An anti-tampering security management system and method based on archival data

Abstract

The application discloses a kind of based on file data tamper-proof security management system and method, comprising the following steps: step one: original file data and file access behavior log information are collected, and content fragmentation processing is carried out;Step two: based on file data segment set and file access behavior log information, file access heterogeneous graph is constructed;Step three: file access heterogeneous graph is input to improved GATv2 model, and the final embedding vector of each node is generated;Step four: based on the final embedding vector of each node, generate multiple logic copies, generate corresponding quantum signature value and form chain signature fingerprint record;Step five: record current access track, and based on Soft-DTW, alignment analysis is carried out;Step six: calculate current quantum signature value and compare with chain signature fingerprint record.The application fuses improved GATv2 model and quantum signature technology, realizes file data tamper-proof and trusted audit.

Description

Technical Field

[0001] This invention relates to the field of archival data security management technology, and in particular to an archival data anti-tampering security management system and method. Background Technology

[0002] With the continuous advancement of archival informatization and digitization, massive amounts of electronic archives are widely stored and used in important fields such as government affairs, finance, healthcare, judiciary, and enterprises. As an important carrier of information assets, the integrity, traceability, and tamper prevention capabilities of archives have become core requirements for ensuring data trustworthiness, business compliance, and incident tracing. Traditional archival management systems mostly rely on access control, operation log recording, and digital signatures to track archival access behavior and prevent content tampering. However, these methods have significant shortcomings in dealing with complex behavioral paths, multi-terminal collaborative operations, and malicious internal personnel tampering.

[0003] Existing technologies for behavioral modeling generally employ linear log analysis or static access strategy management, which struggles to capture the high-dimensional behavioral patterns of archives during actual access, the collaborative relationships across user devices, and the potential semantic dependencies between multi-hop access paths. They also lack a deep understanding of complex access graph structures. Furthermore, tamper detection mechanisms based on traditional hashing or symmetric encryption typically rely on single-copy verification or centralized signatures, making them easily bypassed or forged, and failing to meet the integrity verification requirements of archive data in a distributed environment. Simultaneously, once data anomalies occur, existing systems often lack efficient anomaly trajectory identification capabilities, resulting in the inability to promptly pinpoint the tampering chain and responsible nodes, severely restricting the practicality and controllability of the archive data security management system.

[0004] Therefore, how to provide a security management system and method for preventing tampering of archival data is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a security management system and method for preventing tampering of archival data. This invention integrates an improved GATv2 model with a quantum signature mechanism to construct an archival data tamper-proof management system capable of access behavior modeling, tamper detection, and accountability. By identifying abnormal behavior through multi-order graph structure analysis and combining it with distributed quantum signature verification, it achieves dual protection for archival data content and access paths, improving the security, integrity, and auditability of the archival system. This system is suitable for digital archival management scenarios with high security requirements.

[0006] A method for tamper-proof security management of archival data according to an embodiment of the present invention includes the following steps:

[0007] Step 1: Collect raw archive data and archive access behavior log information, and process the raw archive data into content fragments to obtain a set of archive data fragments;

[0008] Step 2: Construct a heterogeneous map of archive access based on the set of archive data fragments and archive access behavior log information;

[0009] Step 3: Input the heterogeneous map of archive access into the improved GATv2 model to generate the final embedding vector for each node;

[0010] Step 4: Generate multiple logical copies of the archive data fragment based on the final embedding vector of each node, generate corresponding quantum signature values, and form a chain signature fingerprint record;

[0011] Step 5: When archive data is accessed or modified, record the current access trajectory, and align and analyze the current access trajectory with historical legitimate access trajectories based on Soft-DTW to determine if there are any access anomalies;

[0012] Step Six: Once an access anomaly is detected, calculate the current quantum signature value and compare it with the chain signature fingerprint record to mark the tampered copy, and generate a tampering audit report.

[0013] Optionally, step one specifically includes:

[0014] The original archival data includes the main text of the archive, archival metadata information, archival attachments, archival generation timestamps, and archival classification tags;

[0015] The file access behavior log information includes visitor identity, access time, access device identity, and access operation type;

[0016] The content fragmentation process is as follows:

[0017] The original archival data is processed to separate the main text and non-main text content. The main text content and non-main text content are extracted into independent fields for the main text content and independent fields for the non-main text content, respectively. The non-main text content includes archival metadata information, archival attachment files, archival generation timestamps, and archival classification tags.

[0018] Based on the paragraph structure and logical heading level in the independent fields of the main text of the archive, the main text of the archive is divided into multiple semantically complete paragraph units according to the predefined structural semantic boundaries to obtain archive data fragments;

[0019] Each archival data fragment is bound to its original archive number, paragraph level number, and independent fields for non-textual content, forming a traceable set of archival data fragments.

[0020] Optionally, step two specifically includes:

[0021] The nodes of the heterogeneous graph of file access include file data fragment nodes, visitor nodes, and access device nodes. The visitor nodes are used to represent user identity entities, and the access device nodes are used to represent terminal devices accessing files.

[0022] The edges of the heterogeneous graph of file access include access relationship edges, sharing relationship edges, and cross-device transfer relationship edges;

[0023] Access relationship edges are used to connect visitor nodes and file data fragment nodes, representing user actions such as reading, editing, and downloading file data;

[0024] Shared relationship edges are used to connect visitor nodes or visitor nodes and access device nodes, representing the sharing, forwarding, or collaborative editing of archive data;

[0025] Cross-device transfer relationship edges are used to connect the access behavior of the same visitor to the same archive data segment across different devices, representing the device jump path in the access chain;

[0026] When a new access behavior is detected, the corresponding node and edge are dynamically added, and the access operation type and access time attribute information of the relevant edge are updated to construct a dynamic heterogeneous graph of archive access.

[0027] Optionally, the improved GATv2 model is specifically as follows:

[0028] The improved GATv2 model includes a raw feature construction module, a temporal location encoding module, a multi-order neighbor sampling module, a multi-head attention aggregation module, and an embedding generation module;

[0029] The heterogeneous map of archive access is input into the original feature construction module, which constructs original feature vectors for archive data fragment nodes, visitor nodes, and access device nodes in the heterogeneous map of archive access, respectively, to obtain a set of original node feature vectors. The original feature vectors include:

[0030] The original feature vector of the archival data fragment node includes the original archive number, paragraph level number, and independent fields for non-textual content of the archive;

[0031] The original feature vector of the visitor node includes user identity, access frequency, access time, and access operation type;

[0032] The original feature vector of the accessing device node includes the accessing device identifier, device type, device location, and terminal trust level;

[0033] The original set of node feature vectors is input into the time position encoding module, which calculates the relative position offset with respect to the global reference time for the time window and generates a time position encoding vector.

[0034] The temporal location encoding vector is concatenated with the original node feature vector to form a temporally enhanced node feature representation;

[0035] The time-enhanced node feature representation is input into the multi-order neighbor sampling module. The multi-order neighbor sampling module constructs first-order, second-order, and third-order adjacency subgraphs with each target node as the center, and outputs a set of multi-order adjacency subgraphs.

[0036] For each order of adjacency subgraph, a set of independent weight parameters is set, and the temporally enhanced node feature vectors are linearly transformed and mapped to a unified feature space.

[0037] Based on the established weight parameters, each target node and its neighboring nodes are mapped to the feature space to generate the feature representation of the target node and the feature representation of the neighboring nodes.

[0038] The feature representation of the target node is concatenated with the feature representation of each adjacent node to obtain the semantic aggregation result of the target node in each order of the adjacency subgraph;

[0039] The semantic aggregation results of first-order, second-order, and third-order are concatenated into a unified multi-order attention aggregation representation;

[0040] The multi-order attention aggregation representation is input into the embedding generation module, and the final embedding vector of each node is output through a non-linear mapping function.

[0041] Optionally, the steps of constructing first-order, second-order, and third-order adjacency subgraphs respectively are as follows:

[0042] Taking each target node in the heterogeneous graph of file access as the center, find all adjacent nodes that have direct connection edges with the target node to form a first-order set of adjacent nodes. The target node is a time-enhanced node feature representation to be processed.

[0043] Based on the edge relationship between the first-order adjacent node set and the target node, a first-order adjacent subgraph is constructed, which includes the target node, first-order adjacent nodes, and connecting edges.

[0044] Based on the first-order adjacency node set, continue to search for the direct adjacency node of each first-order adjacency node, remove the target node that has appeared in the first order, and form the second-order adjacency node set.

[0045] Based on the connection relationship between the target node and its first-order and second-order adjacent nodes, a second-order adjacency subgraph is constructed. The second-order adjacency subgraph includes the target node, first-order adjacent nodes, second-order adjacent nodes, and all edge structures.

[0046] Based on the second-order adjacency set, find the direct adjacency of each second-order adjacency node, remove the nodes that have already appeared in the first or second order, and form the third-order adjacency set.

[0047] Based on the edge relationships between the target node and its first-order, second-order, and third-order adjacent nodes, a third-order adjacency subgraph is constructed, which contains all connection paths between the target node and its third-order adjacent nodes.

[0048] Optionally, step four specifically includes:

[0049] Based on the final embedding vector of each node, each archive data fragment is copied to generate multiple logical copies. The logical copies can be deployed on local servers, cloud nodes, or edge devices, and each logical copy retains the original data structure and corresponding embedding vector identifier.

[0050] Based on a pre-defined quantum key distribution mechanism, a unique key pair is assigned to each logical copy, and the logical copy and the final embedding vector are jointly signed to generate the corresponding quantum signature value.

[0051] The quantum signature value, along with the corresponding logical replica number, replica deployment location identifier, replica generation time stamp, and final embedding vector, is submitted to the distributed ledger.

[0052] The distributed ledger, based on an immutable distributed consensus mechanism, writes the signature information of each logical copy into the ledger, forming a chain of signature fingerprint records.

[0053] Optionally, step five specifically includes:

[0054] When a data fragment is accessed or modified, key elements of the current operation are collected in real time. These key elements include user identification, access time, access frequency, access device identification, device type, device location, terminal trust level, access operation type, and target data fragment number. The key elements are then arranged into a structured access event sequence in chronological order to form the current access trajectory.

[0055] The current access trajectory is non-linearly aligned with a pre-stored set of historical legal access trajectories using Soft-DTW, and a matching index is calculated. The matching index is used to measure the similarity of the access trajectories in the time dimension.

[0056] The matching index corresponding to the current access trajectory is compared with the set abnormal behavior threshold. If it is higher than the abnormal behavior threshold and no historical legitimate access trajectory is matched, the current access trajectory is determined to be an abnormal access trajectory.

[0057] Optionally, step six specifically includes:

[0058] Extract all logical copies of the archive data fragment nodes bound to the current abnormal access trajectory;

[0059] Read the corresponding logical copy content and the final embedding vector one by one, and regenerate the current quantum signature value using the same key pair;

[0060] Verify the current signature value bit by bit against the chained signature fingerprint records registered in the distributed ledger;

[0061] If a quantum signature value is found to be inconsistent, it is marked as a tampered copy, and all tampered copies are aggregated to generate a tampering audit report.

[0062] According to an embodiment of the present invention, a data tamper-proof security management system includes the following modules:

[0063] The data acquisition and fragmentation module is used to collect raw archive data and archive access behavior log information, and to perform content fragmentation processing on the raw archive data to generate a set of archive data fragments;

[0064] The Archive Access Heterogeneous Graph Construction Module is used to construct an archive access heterogeneous graph based on a set of archive data fragments and archive access behavior log information.

[0065] The final embedding vector generation module is used to input the heterogeneous map of archive access into the improved GATv2 model, and perform original feature construction, temporal location encoding, multi-order neighbor sampling and multi-order attention aggregation on the target node to generate the final embedding vector.

[0066] The logical copy and quantum signature module is used to generate multiple logical copies for each file data fragment based on the node embedding vector, generate quantum signature values, and write them into the distributed ledger to form a chain of signature fingerprint records.

[0067] The access trajectory monitoring module is used to collect key elements of the current operation behavior in real time when archive data is accessed or modified to construct the current access trajectory, and use Soft-DTW to perform alignment analysis with historical legitimate access trajectories to calculate trajectory matching indicators and determine whether there are access anomalies.

[0068] The signature verification module is used to calculate the current quantum signature value and verify it bit by bit against the chain signature fingerprint record after detecting abnormal access behavior to determine whether there is a tampered copy.

[0069] The beneficial effects of this invention are:

[0070] This invention deeply integrates the improved GATv2 model with a quantum signature mechanism to construct a secure archival data anti-tampering management system with capabilities for access behavior modeling, anomaly detection, tamper verification, and accountability tracing, significantly improving the credibility and auditability of archives in complex usage scenarios. Compared to traditional methods relying on static strategies and log comparisons, this invention can dynamically capture the multi-level graph structure features and time-series information during archive access, effectively identifying abnormal access behaviors that are difficult to detect through conventional means. Simultaneously, by generating multiple copies of archival data fragments and applying tamper-proof signatures based on quantum key distribution, combined with distributed ledger recording, dual anti-counterfeiting and chain-based verification of data content and its usage path are achieved. Upon detecting anomalies, the system can reconstruct the causal path of access through embedded vectors and perform signature verification on the target copy, quickly marking tampered data and outputting a structured audit report, providing a highly reliable foundation for audit accountability and evidence collection. The overall solution not only enhances the protection capabilities of the archival management system against security attacks, internal violations, and cross-node collaborative risks, but also provides solid support for the trusted use of large-scale, multi-dimensional archival data. Attached Figure Description

[0071] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0072] Figure 1 This is an overall flowchart of a data tamper-proof security management method for archives proposed in this invention;

[0073] Figure 2 This is a schematic diagram of the structure of a security management system for preventing tampering with archival data proposed in this invention. Detailed Implementation

[0074] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0075] refer to Figure 1 A method for tamper-proof security management of archival data, comprising:

[0076] Step 1: Collect raw archive data and archive access behavior log information, and process the raw archive data into content fragments to obtain a set of archive data fragments;

[0077] Step 2: Construct a heterogeneous map of archive access based on the set of archive data fragments and archive access behavior log information;

[0078] Step 3: Input the heterogeneous map of archive access into the improved GATv2 model to generate the final embedding vector for each node;

[0079] Step 4: Generate multiple logical copies of the archive data fragment based on the final embedding vector of each node, generate corresponding quantum signature values, and form a chain signature fingerprint record;

[0080] Step 5: When archive data is accessed or modified, record the current access trajectory, and align and analyze the current access trajectory with historical legitimate access trajectories based on Soft-DTW to determine if there are any access anomalies;

[0081] Step Six: Once an access anomaly is detected, calculate the current quantum signature value and compare it with the chain signature fingerprint record to mark the tampered copy, and generate a tampering audit report.

[0082] This step integrates the improved GATv2 model and quantum signature mechanism, enabling structured perception and tamper prevention of the entire process of archival data. It not only enhances the intelligent modeling and anomaly detection capabilities of access behavior, but also achieves accurate traceability and auditing of tampered copies through chained signature fingerprints, significantly enhancing the security and credibility of the archival system.

[0083] In this embodiment, step one specifically includes:

[0084] The original archival data includes the main text of the archive, archival metadata information, archival attachments, archival generation timestamps, and archival classification tags;

[0085] The file access behavior log information includes visitor identity, access time, access device identity, and access operation type;

[0086] The content fragmentation process is as follows:

[0087] The original archival data is processed to separate the main text and non-main text content. The main text content and non-main text content are extracted into independent fields for the main text content and independent fields for the non-main text content, respectively. The non-main text content includes archival metadata information, archival attachment files, archival generation timestamps, and archival classification tags.

[0088] Based on the paragraph structure and logical heading level in the independent fields of the main text of the archive, the main text of the archive is divided into multiple semantically complete paragraph units according to the predefined structural semantic boundaries to obtain archive data fragments;

[0089] Each archival data fragment is bound to its original archive number, paragraph level number, and independent fields for non-textual content, forming a traceable set of archival data fragments.

[0090] This step achieves structured management and precise tracking of archival content by finely separating the main text from non-main text content in the original archival data and segmenting it according to paragraph structure and semantic boundaries. This provides a high-quality, traceable data foundation for subsequent behavior modeling, anti-tampering verification, and anomaly location, significantly improving the organization and controllability of archival data.

[0091] In this embodiment, step two specifically includes:

[0092] The nodes of the heterogeneous graph of file access include file data fragment nodes, visitor nodes, and access device nodes. The visitor nodes are used to represent user identity entities, and the access device nodes are used to represent terminal devices accessing files.

[0093] The edges of the heterogeneous graph of file access include access relationship edges, sharing relationship edges, and cross-device transfer relationship edges;

[0094] Access relationship edges are used to connect visitor nodes and file data fragment nodes, representing user actions such as reading, editing, and downloading file data;

[0095] Shared relationship edges are used to connect visitor nodes or visitor nodes and access device nodes, representing the sharing, forwarding, or collaborative editing of archive data;

[0096] Cross-device transfer relationship edges are used to connect the access behavior of the same visitor to the same archive data segment across different devices, representing the device jump path in the access chain;

[0097] When a new access behavior is detected, the corresponding node and edge are dynamically added, and the access operation type and access time attribute information of the relevant edge are updated to construct a dynamic heterogeneous graph of archive access.

[0098] This step constructs a heterogeneous graph of archive access containing multiple types of nodes and multidimensional relationships, enabling dynamic modeling of access relationships between user behavior, device paths, and data fragments. It can accurately depict complex cross-user and cross-device access behaviors, providing a structured graph foundation for subsequent anomaly identification and causal tracing, and significantly improving the comprehensiveness and real-time performance of archive behavior analysis.

[0099] In this embodiment, the improved GATv2 model is specifically as follows:

[0100] The improved GATv2 model includes a raw feature construction module, a temporal location encoding module, a multi-order neighbor sampling module, a multi-head attention aggregation module, and an embedding generation module;

[0101] The heterogeneous map of archive access is input into the original feature construction module, which constructs original feature vectors for archive data fragment nodes, visitor nodes, and access device nodes in the heterogeneous map of archive access, respectively, to obtain a set of original node feature vectors. The original feature vectors include:

[0102] The original feature vector of the archival data fragment node includes the original archive number, paragraph level number, and independent fields for non-textual content of the archive;

[0103] The original feature vector of the visitor node includes user identity, access frequency, access time, and access operation type;

[0104] The original feature vector of the accessing device node includes the accessing device identifier, device type, device location, and terminal trust level;

[0105] The original set of node feature vectors is input into the time position encoding module, which calculates the relative position offset with respect to the global reference time for the time window and generates a time position encoding vector.

[0106] The temporal location encoding vector is concatenated with the original node feature vector to form a temporally enhanced node feature representation;

[0107] The time-enhanced node feature representation is input into the multi-order neighbor sampling module. The multi-order neighbor sampling module constructs first-order, second-order, and third-order adjacency subgraphs with each target node as the center, and outputs a set of multi-order adjacency subgraphs.

[0108] For each order of adjacency subgraph, a set of independent weight parameters is set, and the temporally enhanced node feature vectors are linearly transformed and mapped to a unified feature space.

[0109] Based on the established weight parameters, each target node and its neighboring nodes are mapped to the feature space to generate the feature representation of the target node and the feature representation of the neighboring nodes.

[0110] The feature representation of the target node is concatenated with the feature representation of each adjacent node to obtain the semantic aggregation result of the target node in each order of the adjacency subgraph;

[0111] The semantic aggregation results of first-order, second-order, and third-order are concatenated into a unified multi-order attention aggregation representation;

[0112] The multi-order attention aggregation representation is input into the embedding generation module, and the final embedding vector of each node is output through a non-linear mapping function.

[0113] This step introduces an improved GATv2 model with time-aware and multi-level semantic aggregation capabilities, enabling in-depth representation of various nodes in the heterogeneous graph of archive access. This enhances the model's ability to express complex behavioral paths and cross-level graph structures. The generated embedding vectors can effectively support subsequent abnormal trajectory identification, access pattern modeling, and causal chain tracing, significantly improving the accuracy and robustness of intelligent analysis.

[0114] In this embodiment, the steps of constructing first-order, second-order, and third-order adjacency subgraphs respectively are as follows:

[0115] Taking each target node in the heterogeneous graph of file access as the center, find all adjacent nodes that have direct connection edges with the target node to form a first-order set of adjacent nodes. The target node is a time-enhanced node feature representation to be processed.

[0116] Based on the edge relationship between the first-order adjacent node set and the target node, a first-order adjacent subgraph is constructed, which includes the target node, first-order adjacent nodes, and connecting edges.

[0117] Based on the first-order adjacency node set, continue to search for the direct adjacency node of each first-order adjacency node, remove the target node that has appeared in the first order, and form the second-order adjacency node set.

[0118] Based on the connection relationship between the target node and its first-order and second-order adjacent nodes, a second-order adjacency subgraph is constructed. The second-order adjacency subgraph includes the target node, first-order adjacent nodes, second-order adjacent nodes, and all edge structures.

[0119] Based on the second-order adjacency set, find the direct adjacency of each second-order adjacency node, remove the nodes that have already appeared in the first or second order, and form the third-order adjacency set.

[0120] Based on the edge relationships between the target node and its first-order, second-order, and third-order adjacent nodes, a third-order adjacency subgraph is constructed, which contains all connection paths between the target node and its third-order adjacent nodes.

[0121] This step constructs first- to third-order adjacency subgraphs in a hierarchical manner, accurately capturing the local and extended semantic relationships of target nodes in the access graph. This enhances the structural modeling ability of graph neural networks when dealing with multi-hop behavior paths, cross-node access patterns, and potential abnormal chains, effectively improving the contextual expression depth of node embeddings and laying a high-quality graph feature foundation for subsequent behavior recognition and tamper tracing.

[0122] In this embodiment, step four specifically includes:

[0123] Based on the final embedding vector of each node, each archive data fragment is copied to generate multiple logical copies. The logical copies can be deployed on local servers, cloud nodes, or edge devices, and each logical copy retains the original data structure and corresponding embedding vector identifier.

[0124] Based on a pre-defined quantum key distribution mechanism, a unique key pair is assigned to each logical copy, and the logical copy and the final embedding vector are jointly signed to generate the corresponding quantum signature value.

[0125] The quantum signature value, along with the corresponding logical replica number, replica deployment location identifier, replica generation time stamp, and final embedding vector, is submitted to the distributed ledger.

[0126] The distributed ledger, based on an immutable distributed consensus mechanism, writes the signature information of each logical copy into the ledger, forming a chain of signature fingerprint records.

[0127] This step constructs multiple logical copies of archival data that can be deployed in heterogeneous environments, and uses a quantum key distribution mechanism to perform joint signature processing on each copy, achieving strong trust binding and independent verification at the copy level. Simultaneously, it employs a distributed ledger to store signature fingerprints, constructing an immutable chain record structure, significantly improving the tamper-proof capability and copy consistency and auditability of archival data in distributed application scenarios.

[0128] In this embodiment, step five specifically includes:

[0129] When a data fragment is accessed or modified, key elements of the current operation are collected in real time. These key elements include user identification, access time, access frequency, access device identification, device type, device location, terminal trust level, access operation type, and target data fragment number. The key elements are then arranged into a structured access event sequence in chronological order to form the current access trajectory.

[0130] The current access trajectory is non-linearly aligned with a pre-stored set of historical legal access trajectories using Soft-DTW, and a matching index is calculated. The matching index is used to measure the similarity of the access trajectories in the time dimension.

[0131] The matching index corresponding to the current access trajectory is compared with the set abnormal behavior threshold. If it is higher than the abnormal behavior threshold and no historical legitimate access trajectory is matched, the current access trajectory is determined to be an abnormal access trajectory.

[0132] This step involves collecting multi-dimensional key elements of access behavior and constructing a time-ordered sequence of access events. The Soft-DTW algorithm is then introduced to perform non-linear alignment analysis between the current trajectory and historical legitimate trajectories. This approach can accurately identify potential abnormal access patterns, effectively improve the system's dynamic perception and early warning capabilities for cross-time period and multi-path tampering behaviors, and enhance the real-time security monitoring level of the archive access process.

[0133] In this embodiment, step six specifically includes:

[0134] Extract all logical copies of the archive data fragment nodes bound to the current abnormal access trajectory;

[0135] Read the corresponding logical copy content and the final embedding vector one by one, and regenerate the current quantum signature value using the same key pair;

[0136] Verify the current signature value bit by bit against the chained signature fingerprint records registered in the distributed ledger;

[0137] If a quantum signature value is found to be inconsistent, it is marked as a tampered copy, and all tampered copies are aggregated to generate a tampering audit report.

[0138] This step, by recalculating the signature value and performing bit-by-bit verification of the chained signature fingerprint on the archive data copies associated with abnormal access, can quickly identify tampered copies and achieve accurate tampering determination at the copy level. Simultaneously, by summarizing the information on tampered copies to generate a structured audit report, it provides credible evidence for subsequent accountability and evidence collection, significantly improving the accuracy of archive tampering detection and the audit closed-loop capability.

[0139] refer to Figure 2 A data tamper-proof security management system for archives includes the following modules:

[0140] The data acquisition and fragmentation module is used to collect raw archive data and archive access behavior log information, and to perform content fragmentation processing on the raw archive data to generate a set of archive data fragments;

[0141] The Archive Access Heterogeneous Graph Construction Module is used to construct an archive access heterogeneous graph based on a set of archive data fragments and archive access behavior log information.

[0142] The final embedding vector generation module is used to input the heterogeneous map of archive access into the improved GATv2 model, and perform original feature construction, temporal location encoding, multi-order neighbor sampling and multi-order attention aggregation on the target node to generate the final embedding vector.

[0143] The logical copy and quantum signature module is used to generate multiple logical copies for each file data fragment based on the node embedding vector, generate quantum signature values, and write them into the distributed ledger to form a chain of signature fingerprint records.

[0144] The access trajectory monitoring module is used to collect key elements of the current operation behavior in real time when archive data is accessed or modified to construct the current access trajectory, and use Soft-DTW to perform alignment analysis with historical legitimate access trajectories to calculate trajectory matching indicators and determine whether there are access anomalies.

[0145] The signature verification module is used to calculate the current quantum signature value and verify it bit by bit against the chain signature fingerprint record after detecting abnormal access behavior to determine whether there is a tampered copy.

[0146] This step, by constructing a multi-module collaborative system including data acquisition, graph modeling, intelligent embedding, quantum signature, trajectory monitoring, and signature verification, achieves secure control and reliable verification of archival data throughout the entire process from generation and use to auditing. It significantly improves the intelligence level, tamper prevention capabilities, and abnormal behavior response efficiency of the archival management system, and has broad engineering application value and promotion prospects.

[0147] Example 1:

[0148] To verify the feasibility of this invention in practice, it was applied to the digital archives platform of a municipal archives. This archives has long suffered from a lack of intelligent monitoring and tampering detection capabilities during access to massive amounts of electronic archives. Especially in the context of remote collaborative access, high-frequency operations by numerous staff members, and long-term storage, traditional log recording and access control methods are insufficient to meet the refined management needs for data tamper prevention and access traceability. The archives' data system includes document archives, image archives, scanned copies, and various types of metadata, with daily access requests exceeding 80,000. It exhibits significant risk characteristics such as frequent device switching, overlapping user permissions, and decreased similarity in access patterns, making it highly susceptible to becoming a breeding ground for covert tampering and illegal export activities.

[0149] The proposed data tamper-proof security management method for archives was deployed and verified in the archive system. The system first connects to the archive data catalog and user access log database, automatically performing semantic segmentation of each archive according to paragraph level and title structure. A 3000-word archive is broken down into approximately 18 segments, each bound with a unique number, metadata, and generation time. Subsequently, the system constructs a heterogeneous archive access graph with archive data segments, accessing users, and terminal devices as nodes, and access relationships, shared paths, and device switching behaviors as edges. In this scenario, the initial graph contains 420,000 nodes and approximately 1.9 million edges.

[0150] The above graph was input into the improved GATv2 model. The model automatically identified potential chained access paths in high-frequency access and redirection behaviors and generated time-sensitive embedding vectors for each graph node. In an abnormal access event, the model accurately identified the behavior of two different IP devices logging into the same account and repeatedly accessing the same file segment within 20 minutes. Its Soft-DTW trajectory similarity score was only 0.42, far below the system's set threshold of 0.87, triggering an anomaly judgment. The system recalculated the signatures of the multi-copy logical storage content of the relevant data segments and found that the signature verification of a copy deployed on the edge node failed. By tracing the verification offset log, it was found that the copy had been tampered with and resubmitted. The copy was successfully marked and blocked, and a structured tampering audit report containing abnormal path nodes, signature verification records, visitor device information, and handling suggestions was generated.

[0151] To quantify the differences between the method of this invention and traditional solutions in actual operation, the system was run for 72 hours of simulation testing. The key security indicators of the traditional access log auditing method and the intelligent anti-tampering method of this invention were compared, and the results are shown in Table 1.

[0152] Table 1: Comparison of the effectiveness of traditional methods and the method of this invention in the application of anti-tampering of archive access.

[0153] Indicator Item Traditional access log auditing methods Method of the present invention Increase Average anomaly detection response time (s) 139 17 -87.8% Accuracy of suspicious access path identification 68.3% 94.7% +38.6% Accuracy of tampered copy identification Unable to automatically determine 100% — False alarm rate (false alarms due to normal behavior) 14.2% 2.1% -85.2% Multi-device collaborative access chain identification capability Not supported Supports (3rd order subgraph) Enhanced support capabilities Real-time signature re-verification of copy number Not supported 1106 copies Enhanced support capabilities

[0154] As shown in Table 1, the method of this invention significantly outperforms traditional log auditing methods in terms of average response latency, anomaly detection accuracy, and false alarm rate. In particular, it possesses capabilities completely lacking in traditional technologies, such as supporting complex multi-hop access chain identification, edge node replica verification, and chained audit report generation. Within 72 hours, it successfully intercepted 9 instances of tampering and generated 9 complete audit records, significantly improving system security response speed and data integrity assurance levels, providing a reliable solution for intelligent auditing for large-scale archival institutions.

[0155] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for tamper-proof security management of archival data, characterized in that, include: Step 1: Collect raw archive data and archive access behavior log information, and process the raw archive data into content fragments to obtain a set of archive data fragments; Step 2: Construct a heterogeneous map of archive access based on the set of archive data fragments and archive access behavior log information; Step 3: Input the heterogeneous map of archive access into the improved GATv2 model to generate the final embedding vector for each node; Step 4: Generate multiple logical copies of the archive data fragment based on the final embedding vector of each node, generate corresponding quantum signature values, and form a chain signature fingerprint record; Step 5: When archive data is accessed or modified, record the current access trajectory, and align and analyze the current access trajectory with historical legitimate access trajectories based on Soft-DTW to determine if there are any access anomalies; Step Six: Once an access anomaly is detected, calculate the current quantum signature value and compare it with the chain signature fingerprint record to mark the tampered copy, and generate a tampering audit report.

2. The method for tamper-proof security management of archival data according to claim 1, characterized in that, Step one specifically involves: The original archival data includes the main text of the archive, archival metadata information, archival attachments, archival generation timestamps, and archival classification tags; The file access behavior log information includes visitor identity, access time, access device identity, and access operation type; The content fragmentation process is as follows: The original archival data is processed to separate the main text and non-main text content. The main text content and non-main text content are extracted into independent fields for the main text content and independent fields for the non-main text content, respectively. The non-main text content includes archival metadata information, archival attachment files, archival generation timestamps, and archival classification tags. Based on the paragraph structure and logical heading level in the independent fields of the main text of the archive, the main text of the archive is divided into multiple semantically complete paragraph units according to the predefined structural semantic boundaries to obtain archive data fragments; Each archival data fragment is bound to its original archive number, paragraph level number, and independent fields for non-textual content, forming a traceable set of archival data fragments.

3. The method for tamper-proof security management of archival data according to claim 1, characterized in that, Step two specifically involves: The nodes of the heterogeneous graph of file access include file data fragment nodes, visitor nodes, and access device nodes. The visitor nodes are used to represent user identity entities, and the access device nodes are used to represent terminal devices accessing files. The edges of the heterogeneous graph of file access include access relationship edges, sharing relationship edges, and cross-device transfer relationship edges; Access relationship edges are used to connect visitor nodes and file data fragment nodes, representing user actions such as reading, editing, and downloading file data; Shared relationship edges are used to connect visitor nodes or visitor nodes and access device nodes, representing the sharing, forwarding, or collaborative editing of archive data; Cross-device transfer relationship edges are used to connect the access behavior of the same visitor to the same archive data segment across different devices, representing the device jump path in the access chain; When a new access behavior is detected, the corresponding node and edge are dynamically added, and the access operation type and access time attribute information of the relevant edge are updated to construct a dynamic heterogeneous graph of archive access.

4. The method for tamper-proof security management of archival data according to claim 1, characterized in that, The improved GATv2 model is specifically as follows: The improved GATv2 model includes a raw feature construction module, a temporal location encoding module, a multi-order neighbor sampling module, a multi-head attention aggregation module, and an embedding generation module; The heterogeneous map of archive access is input into the original feature construction module, which constructs original feature vectors for archive data fragment nodes, visitor nodes, and access device nodes in the heterogeneous map of archive access, respectively, to obtain the original node feature vector set. The original feature vectors include: The original feature vector of the archival data fragment node includes the original archive number, paragraph level number, and independent fields for non-textual content of the archive; The original feature vector of the visitor node includes user identity, access frequency, access time, and access operation type; The original feature vector of the accessing device node includes the accessing device identifier, device type, device location, and terminal trust level; The original set of node feature vectors is input into the time position encoding module, which calculates the relative position offset with respect to the global reference time for the time window and generates a time position encoding vector. The temporal location encoding vector is concatenated with the original node feature vector to form a temporally enhanced node feature representation; The time-enhanced node feature representation is input into the multi-order neighbor sampling module. The multi-order neighbor sampling module constructs first-order, second-order, and third-order adjacency subgraphs centered on each target node, and outputs a set of multi-order adjacency subgraphs. For each order of adjacency subgraph, a set of independent weight parameters is set, and the temporally enhanced node feature vectors are linearly transformed and mapped to a unified feature space. Based on the established weight parameters, each target node and its neighboring nodes are mapped to the feature space to generate the feature representation of the target node and the feature representation of the neighboring nodes. The feature representation of the target node is concatenated with the feature representation of each adjacent node to obtain the semantic aggregation result of the target node in each order of the adjacency subgraph; The semantic aggregation results of first-order, second-order, and third-order are concatenated into a unified multi-order attention aggregation representation; The multi-order attention aggregation representation is input into the embedding generation module, and the final embedding vector of each node is output through a non-linear mapping function.

5. A method for tamper-proof security management of archival data according to claim 4, characterized in that, The specific steps for constructing first-order, second-order, and third-order adjacency subgraphs are as follows: Taking each target node in the heterogeneous graph of file access as the center, find all adjacent nodes that have direct connection edges with the target node to form a first-order set of adjacent nodes. The target node is a time-enhanced node feature representation to be processed. Based on the edge relationship between the first-order adjacent node set and the target node, a first-order adjacent subgraph is constructed, which includes the target node, first-order adjacent nodes, and connecting edges. Based on the first-order adjacency node set, continue to search for the direct adjacency node of each first-order adjacency node, remove the target node that has appeared in the first order, and form the second-order adjacency node set. Based on the connection relationship between the target node and its first-order and second-order adjacent nodes, a second-order adjacency subgraph is constructed. The second-order adjacency subgraph includes the target node, first-order adjacent nodes, second-order adjacent nodes, and all edge structures. Based on the second-order adjacency set, find the direct adjacency of each second-order adjacency node, remove the nodes that have already appeared in the first or second order, and form the third-order adjacency set. Based on the edge relationships between the target node and its first-order, second-order, and third-order adjacent nodes, a third-order adjacency subgraph is constructed, which contains all connection paths between the target node and its third-order adjacent nodes.

6. The method for tamper-proof security management of archival data according to claim 1, characterized in that, Step four specifically involves: Based on the final embedding vector of each node, each archive data fragment is copied to generate multiple logical copies. The logical copies are deployed on local servers, cloud nodes, or edge devices, and each logical copy retains the original data structure and the corresponding final embedding vector. Based on a pre-defined quantum key distribution mechanism, a unique key pair is assigned to each logical copy, and the logical copy and the final embedding vector are jointly signed to generate the corresponding quantum signature value. The quantum signature value, along with the corresponding logical replica number, replica deployment location identifier, replica generation time stamp, and final embedding vector, is submitted to the distributed ledger. The distributed ledger is based on an immutable distributed consensus mechanism that writes the signature information of each logical copy into the distributed ledger to form a chain of signature fingerprint records.

7. The method for tamper-proof security management of archival data according to claim 1, characterized in that, Step five specifically involves: When a data fragment is accessed or modified, key elements of the current operation are collected in real time. These key elements include user identification, access time, access frequency, access device identification, device type, device location, terminal trust level, access operation type, and target data fragment number. The key elements are then arranged into a structured access event sequence in chronological order to form the current access trajectory. The current access trajectory is non-linearly aligned with a pre-stored set of historical legal access trajectories using Soft-DTW, and a matching index is calculated. The matching index is used to measure the similarity of the access trajectories in the time dimension. The matching index corresponding to the current access trajectory is compared with the set abnormal behavior threshold. If it is higher than the abnormal behavior threshold and no historical legitimate access trajectory is matched, the current access trajectory is determined to be an abnormal access trajectory.

8. The method for tamper-proof security management of archival data according to claim 1, characterized in that, Step six specifically involves: Extract all logical copies of the archive data fragment nodes bound to the current abnormal access trajectory; Read the corresponding logical copy content and the final embedding vector one by one, and regenerate the current quantum signature value using the same key pair; Verify the current signature value bit by bit against the chained signature fingerprint records registered in the distributed ledger; If a quantum signature value is found to be inconsistent, it is marked as a tampered copy, and all tampered copies are aggregated to generate a tampering audit report.

9. A data tamper-proof security management system based on archival data according to claim 1, comprising a data tamper-proof security management method based on any one of claims 1 to 8, characterized in that, Includes the following modules: The data acquisition and fragmentation module is used to collect raw archive data and archive access behavior log information, and to perform content fragmentation processing on the raw archive data to generate a set of archive data fragments; The Archive Access Heterogeneous Graph Construction Module is used to construct an archive access heterogeneous graph based on a set of archive data fragments and archive access behavior log information. The final embedding vector generation module is used to input the heterogeneous map of archive access into the improved GATv2 model, and perform original feature construction, temporal location encoding, multi-order neighbor sampling and multi-order attention aggregation on the target node to generate the final embedding vector. The logical copy and quantum signature module is used to generate multiple logical copies for each file data fragment based on the node embedding vector, generate quantum signature values, and write them into the distributed ledger to form a chain of signature fingerprint records. The access trajectory monitoring module is used to collect key elements of the current operation behavior in real time when archive data is accessed or modified to construct the current access trajectory, and use Soft-DTW to perform alignment analysis with historical legitimate access trajectories to calculate trajectory matching indicators and determine whether there are access anomalies. The signature verification module is used to calculate the current quantum signature value and verify it bit by bit against the chain signature fingerprint record after detecting abnormal access behavior to determine whether there is a tampered copy.

Images