A data security processing method and system based on hardware encryption

Abstract

This invention belongs to the field of data processing technology, specifically a data security processing method and system based on hardware encryption, including the collection of various types of data. An improved key management mechanism is obtained by optimizing the key rotation mechanism using the White Shark optimization algorithm. Plaintext feature data is classified to obtain a dataset to be encrypted. High-risk datasets are obtained by analyzing user operation behavior data. The verification pass rate of each verification node in the hardware security domain for the high-risk dataset is determined. If it reaches the preset security threshold of the improved key management mechanism, it is considered trusted storage data; otherwise, it is considered abnormal access data. The abnormal access data is analyzed based on hardware operating environment data to obtain the causes of abnormal risks, and adjustments are made to the improved key management mechanism. This invention can improve the adaptability and robustness of key management, enhance the accuracy and timeliness of data risk identification, and achieve rapid and accurate location of the root cause of anomalies.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, specifically a data security processing method and system based on hardware encryption. Background Technology

[0002] In the digital age, data, as a core asset, faces increasingly urgent demands for secure storage and transmission. Hardware encryption technology, with its security capabilities independent of the software layer, is widely used in high-risk scenarios such as finance, government affairs, and enterprise core data. However, existing hardware-based data security processing methods still have many technical pain points, making it difficult to meet the dual requirements of security and efficiency in complex business scenarios.

[0003] Traditional key management mechanisms suffer from significant rigidity. Parameters such as key rotation cycle and key entropy threshold are mostly fixed settings that rely on manual adjustment and cannot be dynamically adapted to changes in hardware load and business scenarios. This makes it difficult to balance security and system operating efficiency—either excessively frequent key rotation increases system latency and energy consumption, or excessively long rotation intervals pose a risk of key leakage and are prone to problems such as inconsistent key synchronization and version mismatch.

[0004] Meanwhile, existing methods mostly classify data simply based on data type, without taking into account the processing needs and security levels of different business scenarios for fine-grained classification. This results in insufficient protection for highly sensitive data and excessive encryption of low-risk data, leading to a waste of encryption resources and an inability to accurately identify high-risk data.

[0005] Furthermore, the cause of the anomaly is difficult to pinpoint. When anomalies occur in hardware encryption verification, existing technologies struggle to effectively correlate abnormal access data with the hardware operating environment and user behavior. They are unable to quickly distinguish between sporadic anomalies and systemic failures, making it difficult to accurately locate the root cause of the anomaly. This results in the inability to optimize the key management mechanism in a timely manner, further reducing the reliability of data security protection.

[0006] Therefore, there is an urgent need for a hardware-encrypted data security processing method and system that can solve the above problems, achieve dynamic optimization of key management, accurate classification of data security, and rapid anomaly location, thereby improving data security protection capabilities and system operating efficiency. Summary of the Invention

[0007] To overcome the shortcomings of existing technologies, this invention proposes a data security processing method and system based on hardware encryption. This invention primarily addresses the problems of rigid traditional key management mechanisms, their inability to balance security and efficiency, insufficient accuracy in identifying data security levels, and difficulties in locating the causes of anomalies.

[0008] The technical solution adopted by this invention to solve its technical problem is: a data security processing method based on hardware encryption provided by this invention, comprising:

[0009] Plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed are collected at preset time intervals.

[0010] An improved key management mechanism is obtained by optimizing the key rotation mechanism using the White Shark optimization algorithm. Plaintext feature data is classified according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted.

[0011] The behavioral risk assessment method is used to analyze the encrypted dataset based on user operation behavior data to obtain a high-risk dataset.

[0012] Determine whether the verification pass rate of each verification node in the hardware security domain for the high-risk dataset reaches the preset security threshold of the improved key management mechanism. If it does, the data is stored as trusted data; otherwise, it is treated as abnormal access data.

[0013] Using causal localization, abnormal access data is analyzed based on hardware operating environment data to identify the causes of abnormal risks, and adjustments are made to improve the key management mechanism.

[0014] The present invention provides a data security processing method based on hardware encryption, wherein the steps for obtaining plaintext feature data include:

[0015] Based on the real-time requirements of different business scenarios, the data collection time interval is set, and the plaintext feature dimensions to be collected are determined based on the business type of the data to be processed.

[0016] Raw data to be processed is collected at intervals, and redundant null values, duplicate data blocks, and data with incorrect format are filtered out to obtain valid data.

[0017] The effective data is extracted according to the plaintext feature dimension, unstructured features are transformed into structured feature values, numerical features are normalized, and categorical features are encoded and converted to generate plaintext feature data.

[0018] The present invention provides a hardware-based data security processing method, the steps of which to obtain an improved key management mechanism include:

[0019] The key rotation period, key entropy threshold, random number generator sampling rate, and session key lifetime in the key rotation mechanism are taken as parameters to be optimized. Each combination of parameters to be optimized is treated as an individual white shark, and the position vector and velocity vector of each individual white shark are randomly initialized.

[0020] A fitness function is constructed based on the security and efficiency balance objective of the key rotation mechanism. The fitness value of each individual white shark is calculated by combining historical attack records of different hardware security domains, current computing load, and velocity vector.

[0021] Simulate the foraging behavior of great white sharks to update the position of each individual great white shark, including sensing the location of prey, moving towards the best individual, and executing schooling tactics.

[0022] In each iteration, check whether the updated position exceeds the physical boundary defined by the parameters. If it does, map it back to the boundary and recalculate the fitness value. If the fitness value of the new position is higher than that of the original position, update the historical best position of the white shark individual and update the global best position at the same time.

[0023] When the preset maximum number of iterations is reached, the iteration stops, and the parameter combination corresponding to the final global optimal position is determined as the optimized parameters, thus forming an improved key management mechanism.

[0024] This invention provides a hardware-encrypted data security processing method for calculating the fitness value of each individual great white shark, expressed by the following formula:

[0025] ;

[0026] In the formula, It is the first The fitness value of an individual great white shark. Based on parameters The generated key entropy value, It is a tiny constant used to prevent division by zero. The system delay is caused by key rotation. It is the energy cost of the key generation process. It is a parameter Corresponding historical trust scores , , , It is the weighting coefficient.

[0027] This invention provides a hardware-based data security processing method, the steps of which include obtaining the dataset to be encrypted:

[0028] Identify the business scenarios that need to be processed, as well as the security level and encryption requirements for each business scenario, and create a scenario classification comparison table.

[0029] The plaintext feature data is cleaned and standardized to obtain feature-processed data. It is then matched against the scenario classification table one by one according to the rules, further subdivided according to the business scenario, and labeled with classification tags to obtain preliminary classification data.

[0030] The preliminary classification data undergoes rule consistency verification and encryption necessity screening. It is then grouped according to security level and business scenario to generate a dataset to be encrypted.

[0031] This invention provides a hardware-encrypted data security processing method, the steps of which include analyzing and obtaining high-risk datasets:

[0032] Effective behavioral features for risk analysis are extracted from user operation behavior data and bound to data in the dataset to be encrypted to form a data behavior association table.

[0033] Based on the business scenario, different risk dimension weights and corresponding scoring rules are set, and scores for different risk dimensions are calculated according to the scoring rules.

[0034] Using the data security level as the baseline variable and other behavioral risks as related variables, the Pearson correlation coefficients between each related variable and the baseline variable are calculated, and the risk dimensions are adjusted to obtain the risk-corrected weights.

[0035] A comprehensive risk score is calculated based on risk dimension scoring and risk adjustment weights.

[0036] Differentiated high-risk thresholds are set according to different business scenarios. The data behavior association table is traversed to filter risk data that meets the comprehensive risk score. The high-risk dataset is obtained by grouping the data according to business scenario and score in descending order.

[0037] The present invention provides a hardware-encrypted data security processing method, the steps of which include obtaining trusted stored data and abnormal access data:

[0038] Nodes that meet the preset verification qualifications are selected from the hardware security domain as verification nodes. The overall verification pass rate threshold, single node verification pass rate threshold, and critical node pass threshold are extracted from the improved key management mechanism as security thresholds.

[0039] A unique verification code is generated for each piece of data in the high-risk dataset, encrypted using an improved key management mechanism, and distributed to all verification nodes to generate a list of data to be verified.

[0040] Each verification node verifies the key validity, data integrity, operation permissions, and hardware environment of each piece of data in the data list to be verified, and generates a verification result.

[0041] Calculate the verification pass rate for each node and the overall verification pass rate based on the verification results, and verify the pass rate reports generated by the key node verification nodes and compare them with the security threshold.

[0042] When the overall pass rate meets the standard, the single node pass rate meets the standard, and all key nodes pass, the current data is determined to be trusted storage data. If any dimension fails to meet the standard, it is directly marked as abnormal access data.

[0043] This invention provides a data security processing method based on hardware encryption, the steps of which include analyzing and obtaining the causes of abnormal risks:

[0044] Using the abnormal access trigger time and verification node ID as a composite primary key, abnormal access data is bound to hardware operating environment data to form abnormal access hardware status data.

[0045] Extract hardware anomaly data related to the abnormal moment from hardware operating environment data, and analyze each abnormal access data from the aspects of key-related status, data integrity and hardware transmission, hardware status and security attack to establish anomaly causal relationship.

[0046] Cluster analysis is used to distinguish between occasional and systematic anomalies, identify the reasons for verification failures, and perform cross-matching based on the causal relationships of the anomalies to pinpoint the causes of anomaly risks.

[0047] The present invention provides a hardware-based data security processing method, the steps of which include adjusting the improved key management mechanism as follows:

[0048] Classify the abnormal risks according to their abnormality type and specific cause, establish a classification archive table, and determine the adjustment priority.

[0049] Based on the classification and filing table and adjustment priorities, corresponding adjustment plans are formulated for various anomalies caused by key-related, transmission-related, hardware-related, attack-related, and permission-related factors.

[0050] Adjustments are made in stages according to the priority of different adjustment schemes, and targeted parameter and rule adjustments are implemented and distributed to all verification nodes in the hardware security domain for unified update and synchronization.

[0051] This invention provides a data security processing system based on hardware encryption, comprising:

[0052] The multi-source data acquisition module is used to collect plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed at preset time intervals.

[0053] The key mechanism optimization module is used to optimize the key rotation mechanism using the White Shark optimization algorithm to obtain an improved key management mechanism. It also classifies plaintext feature data according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted.

[0054] The behavioral risk screening module is used to analyze the encrypted dataset based on user operation behavior data using the behavioral risk comprehensive assessment method to obtain high-risk datasets.

[0055] The verification threshold control and traffic splitting module is used to determine whether the verification pass rate of each verification node in the hardware security domain for high-risk datasets reaches the security threshold preset by the improved key management mechanism. If it does, the data is stored as trusted data; otherwise, it is treated as abnormal access data.

[0056] The anomaly risk tracing module is used to analyze abnormal access data based on hardware operating environment data using anomaly causal localization to obtain the causes of abnormal risks and adjust the improved key management mechanism.

[0057] The beneficial effects of this invention are as follows:

[0058] 1. This invention utilizes the White Shark optimization algorithm, dynamically adjusting key rotation parameters based on historical attack records and computational load to achieve an optimal balance between security and efficiency. Combining data characteristics with user behavior features for comprehensive risk assessment is more accurate than single-dimensional identification, improving the accuracy and timeliness of data risk identification. The behavioral risk assessment method incorporates statistical correlation analysis, enabling it to keenly detect abnormal correlations between user behavior and data sensitivity, more accurately identifying advanced persistent threats and insider misconduct. Simultaneously, dynamic thresholds reduce false alarms caused by normal business fluctuations. Furthermore, a multi-node, multi-dimensional verification mechanism prevents single-point failures and bypass attacks, enhancing the robustness and anti-attack capabilities of the hardware encryption system. Attached Figure Description

[0059] The invention will now be further described with reference to the accompanying drawings.

[0060] Figure 1 This is a schematic diagram of a hardware-encrypted data security processing method provided in an embodiment of the present invention.

[0061] Figure 2 This is a schematic diagram of the process for obtaining clinical mechanical characterization data in a data security processing method based on hardware encryption provided in an embodiment of the present invention.

[0062] Figure 3 This is a flowchart illustrating a data security processing system based on hardware encryption provided in an embodiment of the present invention. Detailed Implementation

[0063] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0064] like Figures 1 to 3 As shown, an embodiment of the present invention provides a data security processing method based on hardware encryption, comprising:

[0065] Plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed are collected at preset time intervals.

[0066] The steps to obtain plaintext feature data include:

[0067] Based on the real-time requirements of different business scenarios, the data collection time interval is set, and the plaintext feature dimensions to be collected are determined based on the business type of the data to be processed.

[0068] Plaintext feature dimensions include, but are not limited to, data format features such as field length, encoding type, data type, content features such as key field values, data volume, sensitive identifiers, and metadata features such as data generation time, source node ID, and data owner user ID.

[0069] Raw data to be processed is collected at intervals, and redundant null values, duplicate data blocks, and data with incorrect format are filtered out to obtain valid data.

[0070] The effective data is extracted according to the plaintext feature dimension, unstructured features are transformed into structured feature values, numerical features are normalized, and categorical features are encoded and converted to generate plaintext feature data.

[0071] An improved key management mechanism is obtained by optimizing the key rotation mechanism using the White Shark optimization algorithm. Plaintext feature data is classified according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted.

[0072] The steps to obtain an improved key management mechanism include:

[0073] The key rotation period, key entropy threshold, random number generator sampling rate, and session key lifetime in the key rotation mechanism are taken as parameters to be optimized. Each combination of parameters to be optimized is treated as an individual white shark, and the position vector and velocity vector of each individual white shark are randomly initialized.

[0074] Based on the security and efficiency balance objective of the key rotation mechanism, a fitness function is constructed. Combining historical attack records from different hardware security domains, current computational load, and velocity vectors, the fitness value of each individual white shark is calculated. The formula is expressed as:

[0075] ;

[0076] In the formula, It is the first The fitness value of an individual great white shark. Based on parameters The generated key entropy value, It is a tiny constant used to prevent division by zero. The system delay is caused by key rotation. It is the energy cost of the key generation process. It is a parameter Corresponding historical trust scores , , , It is the weighting coefficient.

[0077] The simulated foraging behavior of great white sharks updates the position of each individual shark, including sensing prey locations, moving towards the optimal individual, and executing schooling tactics. The update formula is expressed as:

[0078] ;

[0079] ;

[0080] In the formula, It is the first The white shark in the The velocity vector of the next iteration It is inertial weight. , It is a learning factor. , It is a random number between [0,1]. It is the current position of the best white shark individual in the global ranking. It is the first The white shark in the The position of the next iteration. The top performers are selected based on their fitness values. The central point of a prime location It is an element-wise addition operation. The Levy flight step is used to enhance global search capabilities.

[0081] In each iteration, check whether the updated position exceeds the physical boundary defined by the parameters. If it does, map it back to the boundary and recalculate the fitness value. If the fitness value of the new position is higher than that of the original position, update the historical best position of the white shark individual and update the global best position at the same time.

[0082] When the preset maximum number of iterations is reached, the iteration stops, and the parameter combination corresponding to the final global optimal position is determined as the optimized parameters, thus forming an improved key management mechanism.

[0083] The steps to obtain the dataset to be encrypted include:

[0084] Identify the business scenarios that need to be processed, as well as the security level and encryption requirements for each business scenario, and create a scenario classification comparison table.

[0085] Business scenarios can include financial transactions, government document processing, IoT device data collection, and enterprise office data.

[0086] Security levels are classified into four levels: L1, L2, L3, and L4.

[0087] L1: Ordinary corporate office documents, requiring only basic encryption.

[0088] L2: Small-amount payment data and IoT device status data require regular encryption and periodic key rotation.

[0089] L3: Large-amount transfer data and non-classified government documents require high-strength encryption and high-frequency key rotation.

[0090] L4: Classified government documents, core corporate secrets, and large-scale cross-border transaction data require the highest strength encryption and real-time key verification.

[0091] For each security level, the classification criteria should be clearly defined, for example:

[0092] Dimension 1: Does it contain sensitive fields, such as ID card number, bank card number, confidentiality identifier, or core business parameters?

[0093] Dimension 2: Data source and user level.

[0094] Dimension 3: Data type and data volume.

[0095] Dimension 4: Whether real-time encryption, offline storage, and cross-node transmission are required.

[0096] For example, Level 4 = includes classified information + originates from the internal network core server + belongs to the administrator + is an unstructured document + requires offline encrypted storage.

[0097] The plaintext feature data is cleaned and standardized to obtain feature-processed data. It is then matched against the scenario classification table one by one according to the rules, further subdivided according to the business scenario, and labeled with classification tags to obtain preliminary classification data.

[0098] Remove invalid data: null values, duplicate records, and data with incorrect formatting. For example, bank card numbers with field lengths that do not meet business specifications, or garbled text.

[0099] Correcting abnormal data: For example, if numerical features exceed the reasonable range, correct them in conjunction with business logic or mark them and process them separately.

[0100] Structured features are formatted in a unified way: for example, time features are formatted as YYYY-MM-DDHH:MM:SS, numerical features are formatted as floating-point numbers with two decimal places, and categorical features are formatted in a unified way.

[0101] Structure unstructured features: For example, plain text features, extract key fields and transform them into categorizable labels.

[0102] A certain data entry has the following characteristics: it contains a bank card number, a transaction amount of 8,000 yuan, originates from the bank's internal network, and requires real-time cross-node transmission → it matches financial transactions at Level 3.

[0103] A certain data characteristic: ordinary office notice + no sensitive fields + sourced from the company's external network + only requires local storage → matches enterprise office - L1 level.

[0104] Under the same security level, it can be further subdivided according to business scenarios. For example, under L3 level, it can be further divided into two subcategories: large-amount transfer data and non-confidential government documents, which facilitates the subsequent adaptation to different encryption strategies.

[0105] Each piece of data is labeled with both security level and business scenario, such as L3 - large financial transfer and L1 - ordinary office work.

[0106] The preliminary classification data undergoes rule consistency verification and encryption necessity screening. It is then grouped according to security level and business scenario to generate a dataset to be encrypted.

[0107] Rule consistency verification: Randomly select 10%-20% of the classification data and check whether its characteristics match the classification rules. For example, check L4-classified government document data to confirm whether it contains classified information and whether the source is the core intranet. If the matching rate is <95%, return to step 3 for reclassification.

[0108] Encryption necessity screening: retain data that needs to be encrypted: all L2-L4 level data are included in the scope of data to be encrypted.

[0109] Exclude data that does not require encryption: Low-risk data in L1 that contains no sensitive information and only needs to be stored in plaintext is directly excluded and not included in the dataset to be encrypted.

[0110] The behavioral risk assessment method is used to analyze the encrypted dataset based on user operation behavior data to obtain a high-risk dataset.

[0111] The steps involved in analyzing and obtaining a high-risk dataset include:

[0112] Effective behavioral features for risk analysis are extracted from user operation behavior data and bound to data in the dataset to be encrypted to form a data behavior association table.

[0113] Valid behavioral characteristics can include: basic identity characteristics, such as user ID, login terminal, login IP, and account permission level; operation sequence characteristics, such as operation time, operation frequency, and operation interval; operation type characteristics, such as data access, encryption / decryption operations, key invocation, cross-domain transmission, and batch export; operation object characteristics, such as the accessed data ID, the business scenario to which the data belongs, and the data security level; abnormal behavior characteristics, such as login from a different location, permission overreach, and high-frequency failed operations; environment-related characteristics, such as the login network environment and terminal hardware status; historical behavior characteristics, such as the user's operation habits over the past 7 days; and behavior result characteristics, such as whether the operation was successful, whether a security alert was triggered, and whether it was manually marked as abnormal.

[0114] Using a unique data ID, operation timestamp, and user ID as a combined primary key, each piece of data in the dataset to be encrypted is associated with valid behavioral characteristics.

[0115] Complete missing associations: If there is no corresponding operation data for a certain piece of data to be encrypted, such as newly generated unaccessed data, it will be bound to the no operation tag by default, and the risk score will be temporarily assigned according to the security level of the data itself.

[0116] Each record contains characteristics of the data to be encrypted (such as security level, business scenario, sensitive fields, etc.) + characteristics of user behavior that operates on the data (such as operation type, login IP, abnormal behavior markers, etc.).

[0117] Based on the business scenario, different risk dimension weights and corresponding scoring rules are set, and scores for different risk dimensions are calculated according to the scoring rules.

[0118] Using the data security level as the baseline variable and other behavioral risks as related variables, the Pearson correlation coefficients between each related variable and the baseline variable are calculated, and the risk dimensions are adjusted to obtain the risk-corrected weights.

[0119] A comprehensive risk score is calculated based on risk dimension scoring and risk adjustment weights.

[0120] Risk weighting score correlation table:

[0121]

[0122] For example, if the correlation between the batch export operation and the L4 level data reaches 0.9, the risk weight of the operation type can be increased from 0.2 to 0.25.

[0123] Calculate the overall risk score for a single data point: Overall score = Σ (score of each dimension × adjusted weight).

[0124] Differentiated high-risk thresholds are set according to different business scenarios. The data behavior association table is traversed to filter risk data that meets the comprehensive risk score. The high-risk dataset is obtained by grouping the data according to business scenario and score in descending order.

[0125] Risk thresholds for different scenarios: Large financial transfers (L3): A score of ≥7 indicates high risk.

[0126] Classified government documents (L4): A score of 6 or higher indicates high risk.

[0127] Small-amount payments (L2): A score of ≥8 indicates high risk.

[0128] General office work (L1): A score of ≥9 points indicates high risk. The risk itself is low, and only extreme abnormal behavior is considered high risk.

[0129] Determine whether the verification pass rate of each verification node in the hardware security domain for the high-risk dataset reaches the preset security threshold of the improved key management mechanism. If it does, the data is stored as trusted data; otherwise, it is treated as abnormal access data.

[0130] The steps to obtain trusted storage data and abnormal access data include:

[0131] Nodes that meet the preset verification qualifications are selected from the hardware security domain as verification nodes. The overall verification pass rate threshold, single node verification pass rate threshold, and critical node pass threshold are extracted from the improved key management mechanism as security thresholds.

[0132] Nodes that verify qualifications must meet the following requirements: key synchronization completed, hardware in normal condition, and no abnormal access records in the past 7 days. Faulty / risky nodes will be removed.

[0133] Overall verification pass rate threshold: such as ≥85% for financial scenarios and ≥90% for government scenarios, that is, the number of nodes that pass verification / the total number of verification nodes ≥ the threshold.

[0134] Single-node verification pass rate threshold: The number of successful verifications of a single node on a high-risk dataset / the number of data entries to be verified must be ≥70% to avoid misjudgments caused by single-node anomalies.

[0135] Critical nodes must pass the threshold: Core verification nodes, such as the master key storage node, must pass 100% verification; otherwise, they will be directly judged as untrustworthy.

[0136] A unique verification code is generated for each piece of data in the high-risk dataset, encrypted using an improved key management mechanism, and distributed to all verification nodes to generate a list of data to be verified.

[0137] Each verification node verifies the key validity, data integrity, operation permissions, and hardware environment of each piece of data in the data list to be verified, and generates a verification result.

[0138] The key management mechanism currently uses the active keys, excluding data encrypted with expired / forged keys.

[0139] Data integrity verification: The data hash value is recalculated and compared with the check code in the preprocessing stage. If they match, the verification is successful, thus preventing data tampering.

[0140] Operation permission verification: Verify whether the user's operation behavior corresponding to the data complies with the permission rules, such as ordinary users not having the right to operate L4 level data.

[0141] Hardware environment verification: Check the hardware environment logs during data generation / transmission, such as whether they were generated in a trusted execution environment. If there are no anomalies, the verification is successful.

[0142] The verification result includes: data ID, pass / fail status of the verification item, reason for failure, verification timestamp, and node hardware signature.

[0143] Calculate the verification pass rate for each node and the overall verification pass rate based on the verification results, and verify the pass rate reports generated by the key node verification nodes and compare them with the security threshold.

[0144] Calculate the single-node verification pass rate: For each node, count the number of data items that have passed verification / the total number of data items to be verified, and mark whether the single-node threshold has been reached.

[0145] Calculate the overall verification pass rate: count the number of nodes that pass all 4 verifications / the total number of verified nodes, only counting nodes that meet the single node pass rate standard.

[0146] Verify the results of key nodes: confirm whether the core nodes have passed the verification 100%. If even one core node fails the verification, the entire system is deemed unqualified.

[0147] Comparison table:

[0148]

[0149] When the overall pass rate meets the standard, the single node pass rate meets the standard, and all key nodes pass, the current data is determined to be trusted storage data. If any dimension fails to meet the standard, it is directly marked as abnormal access data.

[0150] Using causal localization, abnormal access data is analyzed based on hardware operating environment data to identify the causes of abnormal risks, and adjustments are made to improve the key management mechanism.

[0151] The steps to analyze the causes of abnormal risks include:

[0152] Using the abnormal access trigger time and verification node ID as a composite primary key, abnormal access data is bound to hardware operating environment data to form abnormal access hardware status data.

[0153] Extract hardware anomaly data related to the abnormal moment from hardware operating environment data, and analyze each abnormal access data from the aspects of key-related status, data integrity and hardware transmission, hardware status and security attack to establish anomaly causal relationship.

[0154] Hardware anomaly data includes: ① Voltage anomaly: voltage fluctuation exceeding ±0.2V, voltage spikes, voltage consistently below 3.0V or above 3.6V. ② Temperature anomaly: temperature exceeding 60℃, temperature change rate exceeding 5℃ / minute, temperature consistently above 55℃ for more than 10 seconds. ③ Electromagnetic anomaly: electromagnetic radiation intensity exceeding 10μT, abnormal electromagnetic fluctuation frequency, instantaneous electromagnetic pulses. ④ Physical anti-tampering anomaly: physical anti-tampering sensor triggered, anti-tampering alarm signal lasting more than 1 second. ⑤ Key-related anomalies: key loading failure, key expiration, key version mismatch, key synchronization failure, key call timeout. ⑥ Encryption engine anomaly: encryption engine calculation error, calculation time exceeding twice the normal range, encryption engine hanging / unresponsive, engine restart. ⑦ Transmission anomaly: bus transmission verification error, packet loss rate exceeding 5%, transmission delay exceeding 100ms, transmission link interruption. ⑧ Node anomaly: node offline, abnormal restart, unknown reset cause, hardware fault alarm.

[0155] Key-related status judgment criteria: ① Check key loading status: If hardware environment data shows key loading failure and the verification failure code for abnormal access is 001, indicating an invalid key, it means that the node failed to load a valid key during the abnormal access, resulting in verification failure. ② Check key version: If hardware environment data shows a key version mismatch and the verification failure code for abnormal access is 001, it means that the improved key management mechanism has updated the key version, but the verification node has not updated synchronously, resulting in verification failure using an old version key to verify a high-risk dataset. ③ Check key expiration time: If hardware environment data shows the key has expired, and the abnormal access time is after the key expiration time, it means the key was not updated according to the rotation cycle, resulting in verification failure. ④ Check key synchronization status: If hardware environment data shows key synchronization failure, and the key version of this node is inconsistent with other nodes, it means there is a problem with key synchronization between nodes, resulting in inconsistent verification standards and verification failure.

[0156] Cause-and-effect correspondence conclusion: If any of the above conditions are met, and there are no other higher priority causes of abnormality, then the cause of abnormality is initially determined to be key management abnormality, and the specific sub-cause is marked, such as key expiration, version mismatch, or loading failure.

[0157] Data integrity and hardware transmission assessment: ① Check the bus transmission log: If the hardware environment data shows a high bus verification error packet loss rate and the verification failure code for abnormal access is 002, it indicates that the high-risk dataset was tampered with, lost, or incompletely transmitted between hardware nodes, causing hash value comparison failure during node verification. ② Check the transmission latency: If the hardware environment data shows a transmission latency exceeding 100ms and the verification failure code for abnormal access is 004, hardware verification failed, indicating data transmission timeout. The node did not receive the complete high-risk dataset within the specified time, resulting in verification failure. ③ Check the transmission link status: If the hardware environment data shows a transmission link interruption, and the verification failure time for abnormal access coincides perfectly with the link interruption time, it indicates that the link was interrupted during data transmission, preventing the node from obtaining the data to be verified, leading to verification failure.

[0158] Cause-and-effect correspondence conclusion: If any of the above conditions are met, and there are no key anomalies or attack-related anomalies, then the cause of the anomaly is determined to be hardware transmission / data integrity anomaly, and the specific sub-cause is marked, such as bus verification error, data packet loss, or link interruption.

[0159] Hardware operating status assessment: ① Check voltage and temperature: If hardware environment data shows voltage spikes, persistently low or high voltage, and the verification failure code for abnormal access is 004, it indicates that the hardware node's operating environment is unstable, causing errors in the encryption engine's calculations and abnormal key loading, leading to verification failure. ② Check encryption engine status: If hardware environment data shows that the encryption engine is reporting errors, suspended, or unresponsive, and the verification failure time for abnormal access coincides with the engine's abnormal time, it indicates that the engine cannot perform verification calculations normally, such as hash value calculation and key decryption, resulting in verification failure. ③ Check node status: If hardware environment data shows that the node has abnormally restarted or gone offline, and the verification failure code for abnormal access is 004, it indicates that the node has malfunctioned during the verification process and cannot complete the verification operation, resulting in verification failure.

[0160] Cause-and-effect conclusion: If any of the above conditions are met, and there are no key anomalies, transmission anomalies, or attack-related anomalies, then the cause of the anomaly is determined to be hardware malfunction, and the specific sub-cause is marked, such as abnormal voltage, excessive temperature, encryption engine malfunction, or node restart.

[0161] Security Attack Related Judgments: ① Check Physical Anti-Tampering Records: If hardware environment data shows physical anti-tampering triggered, and the abnormal access operation type is batch export key call, it indicates a physical attack attempt. The attacker is trying to crack the hardware node through physical means to obtain high-risk datasets or keys, causing the node to trigger security protection and verification to fail. ② Check Electromagnetic Anomaly Records: If hardware environment data shows abnormal electromagnetic radiation or instantaneous electromagnetic pulses, and the abnormal access verification failure code is 002 (data integrity failed) or 004 (hardware verification failed), it indicates a side-channel attack. The attacker analyzes the hardware's electromagnetic radiation to tamper with data or steal keys, causing verification to fail. ③ Combine with Operation Behavior: If the abnormal access is remote login + unauthorized access, and hardware environment data shows electromagnetic anomalies, it indicates that the attacker may have obtained user privileges through external attack methods, attempted to access high-risk datasets, and was blocked by the hardware security domain, resulting in verification failure.

[0162] Causal correspondence conclusion: If any of the above conditions are met, regardless of whether other anomalies exist, the anomaly cause should be determined first as possibly being a physical attack / external attack. The specific sub-cause should be marked, such as physical anti-tampering trigger, electromagnetic side-channel attack, or off-site unauthorized attack, and marked as high risk for priority handling.

[0163] Cluster analysis is used to distinguish between occasional and systematic anomalies, identify the reasons for verification failures, and perform cross-matching based on the causal relationships of the anomalies to pinpoint the causes of anomaly risks.

[0164] Systemic anomaly identification criteria: A certain type of hardware anomaly tag appears in ≥15% of the total frequency, corresponding to ≥10 abnormal access data entries, and the abnormal access is concentrated in the same time period, the same batch of nodes, or cross-nodes but with common characteristics. Core characteristics: wide impact range, high frequency of occurrence, obvious pattern, and the causes are mostly due to key mechanism configuration errors, hardware cluster failures, and system-level security vulnerabilities.

[0165] Criteria for identifying occasional anomalies: The frequency of a certain type of hardware anomaly tag is less than 10%, the number of corresponding abnormal access data entries is ≤ 5, and the abnormal accesses are scattered across different time periods and nodes without obvious patterns. Core characteristics: Small impact range, low frequency of occurrence, and no pattern; the causes are mostly instantaneous environmental interference or occasional failure of a single node.

[0166] Pattern Extraction: Combining anomaly tags, time, nodes, and operation types, summarize common patterns and highlight key points: Mark the hardware anomaly tags and anomaly patterns corresponding to batch common anomalies as core analysis objects, and prioritize their precise location in subsequent analysis. Handling Occasional Anomalies: Organize single-point occasional anomalies separately, label them as occasional, and only record the causes in subsequent analysis; no adjustments or improvements to the key management mechanism are required.

[0167] Hardware Fault Table:

[0168]

[0169] The specific steps of cross-matching may include:

[0170] Extract the verification failure code and failure message of the abnormal access data to clarify the core issue of the verification failure.

[0171] Extract the hardware exception tag bound to the exception access.

[0172] By referring to the above correspondence table, the reasons for verification failure are matched with hardware abnormalities, contradictory items are eliminated, and the final cause is confirmed.

[0173] Please provide details of the cause, including: the specific stage in which the anomaly occurred, the scope of its impact, and the triggering conditions.

[0174] The steps to adjust the key management mechanism include:

[0175] Classify the abnormal risks according to their abnormality type and specific cause, establish a classification archive table, and determine the adjustment priority.

[0176] Classification and Filing Table:

[0177]

[0178] Issues are sorted by risk level from highest to lowest and by scope of impact from broadest to narrowest, with the following priority: attack-related (extremely high risk) > key-related (high risk) > transmission / hardware-related / permission-related (medium risk), ensuring that high-risk issues are addressed first.

[0179] Based on the classification and filing table and adjustment priorities, corresponding adjustment plans are formulated for various anomalies caused by key-related, transmission-related, hardware-related, attack-related, and permission-related factors.

[0180] Regarding the causes of key expiration:

[0181] Adjustment methods: ① Optimize key rotation cycle parameters: Dynamically adjust the rotation cycle based on the anomaly occurrence time and business security level, using the fitness function of the White Shark optimization algorithm to ensure a balance between security and performance. ② Add a key expiration warning mechanism: Trigger a warning signal one hour before the key expires, automatically triggering the key update process to avoid human oversight. ③ Add an expired key handling mechanism: Automatically perform hardware-level destruction of expired keys, prohibiting them from participating in any verification operations.

[0182] Causes of key version mismatch and synchronization failure:

[0183] Adjustment methods: ① Optimized synchronization strategy: Adopt a dual mechanism of automatic and manual synchronization. After the key is updated, all verification nodes are forced to complete automatic synchronization within 10 minutes, and the synchronization progress is fed back to the management node in real time. ② Added handling of synchronization failures: Nodes that fail to synchronize will automatically trigger a 3-retry mechanism. After a retry fails, the node will be marked as an abnormal node, removed from the verification cluster, and an alarm will be triggered to notify the operation and maintenance personnel to handle it manually. ③ Added version verification mechanism: Before each verification, the node automatically verifies that its local key version is the latest version issued by the improved key management mechanism. Nodes with mismatched versions are prohibited from participating in verification and will automatically trigger synchronization.

[0184] Regarding the causes of key loading failure:

[0185] Adjustments: ① Optimize key loading process: Add a retry mechanism for loading failures. After a retry fails, the node is marked as a faulty node and temporarily removed from the verification cluster. ② Enhance hardware status linkage: Before loading the key, check the node's hardware status. Nodes with abnormal hardware status are prohibited from loading keys to avoid loading failures. ③ Add loading log recording: Record the time, node, loading result, and reason for failure for each key loading in detail for easy traceability and analysis later.

[0186] Adjustment solutions for transmission-related anomalies, including methods to address bus verification errors, packet loss, and transmission delays:

[0187] Optimize the transmission verification mechanism: Change the original single hash verification to double verification. Only when both verifications pass is the transmission considered valid, reducing anomalies caused by data tampering and packet loss.

[0188] Dynamically adjust the transmission rate: The transmission rate is dynamically adjusted according to the hardware load, and the adjustment parameters are fed back in real time by the load monitoring module with an improved key management mechanism.

[0189] Added transmission link redundancy: Added backup transmission links. When the main link is interrupted or the packet loss rate exceeds 5%, it will automatically switch to the backup link to ensure uninterrupted data transmission.

[0190] Add a transmission delay threshold: Set a transmission delay threshold. Transmission tasks that exceed the threshold will be automatically retried. After three failed retries, the task will be marked as a transmission error and reported to the management node.

[0191] Adjustment plan and methods for addressing hardware-related exceptions:

[0192] Optimize hardware status monitoring thresholds: refine the monitoring thresholds for voltage, temperature, and clock frequency, and add anomaly warnings.

[0193] A new self-healing mechanism for the encryption engine has been added: When the encryption engine encounters an error or hangs, a restart process is automatically triggered. If the restart fails, it is marked as an engine failure, the verification task of that node is removed, and it is reassigned to other normal nodes.

[0194] Optimize node load distribution: Improve the load distribution algorithm of the key management mechanism to evenly distribute the verification tasks of high-risk datasets to all normal nodes, avoid excessive load on a single node, and reduce node restarts and failures.

[0195] Added hardware failure linkage: When the hardware status monitoring module detects a node failure, it immediately reports to the improved key management mechanism, automatically removes the faulty node, and re-includes it in the verification cluster after the node is repaired.

[0196] Adjustment plan for attack-related exceptions, and adjustment methods:

[0197] Enhanced physical protection: Increase the sensitivity of the physical anti-tamper sensor. Upon triggering the anti-tamper signal, immediately execute a triple emergency response: ① Key self-destruction. ② Node locking. ③ Triggering an advanced alarm.

[0198] Optimized side-channel protection: During key computation and data encryption, a new dynamic mask and power consumption noise injection function has been added to reduce the correlation between electromagnetic radiation and the key, thus resisting electromagnetic side-channel attacks. Simultaneously, the timing design of the encryption engine has been optimized to prevent timing features from leaking key information.

[0199] Strict access control: Refine user permission levels and implement the principle of least privilege. Ordinary users are prohibited from accessing high-risk datasets at L3 and above. If unauthorized access is attempted, the operation will be immediately intercepted, the user operation log will be recorded, and an alarm will be triggered.

[0200] Adjustment plan for the causes of permission-related exceptions, and adjustment methods:

[0201] Refine permission levels: Based on user identity and business needs, user permissions are divided into 5 levels: ordinary user, business user, administrator, core administrator, and system administrator. Each level of permission corresponds to a clearly defined access scope.

[0202] A new permission binding mechanism has been added: user permissions are bound to user ID and terminal device ID, prohibiting the sharing of permissions across terminals and users, and preventing permission abuse.

[0203] Improved access control auditing: Added access control log auditing function to record all user access operations in real time, generate weekly access control audit reports, and identify excessive or invalid permissions.

[0204] Regularly review new permissions: Automatically review all user permissions monthly, remove invalid and excessive permissions, and ensure that permission allocation complies with the principle of least privilege.

[0205] Adjustments are made in stages according to the priority of different adjustment schemes, and targeted parameter and rule adjustments are implemented and distributed to all verification nodes in the hardware security domain for unified update and synchronization.

[0206] Phase 1: Implement adjustment plans for attack-related and key-related causes, which is expected to take 2-3 hours. The focus will be on deploying security protection, key rotation, and synchronization mechanism adjustments. After completion, testing will be conducted immediately to ensure that high-risk issues are resolved.

[0207] Phase Two: Implement adjustment plans for transmission-related, hardware-related, and permission-related causes, which is expected to take 3-4 hours. Deploy transmission verification, hardware monitoring, and permission classification functions, and gradually advance the process to avoid module conflicts.

[0208] Targeted parameter and rule adjustments include: adjusting key-related parameters such as key rotation cycle, synchronization strategy, number of loading retries, and key version verification rules.

[0209] Adjust verification rules: Add verification conditions, optimize verification process, and introduce anomaly penalty and locking mechanisms.

[0210] Adjust hardware adaptation strategy: optimize node selection logic, hardware status thresholds, and encryption engine running parameters.

[0211] Adjust security protection strategies: enhance anti-tampering, side-channel protection, attack detection, and key self-destruction mechanisms.

[0212] Adjust access control policies: refine access permissions, add identity and terminal binding, and strengthen unauthorized access control.

[0213] Based on the same general inventive concept, this invention also protects a data security processing system based on hardware encryption, comprising:

[0214] The multi-source data acquisition module is used to collect plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed at preset time intervals.

[0215] The key mechanism optimization module is used to optimize the key rotation mechanism using the White Shark optimization algorithm to obtain an improved key management mechanism. It also classifies plaintext feature data according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted.

[0216] The behavioral risk screening module is used to analyze the encrypted dataset based on user operation behavior data using the behavioral risk comprehensive assessment method to obtain high-risk datasets.

[0217] The verification threshold control and traffic splitting module is used to determine whether the verification pass rate of each verification node in the hardware security domain for high-risk datasets reaches the security threshold preset by the improved key management mechanism. If it does, the data is stored as trusted data; otherwise, it is treated as abnormal access data.

[0218] The anomaly risk tracing module is used to analyze abnormal access data based on hardware operating environment data using anomaly causal localization to obtain the causes of abnormal risks and adjust the improved key management mechanism.

[0219] In summary, the data security processing method and system based on hardware encryption provided in this embodiment dynamically optimizes the key rotation mechanism, automatically adjusting parameters according to hardware load and historical attack scenarios to ensure key freshness and entropy, reducing the risk of key leakage and replay attacks. Encryption is categorized according to business scenarios and security levels, achieving hierarchical protection to meet different compliance requirements and enhance security. The White Shark optimization algorithm finds a balance between security and efficiency, avoiding unnecessary frequent rotations or excessively long cycles. The anomaly causal localization method can quickly pinpoint the cause category and specific link after an anomaly occurs, shortening troubleshooting time. Multi-node distributed verification and multi-threshold joint judgment are adopted to avoid single-point failures and malicious node interference, improving the consistency, reliability, and anti-attack capability of trusted data judgment.

[0220] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data security processing method based on hardware encryption, characterized in that, include: Collect plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed at preset time intervals; An improved key management mechanism is obtained by optimizing the key rotation mechanism using the White Shark optimization algorithm. The plaintext feature data is then classified according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted. The high-risk dataset is obtained by analyzing the user operation behavior data using the behavioral risk assessment method. Determine whether the verification pass rate of each verification node in the hardware security domain for the high-risk dataset reaches the preset security threshold of the improved key management mechanism. If it does, it is considered trusted storage data; otherwise, it is considered abnormal access data. Using anomaly causal localization, the abnormal access data is analyzed based on the hardware operating environment data to obtain the cause of the abnormal risk, and the improved key management mechanism is adjusted accordingly.

2. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps for obtaining the plaintext feature data include: Based on the real-time requirements of different business scenarios, the data collection time interval is set, and the plaintext feature dimensions to be collected are determined based on the business type of the data to be processed. The raw data to be processed is collected according to the specified collection time interval, and redundant null values, duplicate data blocks and data with incorrect format are filtered to obtain valid data. The valid data is extracted according to the plaintext feature dimensions, unstructured features are transformed into structured feature values, numerical features are normalized, and categorical features are encoded and converted to generate the plaintext feature data.

3. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps to obtain the improved key management mechanism include: The key rotation period, key entropy threshold, random number generator sampling rate and session key lifetime in the key rotation mechanism are taken as parameters to be optimized, and each combination of parameters to be optimized is taken as an individual white shark, and the position vector and velocity vector of each individual white shark are randomly initialized. A fitness function is constructed based on the security and efficiency balance objective of the key rotation mechanism. The fitness value of each white shark individual is calculated by combining historical attack records of different hardware security domains, current computing load, and the velocity vector. Simulate the foraging behavior of great white sharks to update the position of each individual great white shark, including sensing the location of prey, moving towards the best individual, and executing schooling tactics; In each iteration, check whether the updated position exceeds the physical boundary defined by the parameters. If it does, map it back to the boundary and recalculate the fitness value. If the fitness value of the new position is higher than that of the original position, update the historical best position of the white shark individual and update the global best position at the same time. When the preset maximum number of iterations is reached, the iteration stops, and the parameter combination corresponding to the final global optimal position is determined as the optimized parameters, which constitute the improved key management mechanism.

4. The data security processing method based on hardware encryption according to claim 1, characterized in that: The fitness value of each individual great white shark is calculated using the following formula: ； In the formula, It is the first The fitness value of an individual white shark. Based on parameters The generated key entropy value, It is a tiny constant used to prevent division by zero. The system delay is caused by key rotation. It is the energy cost of the key generation process. It is a parameter Corresponding historical trust scores , , , It is the weighting coefficient.

5. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps to obtain the dataset to be encrypted include: Identify the business scenarios that need to be processed, as well as the security level and encryption requirements for each business scenario, and create a scenario classification reference table; The plaintext feature data is cleaned and standardized to obtain feature-processed data. It is then matched against the scene classification table one by one according to the rules, further subdivided according to the business scenario, and labeled with classification tags to obtain preliminary classification data. The preliminary classification data is subjected to rule consistency verification and encryption necessity screening, and grouped according to security level and business scenario to generate the dataset to be encrypted.

6. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps for analyzing and obtaining the high-risk dataset include: Effective behavioral features for risk analysis are extracted from the user operation behavior data and bound to the data in the dataset to be encrypted to form a data behavior association table; Based on the business scenario, set different risk dimension weights and corresponding scoring rules for the risk dimensions, and calculate the scores for different risk dimensions according to the scoring rules; Using the data security level itself as the baseline variable and other behavioral risks as related variables, the Pearson correlation coefficient between each related variable and the baseline variable is calculated, and the risk dimensions are adjusted to obtain the risk adjustment weight. A comprehensive risk score is calculated based on the risk dimension scores and the risk adjustment weights. Differentiated high-risk thresholds are set according to different business scenarios. The data behavior association table is traversed to filter the risk data that meets the comprehensive risk score. The high-risk dataset is obtained by grouping the data according to the business scenario and the score in descending order.

7. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps for obtaining the trusted storage data and the abnormal access data include: Nodes that meet the preset verification qualifications are selected from the hardware security domain as verification nodes, and the overall verification pass rate threshold, single node verification pass rate threshold, and critical node must-pass threshold are extracted from the improved key management mechanism as the security thresholds. A unique verification code is generated for each piece of data in the high-risk dataset, encrypted using the improved key management mechanism, and distributed to all verification nodes to generate a list of data to be verified. Each verification node verifies the key validity, data integrity, operation permissions, and hardware environment of each piece of data in the list of data to be verified, and generates a verification result. Based on the verification results, calculate the verification pass rate of each node and the overall verification pass rate, and verify the pass rate reports generated by the key node verification nodes, and compare them with the security threshold. When the overall pass rate meets the standard, the single node pass rate meets the standard, and all key nodes pass, the current data is determined to be the trusted storage data. If any dimension fails to meet the standard, it is directly marked as the abnormal access data.

8. The data security processing method based on hardware encryption according to claim 1, characterized in that: The steps for analyzing and determining the causes of the abnormal risks include: Using the abnormal access trigger time and verification node ID as a composite primary key, the abnormal access data is bound to the hardware operating environment data to form abnormal access hardware status data. Extract hardware anomaly data related to the abnormal moment from the hardware operating environment data, and analyze each abnormal access data in conjunction with the abnormal access hardware status data from the aspects of key-related status, data integrity and hardware transmission, hardware itself status and security attack to establish anomaly causal relationship; Cluster analysis is used to distinguish between occasional and systematic anomalies, identify the reasons for verification failures, and perform cross-matching based on the causal relationships of the anomalies to pinpoint the causes of the anomaly risks.

9. A data security processing method based on hardware encryption according to claim 1, characterized in that: The steps for adjusting the improved key management mechanism include: Classify the abnormal risks according to their abnormality type and specific cause, establish a classification archive table, and determine the adjustment priority; Based on the classification and archiving table and the adjustment priority, corresponding adjustment schemes are formulated for various anomalies caused by key, transmission, hardware, attack, and permission issues. Adjustments are made in stages according to the priority of different adjustment schemes, and targeted parameter and rule adjustments are implemented and distributed to all verification nodes in the hardware security domain for unified update and synchronization.

10. A hardware-encrypted data security processing system, applied to a hardware-encrypted data security processing method as described in any one of claims 1 to 9, characterized in that, The processing system includes: The multi-source data acquisition module is used to collect plaintext feature data, user operation behavior data, and hardware operating environment data of the data to be processed at preset time intervals. The key mechanism optimization module is used to optimize the key rotation mechanism using the White Shark optimization algorithm to obtain an improved key management mechanism, and to classify the plaintext feature data according to the processing requirements and security levels of different business scenarios to obtain the dataset to be encrypted. The behavioral risk screening module is used to analyze the dataset to be encrypted based on the user operation behavior data using the behavioral risk comprehensive assessment method to obtain a high-risk dataset; The verification threshold control and diversion module is used to determine whether the verification pass rate of each verification node in the hardware security domain for the high-risk dataset reaches the preset security threshold of the improved key management mechanism. If it does, it is regarded as trusted storage data; otherwise, it is regarded as abnormal access data. The anomaly risk tracing module is used to analyze the abnormal access data based on the hardware operating environment data using anomaly causal localization to obtain the cause of the abnormal risk, and to adjust the improved key management mechanism.

Images