A data security sharing method and system for government-enterprise data fusion

Abstract

The application relates to the field of data security sharing, and discloses a data security sharing method and system for government-enterprise data fusion, which comprises the following steps: analyzing the operation behaviors of power user side collection terminals and government side data gathering nodes connected to a cloud platform, and constructing cross-domain semantic mapping constraint rules; based on the cross-domain semantic mapping constraint rules, distributing path constraints to data write request entering a cloud storage access link, and constructing a data temporary storage structure; taking the data temporary storage structure as an interactive carrier, analyzing the generation path relationship of power operation data and government related data, and outputting a data content anomaly judgment result; based on the data content anomaly judgment result, tracking the state change of the data write process, forming a write risk dynamic state; and according to the write risk dynamic state, adjusting the path of data writing into a cloud storage system, and generating a data credible write control result. The application has the advantage of improving the consistency of cross-domain data semantics.

Description

Technical Field

[0001] This invention relates to the field of secure data sharing, specifically a secure data sharing method and system for government and enterprise data integration. Background Technology

[0002] Against the backdrop of the advancement of e-government and the digital development of power enterprises, the demand for the integration of e-government data and power data in scenarios such as emergency response and energy supply security is constantly increasing. Existing technologies usually rely on data exchange platforms to achieve cross-system data flow and ensure data security through encrypted transmission, access control and other means, while supporting multi-source data applications by combining data preprocessing and correlation analysis.

[0003] In practical applications, due to differences in temporal granularity, spatial structure, and semantic expression between government data and power data, it is difficult to achieve unified semantic alignment and consistent expression of data from different sources. At the same time, in order to meet privacy protection requirements, data is often processed by methods such as anonymization and aggregation, which can easily cause fine-grained information loss, thereby affecting the effect of fusion analysis. In addition, existing technologies mainly focus on security control after data exchange, lacking targeted management of data access and writing processes. Some data with structural anomalies or consistency deviations may still enter the system. This problem is more prominent in scenarios with frequent multi-source data interaction, and it is also difficult to trace the source and scope of impact of abnormal data. Furthermore, existing security mechanisms are mostly based on static rules or fixed thresholds, which are difficult to dynamically adjust according to changes in data status, making it difficult to balance data security and processing efficiency.

[0004] Therefore, it is essential to design a data security sharing method and system for government and enterprise data fusion that improves the semantic consistency of cross-domain data. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a data security sharing method and system for government and enterprise data fusion, which has the advantage of improving the semantic consistency of cross-domain data and solves the problems mentioned in the background technology.

[0006] To achieve the aforementioned goal of improving the semantic consistency of cross-domain data, this invention provides the following technical solution: a data security sharing method for government and enterprise data fusion, comprising the following steps: The operational behavior of the power user-side data acquisition terminals and government data aggregation nodes connected to the cloud platform is analyzed to extract the device access behavior, timing and load characteristics, and coupled with the differences between power data and government data to build cross-domain semantic mapping constraint rules. Based on cross-domain semantic mapping constraint rules, path constraints are allocated for data write requests entering the cloud storage access link. Combining the consistency of field structure and semantic expression, cross-source association integrity, and data format consistency offset features, a temporary data storage structure with verification constraints is constructed on the storage access node side. Using the data temporary storage structure as the interaction carrier, the generation path relationship between power operation data and government affairs related data is analyzed. Combined with the data link propagation characteristics, the structural consistency deviation during the writing process is identified, and the data content anomaly judgment result is output. Based on the data content anomaly determination results, the state changes of the data writing process are tracked, and the anomaly propagation trend is analyzed by combining the data source stability status and structural deviation characteristics to form a dynamic state of writing risk. Based on the dynamic status of write risks, the data write path to the cloud storage system is adjusted. Combining the stability of the data source and the intensity of abnormal propagation, write behavior is subject to hierarchical constraints, generating data trustworthy write control results.

[0007] Preferably, the process of constructing cross-domain semantic mapping constraint rules is as follows: The access logs, communication handshake sequences, and data reporting frequencies of the power user-side data acquisition terminal and the government-side data aggregation node are collected in a unified manner, and the time-series drift characteristics and load fluctuation characteristics of different nodes are aligned to form access behavior consistency characterization data. Based on the access behavior consistency representation data and the cross-domain data semantic comparison library, the semantic differences and structural mapping analysis of the power data field semantics and the government data field semantics are performed to generate initial semantic difference features. Constraints are extracted based on the correlation between initial semantic difference features and access behavior consistency representation data to form cross-domain semantic mapping constraint rules.

[0008] Preferably, the process of allocating path constraints for data write requests entering the cloud storage access link is as follows: The data write requests entering the cloud storage access link are parsed to extract data source identifiers, field structure features and semantic tag information to form the basic features of the write request. Based on the basic features of write requests and cross-domain semantic mapping constraint rules, a matching analysis is performed to generate request semantic consistency score and structure matching score. The write request constraint level is determined based on the scoring results, and the cloud storage access path is partitioned and mapped based on the constraint level to form a hierarchical write path structure.

[0009] Preferably, the process of constructing a temporary data storage structure with verification constraints on the storage access node side is as follows: Based on the hierarchical write path structure, the data write requests entering the storage access node are received and parsed to form a consistent representation of the field structure. The cross-domain association integrity of power data and government data is assessed by combining the correlation between cross-source data, and a cross-source association integrity index is generated; Constructing a verification feature expression based on field structure consistency representation and cross-source association integrity index; Using the verification feature representation as a constraint basis, a data temporary storage structure composed of hierarchical buffer units is constructed on the storage access node side.

[0010] Preferably, the process of parsing the generation path relationship between power operation data and government affairs related data is as follows: Based on the data record timestamps and source identifiers in the data temporary storage structure, a time-series correlation relationship between power operation data and government-related data is constructed. Track and analyze field dependencies between different data sources to form cross-source path candidate relationships; By combining the node hop information in the data transmission link, the credibility of cross-source path candidate relationships is evaluated, and the credibility results of each candidate path are obtained. The final data generation path relationship structure is determined based on the path credibility assessment results.

[0011] Preferably, the process for determining the anomaly of the output data content is as follows: Expand the data generation path relationship structure to construct a data propagation topology; Based on the propagation topology, structural dependencies between nodes and propagation weight distribution characteristics are extracted; The structural characteristics of the currently written data are compared and analyzed with the historical normal propagation structure to calculate the structural consistency deviation. When the deviation of structural consistency exceeds the preset threshold, the result of abnormal data content is output.

[0012] Preferably, the process of forming and writing the dynamic risk status is as follows: The results of data content anomaly determination are expanded along the time dimension to construct a sequence of write status changes; The stability change characteristics of the data source are analyzed based on the write state change sequence, and the stability state of the data source is determined based on the change characteristics. By combining the stability status and structural consistency deviation characteristics of the data source, an extended analysis of the anomaly propagation path is conducted to form an evolutionary characterization of the anomaly propagation trend. The data source stability status and anomaly propagation trend evolution representation are fused together, and the output is written into the risk dynamic status.

[0013] Preferably, the process of adjusting the data writing path to the cloud storage system is as follows: The dynamic status of written risks is classified into levels, and multi-level risk control strategies are generated. Based on a multi-level risk control strategy, the cloud storage write path is dynamically mapped and adjusted to form a multi-path write channel structure. The multi-path write channel structure is prioritized according to different risk levels, and high-risk channels are rate-limited or isolated. Based on the results of rate limiting or isolation processing, a real-time feedback mechanism is introduced during the write path adjustment process to dynamically monitor the path status and risk control effectiveness. The dynamic status of write risk is updated and adjusted based on the feedback results, generating an updated dynamic status of write risk.

[0014] Preferably, the process for generating trusted data write control results is as follows: Based on the updated dynamic status of write risk, a collaborative analysis is performed on the stability status of data sources and the intensity of anomaly propagation to generate a trust score for write behavior. A hierarchical constraint mechanism is constructed based on the write behavior trust score, and the corresponding constraint level is determined; Based on the mapping and matching between constraint levels and a preset control rule base, differentiated control strategies corresponding to different constraint levels are generated. The control strategy is applied to the cloud storage write execution process to jointly control write permissions, write rate and write path, and output the data write control result with confidence.

[0015] A data security sharing system for government-enterprise data integration includes: Semantic parsing module: parses the operational behavior characteristics of power user-side data acquisition terminals and government-side data aggregation nodes, and constructs cross-domain semantic mapping constraint rules; Write verification module: allocates path constraints for data write requests and builds a temporary data storage structure with verification constraints on the storage access node side; Anomaly detection module: Analyzes the data generation path relationship and link propagation characteristics based on the data temporary storage structure, and identifies structural consistency deviations during the writing process; Risk Analysis Module: Based on the anomaly identification results, the write process status is tracked and analyzed, and anomaly propagation trends and dynamic write risk status are generated; Write control module: Adjusts the write path of the cloud storage system according to the dynamic risk status, and generates trusted write control results by imposing hierarchical constraints on write behavior.

[0016] Compared with existing technologies, this invention provides a data security sharing method and system for government and enterprise data fusion, which has the following beneficial effects: This invention constructs a mechanism for analyzing the operational behavior and coupling the differential characteristics of cross-power and government data, achieving unified processing of semantic consistency constraints and structural mapping for multi-source heterogeneous data during the access phase. By introducing path constraints and temporary verification structures based on semantic consistency, structural integrity, and format offset characteristics into the cloud storage write link, it achieves pre-screening and buffer control of the data write process, effectively reducing the risk of abnormal or inconsistent data directly entering the storage system. Through joint analysis of data generation path relationships and link propagation characteristics, it achieves dynamic identification of structural consistency deviations during the write process, and constructs a dynamic write risk assessment mechanism based on abnormal propagation trends, enabling the system to continuously track and evaluate potential anomalies. By feeding back the risk assessment results to the write path control layer, it achieves hierarchical constraints and dynamic adjustments on the stability of different data sources and the intensity of abnormal propagation, thereby forming an adaptive data write control strategy. Overall, it can improve the security, consistency, and controllability of cross-domain data sharing while ensuring the efficient integration and utilization of government and power data, enhance the system's ability to identify and suppress abnormal data propagation in complex multi-source data environments, and improve the overall reliability and refined management level of trusted data writing and secure sharing. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the method of the present invention; Figure 2 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: Please refer to Figure 1 As shown in the figure, a data security sharing method for government-enterprise data fusion according to an embodiment of the present invention includes the following steps: S1: Analyze the operational behavior of the power user-side data acquisition terminals and government data aggregation nodes connected to the cloud platform, extract the device access behavior and timing and load characteristics, and couple them with the differences between power data and government data to build cross-domain semantic mapping constraint rules.

[0020] The process of constructing cross-domain semantic mapping constraint rules in S1 is as follows: Access logs, communication handshake sequences, and data reporting frequencies of power user-side acquisition terminals and government data aggregation nodes are collected uniformly. The temporal drift characteristics and load fluctuation characteristics of different nodes are aligned to form access behavior consistency characterization data. Logs from different sources are standardized to convert unstructured logs into structured time-series data, and timestamps are uniformly calibrated to eliminate cross-system clock deviations. Based on this, the communication handshake sequence is segmented according to fixed time windows, and connection establishment delay, handshake success status, and abnormal retry characteristics are extracted within each window. Simultaneously, the data reporting frequency is periodically analyzed to characterize the upload rhythm variation. Furthermore, the time series of different nodes are aligned to map them to a unified time axis, and load fluctuation characteristics are normalized to eliminate dimensional influence. After feature fusion processing, temporal drift characteristics, communication behavior characteristics, and load fluctuation characteristics are jointly represented to form access behavior consistency characterization data for depicting the consistency and differences in access behavior of different nodes. Based on access behavior consistency representation data and cross-domain data semantic comparison library, the semantic differences and structural mapping analysis of power data fields and government data fields are performed to generate initial semantic difference features. Based on access behavior consistency representation data and cross-domain data semantic comparison library, semantic matching and difference analysis processing are performed on power data fields and government data fields. The fields are semantically decomposed into business semantic units and structural attribute units, and the business semantic units are mapped to a unified semantic space to achieve cross-system semantic alignment representation. The similarity between power-side fields and government-side fields is calculated in the unified semantic space, and the matching results are verified in combination with field structure consistency constraints to identify field pairs that are semantically consistent or semantically deviate. For field pairs that are semantically deviate or structurally mismatched, their difference type is recorded, including semantic offset, structural inconsistency, and expression granularity difference. The stability correction of the difference results is performed in combination with access behavior consistency representation data to reduce the interference of abnormal access status on semantic judgment, thereby generating initial semantic difference features containing information on the degree of semantic difference and structural difference. Constraints are extracted based on the correlation between initial semantic difference features and access behavior consistency representation data to form cross-domain semantic mapping constraint rules. Based on this correlation, the semantic difference formation mechanism is modeled and analyzed, using the degree of semantic difference as the target variable. Temporal stability, load fluctuation characteristics, and communication reliability in access behavior are established as influencing factors. Based on the strength of the effect of different influencing factors on semantic differences, field mapping relationships are classified, distinguishing between reliable mapping relationships established under high-stability access conditions and mapping relationships requiring additional constraints or verification under fluctuating conditions. The reliability of these mapping relationships is then graded to form a hierarchical rule structure from high-reliability mapping to strongly constrained mapping. This structure serves as the cross-domain semantic mapping constraint rule for mapping control and consistency verification during the fusion of power data and government data.

[0021] S2: Based on cross-domain semantic mapping constraint rules, the data write requests entering the cloud storage access link are allocated with path constraints. Combining the consistency of field structure and semantic expression, cross-source association integrity and data format consistency offset features, a temporary data storage structure with verification constraints is constructed on the storage access node side.

[0022] The process of allocating path constraints for data write requests entering the cloud storage access link in S2 is as follows: Data write requests entering the cloud storage access link are parsed to extract data source identifiers, field structure features, and semantic tag information to form basic write request features. The data write requests entering the cloud storage access link are then parsed and processed, and the request messages are structurally decomposed, dividing the original write requests into three categories: data source identifier information, field structure information, and semantic tag information. The data source identifier information is used to determine the type of system or device initiating the request; the field structure information is used to characterize the hierarchical structure, number of fields, and data type distribution of the data fields; and the semantic tag information is used to describe the business meaning corresponding to the fields. These three types of information are uniformly encoded to convert unstructured request content into a structured feature vector representation. Differences in field naming from different source requests are normalized to eliminate inconsistencies in cross-system representation. After processing, basic write request features are formed that can fully characterize the source attributes, structural features, and semantic attributes of the write request. Matching analysis is performed based on the basic features of write requests and cross-domain semantic mapping constraints to generate request semantic consistency scores and structure matching scores. Consistency analysis is also performed on the matching relationship between write requests and target cloud storage data models based on the basic features of write requests and pre-built cross-domain semantic mapping constraints. Semantic consistency analysis determines the degree of correspondence between the semantics of request fields and the semantics of standard data by calculating the similarity between semantic tags. Structure matching analysis determines the degree of consistency between the structure of request fields and the target storage structure, including field hierarchy, field quantity matching, and data type compatibility. During the analysis, cross-domain semantic mapping constraints are used as a reference benchmark. Field relationships that do not conform to the constraints are marked as deviations, and different types of deviations are quantitatively scored. Finally, request semantic consistency scores reflecting the degree of semantic matching and structure matching scores reflecting the degree of structure matching are generated, providing a basis for pathway grading. The write request constraint level is determined based on the scoring results, and the cloud storage access path is partitioned and mapped according to the constraint level to form a hierarchical write path structure. Based on the request semantic consistency score and structure matching score, the risk and compatibility of the write request are comprehensively evaluated, and the constraint level of the write request is determined according to the score combination relationship. The constraint level is divided into three different processing levels: high matching with low constraint, medium matching with medium constraint, and low matching with high constraint. Among them, high matching requests are allowed to directly enter the main write path, medium matching requests enter the buffered write path with verification, and low matching requests enter the controlled isolated write path. During the path allocation process, the cloud storage access link is logically partitioned and mapped according to the constraint level, and requests of different levels are routed to the corresponding write paths. Corresponding verification and control policies are set at each path node, thereby forming a write path structure with hierarchical control capabilities, realizing differentiated management and control of data write behavior with different risk levels.

[0023] The process of constructing a data temporary storage structure with verification constraints on the storage access node side in S2 is as follows: Based on the hierarchical write path structure, data write requests entering the storage access node are received and parsed to form a consistent field structure representation. The write requests are then structurally decomposed, extracting field names, field hierarchy relationships, and field data type information. Data requests from different sources are uniformly converted into a standardized field description format. During processing, differences in field naming from the power sector and the government sector are uniformly mapped, unifying semantically identical but differently expressed fields into the same standard field identifier. The nesting relationships between fields are hierarchically reconstructed to unify the data structure expression methods of different systems. Furthermore, missing, redundant, and inconsistent field order conditions are marked and corrected, thus forming a consistent field structure representation that reflects the degree of consistency of write requests at the structural level. This study assesses the cross-domain association integrity of power data and government data by combining the relationships between cross-source data, generating a cross-source association integrity index. It also evaluates the association integrity of power data and government data during the writing process, based on a pre-established data association model. This model identifies and matches the correspondence between power data fields and government data fields, including one-to-one, one-to-many, and many-to-one mappings. Furthermore, it checks the integrity of cross-system data links involved in the write request, determining whether related fields are missing, broken, or uncovered, and verifies the continuity of the association path. For data paths with broken or incomplete associations, the degree of loss and the scope of impact are recorded. Finally, it re-evaluates the association integrity based on the stability of the data source, thereby generating a cross-source association integrity index to characterize the cross-source data association integrity. A verification feature expression is constructed based on field structure consistency representation and cross-source association integrity index. Based on field structure consistency representation and cross-source association integrity index, a joint expression model is performed on the structural rationality and data association reliability of write requests. Field structure consistency representation is used to describe the degree of standardization of the internal structure of a single write request, and cross-source association integrity index is used to describe the completeness of the request in cross-system data relationships. The two types of indices are uniformly scaled and normalized to make them comparable. The structural consistency and association integrity are fused and calculated to form a comprehensive verification feature expression, which is used to simultaneously reflect the constraint status of write requests in two dimensions: structural correctness and cross-domain data association integrity. Using verification features as constraints, a data temporary storage structure composed of hierarchical buffer units is constructed on the storage access node side. Data write requests entering the storage access node are processed hierarchically based on these verification features, with different constraint levels determined by the comprehensive results of the verification features. Corresponding data temporary storage mechanisms are then constructed accordingly. In implementation, the data temporary storage structure is divided into multiple buffer units, each corresponding to a different constraint level's data processing path. High-consistency data enters the fast write buffer unit for direct persistence, medium-consistency data enters the verification buffer unit for completion verification and delayed write processing, and low-consistency data enters the isolation buffer unit for temporary storage and manual or rule-based review. Through this hierarchical buffer mechanism, data of varying reliability is differentiated before entering the storage system, thus forming a data temporary storage structure with constraint control capabilities on the storage access node side.

[0024] S3: Using the data temporary storage structure as the interaction carrier, it analyzes the generation path relationship between power operation data and government affairs related data, and combined with the data link propagation characteristics, it identifies the structural consistency deviation during the writing process and outputs the data content anomaly judgment result.

[0025] The process of parsing the generation path relationship between power operation data and government affairs related data in S3 is as follows: Based on the data record timestamps and source identifiers in the data temporary storage structure, a time series association relationship between power operation data and government-related data is constructed. Based on the timestamp information and source identifiers of power operation data and government-related data in the data temporary storage structure, the time format is uniformly standardized and mapped to the same time reference system, so that data from different sources have a unified time reference. After the time granularity is aligned, the data is divided according to a fixed time window. Data within the same time window is grouped into the same time series unit, thus forming a time distribution sequence across data sources. The source identifier is further used to distinguish the generation attribution of power-side data and government-side data, and the sequential triggering characteristics of data from different sources are characterized in combination with the time sequence relationship, so that a comparable time series correspondence structure is formed between power operation data and government-related data, thereby constructing a time series association relationship. Field dependencies between different data sources are tracked and analyzed to form cross-source path candidate relationships. Field dependencies between power operation data and government-related data are analyzed around field semantic identifiers, calculation sources and transmission paths. The reference relationships and generation relationships between fields together form the basis of the dependency chain. If power-side fields and government-side fields share upstream data sources or have front-to-back calculation connections during data processing, potential dependency connections are formed. Multiple sets of field dependency connections are combined and expanded across systems. The data flow path between different systems is gradually restored into multiple possible generation links, thereby forming cross-source path candidate relationships covering multiple dependency possibilities. By combining the node jump information in the data transmission link, the credibility of cross-source path candidate relationships is evaluated to obtain the credibility results of each candidate path. After the cross-source path candidate relationships are matched with the node jump information in the data transmission link, the node traversal of each path in the actual data flow process is restored. Whether the path is continuous, whether there are missing jump nodes, and whether there are non-recorded forwarding links become the basis for credibility judgment. The stability of the path occurrence in historical data further reflects its repeatability and verifiability. The higher the stable occurrence frequency, the stronger the path reliability. The path integrity characteristics and historical stability characteristics work together to evaluate the path credibility, thus forming the credibility results of each candidate path in the actual data generation process. The final data generation path relationship structure is determined based on the path credibility assessment results. After comparing the path credibility results with the preset credibility threshold, candidate paths below the threshold are excluded, and paths above the threshold are added to the retention set. If there are multiple paths within the retention set, the stability characteristics and historical consistency of the paths are used to further distinguish priorities. Paths with higher stability and stronger historical consistency are prioritized as valid generation paths. When there are conflicting relationships between different paths, the consistency comparison results of multiple paths are used to determine the final attribution relationship, thereby forming a unique or multiple controlled data generation path relationship structure to depict the real data generation link between power operation data and government affairs related data.

[0026] The process of outputting abnormal data content judgment results in S3 is as follows: The data generation path relationship structure is expanded to construct a data propagation topology. Based on the data generation path relationship structure, the data flow link between the power system and the government system is expanded and analyzed. Each node and its connection relationship in the path relationship is mapped into a graph structure representation. Nodes are used to represent data processing units or transmission nodes, and edges are used to represent the data transmission relationship between nodes. The connection relationship between nodes is reconstructed according to the actual data flow order, and the data flow direction is marked with path direction information, so that the data propagation process from the source to the storage end forms a directed topology. In this structure, each path corresponds to a complete data propagation chain, thereby constructing a propagation topology structure to describe the entire data flow path. Based on the propagation topology, structural dependencies and propagation weight distribution features between nodes are extracted. Structural analysis is performed on the data flow relationships between nodes, using the connections between nodes to characterize data processing dependencies—that is, the degree to which subsequent nodes depend on the output of preceding nodes. Node dependencies are quantified by combining data flow frequency and path stability, resulting in different weight distributions for different paths within the topology. Simultaneously, multiple propagation paths are statistically summarized to identify differences between high-frequency and low-frequency paths, thus forming weight distribution features that reflect the intensity of data propagation and the degree of structural dependency, used to characterize the structural stability pattern during normal data flow. The structural characteristics of the currently written data are compared and analyzed with the historical normal propagation structure to calculate the structural consistency deviation. After the currently written data enters the system, its structural characteristics are aligned and compared with the historical normal data propagation structure. The structural characteristics include field organization, path dependency, and node flow order. The historical normal propagation structure serves as a benchmark model to characterize the data flow pattern of the system under normal operation. The differences between the current structure and the historical structure are comprehensively measured by node matching results, path consistency, and weight distribution offset, so that the structural differences can be transformed into a unified deviation index. The higher the deviation, the more obvious the difference between the current written data and the historical normal pattern in terms of propagation structure. When the deviation from structural consistency exceeds a preset threshold, the data content anomaly judgment result is output. The structural consistency deviation is compared with the preset threshold. When the deviation is within the threshold range, the current data is judged to conform to the normal propagation structure characteristics. When the deviation exceeds the preset threshold, the current data has a significant difference from the historical normal pattern in the propagation path structure, thereby triggering the anomaly judgment mechanism. The anomaly judgment result and the corresponding propagation path information are output together to identify the abnormal characteristics of the currently written data at the structural propagation level and to provide a basis for data interception or review.

[0027] S4: Based on the data content anomaly determination results, track the state changes during the data writing process, combine the data source stability status and structural deviation characteristics, analyze the anomaly propagation trend, and form a dynamic state of writing risk.

[0028] The process of forming a dynamic state of risk in S4 is as follows: The data content anomaly determination results are expanded along the time dimension to construct a write state change sequence. The data content anomaly determination results are continuously expanded along the time dimension. The anomaly determination results include anomaly identifier, corresponding propagation path number and timestamp information. Different write requests are sorted sequentially based on timestamps. A time-state mapping relationship is constructed for each write record. Abnormal state and normal state are encoded into a unified state identifier. The state sequence is segmented by a fixed time window. State difference calculation is introduced between adjacent time windows to record the switching process from normal to abnormal or from abnormal to normal, thus forming a write state change sequence containing state identifier, time index and switching relationship. The stability change characteristics of the data source are analyzed based on the write state change sequence, and the stability status of the data source is determined based on the change characteristics. Based on the write state change sequence, the proportion of abnormal states, the number of state switching and the duration of continuous abnormalities are statistically analyzed within a preset time sliding window. The proportion of abnormalities is used to reflect the density of short-term abnormalities, the number of state switching is used to reflect the degree of stability fluctuation, and the duration of continuous abnormalities is used to reflect the characteristics of persistent risk. After normalizing the above statistical results, a data source stability assessment value is constructed, and the stability assessment value is used to classify three state levels: stable, high volatility and low stability, thereby forming a data source stability status that can reflect the stability of the data source operation. By combining the stability state of the data source with the deviation characteristics of structural consistency, an extended analysis of the anomaly propagation path is performed to form an anomaly propagation trend evolution characterization. The structural consistency deviation characteristics are used to identify the degree of deviation at the node level. The anomaly node is extended upstream and downstream along the data generation path relationship structure to identify the preceding and subsequent nodes that have a direct data dependency relationship with the anomaly node. The length of the continuous propagation segment of the anomaly in the path and the number of nodes covered are counted. When multiple consecutive nodes simultaneously meet the deviation characteristics, they are merged into anomaly propagation segments, and the start and end positions and diffusion direction of the segments in the path are recorded, thus forming an anomaly propagation trend evolution characterization used to characterize the expansion process of the anomaly in the propagation path. The system integrates the data source stability status and the anomaly propagation trend evolution representation to output a dynamic state of write risk. The data source stability status characterizes the basic fluctuation level of anomalies, while the anomaly propagation trend evolution representation characterizes the extent and duration of anomalies in the propagation path. After unified quantification and mapping of these two types of information, a risk assessment vector is constructed and continuously updated over time. This allows the risk value to dynamically evolve with changes in the write status. When the stability level decreases and the anomaly propagation segment continues to expand, the write risk value increases; when the stability level increases and the anomaly propagation segment converges or disappears, the write risk value decreases. This outputs a dynamic state of write risk reflecting the current data write risk over time, which is then used to adjust data write control strategies.

[0029] S5: Based on the dynamic status of write risks, adjust the data write path to the cloud storage system, and combine the stability of data sources and the intensity of abnormal propagation to impose hierarchical constraints on write behavior and generate data trustworthy write control results.

[0030] The process of adjusting the data writing path to the cloud storage system in S5 is as follows: The dynamic state of write risk is classified into levels to generate multi-level risk control strategies. The dynamic state of write risk is parsed and processed. The dynamic state of risk includes risk value, stability level and anomaly propagation strength information. Based on the risk value range, write risk is classified into three levels: low risk, medium risk and high risk, and each level corresponds to a different control constraint strength. Control strategy parameters are configured for different risk levels. Low risk corresponds to normal write strategy, medium risk corresponds to verification enhancement strategy, and high risk corresponds to restricted write strategy or blocking strategy, thus forming a multi-level risk control strategy to guide write path scheduling. Based on a multi-level risk control strategy, the cloud storage write path is dynamically mapped and adjusted to form a multi-path write channel structure. The cloud storage write path is reconstructed based on the multi-level risk control strategy, dividing the original single write path into multiple parallel write channels. Each channel corresponds to a different risk level and processing strategy. Logically, each write channel is configured with different data processing capabilities and access control rules. Low-risk channels are used to directly write to the storage system, medium-risk channels introduce verification and buffering mechanisms, and high-risk channels are equipped with isolation processing mechanisms or temporary blocking mechanisms. Through the mapping relationship between risk level and channel strategy, the write request is dynamically allocated among multiple channels, thereby forming a multi-path write channel structure. The multi-path write channel structure is prioritized according to different risk levels, and high-risk channels are subject to rate limiting or isolation. Based on the multi-path write channel structure, each channel is prioritized according to its risk level and historical operational stability, with low-risk channels having the highest priority, followed by medium-risk channels, and high-risk channels having the lowest priority. When rate limiting is applied to high-risk channels, the amount of data allowed to be written per unit time is limited, and write requests are queued. When isolation is applied to high-risk channels, relevant write requests are imported into an independent isolation queue, and their direct write permissions to the main storage system are suspended. Through the joint adjustment of priority control and rate limiting / isolation mechanisms, differentiated control of write behavior at different risk levels is achieved. Based on the results of rate limiting or isolation processing, a real-time feedback mechanism is introduced during the write path adjustment process to dynamically monitor the path status and risk control effectiveness. During the write path adjustment process, the operating status of each write channel is continuously monitored, and the monitoring indicators include channel throughput, write success rate, and abnormal interception ratio. Real-time feedback data is constructed based on the monitoring results. The real-time feedback data is used to evaluate the execution effect of the current rate limiting or isolation strategy and to detect whether there is write congestion or false interception. When abnormal spread of high-risk channels or backlog of medium-risk channels is detected, the feedback mechanism triggers channel parameter adjustment instructions to dynamically correct the write path allocation status, thereby forming a closed-loop control mechanism. The dynamic status of write risk is updated and adjusted based on feedback results, generating an updated dynamic status of write risk. The dynamic status of write risk is recalculated based on real-time feedback data, taking changes in channel operation status, write success rate, and anomaly interception as the basis for updating, and correcting the original risk assessment results. If the isolation effect of high-risk channels is enhanced and the scope of anomaly propagation converges, the corresponding risk level is reduced. If anomalies spread or the write failure rate increases in medium- and low-risk channels, the risk level is increased. Through continuous iterative updates of the risk status, the dynamic status of write risk can reflect the latest risk situation of the current system operation, thereby providing a basis for the next round of channel adjustment.

[0031] The process of generating trusted data write control results in S5 is as follows: Based on the updated dynamic state of write risk, a collaborative analysis of the stability state of the data source and the intensity of anomaly propagation is performed to generate a write behavior credibility score. The data source stability state characterizes the degree of fluctuation at the data generation end over time, while the anomaly propagation intensity characterizes the spread and persistence of anomalies in the data generation path. These two states are uniformly quantified and mapped to the same numerical space before being weighted and fused to obtain a write behavior credibility score that comprehensively characterizes the reliability of write operations. The score decreases with decreasing data source stability and increased anomaly propagation, and increases with increased stability and anomaly convergence. A hierarchical constraint mechanism is constructed based on the write behavior credibility score, and the corresponding constraint levels are determined. Data write behavior is classified into three levels based on the write behavior credibility score: high credibility, medium credibility, and low credibility. High credibility corresponds to low constraint strategy, medium credibility corresponds to medium constraint strategy, and low credibility corresponds to high-intensity constraint strategy. Constraint intensity parameters are set for different levels to control the degree of permission opening and the strictness of processing during the write process, thereby forming a hierarchical constraint mechanism corresponding to the write behavior credibility score, and realizing the basis for hierarchical control of write behavior. Based on the mapping and matching between constraint levels and the preset control rule base, differentiated control strategies corresponding to different constraint levels are generated. On the basis of the hierarchical constraint mechanism, the constraint levels are matched with the preset control rule base. The control rule base stores control strategy templates corresponding to different constraint levels in advance, including permission control rules, rate control rules and path control rules. During the matching process, the corresponding control template is called according to the constraint level, and the control parameters are dynamically corrected in combination with the current dynamic status of written risk, so that the control strategy can adapt to the current system risk level, thereby generating differentiated control strategies for different constraint levels. By applying control strategies to the cloud storage write execution process, joint control is exercised over write permissions, write rates, and write paths, outputting data trustworthy write control results. Furthermore, differentiated control strategies are applied to the cloud storage write execution process, jointly controlling write request permission verification, write rate control, and write path allocation before the write request enters the storage system. Permission control limits the write range of data with different trust levels, rate control limits the write traffic per unit time, and path control allocates data of different trust levels to corresponding write channels. Through the synergistic effect of these multi-dimensional controls, hierarchical constraints on write behavior are implemented, and data trustworthy write control results reflecting the current system control status are output, characterizing the trustworthiness and controllability of the write process.

[0032] Example 2: Please refer to Figure 2As shown, a data security sharing system for government-enterprise data integration includes: Semantic parsing module: parses the operational behavior characteristics of power user-side data acquisition terminals and government-side data aggregation nodes, and constructs cross-domain semantic mapping constraint rules; Write verification module: allocates path constraints for data write requests and builds a temporary data storage structure with verification constraints on the storage access node side; Anomaly detection module: Analyzes the data generation path relationship and link propagation characteristics based on the data temporary storage structure, and identifies structural consistency deviations during the writing process; Risk Analysis Module: Based on the anomaly identification results, the status of the writing process is tracked and analyzed, and anomaly propagation trends and dynamic status of writing risks are generated; Write control module: Adjusts the write path of the cloud storage system according to the dynamic risk status, and generates trusted write control results by imposing hierarchical constraints on write behavior.

[0033] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0034] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data security sharing method for government-enterprise data fusion, characterized in that, Includes the following steps: The operational behavior of the power user-side data acquisition terminals and government data aggregation nodes connected to the cloud platform is analyzed to extract the device access behavior, timing and load characteristics, and coupled with the differences between power data and government data to build cross-domain semantic mapping constraint rules. Based on cross-domain semantic mapping constraint rules, path constraints are allocated for data write requests entering the cloud storage access link. Combining the consistency of field structure and semantic expression, cross-source association integrity, and data format consistency offset features, a temporary data storage structure with verification constraints is constructed on the storage access node side. Using the data temporary storage structure as the interaction carrier, the generation path relationship between power operation data and government affairs related data is analyzed. Combined with the data link propagation characteristics, the structural consistency deviation during the writing process is identified, and the data content anomaly judgment result is output. Based on the data content anomaly determination results, the state changes of the data writing process are tracked, and the anomaly propagation trend is analyzed by combining the data source stability status and structural deviation characteristics to form a dynamic state of writing risk. Based on the dynamic status of write risks, the data write path to the cloud storage system is adjusted. Combining the stability of the data source and the intensity of abnormal propagation, write behavior is subject to hierarchical constraints, generating data trustworthy write control results.

2. The data security sharing method for government-enterprise data fusion according to claim 1, characterized in that, The process of constructing cross-domain semantic mapping constraint rules is as follows: The access logs, communication handshake sequences, and data reporting frequencies of the power user-side data acquisition terminal and the government-side data aggregation node are collected in a unified manner, and the time-series drift characteristics and load fluctuation characteristics of different nodes are aligned to form consistent access behavior characterization data. Based on the access behavior consistency representation data and the cross-domain data semantic comparison library, the semantic differences and structural mapping analysis of the power data field semantics and the government data field semantics are performed to generate initial semantic difference features. Constraints are extracted based on the correlation between initial semantic difference features and access behavior consistency representation data to form cross-domain semantic mapping constraint rules.

3. The data security sharing method for government-enterprise data fusion according to claim 2, characterized in that, The process of allocating path constraints for data write requests entering the cloud storage access link is as follows: The data write requests entering the cloud storage access link are parsed to extract data source identifiers, field structure features and semantic tag information to form the basic features of the write request. Based on the basic features of write requests and cross-domain semantic mapping constraint rules, a matching analysis is performed to generate request semantic consistency score and structure matching score. The write request constraint level is determined based on the scoring results, and the cloud storage access path is partitioned and mapped based on the constraint level to form a hierarchical write path structure.

4. A data security sharing method for government-enterprise data fusion according to claim 3, characterized in that, The process of constructing a temporary data storage structure with verification constraints on the storage access node side is as follows: Based on the hierarchical write path structure, the data write requests entering the storage access node are received and parsed to form a consistent representation of the field structure. The cross-domain association integrity of power data and government data is assessed by combining the correlation between cross-source data, and a cross-source association integrity index is generated; Constructing a verification feature expression based on field structure consistency representation and cross-source association integrity index; Using the verification feature representation as a constraint basis, a data temporary storage structure composed of hierarchical buffer units is constructed on the storage access node side.

5. A data security sharing method for government-enterprise data fusion according to claim 4, characterized in that, The process of analyzing the generation path relationship between power operation data and government-related data is as follows: Based on the data record timestamps and source identifiers in the data temporary storage structure, a time-series correlation relationship between power operation data and government-related data is constructed. Track and analyze field dependencies between different data sources to form cross-source path candidate relationships; By combining the node hop information in the data transmission link, the credibility of cross-source path candidate relationships is evaluated, and the credibility results of each candidate path are obtained. The final data generation path relationship structure is determined based on the path credibility assessment results.

6. A data security sharing method for government-enterprise data fusion according to claim 5, characterized in that, The process of outputting the data content anomaly detection result is as follows: Expand the data generation path relationship structure to construct a data propagation topology; Based on the propagation topology, structural dependencies between nodes and propagation weight distribution characteristics are extracted; The structural characteristics of the currently written data are compared and analyzed with the historical normal propagation structure to calculate the structural consistency deviation. When the deviation of structural consistency exceeds the preset threshold, the result of abnormal data content is output.

7. A data security sharing method for government-enterprise data fusion according to claim 6, characterized in that, The process of creating and writing the dynamic status of risk is as follows: The results of data content anomaly determination are expanded along the time dimension to construct a sequence of write status changes; The stability change characteristics of the data source are analyzed based on the write state change sequence, and the stability state of the data source is determined based on the change characteristics. By combining the stability status and structural consistency deviation characteristics of the data source, an extended analysis of the anomaly propagation path is conducted to form an evolutionary characterization of the anomaly propagation trend. The data source stability status and anomaly propagation trend evolution representation are fused together, and the output is written into the risk dynamic status.

8. A data security sharing method for government-enterprise data fusion according to claim 7, characterized in that, The process of adjusting the data writing path to the cloud storage system is as follows: The dynamic status of written risks is classified into levels to generate multi-level risk control strategies. Based on a multi-level risk control strategy, the cloud storage write path is dynamically mapped and adjusted to form a multi-path write channel structure. The multi-path write channel structure is prioritized according to different risk levels, and high-risk channels are rate-limited or isolated. Based on the results of rate limiting or isolation processing, a real-time feedback mechanism is introduced during the write path adjustment process to dynamically monitor the path status and risk control effectiveness. The dynamic status of write risk is updated and adjusted based on the feedback results, generating an updated dynamic status of write risk.

9. A data security sharing method for government-enterprise data fusion according to claim 8, characterized in that, The process of generating trusted data write control results is as follows: Based on the updated dynamic status of write risk, a collaborative analysis is performed on the stability status of data sources and the intensity of anomaly propagation to generate a trust score for write behavior. A hierarchical constraint mechanism is constructed based on the write behavior trust score, and the corresponding constraint level is determined; Based on the mapping and matching between constraint levels and a preset control rule base, differentiated control strategies corresponding to different constraint levels are generated. The control strategy is applied to the cloud storage write execution process to jointly control write permissions, write rate and write path, and output the data write control result with confidence.

10. A data security sharing system for government-enterprise data fusion, applied to the method described in any one of claims 1-9, characterized in that, include: Semantic parsing module: parses the operational behavior characteristics of power user-side data acquisition terminals and government-side data aggregation nodes, and constructs cross-domain semantic mapping constraint rules; Write verification module: allocates path constraints for data write requests and builds a temporary data storage structure with verification constraints on the storage access node side; Anomaly detection module: Analyzes the data generation path relationship and link propagation characteristics based on the data temporary storage structure, and identifies structural consistency deviations during the writing process; Risk Analysis Module: Based on the anomaly identification results, the write process status is tracked and analyzed, and anomaly propagation trends and dynamic write risk status are generated; Write control module: Adjusts the write path of the cloud storage system according to the dynamic risk status, and generates trusted write control results by imposing hierarchical constraints on write behavior.

Images