Distributed data security processing method for multi-source heterogeneous data

Abstract

The invention discloses a distributed data security processing method oriented to multi-source heterogeneous data, and relates to the technical field of data security processing, and the method comprises the following steps: S1, collecting multi-source heterogeneous data, analyzing grammar rules and semantic attributes of various types of data, determining format types, core semantic information and sensitivity levels of the data, and forming a data feature file; according to the method, comprehensive analysis of grammar rules and semantic attributes is carried out on multi-source heterogeneous data, an adaptive encryption scheme is automatically matched in combination with data features, efficiency loss or security vulnerability caused by a single encryption mode is avoided, the dynamic permission atlas is constructed based on access subject identity attributes, task scenes and historical behaviors, and the security of the access subject is improved. Real-time binding of the data desensitization level and the access permission is realized, the problems of encryption strategy solidification and mismatching of permission control and data heterogeneous characteristics in a distributed system are solved, and the data processing efficiency and the access flexibility are improved on the premise of guaranteeing the distributed processing security and integrity of the multi-source heterogeneous data.

Description

Technical Field

[0001] This invention relates to the field of data security processing technology, specifically to a distributed data security processing method for multi-source heterogeneous data. Background Technology

[0002] In the current context of accelerated digital transformation, multi-source heterogeneous data has become a core data foundation supporting the development of various industries. Multi-source heterogeneous data refers to datasets originating from different data sources such as terminal devices, servers, cloud platforms, and IoT nodes, exhibiting significant differences in data format, semantic rules, data attributes, and sensitivity. This type of data encompasses comprehensive information dimensions and has high value density, providing crucial data support for multiple fields such as industrial internet collaborative scheduling, financial risk control decision-making, and smart city management. It is an important prerequisite for achieving accurate analysis and intelligent decision-making.

[0003] Distributed data security processing refers to a technical approach that distributes multi-source heterogeneous data across multiple distributed nodes, enabling cross-node collaborative data processing while ensuring data confidentiality, integrity, and availability. This technology effectively addresses the challenges of centralized data processing, such as high storage pressure, high risk of single points of failure, and low processing efficiency. It is well-suited for processing large-scale heterogeneous data, providing technical support for the efficient utilization of multi-source data and playing an irreplaceable role in massive data processing scenarios.

[0004] However, existing distributed data security processing technologies still have certain shortcomings. Most existing encryption strategies are fixed designs, failing to fully consider the differentiated characteristics of multi-source heterogeneous data in terms of format, semantics, and sensitivity. Using a single encryption method for all data results in insufficient encryption strength for some highly sensitive data, leading to security vulnerabilities, while over-encryption of some low-sensitivity data wastes computing resources and reduces processing efficiency. Access control adopts a static allocation model, setting permissions only based on the initial identity of the access subject, without adjusting for dynamic factors such as specific task scenarios and the access subject's historical behavior. This makes access control mismatched with the heterogeneous characteristics of the data and actual access needs, making it difficult to ensure data security while maintaining access flexibility, thus limiting the efficient utilization of multi-source heterogeneous data. Therefore, developing a distributed data security processing method for multi-source heterogeneous data is of great significance. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a distributed data security processing method for multi-source heterogeneous data. It can comprehensively analyze the syntax rules and semantic attributes of multi-source heterogeneous data, and automatically match adaptive encryption schemes based on data features to avoid efficiency loss or security vulnerabilities caused by single encryption methods. It constructs a dynamic permission graph based on the identity attributes, task scenarios and historical behaviors of the access subject, and realizes real-time binding of data anonymization level and access permissions. While ensuring the security and integrity of distributed processing of multi-source heterogeneous data, it improves data processing efficiency and access flexibility.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a distributed data security processing method for multi-source heterogeneous data, the method comprising the following steps: S1. Collect multi-source heterogeneous data, analyze the syntax rules and semantic attributes of various types of data, clarify the format type, core semantic information and sensitivity level of the data, and form a data feature profile. S2. Establish an encryption algorithm adaptation rule base containing multiple encryption algorithms and data feature adaptation logic, select the appropriate encryption scheme based on the data feature file through rule matching, and perform differentiated encryption processing on heterogeneous data. S3. Collect the identity attributes, task scenarios, and historical access behavior data of the data access subjects, construct a dynamic permission assessment model, quantify the permission adaptation level of the access subjects through this model, and then construct a dynamic permission graph. S4. Associate and bind the encrypted data with the dynamic permission graph, receive data access requests, verify the matching degree between the access subject's permission level and the data anonymization level in real time, and execute the corresponding access operation according to the verification result to achieve three-in-one adaptive control of data type, encryption algorithm and access permission.

[0007] Furthermore, step S1, in parsing the syntax rules and semantic attributes of various types of data, includes the following steps: The collected multi-source heterogeneous data is classified by format, distinguishing between structured data, unstructured data, and semi-structured data; It extracts specific syntax rules for different data formats, extracts field definitions, data types and relationships from structured data, extracts text encoding, content themes and keywords from unstructured data, and extracts tag rules and hierarchical structure from semi-structured data; The sensitivity level is determined by combining the business scenario to which the data belongs and the degree of information leakage risk. The format identifier, grammatical features, semantic tags and sensitivity level are integrated to form a complete data feature profile.

[0008] Furthermore, step S1 employs a distributed parallel architecture when classifying formats and extracting syntax rules from multi-source heterogeneous data. The execution steps of this architecture include: Multi-source heterogeneous data is allocated to corresponding parsing nodes according to the data source type, and each parsing node is preset with the corresponding data source parsing standard; Each parsing node synchronously performs format classification and syntax rule extraction operations, and shares the parsing dictionary and standard parameters through the inter-node communication protocol; Each parsing node uploads its local parsing results to the central node, which then performs merging, deduplication, and consistency checks on the local results to generate a global data feature profile.

[0009] Furthermore, step S2, in establishing the encryption algorithm adaptation rule base, includes the following steps: Preset the performance parameters, security levels, and applicable data type thresholds for symmetric encryption, homomorphic encryption, zero-knowledge proof, and lightweight symmetric encryption algorithms; Establish a mapping rule between data format, sensitivity level, and encryption algorithm. High-sensitivity data corresponds to encryption algorithms with security levels that meet preset standards, low-sensitivity data corresponds to encryption algorithms with computational overhead that meet preset requirements, and medium-sensitivity data selects encryption algorithms that balance security level and computational efficiency. The rule base can be dynamically updated via an interface that allows for the addition or adjustment of mapping relationships based on newly added data types and encryption algorithms.

[0010] Furthermore, step S2, when performing differentiated encryption processing on heterogeneous data, includes the following steps: Retrieve the sensitivity level information from the data feature archive to determine the sensitivity range corresponding to the data; The encryption algorithm is matched with the corresponding encryption scheme in the rule base based on the sensitivity interval. High sensitivity interval data is matched with homomorphic encryption scheme, medium sensitivity interval data is matched with symmetric encryption scheme, and low sensitivity interval data is matched with lightweight symmetric encryption scheme. The key fields of the data are marked, and the marked fields are encrypted using the enhanced encryption mode of the corresponding encryption scheme. The remaining fields are processed using the normal encryption mode.

[0011] Furthermore, step S2, after performing differentiated encryption processing, also includes a dynamic switching step for encryption schemes, which includes: Real-time monitoring of data sensitivity level, format type, and changes in business scenarios, while also collecting data processing computing resource utilization and data transmission rate; When changes in data characteristics or resource status are detected to exceed the preset range, a re-matching process for the encryption algorithm adaptation rule base is triggered to generate a new adapted encryption scheme. The original encrypted data is read through the encryption conversion interface, and the encryption conversion operation is performed using the new encryption scheme. Data integrity verification is performed during the conversion process.

[0012] Furthermore, step S3, when constructing the dynamic permission evaluation model, includes the following steps: The access subject's identity attributes, task scenario, and historical access behavior are divided into three evaluation dimensions. Identity attributes include user role, department, and authorization level; task scenario includes urgency and business relevance; and historical access behavior includes compliance rate, number of unauthorized attempts, and access frequency. A fixed weight coefficient is set for each evaluation dimension, with the identity attribute dimension having a higher weight coefficient than other dimensions; The total permission adaptation score of the access subject is calculated by weighting and summing the data of each dimension with the corresponding weight coefficients, and multiple permission adaptation levels are divided according to the total score range.

[0013] Furthermore, step S3 includes the following steps when constructing the dynamic permission graph: Based on the data's business affiliation, access frequency, and update cycle, three data anonymization levels are defined: fully anonymized, partially anonymized, and not anonymized. Based on the permission adaptation level, access permissions are divided into three levels: Level 1 permission corresponds to fully de-identified data, Level 2 permission corresponds to fully de-identified and partially de-identified data, and Level 3 permission corresponds to data with all de-identification levels. Establish a mapping relationship between data anonymization levels and access permissions, record the effective time, applicable business scenarios and update logs of the mapping relationship in the graph, and set the dynamic iteration trigger conditions of the graph.

[0014] Furthermore, step S4, when verifying the matching degree between the access subject's permission level and the data anonymization level in real time, includes the following steps: Receive access requests and extract the identity of the accessing entity, the current task description, and the data identifier requested for access; Based on the identity identifier, query the dynamic permission graph to obtain the corresponding access permission level; based on the request data identifier, query the data feature file to obtain the corresponding data anonymization level. Compare the compatibility between the access permission level and the data anonymization level. If they are compatible, execute the access operation and record the access information. If they are partially compatible, only grant access permissions to the corresponding anonymized fields. If they are not compatible, execute the access denial operation and generate an operation record.

[0015] Compared with existing technologies, this distributed data security processing method for multi-source heterogeneous data has the following advantages: This invention comprehensively analyzes the syntax rules and semantic attributes of multi-source heterogeneous data, and automatically matches adaptive encryption schemes based on data features. This avoids the efficiency loss or security vulnerabilities caused by a single encryption method. At the same time, it constructs a dynamic permission graph based on the identity attributes, task scenarios, and historical behaviors of the access subject, and realizes real-time binding of data anonymization level and access permissions. This effectively solves the problems of fixed encryption strategies and mismatch between permission control and data heterogeneity in traditional distributed systems. While ensuring the security and integrity of distributed processing of multi-source heterogeneous data, it improves data processing efficiency and access flexibility, and can fully adapt to the security processing needs of large-scale heterogeneous data in multiple fields.

[0016] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0018] Figure 1 A flowchart of a distributed data security processing method for multi-source heterogeneous data; Figure 2 A flowchart illustrating a distributed data security processing method for multi-source heterogeneous data; Figure 3 This is a flowchart illustrating the differential encryption process performed on heterogeneous data in a distributed data security processing method for multi-source heterogeneous data. Detailed Implementation

[0019] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0020] This invention provides a distributed data security processing method for multi-source heterogeneous data, and proposes a complete technical solution. (See attached document.) Figure 1 , Figure 2 and Figure 3 The core content is as follows: The core process of this method includes four key steps: First, collect multi-source heterogeneous data, parse its syntax rules and semantic attributes, clarify the format type, core semantics and sensitivity level, and form a data feature profile; second, establish an encryption algorithm adaptation rule base, match and adapt encryption schemes according to data features, and perform differentiated encryption; next, collect the identity attributes, task scenarios and historical access behaviors of the access subject, construct a dynamic permission evaluation model to quantify the permission adaptation level, and then form a dynamic permission graph; finally, bind the encrypted data with the dynamic permission graph, verify the matching degree between the permission and the data anonymization level when receiving access requests, and execute the corresponding access operation according to the result, so as to achieve three-in-one adaptive control of data type, encryption algorithm and access permission.

[0021] The subsequent dependent claims further elaborate on the core steps. Specifically, in step S1, when parsing the data, structured, unstructured, and semi-structured data are first distinguished, and specific syntax rules are extracted for each. The sensitivity level is determined by combining the business scenario and the risk of leakage, and a complete data feature profile is formed. Furthermore, a distributed parallel architecture is adopted, in which multiple parsing nodes process the data synchronously, and the central node merges and verifies the data to generate a global profile.

[0022] The encryption algorithm adaptation rule base constructed in step S2 presets the performance and security parameters of various encryption algorithms, establishes mapping rules between data format, sensitivity level and encryption algorithm, and different encryption schemes for high, medium and low sensitivity data. At the same time, a dynamic update interface is set up to support the adjustment of the mapping relationship. Key fields are strengthened during encryption, and the encryption scheme can be dynamically switched according to changes in data characteristics and resource status.

[0023] When constructing the dynamic permission assessment model in step S3, the assessment is carried out from three dimensions: identity attributes, task scenarios, and historical access behavior. Weight coefficients are set and the total score is quantified to classify permission levels. The dynamic permission graph is divided into three data anonymization levels and three levels of access permissions. The mapping relationship between the two is established and relevant information is recorded. Dynamic iteration conditions are set.

[0024] In step S4, when verifying the matching degree, extract information related to the access subject and the requested data, query the permission level and data anonymization level, allow access if they match, partially match only open the anonymized fields, deny access if they do not match, and record relevant operation information at the same time.

[0025] Example 1 This embodiment applies to a multi-source heterogeneous data security processing scenario in the field of financial risk control decision-making. The data in this scenario comes from multiple data sources, such as the bank's core business system, third-party payment platforms, credit reporting agency databases, and user behavior collection terminals. The data types include structured user account transaction data, unstructured customer identity authentication image data, and semi-structured risk assessment report data. These types of data differ significantly in semantic rules and sensitivity. It is necessary to ensure the absolute security of core sensitive data such as user funds and credit records, while also meeting the data processing efficiency requirements of real-time calculations by risk control models. This embodiment achieves an organic unity of data security protection and efficient utilization through this distributed data security processing method.

[0026] See Figure 1 and Figure 2 The specific implementation process of this embodiment is as follows: First, multi-source heterogeneous data is collected and a data feature profile is created. This involves collecting user deposit details and loan records stored in the bank's core business system, transaction logs and payment terminal information transmitted from third-party payment platforms, credit rating data provided by credit reporting agencies, and login addresses and operation trajectories reported by user behavior collection terminals. A distributed parallel architecture is used to classify the data formats and extract grammatical rules. Data types are then assigned to corresponding parsing nodes based on data source type: account transaction data is assigned to structured data parsing nodes, identity authentication image data to unstructured data parsing nodes, and risk assessment report data to semi-structured data parsing nodes. Each parsing node has preset parsing standards for its corresponding data source.

[0027] Each node executes operations synchronously, extracting field definitions, data types, and relationships from structured data; extracting text encoding, content themes, and keywords from unstructured data; and extracting tag rules and hierarchical structures from semi-structured data. A shared parsing dictionary and standard parameters are shared through inter-node communication protocols. Each node uploads its local parsing results to the central node, which performs merging, deduplication, and consistency checks on the local results to generate a global data feature profile. Subsequently, the sensitivity level is determined based on the data's business context and the degree of information leakage risk. For example, user bank card passwords and account balances are classified as highly sensitive due to extremely high leakage risk; publicly available user occupational information and transaction locations are classified as low sensitive; and user income certificates and credit records are classified as moderately sensitive. Format identifiers, syntactic features, semantic tags, and sensitivity levels are integrated to form a complete data feature profile.

[0028] Next, an encryption algorithm adaptation rule base is established and differentiated encryption processing is performed. When establishing the rule base, performance parameters, security levels, and applicable data type thresholds for symmetric encryption, homomorphic encryption, zero-knowledge proof, and lightweight symmetric encryption algorithms are preset. A mapping rule is established between data format, sensitivity level, and encryption algorithm. High-sensitivity data corresponds to encryption algorithms with security levels that meet preset standards, low-sensitivity data corresponds to encryption algorithms with computational overhead that meets preset requirements, and medium-sensitivity data selects encryption algorithms that balance security level and computational efficiency. At the same time, a dynamic update interface for the rule base is set up to support the subsequent addition or adjustment of mapping relationships based on newly added data types and encryption algorithms.

[0029] When performing differential encryption on heterogeneous data, see [link to relevant documentation]. Figure 3 First, the sensitivity level information in the data feature file is retrieved to determine the sensitivity range corresponding to the data. In the specific implementation of this embodiment, the adaptability of the encryption scheme is calculated using the following formula: ,in The score is based on the encryption scheme adaptation. The security level of an encryption algorithm is scored by summing the scores of each item in a pre-defined security indicator system, including key length, attack resistance type, and decryption complexity. The processing efficiency score for the encryption algorithm is obtained by converting the processing time and resource utilization of the encryption algorithm on a unit volume of heterogeneous data through actual testing. The compatibility score between encryption algorithms and data formats is quantified based on the encryption algorithm's success rate in parsing the target data format and the proportion of direct processing without format conversion. , , To adapt to the weights, the application effects of historical encryption schemes in similar heterogeneous data processing scenarios are fitted by multiple linear regression analysis to determine the balance between security requirements, processing efficiency, and compatibility.

[0030] Based on the sensitivity range and adaptation score, corresponding encryption schemes are matched. High-sensitivity data is matched with homomorphic encryption schemes, medium-sensitivity data with symmetric encryption schemes, and low-sensitivity data with lightweight symmetric encryption schemes. Key fields of the data are marked, such as bank card numbers and password hashes in user account data. The marked fields are encrypted using the enhanced encryption mode of the corresponding encryption scheme, while other fields are processed using the conventional encryption mode.

[0031] After encryption, the sensitivity level, format type, and changes in business scenarios of the data are monitored in real time. At the same time, the computing resource utilization rate and data transmission rate of data processing are collected. When changes in data characteristics or resource status are detected to exceed the preset range, the re-matching process of the encryption algorithm adaptation rule base is triggered to generate a new adapted encryption scheme. The original encrypted data is read through the encryption conversion interface, and the encryption conversion operation is performed using the new encryption scheme. Data integrity verification is performed during the conversion process.

[0032] Then, a dynamic permission assessment model and a dynamic permission graph are constructed. In constructing the dynamic permission assessment model, the access subject's identity attributes, task scenario, and historical access behavior are divided into three assessment dimensions. Identity attributes include user role, department, and authorization level; task scenario includes urgency and business relevance; and historical access behavior includes compliance rate, number of unauthorized access attempts, and access frequency. Fixed weight coefficients are assigned to each assessment dimension, with the identity attribute dimension having a higher weight coefficient than other dimensions.

[0033] In the specific implementation of this embodiment, the quantification formula for the permission adaptation level is as follows: ,in The total score is used to adapt permissions to different levels. The score for the identity attribute dimension is obtained by summing the basic authorization score corresponding to the user role, the business association weight of the department to which the user belongs, and the hierarchical coefficient of the authorization level. The task score is calculated by multiplying the priority score corresponding to the task's urgency and the matching coefficient corresponding to the business relevance. The score for historical access behavior is obtained by subtracting the penalty points for the number of unauthorized access attempts from the base score, and then multiplying it by the compliance rate and access frequency adaptation coefficient. , , Using dimensional weights, the analytic hierarchy process (AHP) is used to perform pairwise comparisons of permission-influencing factors in multi-domain distributed data processing scenarios. A judgment matrix is ​​constructed and determined after consistency testing, and it satisfies the following conditions: The total permission adaptation score of the access subject is calculated by weighting and summing the data from each dimension with the corresponding weight coefficients, and multiple permission adaptation levels are divided according to the total score range.

[0034] When constructing a dynamic permission graph, based on the business ownership, access frequency, and update cycle of the data, three data anonymization levels are defined: fully anonymized, partially anonymized, and not anonymized. Combined with the permission adaptation level, three levels of access permissions are defined: Level 1 permissions correspond to fully anonymized data, Level 2 permissions correspond to fully anonymized and partially anonymized data, and Level 3 permissions correspond to all anonymized levels of data.

[0035] In the specific implementation of this embodiment, the mapping degree between data anonymization level and access permissions is verified by the following formula: ,in For mapping matching degree, For the access permissions corresponding to the first Each permission item The first level corresponding to the data anonymization level Each permission requirement This represents the total number of permission items, and its value is determined by analyzing data business attributes and access control requirements, covering core operation dimensions such as data access, modification, transmission, and storage. The graph records the effective time of mapping relationships, applicable business scenarios, and update logs, and sets the dynamic iteration trigger conditions for the graph.

[0036] Finally, the system implements the association and binding of encrypted data with a dynamic permission graph, along with access control. The encrypted data is associated with the dynamic permission graph. When a data access request is received, the system extracts the access subject's identity, current task description, and the requested data identifier. Based on the identity, the system queries the dynamic permission graph to obtain the corresponding access permission level; based on the requested data identifier, it queries the data feature file to obtain the corresponding data anonymization level.

[0037] The system compares the compatibility between access permission levels and data anonymization levels. If they are fully compatible, an access operation is performed and detailed information such as the access subject, access time, and access content is recorded. If they are partially compatible, access permissions are granted only to the corresponding anonymized fields, and access information is recorded. If they are completely incompatible, an access denial operation is performed and detailed operation records are generated, including the reason for denial, access subject information, and requested data information. This achieves a three-in-one adaptive control of data type, encryption algorithm, and access permission.

[0038] In summary, this embodiment successfully addresses the industry pain points of rigid encryption strategies and inflexible access control for multi-source heterogeneous data by applying this distributed data security processing method in financial risk control decision-making scenarios. By implementing differentiated encryption for data of varying sensitivity, a strong security barrier is built for highly sensitive financial data, while avoiding resource consumption caused by excessive encryption of low-sensitivity data, significantly improving data processing and transmission efficiency. Based on a dynamic access control graph constructed using multi-dimensional assessment, real-time dynamic adjustment of access permissions is achieved, ensuring precise matching between access control and risk control business scenarios. Under the premise of strictly ensuring data security and compliance, it provides efficient and flexible data support for risk control models, effectively improving the accuracy of risk identification and the speed of decision response, and providing reliable technical support for data security governance in the financial industry.

[0039] Example 2 This embodiment is applied to an industrial internet collaborative scheduling scenario. The data in this scenario comes from multiple heterogeneous data sources, such as production equipment sensors, supply chain management systems, warehousing and logistics terminals, and production execution systems. The data types cover structured production parameter data, unstructured equipment fault image data, and semi-structured supply chain order data. These types of data have significant differences in transmission frequency, semantic rules, and sensitivity. It is necessary to ensure the security of sensitive information such as core parameters of production formulas and core equipment operation and maintenance data, while also meeting the stringent requirements of real-time industrial production scheduling for data processing latency. Based on the previous embodiments, this embodiment optimizes the processing flow for the characteristics of high real-time performance and high correlation of data in industrial scenarios, achieving a precise match between data security and collaborative scheduling efficiency.

[0040] See Figure 1 and Figure 2 The specific implementation process of this embodiment is as follows: First, multi-source heterogeneous data is collected and a data feature profile is constructed. Based on the distributed parallel architecture of the aforementioned embodiment, the node allocation strategy is optimized. According to the industrial data type, the sensor data of production equipment is allocated to the real-time parsing node, the data of the supply chain management system is allocated to the batch parsing node, and the data of the warehousing and logistics terminal is allocated to the edge parsing node. Each node is preset with the corresponding real-time processing threshold and parsing standard.

[0041] Each node synchronously performs format classification and syntax rule extraction. Structured production parameter data is extracted to define field definitions, data types, and equipment relationships. Unstructured equipment fault image data is extracted to extract encoding formats, fault feature keywords, and shooting parameters. Semi-structured supply chain order data is extracted to extract tag levels and field mapping rules. Through low-latency node communication protocols, a parsing dictionary and standard parameters are shared to ensure the real-time transmission and parsing of industrial data.

[0042] Each node uploads its local parsing results to the central node in real time. The central node uses an incremental merging algorithm to perform merging, deduplication, and consistency checks on the local results, quickly generating a global data feature profile. At the same time, it combines the scope of the fault impact in the industrial production scenario and the degree of production loss caused by data leakage to determine the sensitivity level, and integrates them into a complete data feature profile.

[0043] Next, a rule base for adapting encryption algorithms specific to industrial scenarios is established, and differentiated encryption processing is performed. Based on preset performance parameters and security levels for various encryption algorithms, the rule base adds industrial data transmission latency threshold constraints, establishing a four-dimensional mapping rule between data format, sensitivity level, transmission latency, and encryption algorithm. When performing differentiated encryption processing on heterogeneous data, see [reference needed]. Figure 3First, the sensitivity level and transmission delay requirements in the data feature file are retrieved to clarify the corresponding adaptation constraints for the data. In the specific implementation of this embodiment, the adaptability of the encryption scheme is calculated using the following formula: .

[0044] Based on the adaptation constraints, corresponding encryption schemes are matched. High-sensitivity data with lenient transmission delay requirements are matched with homomorphic encryption schemes, medium-sensitivity data with moderate transmission delay requirements are matched with symmetric encryption schemes, and low-sensitivity data with stringent transmission delay requirements are matched with lightweight symmetric encryption schemes. Key fields of core industrial data, such as production formula parameters and core equipment operating thresholds, are marked and processed using the enhanced encryption mode of the corresponding encryption scheme, while other fields are processed using the conventional encryption mode.

[0045] After encryption, a new dynamic switching mechanism specifically for industrial scenarios is added to monitor changes in production conditions, data transmission link bandwidth, and equipment computing resource load in real time. When data sensitivity is upgraded, transmission link fluctuations are detected, or equipment load exceeds the standard, the rule base is triggered to re-match the process, generate a new adapted encryption scheme, and quickly read the original encrypted data through the encryption conversion interface and perform the conversion. During the conversion process, an industrial-grade data integrity verification algorithm is used to ensure that no data is lost.

[0046] Then, a dynamic permission assessment model and dynamic permission graph for industrial scenarios are constructed. Based on the aforementioned three assessment dimensions, the model adds a production scheduling priority dimension. Identity attributes include job role, workshop affiliation, and system authorization level; task scenarios include production urgency and process relevance; historical access behavior includes operation compliance rate, number of unauthorized attempts, and access frequency; and production scheduling priority includes task urgency level and capacity impact weight. Dynamic weight coefficients are set for each dimension, with the weight of the production scheduling priority dimension dynamically adjusted according to production conditions. During urgent production phases, this dimension has a higher weight than other dimensions. In the specific implementation of this embodiment, the quantification formula for permission adaptation level is: .

[0047] The total permission adaptation score is calculated by weighting and summing the data from each dimension with their corresponding weight coefficients, and multiple permission adaptation levels are then defined. When constructing the dynamic permission graph, based on the process affiliation, access frequency, and update cycle of industrial data, three data anonymization levels are defined: fully anonymized, partially anonymized, and not anonymized. These are combined with the permission adaptation levels to define access permissions from level one to level three. A temporary permission application channel is also added to support temporary permission escalation in emergency production scenarios. In the specific implementation of this embodiment, the mapping and matching degree between data anonymization levels and access permissions is verified using the following formula: The mapping graph records the effective processes, applicable production stages, and update logs of the mapping relationships, and sets dynamic iteration trigger conditions for the graph based on the production cycle time.

[0048] Finally, the system implements the association and binding of encrypted data with a dynamic permission graph and access control. The encrypted data is associated with the dynamic permission graph and the industrial production process. When a data access request is received, the system extracts the access subject's identity, current production task description, process affiliation, and the requested data identifier. Based on the identity and process affiliation, the system queries the dynamic permission graph to obtain the corresponding access permission level and temporary permission status. Based on the requested data identifier, the system queries the data feature file to obtain the corresponding data anonymization level and transmission delay requirements.

[0049] The system compares the compatibility between access permission levels and data anonymization levels. If the data is compatible and meets the transmission delay requirements, the system executes the access operation and records information such as the access subject, access process, and access time. If the data is partially compatible, access permissions are only granted to the corresponding anonymized fields, and access information is recorded. If the data is not compatible or does not meet the transmission delay requirements, the system denies access and generates an operation record, including the reason for denial and the impact assessment on production tasks. This enables a four-in-one adaptive control of data type, encryption algorithm, access permission, and production scheduling in industrial scenarios.

[0050] In summary, this embodiment enhances the real-time performance and scenario adaptability of data processing based on the aforementioned embodiments by optimizing the process for collaborative scheduling scenarios in the Industrial Internet. By optimizing the distributed parsing node allocation strategy and data merging algorithm, it meets the high real-time processing requirements of industrial data. By constructing a four-dimensional encryption algorithm mapping rule and an industrial-grade dynamic switching mechanism, it reduces the impact of data encryption on production scheduling delays while ensuring the security of core sensitive data. Furthermore, by adding a production scheduling priority evaluation dimension and temporary permission channels, it achieves dynamic matching of permission control with industrial production conditions. This embodiment effectively resolves the contradiction between multi-source heterogeneous data security and real-time collaboration in industrial scenarios, providing reliable data security support for efficient scheduling, equipment collaboration, and safe production in the Industrial Internet, and significantly improving the accuracy of production scheduling and the security of data utilization.

[0051] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A distributed data security processing method for multi-source heterogeneous data, characterized in that, The method includes the following steps: S1. Collect multi-source heterogeneous data, analyze the syntax rules and semantic attributes of various types of data, clarify the format type, core semantic information and sensitivity level of the data, and form a data feature profile. S2. Establish an encryption algorithm adaptation rule base containing multiple encryption algorithms and data feature adaptation logic, select the appropriate encryption scheme based on the data feature file through rule matching, and perform differentiated encryption processing on heterogeneous data. S3. Collect the identity attributes, task scenarios, and historical access behavior data of the data access subjects, construct a dynamic permission assessment model, quantify the permission adaptation level of the access subjects through this model, and then construct a dynamic permission graph. S4. Associate and bind the encrypted data with the dynamic permission graph, receive data access requests, verify the matching degree between the access subject's permission level and the data anonymization level in real time, and execute the corresponding access operation according to the verification result to achieve three-in-one adaptive control of data type, encryption algorithm and access permission.

2. The distributed data security processing method for multi-source heterogeneous data according to claim 1, characterized in that, Step S1, when parsing the syntax rules and semantic attributes of various types of data, includes the following steps: The collected multi-source heterogeneous data is classified by format, distinguishing between structured data, unstructured data, and semi-structured data; It extracts specific syntax rules for different data formats, extracts field definitions, data types and relationships from structured data, extracts text encoding, content themes and keywords from unstructured data, and extracts tag rules and hierarchical structure from semi-structured data; The sensitivity level is determined by combining the business scenario to which the data belongs and the degree of information leakage risk. The format identifier, grammatical features, semantic tags and sensitivity level are integrated to form a complete data feature profile.

3. A distributed data security processing method for multi-source heterogeneous data according to claim 2, characterized in that, Step S1 employs a distributed parallel architecture for format classification and syntax rule extraction of multi-source heterogeneous data. The execution steps of this architecture include: Multi-source heterogeneous data is allocated to corresponding parsing nodes according to the data source type, and each parsing node is preset with the corresponding data source parsing standard; Each parsing node synchronously performs format classification and syntax rule extraction operations, and shares the parsing dictionary and standard parameters through the inter-node communication protocol; Each parsing node uploads its local parsing results to the central node, which then performs merging, deduplication, and consistency checks on the local results to generate a global data feature profile.

4. The distributed data security processing method for multi-source heterogeneous data according to claim 1, characterized in that, Step S2, when establishing the encryption algorithm adaptation rule base, includes the following steps: Preset the performance parameters, security levels, and applicable data type thresholds for symmetric encryption, homomorphic encryption, zero-knowledge proof, and lightweight symmetric encryption algorithms; Establish a mapping rule between data format, sensitivity level, and encryption algorithm. High-sensitivity data corresponds to encryption algorithms with security levels that meet preset standards, low-sensitivity data corresponds to encryption algorithms with computational overhead that meet preset requirements, and medium-sensitivity data selects encryption algorithms that balance security level and computational efficiency. The rule base can be dynamically updated via an interface that allows for the addition or adjustment of mapping relationships based on newly added data types and encryption algorithms.

5. A distributed data security processing method for multi-source heterogeneous data according to claim 4, characterized in that, Step S2, when performing differential encryption processing on heterogeneous data, includes the following steps: Retrieve the sensitivity level information from the data feature archive to determine the sensitivity range corresponding to the data; The encryption algorithm is matched with the corresponding encryption scheme in the rule base based on the sensitivity interval. High sensitivity interval data is matched with homomorphic encryption scheme, medium sensitivity interval data is matched with symmetric encryption scheme, and low sensitivity interval data is matched with lightweight symmetric encryption scheme. The key fields of the data are marked, and the marked fields are encrypted using the enhanced encryption mode of the corresponding encryption scheme. The remaining fields are processed using the normal encryption mode.

6. A distributed data security processing method for multi-source heterogeneous data according to claim 5, characterized in that, Step S2, after performing differentiated encryption processing, also includes a dynamic switching step for encryption schemes, which includes: Real-time monitoring of data sensitivity level, format type, and changes in business scenarios, while also collecting data processing computing resource utilization and data transmission rate; When changes in data characteristics or resource status are detected to exceed the preset range, a re-matching process for the encryption algorithm adaptation rule base is triggered to generate a new adapted encryption scheme. The original encrypted data is read through the encryption conversion interface, and the encryption conversion operation is performed using the new encryption scheme. Data integrity verification is performed during the conversion process.

7. A distributed data security processing method for multi-source heterogeneous data according to claim 1, characterized in that, Step S3, when constructing the dynamic permission evaluation model, includes the following steps: The access subject's identity attributes, task scenario, and historical access behavior are divided into three evaluation dimensions. Identity attributes include user role, department, and authorization level; task scenario includes urgency and business relevance; and historical access behavior includes compliance rate, number of unauthorized attempts, and access frequency. A fixed weight coefficient is set for each evaluation dimension, with the identity attribute dimension having a higher weight coefficient than other dimensions; The total permission adaptation score of the access subject is calculated by weighting and summing the data of each dimension with the corresponding weight coefficients, and multiple permission adaptation levels are divided according to the total score range.

8. A distributed data security processing method for multi-source heterogeneous data according to claim 7, characterized in that, Step S3, when constructing the dynamic permission graph, includes the following steps: Based on the data's business affiliation, access frequency, and update cycle, three data anonymization levels are defined: fully anonymized, partially anonymized, and not anonymized. Based on the permission adaptation level, access permissions are divided into three levels: Level 1 permission corresponds to fully de-identified data, Level 2 permission corresponds to fully de-identified and partially de-identified data, and Level 3 permission corresponds to data with all de-identification levels. Establish a mapping relationship between data anonymization levels and access permissions, record the effective time, applicable business scenarios and update logs of the mapping relationship in the graph, and set the dynamic iteration trigger conditions of the graph.

9. A distributed data security processing method for multi-source heterogeneous data according to claim 1, characterized in that, Step S4, when verifying the match between the access subject's permission level and the data anonymization level in real time, includes the following steps: Receive access requests and extract the identity of the accessing entity, the current task description, and the data identifier requested for access; Based on the identity identifier, query the dynamic permission graph to obtain the corresponding access permission level; based on the request data identifier, query the data feature file to obtain the corresponding data anonymization level. Compare the compatibility between the access permission level and the data anonymization level. If they are compatible, execute the access operation and record the access information. If they are partially compatible, only grant access permissions to the corresponding anonymized fields. If they are not compatible, execute the access denial operation and generate an operation record.

Images