Data compliance encryption and tiered storage system for cross-border business

Abstract

The application relates to the technical field of data processing, and discloses a data compliance encryption and hierarchical storage system for cross-border business, which comprises the following steps: constructing a control topology structure, determining the data sensitive correlation degree between controls based on the control topology structure, determining an initial control security level according to a tenant identity and the data sensitive correlation degree, constructing a dynamic security policy set by combining the initial control security level and role permissions, extracting role access mode features according to the role permissions of real-time access requests, adjusting the dynamic security policy set by using the role access mode features to generate a strategy verification rule, verifying the control security level according to the strategy verification rule in the data transmission stage, and performing encryption processing or hierarchical storage of control data based on the verification result; the application realizes dynamic sensitive grading and adaptive encryption storage of data in a cross-border business scene, and effectively improves the data security, compliance and storage efficiency.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a data compliance encryption and hierarchical storage system for cross-border business. Background Technology

[0002] With the acceleration of global economic integration, cross-border business has gradually become an important part of business expansion for many enterprises. Against this backdrop, the types of data involved by enterprises are becoming increasingly diverse, especially data involving user privacy, financial information, or other sensitive information, which faces stricter compliance and regulatory requirements during cross-regional transmission and storage. Traditional data security processing methods mostly adopt uniform encryption or uniform storage models, failing to fully consider the degree of sensitivity between data and the differences in data types. This results in overly simplistic data protection measures that are unable to accurately meet the security protection needs of data with different levels of sensitivity.

[0003] Furthermore, in actual business operations, data access permissions and security level assessments often adopt a static management model, ignoring the real-time changes in user roles and permissions and the dynamic nature of access patterns. This results in a lack of flexibility in adjusting security policies and difficulty in quickly responding to changes in data access needs. To address these issues, a more refined data security management approach is urgently needed to achieve differentiated encryption and tiered storage of data, ensuring the compliance and security of cross-border data while also considering business processing efficiency. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a data compliance encryption and hierarchical storage system for cross-border business.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A data compliance encryption and tiered storage system for cross-border business, the system comprising: The association module is used to construct a control topology based on the positional relationship of field controls in the form and the differences in data types between controls, and to determine the data sensitivity association between controls based on the control topology. The module is used to determine the initial security level of controls based on tenant identity and data sensitivity correlation, and to build a dynamic security policy set by combining the initial control security level with role permissions; The verification module is used to extract role access pattern features based on the role permissions of real-time access requests, and adjust the dynamic security policy set using the role access pattern features to generate policy verification rules. The execution module is used to verify the security level of the control according to the policy verification rules during the data transmission phase, and to perform encryption processing or hierarchical storage of the control data based on the verification results.

[0006] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention constructs a control topology by combining the spatial relationship and data type differences of controls, thereby determining the data sensitivity correlation between controls and achieving accurate classification of data sensitivity levels, providing an effective basis for subsequent data security protection.

[0007] This invention achieves dynamic determination of control security levels and real-time adjustment of security policies through the bidirectional interaction between tenant permission change characteristics and the sensitivity correlation between controls, thereby ensuring the flexibility and adaptability of security policies and avoiding the shortcomings of traditional static policies.

[0008] This invention verifies the policy verification rules during the data transmission phase in real time, and performs differentiated encryption processing or dynamic hierarchical storage on the control data according to the verification results, thereby ensuring the compliance and security of cross-border business data during transmission and storage and effectively reducing the risk of data leakage. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the module structure of the system of the present invention. Detailed Implementation

[0010] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] Example 1 Please see Figure 1 As shown in the figure, this embodiment discloses a data compliance encryption and hierarchical storage system for cross-border business, the system comprising: The association module 101 is used to construct a control topology based on the positional relationship of field controls in the form and the differences in data types between controls, and to determine the data sensitivity association between controls based on the control topology. Specifically, the process of determining the data sensitivity correlation between the controls includes: Construct a spatial position relationship diagram of controls based on their spatial position characteristics, and construct a data type difference diagram of controls based on their data type differences; Specifically, the method for constructing the spatial location relationship diagram of controls is as follows: In one specific embodiment, the two-dimensional coordinate position of each control in the form interface is first obtained, and an initial control position map is constructed using the position of each control as a node; then, the Euclidean distance between any two control position nodes is calculated, and based on a preset distance threshold, when the Euclidean distance between two controls is less than or equal to the distance threshold, an undirected edge is connected between the two control nodes to form a spatial position relationship map.

[0012] Specifically, the method for constructing the control data type difference graph is as follows: In one specific embodiment, firstly, based on the sensitivity of the data corresponding to the control, the sensitivity level of the control's data type is divided into three levels: high sensitivity, medium sensitivity, and low sensitivity. The specific criteria for this division are as follows: For example, highly sensitive data types include, but are not limited to, important data that are directly related to finances or personal privacy, such as payment information, identity authentication information, and bank account information; moderately sensitive data types include, but are not limited to, address information, personal contact information, and email addresses, which may indirectly involve personal privacy but do not directly involve financial security; and low-sensitivity data types include, but are not limited to, general business data such as usernames and product preferences, or data that does not directly involve user privacy and financial security.

[0013] Then, for any two controls, compare their data type sensitivity levels, specifically: If two controls have the same data sensitivity level, connect them with an edge and assign a weight of 1 to the edge. If the controls have different data sensitivity levels, assign a corresponding edge weight value based on the specific difference in data sensitivity levels. The specific weight assignment rules are as follows: If the data sensitivity levels of two controls differ by one level (e.g., between high sensitivity and medium sensitivity, or between medium sensitivity and low sensitivity), then connect the control nodes with an edge and assign that edge a weight of 0.5. If the difference in data sensitivity levels between two controls is two levels (e.g., between high sensitivity level and low sensitivity level), then connect the control nodes with an edge and assign that edge a weight of 0.1.

[0014] Multiple initial propagation nodes are selected based on the spatial location relationship graph of the control. The propagation path is dynamically expanded according to the density of the neighborhood of the propagation node to form a spatial dynamic propagation path. Specifically, the dynamic expansion process of the propagation path includes: In some specific embodiments, the neighborhood density feature of each control node is calculated based on the spatial location relationship diagram, wherein the neighborhood density feature is defined as the number of control nodes directly connected to a certain control node within a preset range; Preferably, the corresponding control node is selected as the initial propagation node based on the magnitude of the neighborhood density feature (for example, the neighborhood density feature value is in the top 20% of the neighborhood density features of all control nodes). It should be noted that, starting from the initial propagation node, the propagation path is expanded level by level according to the connection relationship between the control nodes until the preset path expansion layer limit is met (for example, the path expansion layer limit is 3 layers), and finally a spatial dynamic propagation path is formed.

[0015] Based on the data type difference diagram of the control, calculate the data type sensitivity weight of each node, and use the data type sensitivity weight to perform multiple interactive adjustments on the spatial dynamic propagation path to generate spatial and data type interaction fusion features; Specifically, the formula for calculating the data type sensitivity weight of each control node is as follows: In the formula, Assign a data type sensitive weight to control node i. This represents the set of all control nodes adjacent to control node i. The edge weights in the graph represent the data type differences between control node i and control node j. For set The number of elements.

[0016] The generation process of the spatial and data type interaction fusion feature includes: The propagation probability of a node is calculated based on the density of its neighborhood, and spatial propagation features are generated by randomly perturbing the propagation probability. Specifically, the formula for calculating the node propagation probability is: ;in, Let be the propagation probability of node i. Let be the neighborhood density feature value of node i, and m be the total number of nodes participating in the propagation path expansion; Preferably, the above propagation probability is further... Apply random perturbations (e.g., small random perturbations that follow a uniform or Gaussian distribution) to generate spatial propagation features.

[0017] The propagation probability is dynamically adjusted based on the data type sensitivity weight of the nodes to generate data type propagation features; Specifically, utilizing node data type sensitive weights The propagation probability is dynamically adjusted, and the adjusted propagation probability is: ;in, The adjusted propagation probability of node i; Perform cross-iterative fusion processing on spatial propagation features and data type propagation features to generate interactive fusion features of spatial and data types; Specifically, the cross-iterative fusion process is implemented using the following formula: ;in, Let i be the fused feature of node i after the (t+1)th iteration. Let be the spatial propagation characteristics of the t-th iteration. Propagate the data type characteristics for the t-th iteration. The preset fusion ratio coefficient (e.g., 0.5) is used in the initial state. .

[0018] It should be noted that the number of iterations for the above cross-iterative fusion process is set according to actual needs (for example, the number of iterations is 5 times), and finally a stable spatial and data type interaction fusion feature is obtained.

[0019] Based on the interaction and fusion features of spatial and data types, a control topology is constructed, and the data sensitivity correlation between controls is obtained through the diffusion calculation of the topology. Specifically, the control topology is constructed by calculating the similarity of spatial and data type interaction features between control nodes: Preferably, the similarity of the fused features between control nodes can be calculated using cosine similarity or Euclidean distance transformation: Taking cosine similarity as an example, the formula for calculating the similarity between control node i and node j is: ;in, and These are the fused feature vectors of control node i and node j, respectively; It should be noted that, based on the above similarity... Edges are connected between control nodes according to a similarity threshold (e.g., a similarity threshold of 0.7) to obtain the complete control topology. Furthermore, the data sensitivity correlation between controls is calculated using a diffusion propagation model of the control topology (such as the classic PageRank or tag propagation model).

[0020] Module 102 is used to determine the initial control security level based on the tenant identity and data sensitivity correlation, and to construct a dynamic security policy set by combining the initial control security level and role permissions; Specifically, the process of determining the initial control security level includes: Extract the permission change difference features from the tenant's historical permission change records, and generate the tenant permission change expression based on the permission change difference features; In some specific embodiments, the process of extracting permission change difference features includes: First, the tenant's historical permission change records are compiled into a time series, and the time series is divided into multiple time series sub-intervals with a preset time window size; Furthermore, for each time series sub-interval, the number of permission changes, the number of types of permission changes, and the permission difference before and after the permission changes are calculated within that time series sub-interval. The permission difference is specifically implemented using the set difference calculation method, and the calculation formula is as follows: In the formula, This represents the permission difference degree of the t-th time series sub-interval. Represents the set of permissions within the t-th time series sub-interval, denoted by "". "" represents the symmetric difference between two permission sets, that is, the set of elements that exist in one set but not in the other set; Furthermore, based on the three features calculated above—the number of permission changes, the number of permission types, and the degree of permission difference—a permission change difference feature vector is formed for each time series sub-interval.

[0021] The process of generating the tenant permission change expression includes: Based on the tenant's historical permission change records, multiple permission change time series sub-intervals are divided. For each time series sub-interval, feature random perturbation processing is performed to obtain multiple candidate permission feature subsets. The execution feature random perturbation processing includes: Within each permission change time series sub-interval, a subset of permission change features are randomly selected and subjected to initial perturbation processing to obtain initial feature groups; For example, assuming 10 permission change features are obtained in a certain time series sub-interval, a fixed number (e.g., 6 features) are randomly selected for random perturbation. The perturbation method can be to apply a random weighting factor or random noise to the feature values, specifically using the following formula: In the formula, This represents the permission change characteristic value after random perturbation processing. To represent the original permission change feature value obtained by random selection, The random disturbance factor is determined based on experimental data. Specifically, the random disturbance factor... The range of values ​​can be: ; Adaptive feature reconstruction processing is performed on the initial feature groups to form a subset of candidate permission features; Specifically, the adaptive feature reconstruction process is implemented using principal component analysis (PCA): First, the initial features are grouped into a feature matrix. Then, PCA dimensionality reduction is performed on the feature matrix to extract the principal components as a subset of candidate permission features.

[0022] The information contribution of candidate permission feature subsets is evaluated and fused for screening, and tenant permission change expression is constructed based on the screened feature subsets. Specifically, the method for evaluating information contribution is to calculate the information contribution of each candidate permission feature subset based on information entropy, as shown in the following formula: In the formula, For feature subset Information entropy Let be the probability of the i-th feature appearing in the feature subset.

[0023] Furthermore, the top-ranked subset of candidate permission features (e.g., the top 3 candidate feature subsets) are retained and fused into a tenant permission change expression using a weighted average method. The fusion method is as follows: In the formula, This indicates changes to tenant permissions after the integration. This represents the subset of candidate permission features. The weight is the proportion of the information entropy of the i-th candidate permission feature subset to the total information entropy of the selected feature subsets.

[0024] Based on the bidirectional interaction between tenant permission change expression and data sensitivity correlation between controls, calculate the data risk characteristics of controls; Specifically, the calculation of control data risk characteristics is implemented using a two-way interactive attention mechanism: First, the tenant permission change expression and the data sensitivity correlation feature of the control are used as inputs to the attention mechanism, and the interaction weight is calculated using the following bidirectional attention mechanism formula: ;in, This represents the attention weight between the i-th feature in the tenant permission change expression and the j-th control node in the control data sensitivity correlation. Let i be the i-th dimension feature representing the tenant permission change expression. Let be the data sensitivity correlation vector of the j-th control, and d be the feature dimension; Furthermore, based on the aforementioned attention weights, the risk characteristics of the control data are calculated: ;in, This represents the data risk characteristics of the j-th control, and m represents the number of feature dimensions expressed by the tenant permission change.

[0025] Based on the correlation constraints between the risk characteristics of control data and the combination of role permissions, feature aggregation processing is performed to determine the initial security level of the control; Specifically, the feature aggregation process is implemented using a multi-feature constrained clustering method: In one specific embodiment, all controls are first clustered based on the risk characteristics of the control data. The initial clustering method uses the K-means algorithm, as detailed below: First, based on the risk characteristics of the control data, initialize the control security level cluster centers. The number of cluster centers is preset to several levels (for example, three levels, representing high, medium and low security levels respectively). Furthermore, the initial security level of a control is determined by minimizing the Euclidean distance between the control's data risk characteristics and the cluster centers. The specific clustering objective function is defined as follows: ;in, This represents the objective function for clustering, where K is the preset number of clusters (e.g., 3). This represents the data risk characteristics of the j-th control. For the first The set of controls corresponding to each cluster. For the first Cluster centers of each cluster; Furthermore, the association constraints of role-permission combinations are added to adjust the constraints of the initial clustering results. The specific method is as follows: It should be noted that the associated constraints of the role permission combination refer to the constraints of the security level of the controls that different roles are allowed to access (for example, the administrator role can access controls of all security levels, while the customer service role can only access controls of low security levels). Specifically, for each control's initial cluster level, constraint verification is performed based on the role permission combination. That is, all role permission combinations are traversed. If there is a role permission combination that conflicts with the initial security level of the control, the security level of the control is adjusted up or down to ensure that the control's security level meets the associated constraint conditions of the role permission combination. Specifically, the security level is adjusted step by step. If the initial security level of a control is medium and the role permission combination requires a higher security level, the control's security level will be raised to high. If the initial security level of a control is high and the role permission combination allows access to low-level controls, the original level will remain unchanged. Finally, after the above multi-feature constraint clustering process, a complete initial control security level distribution is formed; It should be noted that the initial security level distribution of the above controls is specifically manifested in that each control is marked with its corresponding security level identifier (e.g., high level, medium level, low level) for use when building a dynamic security policy set later. Specifically, the process of constructing the dynamic security policy set includes: In some specific embodiments, security policy rules are generated based on the combination of role permissions and the security level identifier of the control, as follows: First, for each role permission combination, iterate through the security level identifiers of all controls to generate corresponding role access permission rules. For example, define role access permission rules in the form of tuples: ;in, This represents the permission combination for the i-th role. This indicates the security level identifier of the j-th control. Specifically, there is a preset mapping relationship between the role permission combination and the control security level identifier (for example, the administrator role is mapped to a high-security-level control, and the logistics role is mapped to a low-security-level control). Furthermore, by iterating through all combinations of role permissions and control security level identifiers, an initial set of dynamic security policy rules is constructed, defined as follows: ;in, This represents the initial set of dynamic security policy rules, where n represents the total number of rules. Furthermore, a rule set optimization algorithm (such as an optimization method based on rule merging and redundancy removal) is used to perform rule fusion processing on the initial dynamic security policy rule set to generate an optimized dynamic security policy set; Specifically, rule set optimization algorithms include rule merging and redundant rule removal: First, if multiple role permission combinations map to the same control security level, then the corresponding rules are merged; Secondly, if there are multiple rules of the same level corresponding to the same role permission combination, retain the unique rule and delete the redundant rules; Finally, the dynamic security policy set after rule fusion is output in the form of a policy table for subsequent use and execution.

[0026] The verification module 103 is used to extract role access pattern features based on the role permissions of real-time access requests, and adjust the dynamic security policy set using the role access pattern features to generate policy verification rules. Specifically, the extraction process of the role access pattern features includes: Construct a role access behavior matrix based on historical role access permission records, and generate enhanced role access pattern features based on the temporal dynamic features and access frequency features in the matrix. Specifically, the process of constructing the role access behavior matrix includes: In one specific embodiment, the permission request sequence corresponding to each role in the historical access records is first extracted, and the role permission request sequence is defined as follows: ;in, This represents the sequence of permission requests for the i-th role. This indicates the control permission identifier that role i requests to access at time point j, where m is the total length of the permission request sequence; Then, all role permission request sequences are combined in chronological order to form a role access behavior matrix, specifically represented as follows: ; where, matrix The number of rows n represents the number of roles, the number of columns m represents the length of the permission request sequence, and the matrix elements This indicates the control permission identifier that role i requests to access at time point j; It should be noted that the above matrix can express the pattern of changes in access permissions for each role over a continuous time series; Furthermore, based on the role access behavior matrix, the temporal dynamic features and access frequency features are calculated: Specifically, the calculation method of the time-series dynamic features is as follows: for the permission request sequence of each role, the difference between adjacent elements of the sequence is calculated to obtain the corresponding difference sequence, and then the statistical features, including the mean and variance of the difference sequence, are obtained based on the difference sequence to form the time-series dynamic features corresponding to the role. Specifically, the method for calculating the access frequency feature is to count the number of times each role accesses different types of controls within a specified time period, and then calculate the proportion of the number of times each type of control is accessed to the total number of times the role accesses the control, thus obtaining the access frequency feature corresponding to the role. The process of generating the enhanced role access mode features includes: The dynamic sequence weight is determined based on the dynamic change trend of the historical role permission access sequence, and the dynamic sequence weight is used to identify high-frequency access patterns of role permissions. Perform local pattern feature enhancement processing on high-frequency access patterns of role permissions to obtain enhanced role access pattern features; Specifically, the local pattern feature enhancement processing method includes segmenting the identified high-frequency permission access patterns and extracting local features of the permission access patterns for each segment. These local features include, but are not limited to, the frequency of occurrence of the segmented patterns and the average duration of the segmented patterns. Furthermore, the local pattern features are fused with the obtained temporal dynamic features and access frequency features to form enhanced role access pattern features for subsequent invocation.

[0027] Based on the role permission characteristics of real-time access requests, historical access paths are dynamically matched, and role access path characteristics are calculated based on the differences in the degree of path matching. Specifically, the dynamic matching method for role permission features is as follows: In one specific embodiment, the current role's request permission sequence is first obtained based on real-time access requests, and the current request sequence is matched with the historical permission request sequence using the Dynamic Time Warping (DTW) algorithm. Specifically, the DTW algorithm obtains the matching distance of the sequences by calculating the minimum cumulative distance of the element correspondence between the two sequences. Furthermore, the matching distances obtained above are normalized to reflect the difference in matching degree between the real-time request permission sequence and the historical permission sequence, thus obtaining the role access path features. By cross-recursively fusing enhanced role access pattern features and role access path features, role access pattern features are determined. Specifically, the cross-recursive fusion method is implemented using a recurrent attention mechanism: In one specific embodiment, the enhanced role access pattern features and role access path features are respectively input into a recurrent attention network for feature fusion processing, specifically implemented using an attention calculation method: The query matrix Q, key matrix K, and value matrix V are obtained by linear mapping of enhanced role access pattern features and role access path features, respectively. The symbol T represents the matrix transpose operation. The dimension of the feature vector; Furthermore, the dynamic security policy set is adjusted based on the aforementioned role access pattern characteristics: Specifically, the strategy adjustment process employs both enhancement and suppression methods: Specifically, if the degree of matching between the role access pattern characteristics and the rules in the dynamic security policy set reaches a preset threshold, the rule will be enhanced and adjusted, that is, the constraints on access control for the role will be reduced; if the degree of matching between the role access pattern characteristics and the rules in the dynamic security policy set is lower than the preset threshold, the rule will be suppressed and adjusted, that is, the constraints on access control for the role will be increased. Through the above enhancement and suppression adjustment processes, policy verification rules for the data transmission phase are finally generated.

[0028] The execution module 104 is used to verify the security level of the control according to the policy verification rules during the data transmission phase, and to perform encryption processing or hierarchical storage of the control data based on the verification result. Specifically, the execution process of encrypting or hierarchically storing the control data includes: The control data access action is determined based on the role permissions of the policy verification rules and real-time access requests. If the control data access action is determined to have a security risk, the encryption processing of sensitive control data is triggered. If the control data is determined to be sensitive control data, then multi-segment split encryption processing is performed on the sensitive control data, and the encrypted sensitive control data is output. Specifically, the multi-segment separation encryption method includes the following specific processes: In one specific embodiment, the sensitive control data is first segmented into multiple data subsets, each denoted as: ;in, Let i represent the i-th data subset, and k be the total number of subsets; Specifically, different types of encryption algorithms are applied to each data subset. For example, the first data subset is encrypted using the asymmetric encryption algorithm RSA, while other data subsets are encrypted using the symmetric encryption algorithm AES. Through the above multi-segment encryption strategy, the security of sensitive data during transmission and storage is improved. Furthermore, the specific processes of the above-mentioned different types of encryption algorithms are as follows: ,in, Represents a subset of encrypted sensitive data The encrypted result, Represents the RSA encryption function. This represents a predefined public key in the system; For a subset of data processed using the asymmetric encryption algorithm RSA, the subset is first encrypted using a pre-generated public key, denoted as: ;in, This represents the AES encryption function. The AES symmetric key is randomly generated by the system; Specifically, after each subset has been encrypted, the subsets are sequentially assembled using a predefined combination strategy to output the fully encrypted sensitive control data.

[0029] If the control data is determined to be non-sensitive control data, the storage level of the non-sensitive control data is determined based on the data sensitivity correlation between controls, and the storage area is dynamically matched according to the storage level to output the hierarchical storage location of the non-sensitive control data. Specifically, the method for determining the storage level of non-sensitive control data is as follows: In one specific embodiment, the data sensitivity correlation between controls is first extracted, and the control data is then classified according to the threshold range of the correlation: For example, the data sensitivity correlation is divided into three threshold intervals: If the data sensitivity correlation value is within the range [0, 0.3], then the storage level corresponding to the control data is determined to be low sensitivity level; If the data sensitivity correlation value is within the range (0.3, 0.7], then the storage level corresponding to the control data is determined to be medium sensitivity level; If the data sensitivity correlation value is within the range (0.7, 1], then the storage level corresponding to the control data is determined to be a high sensitivity level; Furthermore, storage regions are dynamically matched based on the determined storage level: Specifically, within a predefined set of storage regions, sensitivity level identifiers are defined for different storage regions, and the appropriate storage region is matched using the following method: For example, for data with low sensitivity levels, a standard storage area matching normal access permissions is used; For data of medium sensitivity, use a medium-security storage area with restricted access. For highly sensitive data, use a secure storage area with strict access control. Then, the system dynamically matches the storage area for non-sensitive control data and outputs the final hierarchical storage location to ensure that the data is stored in a secure and compliant manner.

[0030] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters, weights, and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0031] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0032] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A data compliance encryption and tiered storage system for cross-border business, characterized in that, The system includes: The association module is used to construct a control topology based on the positional relationship of field controls in the form and the differences in data types between controls, and to determine the data sensitivity association between controls based on the control topology. The module is used to determine the initial security level of controls based on tenant identity and data sensitivity correlation, and to build a dynamic security policy set by combining the initial control security level with role permissions; The verification module is used to extract role access pattern features based on the role permissions of real-time access requests, and adjust the dynamic security policy set using the role access pattern features to generate policy verification rules. The execution module is used to verify the security level of the control according to the policy verification rules during the data transmission phase, and to perform encryption processing or hierarchical storage of the control data based on the verification results.

2. The system according to claim 1, characterized in that, The process of determining the data sensitivity correlation between the controls includes: Construct a spatial position relationship diagram of controls based on their spatial position characteristics, and construct a data type difference diagram of controls based on their data type differences; Multiple initial propagation nodes are selected based on the spatial location relationship graph of the control. The propagation path is dynamically expanded according to the density of the neighborhood of the propagation node to form a spatial dynamic propagation path. Based on the data type difference diagram of the control, calculate the data type sensitivity weight of each node, and use the data type sensitivity weight to perform multiple interactive adjustments on the spatial dynamic propagation path to generate spatial and data type interaction fusion features; The topology of controls is constructed based on the interaction and fusion characteristics of spatial and data types, and the data sensitivity correlation between controls is obtained through the diffusion calculation of the topology.

3. The system according to claim 2, characterized in that, The generation process of the spatial and data type interaction fusion feature includes: The propagation probability of a node is calculated based on the density of its neighborhood, and spatial propagation features are generated by randomly perturbing the propagation probability. The propagation probability is dynamically adjusted based on the data type sensitivity weight of the nodes to generate data type propagation features; Perform cross-iterative fusion processing on spatial propagation features and data type propagation features to generate interactive fusion features of spatial and data types.

4. The system according to claim 3, characterized in that, The process of determining the initial control security level includes: Extract the permission change difference features from the tenant's historical permission change records, and generate the tenant permission change expression based on the permission change difference features; Based on the bidirectional interaction between tenant permission change expression and data sensitivity correlation between controls, calculate the data risk characteristics of controls; Based on the association constraints between the risk characteristics of control data and the combination of role permissions, feature aggregation processing is performed to determine the initial security level of the control.

5. The system according to claim 4, characterized in that, The process of generating the tenant permission change expression includes: Based on the tenant's historical permission change records, multiple permission change time series sub-intervals are divided. For each time series sub-interval, feature random perturbation processing is performed to obtain multiple candidate permission feature subsets. The information contribution of candidate permission feature subsets is evaluated and fused for selection. Based on the selected feature subsets, a tenant permission change expression is constructed.

6. The system according to claim 5, characterized in that, The execution feature random perturbation processing includes: Within each permission change time series sub-interval, a subset of permission change features are randomly selected and subjected to initial perturbation processing to obtain initial feature groups; Adaptive feature reconstruction processing is performed on the initial feature groups to form a subset of candidate permission features.

7. The system according to claim 6, characterized in that, The extraction process of the role access pattern features includes: Construct a role access behavior matrix based on historical role access permission records, and generate enhanced role access pattern features based on the temporal dynamic features and access frequency features in the matrix. Based on the role permission characteristics of real-time access requests, historical access paths are dynamically matched, and role access path characteristics are calculated based on the differences in the degree of path matching. By cross-recursively fusing enhanced role access pattern features and role access path features, role access pattern features are determined.

8. The system according to claim 7, characterized in that, The process of generating the enhanced role access mode features includes: The dynamic sequence weight is determined based on the dynamic change trend of the historical role permission access sequence, and the dynamic sequence weight is used to identify high-frequency access patterns of role permissions. Local pattern feature enhancement processing is performed on the high-frequency access patterns of role permissions to obtain enhanced role access pattern features.

9. The system according to claim 8, characterized in that, The execution process of encrypting or hierarchically storing the control data includes: The control data access action is determined based on the role permissions of the policy verification rules and real-time access requests. If the control data access action is determined to have a security risk, the encryption processing of sensitive control data is triggered. If the control data is determined to be sensitive control data, then multi-segment split encryption processing is performed on the sensitive control data, and the encrypted sensitive control data is output. If the control data is determined to be non-sensitive control data, the storage level of the non-sensitive control data is determined based on the data sensitivity correlation between controls, and the storage area is dynamically matched according to the storage level to output the hierarchical storage location of the non-sensitive control data.

Images