data with unified dimensions and accurate data.

[0087] Security Level and Risk Assessment: The data security big data model extracts the core features of statistical data, the first of which is data sensitivity. The sensitivity of low-aggregation statistical data is 0.7, while the sensitivity of data traceable to individuals is 0.75. The second category is usage scenario weight. For external sharing scenarios, a weight of 0.3 is set. The third category is the weight for the scope of circulation. For cross-organizational transmission scenarios, a weight of 0.3 is set, and the security level scoring formula is used. Calculation, in the formula The value is 0.5. The value is 0.25. The value is 0.25. Substituting the value, we get... Ultimately, this type of data was determined to be of medium to low security level, based on the privacy risk value formula. Assessing privacy risks, in the formula This represents the probability of indirectly inferring personal information from statistical data, and its value is 0.6. The value representing the loss caused by indirectly inferring personal information is 1.02, which can be calculated as follows: The privacy risk level of this type of data is determined to be low.

[0088] Isolation and Protection: The dynamic isolation module employs a strategy combining port isolation and access control for statistical data with low to medium security levels. Statistical data is stored in a shared database, with designated access ports configured for this database. Only terminals from authorized departments are allowed to access the data through these ports. Differential access permissions are configured for different departments, restricting access to statistical data only within their respective business areas. For example, the sales department can only access sales trend-related statistics, and the finance department can only access financial summary-related statistics. When processing statistical data, the privacy protection module first further aggregates low-aggregation statistical data, such as aggregating population statistics by street into district-based statistics. When statistical data needs to be shared externally, a differential privacy formula is used. Add noise, in the formula This represents the range of fluctuation for the statistical value, with a value of 20. Representing the privacy budget, with a value of 0.9, noise is added to remove details from statistical data that could be traced back to individuals, ensuring that specific individuals cannot be identified from shared data.

[0089] Monitoring Adjustment: The monitoring module tracks the query scope of statistical data in real time, prohibiting any user from querying overly detailed statistical data, such as the age distribution of a specific building in a community—data that can pinpoint a small group of people. It also records all data sharing operations, requiring complete approval records for external sharing, including the approver, approval time, sharing recipients, and sharing scope. When statistical data is detected being used for unauthorized analysis, such as using financial statistics for market competition analysis, the system immediately restricts data sharing permissions, suspends data access services to relevant parties, and uses differential privacy noise formulas to reprocess the detailed information in the data, further aggregating data dimensions and adding noise. Simultaneously, it verifies the data sharing approval process to confirm whether there are any approval loopholes or violations.

[0090] The preferred embodiments of the present invention disclosed above are only for the purpose of illustrating the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation described herein. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can better understand and utilize the present invention.

Claims

1. A data isolation and privacy protection method based on a large-scale data security model, characterized in that: Includes the following steps: S1: Collect the data to be processed, perform cleaning, deduplication, and format standardization on the data to obtain standardized data; S2: Standardized data is input into a pre-trained data security model. The data security model extracts security features from the data, including data sensitivity. Data usage scenario weight Data flow scope weight The data security level score L is calculated using formula (1), and the data is divided into three security levels: high, medium, and low based on the score L. Formula (1): ; S3: Configure the corresponding isolation policy based on the security level determined in step S2; S4: The data security big model outputs the data privacy risk assessment results, calculates the privacy risk value R through formula (2), and processes the data using the corresponding privacy protection technology in combination with the data security level; Official (2): ; S5: Real-time monitoring of the flow, access, and usage of isolated data.

2. The data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S1, data cleaning includes removing invalid data, correcting erroneous data, and standardizing the data format according to preset XML and JSON data format specifications.

3. The data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S2, the training process of the large data security model includes collecting massive data security samples, including historical security event data and data feature data, using deep learning algorithms to train the samples, calculating the model loss value Loss through formula (3), and iteratively optimizing the model parameters until Loss converges. Official (3): ; in, For the first The true label of each sample For the model to the first Predicted label for each sample, The sample number. .

4. The data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S3, the isolation policy configuration rules are as follows: High-security data: Physical isolation is used to store data on a separate physical server, and the server is prohibited from connecting to the external network; Medium-security level data: Logical isolation is used, and data access is restricted through virtual private networks and access control lists; Low-security data: Port isolation is used to restrict data transmission only through preset TCP / UDP ports.

5. The data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S4, the privacy protection technology configuration rule is as follows: when the data is at a high security level and the privacy risk value is... At that time, homomorphic encryption technology is used, and the data is encrypted using formula (4). Perform encryption to obtain ciphertext ; Official (4): ; in, For the preset generator, It is a random number. It is a large prime number; When the data is at a medium security level and At that time, differential privacy technology is used to add Laplace noise to the dataset using formula (5); Official (5): ; in, This is the original data. For the data after adding noise, For function sensitivity, Budget for privacy; When the data is of low security level and At that time, data anonymization technology was used to remove sensitive fields such as ID card number and mobile phone number from the data.

6. The data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S5, when a security risk is detected, the data security level, isolation strategy, and privacy protection technology are automatically adjusted. The security risk detection uses a large data security model to analyze data access logs in real time. When risk events such as unauthorized access or abnormal data flow are detected, the security level is adjusted, and the data security level score is recalculated. Update isolation strategies and privacy protection technologies.

7. The data isolation and privacy protection method based on a large data security model according to claim 3, characterized in that: The deep learning algorithm adopts a hybrid model of Transformer and CNN-LSTM. During the model training process, the parameters are optimized using the batch gradient descent method, with the learning rate set to 0.001-0.01 and the number of iterations set to 100-200 rounds.

8. A data isolation and privacy protection method based on a large data security model according to claim 5, characterized in that: Homomorphic encryption uses partially homomorphic or fully homomorphic encryption algorithms, while differential privacy technology incorporates a privacy budget. The value range is 0.1-1.0, and the scale parameter of Laplace noise is... .

9. A data isolation and privacy protection method based on a large data security model according to claim 1, characterized in that: In step S5, the real-time monitoring indicators include data access IP address, access time, data transmission volume, and data operation type. When the indicators exceed the preset threshold, they are determined to be a security risk event.

10. A data isolation and privacy protection system based on a large data security model according to any one of claims 1-9, characterized in that: It includes a data preprocessing module, a large data security model module, a dynamic isolation module, a privacy protection module, and a monitoring and adjustment module; The data preprocessing module is used to collect data to be processed, perform cleaning, deduplication and format standardization operations, and output standardized data. The data security big model module is pre-trained using massive data security samples. The data security big model module has built-in calculation logic corresponding to formulas (1), (2), and (3) to extract the security features of standardized data and calculate the data security level score. and privacy risk value It classifies security levels and assesses privacy risks, while monitoring data security status in real time; The dynamic isolation module is communicatively connected to the data security big model module, receives the security level results output by the module, and performs physical isolation, logical isolation or port isolation operations according to the isolation policy configuration rules. The privacy protection module is communicatively connected to the data security big data model module, and receives the security level and privacy risk value output by the receiving module. According to the privacy protection technology configuration rules, homomorphic encryption, differential privacy or data desensitization processing are performed, and the encryption and noise addition logic corresponding to the built-in formulas (4) and (5) is implemented. The monitoring and adjustment module is communicatively connected to the data security big model module, the dynamic isolation module, and the privacy protection module, respectively. It receives monitoring data output by the data security big model module. When a security risk is detected, it triggers the dynamic isolation module to adjust its isolation strategy and the privacy protection module to adjust its privacy protection technology. At the same time, it notifies the data security big model module to recalculate the data security level score. and privacy risk value .

Images