A cloud government affair sensitive data encryption protection method

Abstract

The present application relates to the field of computer data security and encryption technology, and particularly relates to a cloud government affair sensitive data encryption protection method.A cloud government affair sensitive data encryption protection method comprises the following steps: S1: obtaining a full-amount data asset composition original data set in a target cloud government affair environment, and determining a data attribute combination set according to the original data set; S2: constructing a data set for statistical analysis based on the original data set, and performing sensitivity calculation on the data attribute combination set according to the data set to obtain a sensitivity calculation result.The present application realizes accurate classification and encryption of government affair data by dynamic sensitivity evaluation and file classification, and constructs a joint sensitive probability model; and the present application combines a basic protection and a strategy inheritance double architecture, dynamically adjusts a key, and effectively improves the protection capability of temporary and time-effective files and cloud self-adaptability.

Description

Technical Field

[0001] This invention relates to the field of computer data security and encryption technology, and in particular to a cloud-based method for encrypting and protecting sensitive government data. Background Technology

[0002] Existing protection technologies have established a standardized protection scheme for protecting structured databases and persistent storage files by setting up a data classification and grading system and predefined encryption strategies, and adopting a key rotation mechanism based on fixed periods, thus providing basic security support for the migration of government data to the cloud.

[0003] However, current methods are significantly limited in their protective effectiveness against dynamically generated temporary work files and time-sensitive documents with clearly defined lifecycles in government cloud environments. Static encryption strategies struggle to adapt to the dynamic changes in file lifecycles, failing to effectively cover geographically dispersed and randomly named temporary files, and lacking the ability to dynamically adjust encryption strength based on the sensitivity decay of time-sensitive documents. This results in highly sensitive information remaining in plaintext form in temporary files, creating a data leakage risk, while expired time-sensitive documents continue to consume high-strength encryption resources, causing a significant imbalance between security protection and operational efficiency.

[0004] Therefore, there is an urgent need to build an adaptive encryption method that can sense the dynamic characteristics of data, so as to break through the inherent limitations of static strategies and achieve refined security management of the entire lifecycle of cloud-based government data. Summary of the Invention

[0005] To overcome the rigidity of static encryption, this invention provides a cloud-based method for encrypting and protecting sensitive government data.

[0006] The technical implementation scheme of this invention is: a cloud-based encryption and protection method for sensitive government data, comprising the following steps: S1: Obtain the complete set of data assets in the target cloud-based government environment to form the original data set, and determine the set of data attribute combinations based on the original data set; S2: Construct a dataset for statistical analysis based on the original dataset, and perform sensitivity calculation on the data attribute combination set according to the dataset to obtain the sensitivity calculation result; S3: Obtain the file objects in the dataset, and generate a temporary file set and a time-sensitive file set by identifying the file types of the file objects according to predefined rules; S4: Determine the cloud-based government data encryption and protection method based on the temporary file set and the time-sensitive file set, combined with the sensitivity calculation results.

[0007] Preferably, the acquisition of all data assets in the target cloud-based government environment constitutes an original data set, and the determination of a data attribute combination set based on the original data set includes: The original dataset is parsed and features are extracted to obtain all basic data attributes; The basic data attributes are divided according to natural categories to generate a list of basic data attributes; Based on business logic and data relationships, different basic data attributes in the basic data attribute list are combined to generate a set of data attribute combinations to be evaluated.

[0008] Preferably, the step of constructing a dataset for statistical analysis based on the original data set, and performing sensitivity calculations on the data attribute combination set according to the dataset to obtain sensitivity calculation results includes: The dataset is a collection of data whose basic data attributes have been extracted and stored in a structured manner; The frequency of occurrence of each data attribute combination is counted in the dataset, and the number of basic data attributes contained in each data attribute combination is recorded. Sensitivity is obtained based on the frequency of occurrence and the number of basic data attributes.

[0009] Preferably, obtaining sensitivity based on the frequency of occurrence and the number of basic data attributes includes: the sensitivity calculation formula is: ; in, For the first The original sensitivity score of each data attribute combination For the first The number of basic data attributes in a combination of data attributes The total number of records in the dataset. For the first The frequency of occurrence of a combination of data attributes in the dataset. This is the lifespan factor for temporary files. As a sensitivity attenuation factor for time-sensitive documents, For temporary document factor weighting coefficients, This refers to the weighting coefficient of the timeliness document factor. This is the baseline value for the maximum number of attributes. This is the baseline value for the maximum temporary file lifespan. This is the baseline value for the maximum sensitivity decay period.

[0010] Preferably, the step of obtaining file objects from the dataset and generating a temporary file set and a time-sensitive file set by identifying the file objects according to predefined rules includes: The file object contains file metadata and file content; The predefined rules include temporary file identification rules: identification is based on at least one of file path patterns, file naming rules, and creation process characteristics; Time-sensitive document identification rules: Identification is based on at least one of the creation time, modification time, and expiration time markers in the file metadata.

[0011] Preferably, the method for determining cloud-based government data encryption and protection based on the temporary file set and the time-sensitive file set, combined with the sensitivity calculation result, includes: For each temporary file in the set of temporary files, extract all combinations of data attributes; For each time-sensitive file in the aforementioned time-sensitive file set, extract all data attribute combinations; Based on the sensitivity calculation results, obtain the normalized sensitivity score corresponding to each data attribute combination; For each temporary file and time-limited file, sort all data attribute combinations in descending order according to the normalized sensitivity score to generate the sorting results; If the maximum normalized sensitivity score of the temporary file in the sorting result is higher than the preset high sensitivity threshold, and there is an associated time-sensitive file, then the lifecycle synchronization factor is calculated. If the sensitivity distribution types of the temporary files and the associated time-sensitive files in the sorting results are inconsistent, then the security policy inheritance anomaly factor is calculated. If the maximum normalized sensitivity score of the associated time-sensitive file in the sorting result is higher than the preset high sensitivity threshold, and the current system time exceeds the expiration timestamp of the associated time-sensitive file, then the data shadow risk factor is calculated. Based on the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor, a joint sensitivity probability is calculated, and a cloud-based government data encryption protection method is determined according to the joint sensitivity probability.

[0012] Preferably, if the maximum normalized sensitivity score of the temporary file in the sorting result is higher than a preset high sensitivity threshold, and there are associated time-sensitive files, then the lifecycle synchronization factor is calculated, including: The associated time-sensitive files are determined through file path pattern matching, process creation chain correlation analysis, or content similarity; the lifecycle synchronization factor is calculated using the following formula: ; in, As a life cycle synchronization factor, Create timestamps for temporary files. This is the expected deletion timestamp for the temporary file. Create timestamps for associated time-sensitive documents. This is the expiration timestamp of the associated time-sensitive document.

[0013] Preferably, if the sensitivity distribution types of the temporary files and associated time-sensitive files in the sorting results are inconsistent, the calculation of the security policy inheritance anomaly factor includes: The sensitivity distribution types include high sensitivity distribution, mixed distribution, or low sensitivity distribution; the formula for calculating the security policy inheritance anomaly factor is: ; in, To inherit abnormal factors for security policies, For the first A strategy inheritance mismatch indicator This represents the total number of strategy dimensions for security checks. The number of historical orphan documents, This represents the total number of files in the system.

[0014] Preferably, if the maximum normalized sensitivity score of the associated time-sensitive file in the sorting result is higher than a preset high sensitivity threshold, and the current system time exceeds the expiration timestamp of the associated time-sensitive file, then the data shadow risk factor is calculated, including: the data shadow risk factor calculation formula is: ; in, As a data shadow risk factor, The current overall sensitivity score for temporary files. The overall sensitivity score for the associated time-sensitive documents. This is the current system timestamp. This is the expiration timestamp for the time-sensitive document. Create timestamps for time-sensitive documents.

[0015] Preferably, the step of calculating the joint sensitivity probability based on the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor, and determining the cloud-based government data encryption protection method according to the joint sensitivity probability, includes: the joint sensitivity probability calculation formula is: ; in, For joint sensitivity probability, As an overall regulatory factor, To synchronize weights throughout the lifecycle, To inherit abnormal weights for the strategy, Data shadow risk weights; The encryption level is determined based on the file sensitivity distribution type, and a corresponding key rotation cycle is set; the degree of inheritance of the encryption strategy of the temporary file to the associated time-limited file is determined according to the joint sensitivity probability threshold; when the time-limited file completes its life cycle processing, the associated temporary file synchronously performs encryption strategy adjustment and file disposal.

[0016] Beneficial Effects: This invention constructs a dynamic evaluation system based on the frequency of occurrence and the number of attributes by analyzing the features of all data assets and quantifying the sensitivity of attribute combinations, thereby achieving accurate characterization of the sensitive features of government data. By establishing a classification and identification mechanism for temporary and time-sensitive documents, combined with sensitivity distribution type determination and document association analysis, the joint sensitivity probability is calculated and a hierarchical encryption scheme is constructed. A key rotation mechanism dynamically associated with the sensitivity level is adopted, ensuring that the encryption strength accurately matches the actual risk, effectively overcoming the shortcomings of traditional static encryption strategies in providing insufficient protection for temporary documents and lagging adjustments for time-sensitive documents. By establishing a two-layer architecture combining unified basic protection and policy inheritance, all documents receive matching basic encryption, while ensuring that derived temporary documents inherit the parent security policy in a timely manner. This significantly enhances the overall protection level of government data and strengthens the encryption system's adaptability to the dynamic cloud environment. Attached Figure Description

[0017] Figure 1 This is a flowchart of a cloud-based method for encrypting and protecting sensitive government data according to the present invention. Figure 2 This is a schematic diagram of the cloud-based government data encryption and protection method of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] A cloud-based method for encrypting and protecting sensitive government data, such as Figure 1 and Figure 2 As shown, it includes the following steps: S1: Obtain the complete set of data assets in the target cloud-based government environment to form the original data set, and determine the set of data attribute combinations based on the original data set; The original dataset is parsed and features are extracted to obtain all basic data attributes; The basic data attributes are divided according to natural categories to generate a list of basic data attributes; Based on business logic and data relationships, different basic data attributes in the basic data attribute list are combined to generate a set of data attribute combinations to be evaluated.

[0020] It should be noted that, to ensure comprehensive protection of sensitive data dynamically generated and transferred in the cloud-based government environment, a systematic collection of all data assets within the distributed storage system is first required. This process relies on calls to cloud platform data interfaces, combined with a comprehensive scan of file storage services and deep analysis of database metadata, thereby covering structured data tables and unstructured document logs to form the original data set. Traditional static encryption methods fail to identify the semantic relationships between data attributes, making it difficult for encryption strategies to match the actual sensitivity of the data, resulting in insufficient protection or wasted resources.

[0021] Based on this, the original dataset is parsed and its features are extracted. Pre-defined sensitive data patterns are matched using regular expressions, and the semantic meaning of text fields is identified using a natural language processing model, thereby accurately extracting basic data attributes with clear security implications. Subsequently, based on their inherent semantic categories, the attributes are divided into natural categories such as personal identity, health and medical care, and communication, forming a structured list of basic data attributes.

[0022] Furthermore, based on business logic and data relationships, the attributes in the list are effectively combined. For example, in the medical insurance business scenario, name and health status are combined into a composite sensitive information unit; or based on high-frequency co-occurrence statistics, ID number and home address are linked. Such combinations effectively characterize multi-attribute joint sensitivity patterns, laying a data foundation for subsequent sensitivity measurement based on frequency and association scale. This overcomes the inherent limitations of fixed strategies in adapting to dynamic business environments and provides key input for building a precise and adaptive encryption protection system.

[0023] S2: Construct a dataset for statistical analysis based on the original dataset, and perform sensitivity calculation on the data attribute combination set according to the dataset to obtain the sensitivity calculation result; The dataset is a collection of data whose basic data attributes have been extracted and stored in a structured manner; The frequency of occurrence of each data attribute combination is counted in the dataset, and the number of basic data attributes contained in each data attribute combination is recorded. Sensitivity is obtained based on the frequency of occurrence and the number of basic data attributes.

[0024] The formula for calculating sensitivity is: ; in, For the first The original sensitivity score of each data attribute combination For the first The number of basic data attributes in a combination of data attributes The total number of records in the dataset. For the first The frequency of occurrence of a combination of data attributes in the dataset. This is the lifespan factor for temporary files. As a sensitivity attenuation factor for time-sensitive documents, For temporary document factor weighting coefficients, This refers to the weighting coefficient of the timeliness document factor. This is the baseline value for the maximum number of attributes. This is the baseline value for the maximum temporary file lifespan. This is the baseline value for the maximum sensitivity decay period.

[0025] It should be noted that, to overcome the inherent limitations of static encryption strategies in cloud-based government environments where they struggle to dynamically adapt to changes in data sensitivity, this step achieves quantitative sensitivity assessment by constructing a dataset specifically for statistical analysis. This dataset is organized using a structured storage format, based on fundamental data attributes extracted from the original dataset. For example, it uses tables to systematically record attribute names, types, and values. The core function of this dataset is to provide a statistical basis for sensitivity calculation; essentially, it is an analytical set containing all combinations of data attribute features. The weight coefficients are optimized and determined using machine learning methods based on historical data, such as random forest feature importance analysis combined with cross-validation, to ensure the objectivity and effectiveness of the weight allocation.

[0026] After the dataset is constructed, it is necessary to count the frequency of occurrence of each data attribute combination and the number of underlying data attributes it contains. The lower the frequency, the rarer the data combination is in the business environment, and its potential sensitivity is often higher; the more underlying data attributes, the more complex the data association dimensions, and the corresponding security risk level is significantly increased. Traditional methods, lacking such dynamic statistical mechanisms, are unable to identify high-risk characteristics of low-frequency, multi-attribute combinations such as "ID number + medical diagnosis".

[0027] The core function of these three benchmark values ​​is normalization, that is, scaling values ​​with different dimensions and ranges to a relatively standard and comparable range (between 0 and 1), thereby making the sensitivity calculation formula more balanced and stable. Maximum Attribute Quantity Benchmark Value: Determined by statistically analyzing the maximum number of basic data attributes contained in all combinations of data attributes that have appeared in historical data. Maximum Temporary File Survival Period Benchmark Value: Based on business needs and system policies, a maximum allowed survival period for temporary files (e.g., 24 hours, 7 days) is preset as a benchmark. Maximum Sensitivity Decay Period Benchmark Value: Determined by analyzing the maximum time span from creation to expiration of all time-limited files in historical data.

[0028] In the sensitivity calculation formula, the number of basic data attributes is positively correlated with the score; the richer the attribute dimensions, the higher the sensitivity assessment value. Frequency of occurrence, on the other hand, influences the score inversely; data combinations with lower frequency have a greater sensitivity weight. The temporary document lifespan factor and the time-limited document sensitivity decay factor further introduce a dynamic adjustment mechanism. For example, short-lived temporary documents have their instantaneous risk weight enhanced by the lifespan factor, while time-limited documents past their expiration date have their encryption strength reduced by the decay factor. Taking government health data as an example, if the combination of "ID number + medical history" appears very infrequently in the dataset and contains multiple key attributes, it will be automatically assigned a high sensitivity score, thereby triggering dynamic key rotation and enhanced encryption strategies to achieve precise matching of security resources with actual risks.

[0029] Example: Taking the aforementioned data attribute combination containing {ID number, disease diagnosis} as an example, the number of its basic data attributes... The value is 2. Assume the total number of records in the dataset is 2. The frequency of this combination is 1,000,000. The maximum number of attributes is set to 100. The value is 5. This combination currently exists in a temporary file with a lifespan factor of 5. The preset maximum temporary file lifespan is 12 hours. For 24 hours, the temporary document factor weighting coefficient The value is 0.1. Meanwhile, the associated time-limited document for this temporary file has expired 30 days ago, and its sensitivity decay factor is 0.1. The preset maximum sensitivity decay period is 30. The timeliness factor weighting coefficient is 365 days. The value is 0.05. The calculation process is as follows: = ≈5.308; = ≈1.0541; =5.308×1.0541≈5.59.

[0030] In stark contrast, the single "name" attribute has a large number of attributes. The frequency of occurrence is 1. Up to 500,000 times, and does not involve temporary or time-limited documents (i.e. =0, =0), its sensitivity calculation result =[ ]×1≈[0.2×0.999]≈0.20.

[0031] The significant differences in the above calculation results strongly confirm the core design premise that "the more complex the attribute combination, the rarer it appears, and the higher the sensitivity in a high-risk temporary file or expired time-limited file environment."

[0032] S3: Obtain the file objects in the dataset, and generate a temporary file set and a time-sensitive file set by identifying the file types of the file objects according to predefined rules; The file object contains file metadata and file content; The predefined rules include temporary file identification rules: identification is based on at least one of file path patterns, file naming rules, and creation process characteristics; Time-sensitive document identification rules: Identification is based on at least one of the creation time, modification time, and expiration time markers in the file metadata.

[0033] It should be noted that, to achieve precise data protection, this stage systematically obtains file objects within the dataset by calling the cloud platform's file system interface. These objects consist of file metadata and file content. The metadata records system attributes such as file path, creation time, revision time, and access permissions, while the file content carries substantive information such as document text or database records. Traditional static encryption systems lack a file category identification mechanism, resulting in insufficient policy adaptability. To address this issue, this solution introduces a classification and identification mechanism based on predefined rules.

[0034] The collection of temporary files relies on feature recognition rules, including searching for the keyword "tmp" in the file path, identifying naming formats with the ".temp" suffix, and analyzing creation characteristics generated by text editor processes. The filtering of time-sensitive files depends on parsing metadata timestamps, such as extracting log files created more than thirty days ago or identifying contract documents with clearly marked expiration dates. Both types of recognition rules follow the principle of 'classification is possible if any condition is met,' a design that effectively adapts to the diverse characteristics of file generation paths in a government cloud environment. Establishing a precise file classification system creates the necessary conditions for subsequent targeted dynamic encryption protection.

[0035] S4: Determine the cloud-based government data encryption and protection method based on the temporary file set and the time-sensitive file set, combined with the sensitivity calculation results.

[0036] For each temporary file in the set of temporary files, extract all combinations of data attributes; For each time-sensitive file in the aforementioned time-sensitive file set, extract all data attribute combinations; Based on the sensitivity calculation results, obtain the normalized sensitivity score corresponding to each data attribute combination; For each temporary file and time-limited file, sort all data attribute combinations in descending order according to the normalized sensitivity score to generate the sorting results; It should be noted that, as Figure 2 As shown, to address the core deficiency of the disconnect between temporary and time-limited files in traditional protection systems, this step systematically extracts the data attribute combinations of the two types of files and implements sensitivity ranking to establish a dynamically correlated security assessment mechanism. Extracting the data attribute combinations of temporary and time-limited files separately aims to accurately identify the inherent correlation characteristics between derived files and the parent file, providing an analytical basis for subsequent policy inheritance. Since the original sensitivity scores have different dimensions, normalization processing can uniformly convert these scores to standard dimensions, thereby ensuring the comparability of sensitivity levels between different attribute combinations.

[0037] By sorting all data attribute combinations within each file in descending order according to their normalized sensitivity scores, the key attribute combinations that dominate the overall security level of the file can be quickly identified. The sorting results not only clearly reveal the data sensitivity structure within the file but also provide core input for subsequent calculations of dynamic evaluation indicators such as lifecycle synchronization factors and security policy inheritance anomaly factors. Traditional static encryption methods, lacking this kind of refined sorting analysis, cannot identify the sensitivity differences between temporary cache files generated during government approval processes and original time-sensitive files, resulting in inaccurate adaptation of encryption strategies.

[0038] Continuing with the previous example, suppose the system, through statistical analysis, obtains the minimum original sensitivity score for all combinations of data attributes as: =0.10, the maximum value is =10.0. The original score is mapped to the [0,1] interval using the Min-Max normalization method.

[0039] For the above combination {ID number, disease diagnosis}, its normalization sensitivity score is: = ≈0.554; Suppose that in a certain government approval process, a temporary document is generated (such as an intermediate cache for approval). After extraction, it is found that it contains three data attribute combinations, with normalized scores of: {combination A (high sensitivity): 0.554}, {combination B (extremely high sensitivity): 0.92}, {combination C (low sensitivity): 0.15}.

[0040] The data is then sorted in descending order based on the normalized sensitivity score, resulting in the ranking: [0.92, 0.554, 0.15]. This result clearly shows that combination B plays a dominant role in the overall sensitivity level of this temporary file. This ranking result will serve as the core input for subsequent calculations of the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor dynamic evaluation indicators, ultimately guiding the system to match a high-level encryption strategy and a short-cycle key rotation mechanism for this file.

[0041] This sorting process enables intelligent determination of high-level encryption response based on the sensitivity distribution characteristics of file internal attribute combinations. This effectively solves the problem of security policy disconnect caused by asynchronous lifecycles and achieves collaborative protection for temporary and time-sensitive files.

[0042] If the maximum normalized sensitivity score of the temporary file in the sorting result is higher than the preset high sensitivity threshold, and there is an associated time-sensitive file, then the lifecycle synchronization factor is calculated. The associated time-sensitive files are determined through file path pattern matching, process creation chain correlation analysis, or content similarity; the lifecycle synchronization factor is calculated using the following formula: ; in, As a life cycle synchronization factor, Create timestamps for temporary files. This is the expected deletion timestamp for the temporary file. Create timestamps for associated time-sensitive documents. This is the expiration timestamp of the associated time-sensitive document.

[0043] It should be noted that when the maximum normalized sensitivity score of a temporary file exceeds the preset high sensitivity threshold and there are associated time-sensitive files, the lifecycle synchronization factor calculation will be initiated. The maximum normalized sensitivity score represents the evaluation result of the most sensitive data attribute combination contained in the file. This indicator can accurately identify high-risk temporary files that require key protection. The determination of associated time-sensitive files is achieved through three technical paths: file path pattern matching for association identification based on directory structure similarity; process creation chain association analysis to track the causal relationship of file generation process; and content similarity detection to establish file association through text feature comparison.

[0044] The lifecycle synchronization factor quantifies the degree of coordination between temporary files and associated time-limited files in terms of their existence time; a higher value indicates better lifecycle synchronization. This factor is calculated by comparing the difference between the lifespan of temporary files and the validity period of time-limited files, specifically reflected in the ratio between the absolute difference in the duration of the two lifecycles and the longer lifecycle. In government application scenarios, when there is a significant lifecycle difference between the temporary editing cache file and the original document, this factor can promptly identify the risk of this security policy asynchrony, thereby triggering an encryption policy adjustment mechanism and effectively addressing security vulnerabilities caused by file lifecycle mismatches in traditional protection systems.

[0045] The preset high sensitivity threshold is determined based on historical data statistical analysis. For example, the 85th percentile of the normalized sensitivity score of all files in the dataset is used as the benchmark value, and it is dynamically adjusted according to the business security level requirements.

[0046] Scenario Continuation: The aforementioned temporary file (combination B score 0.92) was identified as high-risk, and its associated parent expired file was determined through file path pattern matching (e.g., the temporary file path is / var / tmp / approval_cache_policy_draft_A.doc, and the associated expired file path is / home / department / policy_draft_A.doc).

[0047] Parameter settings: Temporary file creation time Expected deletion time of temporary files: 2024-10-20 10:00:00 : 2024-10-21 10:00:00 (surviving for 1 day), associated time-limited file creation time : 2024-01-01 09:00:00, the expiration time of the associated time-limited document. : 2024-12-31 18:00:00 (Valid for 365 days).

[0048] Calculation process: Calculate the lifespan of temporary files: - =1 day, calculating the lifespan of time-sensitive documents: - =365 days, calculate the absolute difference of the life cycle: |1-365|=364 days, calculate the maximum life cycle: max(1,365)=365 days.

[0049] Substitute into the formula: =1-(364 / 365)≈1-0.997≈0.003.

[0050] Interpretation of results: Life cycle synchronicity factor The value is approximately 0.003, very close to 0, indicating a significant misalignment between the lifecycle of the temporary file and its parent, time-limited file. The parent file represents a long-term valid policy, while the temporary cache is quickly deleted, creating a huge gap in management strategy and posing a security risk.

[0051] If the sensitivity distribution types of the temporary files and the associated time-sensitive files in the sorting results are inconsistent, then the security policy inheritance anomaly factor is calculated. The sensitivity distribution types include high sensitivity distribution, mixed distribution, or low sensitivity distribution; the formula for calculating the security policy inheritance anomaly factor is: ; in, To inherit abnormal factors for security policies, For the first A strategy inheritance mismatch indicator This represents the total number of strategy dimensions for security checks. The number of historical orphan documents, This represents the total number of files in the system.

[0052] It should be noted that the core challenge of protecting cloud-based government data lies in the difficulty of traditional static encryption mechanisms in coordinating the sensitivity of temporary and time-sensitive files. When a significant difference in the sensitivity distribution characteristics of the two types of files is detected, the security policy inheritance anomaly assessment process is automatically triggered. The determination of the sensitivity distribution type is based on the normalized score pattern of the file's internal attribute combinations: a high sensitivity pattern corresponds to a state where most attribute combinations exceed the risk threshold, indicating a prominent overall security threat; a low sensitivity pattern is characterized by the main attribute combinations remaining below the security baseline, indicating that potential risks are controllable; a mixed pattern presents a situation where high and low risk attributes coexist, requiring differentiated protection deployment. The calculation of this anomaly factor integrates multi-dimensional policy matching degree analysis and historical system operation and maintenance data. The policy inheritance mismatch indicator performs deviation detection on core dimensions such as encryption algorithm strength and key update frequency. The total number of policy dimensions encompasses all security inspection directions, the number of historical orphan files records residual temporary files that have not been properly handled by the system, and the total number of files constitutes a standardized reference for global risk assessment. Taking the circulation of government documents as an example, when the edited cache file shows highly sensitive characteristics while the original time-sensitive file shows low-risk attributes, the abnormal factor transmits the degree of failure through the quantification strategy, prompting the encryption system to achieve dynamic reconstruction, thereby repairing the security defects caused by the interruption of strategy inheritance in traditional protection.

[0053] Scenario Context: Analysis revealed that the aforementioned temporary file exhibits a high-sensitivity distribution (due to the presence of multiple high-score combinations), while its associated parent time-sensitive file, having passed its initial confidentiality period, is classified as having a mixed sensitivity distribution. This inconsistency in distribution types triggers anomaly calculations.

[0054] Parameter settings: Total number of strategy dimensions :5 (e.g., encryption algorithm strength, key length, key rotation cycle, access control level, log audit granularity), policy inheritance mismatch indicator Upon inspection, two of the five dimensions showed mismatches (e.g., the encryption algorithm strength and key rotation cycle of temporary files did not inherit the parent's high-level strategy), therefore ∑I=2, indicating the number of historical orphan files. 150 (unmanaged files found in the system), total number of files in the system : 1,000,000.

[0055] Calculation process: Calculate the strategy mismatch ratio: 2 / 5 = 0.4; calculate the impact of orphan files: =log(1.00015)≈0.000065.

[0056] Substitute into the formula: =0.4×0.000065≈0.000026.

[0057] Interpretation of results: Security policy inheritance anomaly factor ≈0.000026. Although the value is small, its existence (greater than 0) indicates a quantifiable anomaly in policy inheritance. The presence of orphan files in the system history slightly amplifies the risk assessment of this anomaly.

[0058] If the maximum normalized sensitivity score of the associated time-sensitive file in the sorting results is higher than a preset high sensitivity threshold, and the current system time exceeds the expiration timestamp of the associated time-sensitive file, then a data shadow risk factor is calculated; the formula for calculating the data shadow risk factor is: ; in, As a data shadow risk factor, The current overall sensitivity score for temporary files. The overall sensitivity score for the associated time-sensitive documents. This is the current system timestamp. This is the expiration timestamp for the time-sensitive document. Create timestamps for time-sensitive documents.

[0059] It should be noted that when the maximum normalized sensitivity score of a related time-sensitive document exceeds the preset high sensitivity threshold, and the current system time is later than the document's expiration timestamp, the data shadow risk factor calculation process will be initiated. This dual-condition design aims to identify time-sensitive documents that were originally highly sensitive but have expired. These documents are often downgraded in traditional protection systems, but their derivative temporary files still contain sensitive data, posing a security risk.

[0060] The data shadow risk factor is specifically designed to measure the degree of risk transmission between expired documents and their associated temporary files. A higher factor value indicates a greater potential risk of leakage for the temporary file at the current point in time. In the calculation formula, the ratio of the current overall sensitivity score of the temporary file to the current overall sensitivity score of the associated expired file constitutes the base risk value, while the ratio of the current system time exceeding the expiration timestamp to the file's valid lifespan serves as the risk amplification coefficient. For example, in a government document management scenario, if a highly sensitive policy document whose confidentiality period has expired still maintains high sensitivity in its temporary cached file generated during editing, the data shadow risk factor will quantify this dual risk of time mismatch and sensitivity mismatch, driving the system to maintain or increase the encryption strength of the temporary file. This effectively compensates for data protection vulnerabilities caused by traditional encryption methods neglecting the associated risks of expired files. The preset high sensitivity threshold is determined based on historical data statistical analysis, for example, using the 85th percentile of the normalized sensitivity scores of all files in the dataset as a benchmark value, and dynamically adjusted according to business security level requirements.

[0061] Scenario: The associated parent time-sensitive document (Policy Draft A.doc) also had a normalized sensitivity score that exceeded the threshold, but the current system time has exceeded its expiration timestamp. However, the derived temporary documents still maintain high sensitivity.

[0062] Parameter settings: Current overall sensitivity score of temporary files : 0.92 (using its maximum normalized score to represent the entire file), associated with the current overall sensitivity score of the time-sensitive file. : 0.65 (sensitivity has decreased due to expiration), time-sensitive document creation time : 2024-01-01 09:00:00, the expiration time of the document. : 2024-07-01 18:00:00 (originally valid for six months), current system time 2024-10-25 15:00:00 (Expired approximately 4 months ago).

[0063] Calculation process: Calculate the baseline risk value: 0.92 / 0.65≈1.415; calculate the original lifespan of the document: - =182 days, calculate the overdue period: - =116 days, calculate the risk amplification factor: 1+(116 / 182)≈1+0.637≈1.637.

[0064] Substitute into the formula: =1.415×1.637≈2.317.

[0065] Interpretation of Results: Data Shadow Risk Factor The value is approximately 2.317, which is much greater than 1, indicating that the potential leakage risk of the temporary file is significantly amplified compared to the expired parent file. This is a typical "data shadow" risk, where the value of the parent file decreases, but the residual temporary data remains a high-value attack target.

[0066] Based on the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor, a joint sensitivity probability is calculated, and a cloud-based government data encryption protection method is determined according to the joint sensitivity probability.

[0067] The formula for calculating the joint sensitivity probability is: ; in, For joint sensitivity probability, As an overall regulatory factor, To synchronize weights throughout the lifecycle, To inherit abnormal weights for the strategy, Data shadow risk weights; The encryption level is determined based on the file sensitivity distribution type, and a corresponding key rotation cycle is set; the degree of inheritance of the encryption strategy of the temporary file to the associated time-limited file is determined according to the joint sensitivity probability threshold; when the time-limited file completes its life cycle processing, the associated temporary file synchronously performs encryption strategy adjustment and file disposal.

[0068] It should be noted that in the field of cloud-based government data security protection, traditional static encryption mechanisms often lead to gaps in security policies between temporary and time-sensitive files due to the failure to establish dynamic correlation analysis between files. This stage constructs a joint sensitivity probability calculation model by integrating lifecycle synchronicity factors, policy inheritance anomaly factors, and data shadow risk factors. The calculation results of the three risk factors integrated in this model are all dimensionless pure numbers, ensuring their additivity and comparability: the formulas for the lifecycle synchronicity factor and the data shadow risk factor naturally eliminate the time dimension by calculating the ratio of time periods. The formula for the security policy inheritance anomaly factor is based on the ratio of the number of files to the count ratio of the policy dimension, and its result is also a dimensionless pure number. Based on this unified dimension, the model uses an S-shaped function to transform the weighted combination of each factor into a standardized probability output. The overall adjustment factor (k) is responsible for controlling the concentration of the probability distribution, while the weight coefficients (γ, δ, η) dynamically allocate the influence of different factors according to the business scenario. Each weight coefficient is determined through optimization using machine learning methods based on historical data, such as random forest feature importance analysis combined with cross-validation, to ensure the objectivity and effectiveness of weight allocation.

[0069] The technical logic behind setting encryption levels based on file sensitivity distribution types lies in the fact that different distribution characteristics directly reflect the inherent risk structure of the data. High-sensitivity distributions require enhanced encryption and short-cycle key rotation to address ongoing threats, while low-sensitivity distributions employ basic protection to optimize resource allocation. The joint sensitivity probability threshold, as the trigger mechanism for policy inheritance, essentially determines the degree to which temporary files should adopt the parent encryption strategy by quantifying the strength of file associations. When a time-limited file completes its lifecycle evolution, the synchronous handling mechanism of associated temporary files effectively prevents the formation of data shadows. For example, in a government system, temporary working copies of expired confidential documents automatically maintain encryption and synchronously perform security cleanup when a high joint sensitivity probability is detected, thus achieving closed-loop management of the entire protection strategy lifecycle.

[0070] Scenario Implementation: Based on the three risk factors calculated above, a final joint sensitivity probability calculation is performed to make an encryption protection decision.

[0071] Parameter settings: Each weight coefficient is set according to business risk preferences, among which the data shadow risk factor is given the highest weight because it is directly related to the current data breach threat. =0.8); Lifecycle synchronization ( =0.5) and strategy inheritance exception ( =0.3) serves as an auxiliary measure of correlation risk. The overall adjustment factor k is set to 2.5 to control the distribution pattern of the probability output.

[0072] Calculation process: Calculate the weighted sum: (0.5×0.003)+(0.3×0.000026)+(0.8×2.317)≈0.0015+0.0000078+1.8536≈1.8551.

[0073] Calculate the exponential term: = ≈0.00965.

[0074] Substitute into the formula: =2 / (1+0.00965)≈2 / 1.00965≈1.98.

[0075] Final Decision and Action: Joint Sensitive Probability ≈1.98, extremely close to the maximum value of 2. Determine the encryption level: Based on the file being a "high-sensitivity distribution," the system assigns it the highest encryption level (e.g., using the AES-256 algorithm). Set the key rotation cycle: Because... Extremely high, the system sets an extremely short key rotation cycle for it (e.g., once every 24 hours).

[0076] Policy Inheritance and Synchronous Handling: The system determines that the temporary file fully inherits all high-strength security policies of its associated time-limited file within its validity period, ignoring current lifecycle discrepancies and policy anomalies. When the associated time-limited file is automatically archived or destroyed by the system, an immediate and secure erasure of the temporary file is triggered synchronously, completely eliminating the risk of "data shadows."

[0077] Through this series of quantitative calculations and decisions, this solution achieves accurate identification and ultimate protection for high-risk temporary files.

[0078] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cloud-based encryption and protection method for sensitive government data, characterized in that, Includes the following steps: S1: Obtain the complete set of data assets in the target cloud-based government environment to form the original data set, and determine the set of data attribute combinations based on the original data set; S2: Construct a dataset for statistical analysis based on the original dataset, and perform sensitivity calculation on the data attribute combination set according to the dataset to obtain the sensitivity calculation result; S3: Obtain the file objects in the dataset, and generate a temporary file set and a time-sensitive file set by identifying the file types of the file objects according to predefined rules; S4: Determine the cloud-based government data encryption and protection method based on the temporary file set and the time-sensitive file set, combined with the sensitivity calculation results.

2. The cloud-based government sensitive data encryption and protection method according to claim 1, characterized in that, The acquisition of all data assets in the target cloud-based government environment constitutes the original data set, and a set of data attribute combinations is determined based on the original data set, including: The original dataset is parsed and features are extracted to obtain all basic data attributes; The basic data attributes are divided according to natural categories to generate a list of basic data attributes; Based on business logic and data relationships, different basic data attributes in the basic data attribute list are combined to generate a set of data attribute combinations to be evaluated.

3. The cloud-based government sensitive data encryption and protection method according to claim 2, characterized in that, The process of constructing a dataset for statistical analysis based on the original data set, and performing sensitivity calculations on the data attribute combination set according to the dataset to obtain sensitivity calculation results, includes: The dataset is a collection of data whose basic data attributes have been extracted and stored in a structured manner; The frequency of occurrence of each data attribute combination is counted in the dataset, and the number of basic data attributes contained in each data attribute combination is recorded. Sensitivity is obtained based on the frequency of occurrence and the number of basic data attributes.

4. The cloud-based encryption and protection method for sensitive government data according to claim 3, characterized in that, The step of obtaining sensitivity based on the frequency of occurrence and the number of basic data attributes includes: the sensitivity calculation formula is: ； in, For the first The original sensitivity score of each data attribute combination For the first The number of basic data attributes in a combination of data attributes The total number of records in the dataset. For the first The frequency of occurrence of a combination of data attributes in the dataset This is the lifespan factor for temporary files. As a sensitivity attenuation factor for time-sensitive documents, For temporary document factor weighting coefficients, This refers to the weighting coefficient of the timeliness document factor. This is the baseline value for the maximum number of attributes. This is the baseline value for the maximum temporary file lifespan. This is the baseline value for the maximum sensitivity decay period.

5. The cloud-based encryption and protection method for sensitive government data according to claim 1, characterized in that, The step of obtaining file objects from the dataset and generating a temporary file set and a time-sensitive file set by identifying the file objects according to predefined rules includes: The file object contains file metadata and file content; The predefined rules include temporary file identification rules: identification is based on at least one of file path patterns, file naming rules, and creation process characteristics; Time-sensitive document identification rules: Identification is based on at least one of the creation time, modification time, and expiration time markers in the file metadata.

6. The cloud-based government sensitive data encryption and protection method according to claim 1, characterized in that, The method for determining cloud-based government data encryption and protection based on the temporary file set and the time-sensitive file set, combined with the sensitivity calculation result, includes: For each temporary file in the set of temporary files, extract all combinations of data attributes; For each time-sensitive file in the aforementioned time-sensitive file set, extract all data attribute combinations; Based on the sensitivity calculation results, obtain the normalized sensitivity score corresponding to each data attribute combination; For each temporary file and time-limited file, sort all data attribute combinations in descending order by normalized sensitivity score to generate the sorting results; If the maximum normalized sensitivity score of the temporary file in the sorting result is higher than the preset high sensitivity threshold, and there is an associated time-sensitive file, then the lifecycle synchronization factor is calculated. If the sensitivity distribution types of the temporary files and the associated time-sensitive files in the sorting results are inconsistent, then the security policy inheritance anomaly factor is calculated. If the maximum normalized sensitivity score of the associated time-sensitive file in the sorting result is higher than the preset high sensitivity threshold, and the current system time exceeds the expiration timestamp of the associated time-sensitive file, then the data shadow risk factor is calculated. Based on the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor, a joint sensitivity probability is calculated, and a cloud-based government data encryption protection method is determined according to the joint sensitivity probability.

7. A cloud-based method for encrypting and protecting sensitive government data according to claim 6, characterized in that, If the maximum normalized sensitivity score of the temporary file in the sorting result is higher than a preset high sensitivity threshold, and there are associated time-sensitive files, then the lifecycle synchronization factor is calculated, including: The associated time-sensitive files are determined through file path pattern matching, process creation chain correlation analysis, or content similarity; the lifecycle synchronization factor is calculated using the following formula: ； in, As a life cycle synchronization factor, Create timestamps for temporary files. This is the expected deletion timestamp for the temporary file. Create timestamps for associated time-sensitive documents. This is the expiration timestamp of the associated time-sensitive document.

8. A cloud-based method for encrypting and protecting sensitive government data according to claim 6, characterized in that, If the sensitivity distribution types of the temporary files and associated time-sensitive files in the sorting results are inconsistent, then a security policy inheritance anomaly factor is calculated, including: The sensitivity distribution types include high sensitivity distribution, mixed distribution, or low sensitivity distribution; the formula for calculating the security policy inheritance anomaly factor is: ； in, To inherit abnormal factors for security policies, For the first The strategy inheritance does not match the indicator. This represents the total number of strategy dimensions for security checks. The number of historical orphan documents, This represents the total number of files in the system.

9. A cloud-based method for encrypting and protecting sensitive government data according to claim 6, characterized in that, If the maximum normalized sensitivity score of the associated time-sensitive file in the sorting result is higher than a preset high sensitivity threshold, and the current system time exceeds the expiration timestamp of the associated time-sensitive file, then a data shadow risk factor is calculated, including: the data shadow risk factor calculation formula is: ； in, As a data shadow risk factor, The current overall sensitivity score for temporary files. The overall sensitivity score for the associated time-sensitive documents. This is the current system timestamp. This is the expiration timestamp for the time-sensitive document. Create timestamps for time-sensitive documents.

10. A cloud-based method for encrypting and protecting sensitive government data according to claim 6, characterized in that, The method for calculating the joint sensitivity probability based on the lifecycle synchronization factor, security policy inheritance anomaly factor, and data shadow risk factor, and determining the cloud-based government data encryption protection method according to the joint sensitivity probability, includes: the joint sensitivity probability calculation formula is as follows: ； in, For joint sensitivity probability, As an overall regulatory factor, To synchronize weights throughout the lifecycle, To inherit abnormal weights for the strategy, Data shadow risk weights; The encryption level is determined based on the file sensitivity distribution type, and a corresponding key rotation cycle is set; the degree of inheritance of the encryption strategy of the temporary file to the associated time-limited file is determined according to the joint sensitivity probability threshold; when the time-limited file completes its life cycle processing, the associated temporary file synchronously performs encryption strategy adjustment and file disposal.

Images