A personal information encryption protection method and system

Abstract

This invention relates to a method and system for encrypting and protecting personal information, belonging to the field of network security information technology. Through a personal information set association unit, an information encapsulation unit, a security risk control unit, a personal information set management unit, and a listening unit, personalized information processing is performed according to security levels. This allows for adjustments and optimizations to suit different security levels and their requirements. Various strategies for encapsulation packets are defined before security begins, which can specifically improve security performance and increase the efficiency of packet usage. Information is aggregated and its recovery importance is controlled based on security identification codes. Adjustments and optimizations are made for different security levels to suit their requirements. The overall importance of the security identification code for each information block is calculated using a weighted average of information proportion and importance. This allows for selection of importance control methods based on different security levels and needs, effectively improving information recovery time and ensuring the availability of important information.

Description

Technical Field

[0001] This invention belongs to the field of network security information technology, and in particular relates to a method and system for encrypting and protecting personal information. Background Technology

[0002] With the rapid development of cloud computing technology, data sharing has become one of the current research and application hotspots. Public-key encryption schemes with one-to-many encryption characteristics are an important technical tool for achieving secure data sharing in cloud computing environments.

[0003] Traditional encryption methods may lack the flexibility to adjust encryption strategies and parameters to meet the diverse data protection needs of different environments. Stateless encryption cannot adapt to real-time environmental conditions, user behavior, or network topology changes, resulting in insufficient security and performance. Continuously using encryption during transmission or storage, even when data no longer needs confidentiality, can lead to over-encryption and additional computational and storage overhead. The lack of zero-time protection and transient encryption means that once data is encrypted, it is not automatically decrypted even after transmission or storage. This may force the receiving or storing party to maintain an additional decryption process, increasing management and operational complexity. In the real world, environmental conditions, user behavior, and network topology are constantly changing. Existing encryption methods lack corresponding encryption schemes and adaptability to these changes, potentially leading to insufficient or excessive data protection and an inability to adjust to actual needs. Summary of the Invention

[0004] According to a first aspect of the present invention, a method for encrypting and protecting personal information is provided, comprising:

[0005] The encryption server generates a package through a listener. After generation, it records the synchronization and association data and returns a successful package identifier to the listener.

[0006] The file to be encrypted triggers a modification instruction to a personal information set through the target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification.

[0007] The modification instruction for the target encapsulation key is verified to check whether there is an available information block group. If there is, the synchronization mapping relationship of the information block group is instructed; otherwise, a new batch of modifiable information block groups is requested.

[0008] The modification instructions for the information block group are corrected. After all information blocks are successfully modified, a success output is returned, and the security identification code statistics of the corresponding information block group are synchronized.

[0009] The system will periodically decrypt and identify the personal information set. If key decryption is detected and information recovery is required, a new key or signature will be searched as the target key or signature for recovery. An information recovery instruction for the specified key will be triggered, and the recovery security risk will be issued according to different strategies. After the recovery is completed, the routing information will be synchronized.

[0010] Furthermore, the encryption server generates a package through a listener, records synchronized data after generation, and returns a successfully generated package identifier to the listener. This also includes:

[0011] When generating the package, specify the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package.

[0012] Furthermore, after specifying the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package when generating the package, it also includes:

[0013] After receiving the packet generation instruction from the encryption server, the listener forwards the instruction to the personal information set management unit.

[0014] After receiving the package generation instruction, the personal information set management unit verifies the instruction parameters of the generation instruction, assigns a package identifier, and records the package's strategy debugging information.

[0015] The personal information set management unit waits for the basic debugging information for generating the encapsulation package and the debugging information of the personal information set management unit itself according to the complexity strategy, and calls the interface of the information encapsulation unit to generate a batch of information block groups;

[0016] The information block group is composed of multiple information blocks from different locations according to complexity and early warning strategy. The information block group will record the length or percentage of information encapsulated in each security identification code as the security identification code statistics of the information block group.

[0017] After generation is complete, the personal information set management unit records the synchronized associated data and returns a successful generation package identifier to the listener.

[0018] Furthermore, the file to be encrypted triggers a modification instruction to a personal information set via a target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification. This also includes:

[0019] The target encapsulation key obtains the encapsulation package information through an interface, and selects the specified encapsulation package according to the security level after receiving the modification instruction from the file to be encrypted;

[0020] Based on the information aggregation strategy and recovery control strategy of the package, a suitable security identification code is selected and modified, and a modification instruction is triggered to the personal information set association unit. The instruction includes the package identifier, the information to be modified, and the content of the security identification code.

[0021] Further, the process includes verifying whether an available information block group exists; if so, instructing the synchronization mapping relationship of the information block group; otherwise, requesting a new batch of modifiable information block groups.

[0022] Under the first information aggregation strategy, information with the same security identification code is modified into the same information block group;

[0023] Alternatively, under the second information aggregation strategy, information with the same identification code or similar importance can be modified into the same information block group.

[0024] Furthermore, the modification instruction for modifying the information block group is corrected, and after all information blocks are successfully modified, a success output is returned, and the security identification code statistics information of the corresponding information block group is synchronized, which also includes:

[0025] After obtaining the available information block group, the personal information set association unit verifies other content, instructs the personal information set management unit on the routing information of the information block group, and triggers a write instruction to the information encapsulation unit based on the routing information.

[0026] After receiving the write instruction, the information encapsulation unit corrects the error and modifies each information block in the information block group according to the complexity and early warning strategy.

[0027] Once all information blocks have been successfully modified, the information encapsulation unit returns a success output to the personal information set association unit; otherwise, it returns a failure output.

[0028] After receiving the successful modification output from the information encapsulation unit, the personal information set association unit synchronizes the security identification code statistics information of the corresponding information block group.

[0029] Furthermore, the method also includes:

[0030] If a modification failure is received, the personal information set association unit records the synchronized modification information and selects another available information block group for re-verification.

[0031] Furthermore, the step of periodically decrypting and identifying the personal information set, and upon discovering key decryption requiring information recovery, finding a new key or signature as the target key or signature for recovery, triggering an information recovery instruction for the specified key, issuing recovery security risk alerts according to different strategies, and synchronizing routing information after recovery, also includes:

[0032] After receiving the information recovery instruction, the security risk control unit generates a security risk queue for information block recovery of the key based on the security identification code statistics of the information block group to which each information block to be recovered belongs and the recovery control strategy of the package.

[0033] Different security types employ different control strategies, requiring personalized selection based on the specific security type.

[0034] After the security risk control unit completes the construction of the recovery security risk queue, it issues the recovery security risks to the information encapsulation unit according to different strategies.

[0035] After the recovery is complete, synchronize the synchronization routing information in the personal information set management unit.

[0036] Furthermore, the recovery control strategy also includes:

[0037] The first recovery control strategy prioritizes information from the higher-importance identification code for recovery.

[0038] The second recovery control strategy prioritizes information from higher-importance identification codes for recovery.

[0039] The third recovery control strategy: Based on the first and second recovery control strategies, if the information recovery time may be longer than the expiration time of low-importance security information after assessment by the security risk control unit, then the information blocks of the low-importance security information will not participate in the sorting of the recovery queue.

[0040] According to a second aspect of the present invention, the present invention provides protection for a personal information encryption protection system, comprising a personal information set association unit, an information encapsulation unit, a security risk control unit, a personal information set management unit, and a listening device unit;

[0041] The personal information collection and association unit receives external instructions and performs verification;

[0042] The information encapsulation unit encapsulates information and performs copy migration or checksum calculation based on a complexity strategy.

[0043] The security risk control unit controls and manages the backend security risks of encapsulating personal information sets in the network security system. Backend security risks include at least information recovery, information balancing, and garbage collection. The importance and concurrency scale of security risks are controlled according to the management strategy.

[0044] The personal information set management unit manages the key view, saves debugging information, and provides information routing information for the personal information set association unit.

[0045] The listening unit, the control plane of the network security encapsulation system, provides functions for personal data set generation, debugging management, operation and maintenance.

[0046] The aforementioned personal information encryption protection system is used to execute the aforementioned personal information encryption protection method.

[0047] This invention relates to a method and system for encrypting and protecting personal information, belonging to the field of network security information technology. Through a personal information set association unit, an information encapsulation unit, a security risk control unit, a personal information set management unit, and a listening unit, personalized information processing is performed according to security levels. This allows for adjustments and optimizations to suit different security levels and their requirements. Various strategies for encapsulation packets are defined before security begins, which can specifically improve security performance and increase the efficiency of packet usage. Information is aggregated and its recovery importance is controlled based on security identification codes. Adjustments and optimizations are made for different security levels to suit their requirements. The overall importance of the security identification code for each information block is calculated using a weighted average of information proportion and importance. This allows for selection of importance control methods based on different security levels and needs, effectively improving information recovery time and ensuring the availability of important information. Attached Figure Description

[0048] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0049] Figure 1 This is a flowchart illustrating the process of a personal information encryption protection method as instructed in an embodiment of the present invention.

[0050] Figure 2 This is a structural unit diagram of a personal information encryption protection system protected by the instructions of an embodiment of the present invention. Detailed Implementation

[0051] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0052] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0053] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two elements. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0054] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0055] According to a first embodiment of the present invention, a method for encrypting and protecting personal information is proposed, with reference to... Figure 1 ,include:

[0056] The encryption server generates a package through a listener. After generation, it records the synchronization and association data and returns a successful package identifier to the listener.

[0057] The file to be encrypted triggers a modification instruction to a personal information set through the target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification.

[0058] The modification instruction for the target encapsulation key is verified to check whether there is an available information block group. If there is, the synchronization mapping relationship of the information block group is instructed; otherwise, a new batch of modifiable information block groups is requested.

[0059] The modification instructions for the information block group are corrected. After all information blocks are successfully modified, a success output is returned, and the security identification code statistics of the corresponding information block group are synchronized.

[0060] The system will periodically decrypt and identify the personal information set. If key decryption is detected and information recovery is required, a new key or signature will be searched as the target key or signature for recovery. An information recovery instruction for the specified key will be triggered, and the recovery security risk will be issued according to different strategies. After the recovery is completed, the routing information will be synchronized.

[0061] In this embodiment, the encryption server first generates a package on the management listener, specifying the warning strategy (which racks, servers, and signatures to warn about), complexity strategy, information aggregation strategy, and recovery control strategy for the package during generation. The upper-layer unit (e.g., the target key) selects a specified package based on security needs and, when modifying information, transmits the corresponding security identification code to the packaged personal information set according to the package's information aggregation strategy and recovery control strategy. Upon receiving the information modification instruction, the associated information set selects the corresponding information block for modification according to the information aggregation strategy. The upper-layer unit (e.g., the target key) deletes expired information according to its own lifecycle strategy, and the network security packaged personal information set marks the corresponding space as reclaimable. The control key performs garbage collection according to the information aggregation strategy. For information aggregated according to the lifecycle strategy, it verifies whether the latest modification time of the information block has expired; if expired, the entire block is reclaimed. When information recovery is required after key decryption offline, the control key recovers the information block according to the specified importance based on the recovery strategy.

[0062] This invention can be adjusted and optimized for different security levels, adapting to the needs of different security levels, improving security performance, and increasing the efficiency of the encapsulation package. It maximizes the effectiveness of the encapsulation package, effectively improving information recovery time and ensuring the availability of important information. It also improves the performance of the encapsulation system and reduces system overhead.

[0063] Furthermore, the encryption server generates a package through a listener, records synchronized data after generation, and returns a successfully generated package identifier to the listener. This also includes:

[0064] When generating the package, specify the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package.

[0065] The alert strategy refers to which racks, servers, and signatures should issue alerts for the information blocks in the package. Preferably, the information blocks should issue alerts on different racks, secondly on different servers, and thirdly on different signatures.

[0066] Information aggregation strategy refers to the criteria by which information is aggregated or not aggregated, and aggregated information will be modified into the same information block as much as possible; for example, it can be specified to aggregate according to security identification codes. In this case, the type of security identification code should be agreed upon, and the weight or importance of different security identification codes should be determined.

[0067] The recovery control strategy can specify whether to use importance control or other control methods according to the aggregation method when information needs to be recovered.

[0068] Furthermore, after specifying the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package when generating the package, it also includes:

[0069] After receiving the packet generation instruction from the encryption server, the listener forwards the instruction to the personal information set management unit.

[0070] After receiving the package generation instruction, the personal information set management unit verifies the instruction parameters of the generation instruction, assigns a package identifier, and records the package's strategy debugging information.

[0071] The personal information set management unit waits for the basic debugging information for generating the encapsulation package and the debugging information of the personal information set management unit itself according to the complexity strategy, and calls the interface of the information encapsulation unit to generate a batch of information block groups;

[0072] The information block group is composed of multiple information blocks from different locations according to complexity and early warning strategy. The information block group will record the length or percentage of information encapsulated in each security identification code as the security identification code statistics of the information block group.

[0073] After generation is complete, the personal information set management unit records the synchronized associated data and returns a successful generation package identifier to the listener.

[0074] Furthermore, the file to be encrypted triggers a modification instruction to a personal information set via a target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification. This also includes:

[0075] The target encapsulation key obtains the encapsulation package information through an interface, and selects the specified encapsulation package according to the security level after receiving the modification instruction from the file to be encrypted;

[0076] Based on the information aggregation strategy and recovery control strategy of the package, a suitable security identification code is selected and modified, and a modification instruction is triggered to the personal information set association unit. The instruction includes the package identifier, the information to be modified, and the content of the security identification code.

[0077] In this embodiment, the information reporting method flow is as follows: when the information of the file to be encrypted is modified, the modification is triggered to the personal information set through the target encapsulation key.

[0078] The target encapsulation key obtains the encapsulation package information through the interface. After receiving the modification instruction from the file to be encrypted, it selects the specified encapsulation package according to the security level, and modifies it by selecting and attaching a suitable security identification code according to the information aggregation strategy and recovery control strategy of the encapsulation package. It then triggers the modification instruction to the personal information set association unit. The instruction includes the encapsulation package identifier, the information to be modified, and the security identification code.

[0079] The personal information set association unit receives and verifies the modification instruction from the target encapsulation key. Upon successful verification, the unit checks for available information block groups according to the information aggregation strategy. This aims to: under a strict information aggregation strategy, modify information with the same security identifier into the same information block group; or under a relatively lenient information aggregation strategy, modify information with the same identifier or similar importance into the same information block group as much as possible. When no available information block groups are available, the personal information set association unit requests a new batch of modifiable information block groups from the personal information set management unit.

[0080] After obtaining the available information block group, the personal information set association unit verifies other content and then instructs the personal information set management unit on the synchronization mapping relationship (routing information) of the information block group. Based on the routing information, it triggers a write instruction to the information encapsulation unit.

[0081] Upon receiving a write command, the information encapsulation unit first makes corrections, and then modifies each information block in the information block group according to the complexity and early warning strategy. If all information blocks are successfully modified, the information encapsulation unit returns a success output to the information set association unit; otherwise, it returns a failure output.

[0082] After receiving a successful modification output from the information encapsulation unit, the personal information set association unit synchronizes the security identification code statistics of the corresponding information block group; if it receives a failed modification output, the personal information set association unit records the synchronized modification information and selects another available information block group for re-verification.

[0083] The encapsulation package generation method and information reporting method of this system can be used to aggregate information according to security identification codes for different specific security requirements.

[0084] Further, the process includes verifying whether an available information block group exists; if so, instructing the synchronization mapping relationship of the information block group; otherwise, requesting a new batch of modifiable information block groups.

[0085] Under the first information aggregation strategy, information with the same security identification code is modified into the same information block group;

[0086] Alternatively, under the second information aggregation strategy, information with the same identification code or similar importance can be modified into the same information block group.

[0087] In this embodiment, the personal information set association unit receives and verifies a modification instruction from the target encapsulation key. Upon successful verification, the personal information set association unit checks for available information block groups according to the information aggregation strategy. This achieves the following: under a strict information aggregation strategy, information with the same security identifier is modified into the same information block group; or under a relatively lenient information aggregation strategy, information with the same identifier or similar importance is modified into the same information block group as much as possible. When no available information block groups are available, the personal information set association unit requests a new batch of modifiable information block groups from the personal information set management unit.

[0088] Furthermore, the modification instruction for modifying the information block group is corrected, and after all information blocks are successfully modified, a success output is returned, and the security identification code statistics information of the corresponding information block group is synchronized, which also includes:

[0089] After obtaining the available information block group, the personal information set association unit verifies other content, instructs the personal information set management unit on the routing information of the information block group, and triggers a write instruction to the information encapsulation unit based on the routing information.

[0090] After receiving the write instruction, the information encapsulation unit corrects the error and modifies each information block in the information block group according to the complexity and early warning strategy.

[0091] Once all information blocks have been successfully modified, the information encapsulation unit returns a success output to the personal information set association unit; otherwise, it returns a failure output.

[0092] After receiving the successful modification output from the information encapsulation unit, the personal information set association unit synchronizes the security identification code statistics information of the corresponding information block group.

[0093] Furthermore, the method also includes:

[0094] If a modification failure is received, the personal information set association unit records the synchronized modification information and selects another available information block group for re-verification.

[0095] Furthermore, in the information recovery control process, the timely decryption and identification of the personal information set, the discovery of key decryption requiring information recovery, the search for a new key or signature as the target key or signature for recovery, the triggering of an information recovery instruction for the specified key, the issuance of recovery security risk reports according to different strategies, and the synchronization of routing information after recovery, also include:

[0096] After receiving the information recovery instruction, the security risk control unit generates a security risk queue for information block recovery of the key based on the security identification code statistics of the information block group to which each information block to be recovered belongs and the recovery control strategy of the package.

[0097] Different security types employ different control strategies, requiring personalized selection based on the specific security type.

[0098] After the security risk control unit completes the construction of the recovery security risk queue, it issues the recovery security risks to the information encapsulation unit according to different strategies.

[0099] After the recovery is complete, synchronize the synchronization routing information in the personal information set management unit.

[0100] Furthermore, the recovery control strategy also includes:

[0101] The first recovery control strategy prioritizes information from the higher-importance identification code for recovery.

[0102] The second recovery control strategy prioritizes information from higher-importance identification codes for recovery.

[0103] The third recovery control strategy: Based on the first and second recovery control strategies, if the information recovery time may be longer than the expiration time of low-importance security information after assessment by the security risk control unit, then the information blocks of the low-importance security information will not participate in the sorting of the recovery queue.

[0104] According to a second embodiment of the present invention, the present invention provides protection for a personal information encryption protection system, as described above. Figure 2 It includes a personal information set association unit, an information encapsulation unit, a security risk control unit, a personal information set management unit, and a listening device unit;

[0105] The personal information collection and association unit receives external instructions and performs verification;

[0106] The information encapsulation unit encapsulates information and performs copy migration or checksum calculation based on a complexity strategy.

[0107] The security risk control unit controls and manages the backend security risks of encapsulating personal information sets in the network security system. Backend security risks include at least information recovery, information balancing, and garbage collection. The importance and concurrency scale of security risks are controlled according to the management strategy.

[0108] The personal information set management unit manages the key view, saves debugging information, and provides information routing information for the personal information set association unit.

[0109] The listening unit, the control plane of the network security encapsulation system, provides functions for personal data set generation, debugging management, operation and maintenance.

[0110] The aforementioned personal information encryption protection system is used to execute the aforementioned personal information encryption protection method.

[0111] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A method for encrypting and protecting personal information, characterized in that, include: The encryption server generates a package through a listener. After generation, it records the synchronization and association data and returns a successful package identifier to the listener. The file to be encrypted triggers a modification instruction to a personal information set through the target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification. The modification instruction for the target encapsulation key is verified to check whether there is an available information block group. If there is, the synchronization mapping relationship of the information block group is instructed; otherwise, a new batch of modifiable information block groups is requested. The modification instructions for the information block group are corrected. After all information blocks are successfully modified, a success output is returned, and the security identification code statistics of the corresponding information block group are synchronized. The system will periodically decrypt and identify the personal information set. If key decryption is detected and information recovery is required, a new key or signature will be searched as the target key or signature for recovery. An information recovery instruction for the specified key will be triggered, and the recovery security risk will be issued according to different strategies. After the recovery is completed, the routing information will be synchronized.

2. The method for encrypting and protecting personal information according to claim 1, characterized in that, The encryption server generates a package via a listener, records synchronized data after generation, and returns a successful package identifier to the listener. It also includes: When generating the package, specify the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package.

3. The method for encrypting and protecting personal information according to claim 2, characterized in that, When generating the package, after specifying the complexity strategy, early warning strategy, information aggregation strategy, and recovery control strategy of the package, it also includes: After receiving the packet generation instruction from the encryption server, the listener forwards the instruction to the personal information set management unit. After receiving the package generation instruction, the personal information set management unit verifies the instruction parameters of the generation instruction, assigns a package identifier, and records the package's strategy debugging information. The personal information set management unit waits for the basic debugging information for generating the encapsulation package and the debugging information of the personal information set management unit itself according to the complexity strategy, and calls the interface of the information encapsulation unit to generate a batch of information block groups; The information block group is composed of multiple information blocks from different locations according to complexity and early warning strategy. The information block group will record the length or percentage of information encapsulated in each security identification code as the security identification code statistics of the information block group. After generation is complete, the personal information set management unit records the synchronized associated data and returns a successful generation package identifier to the listener.

4. The method for encrypting and protecting personal information according to claim 1, characterized in that, The file to be encrypted triggers a modification instruction to the personal information set via the target encapsulation key. The target encapsulation key selects a specified encapsulation package and attaches a suitable security identification code for modification. The modification also includes: The target encapsulation key obtains the encapsulation package information through an interface, and selects the specified encapsulation package according to the security level after receiving the modification instruction from the file to be encrypted; Based on the information aggregation strategy and recovery control strategy of the package, a suitable security identification code is selected and modified, and a modification instruction is triggered to the personal information set association unit. The instruction includes the package identifier, the information to be modified, and the content of the security identification code.

5. A method for encrypting and protecting personal information according to claim 1, characterized in that, Verify whether an available information block group exists; if so, instruct the synchronization mapping relationship of the information block group; otherwise, request a new batch of modifiable information block groups. The process also includes: Under the first information aggregation strategy, information with the same security identification code is modified into the same information block group; Alternatively, under the second information aggregation strategy, information with the same identification code or similar importance can be modified into the same information block group.

6. The method for encrypting and protecting personal information according to claim 1, characterized in that, The modification instruction for the information block group is corrected, and after all information blocks are successfully modified, a success output is returned, and the security identification code statistics of the corresponding information block group are synchronized, which also includes: After obtaining the available information block group, the personal information set association unit verifies other content, instructs the personal information set management unit on the routing information of the information block group, and triggers a write instruction to the information encapsulation unit based on the routing information. After receiving the write instruction, the information encapsulation unit corrects the error and modifies each information block in the information block group according to the complexity and early warning strategy. Once all information blocks have been successfully modified, the information encapsulation unit returns a success output to the personal information set association unit; otherwise, it returns a failure output. After receiving the successful modification output from the information encapsulation unit, the personal information set association unit synchronizes the security identification code statistics information of the corresponding information block group.

7. A method for encrypting and protecting personal information according to claim 1, characterized in that, Also includes: If a modification failure is received, the personal information set association unit records the synchronized modification information and selects another available information block group for re-verification.

8. A method for encrypting and protecting personal information according to claim 1, characterized in that, The method of timely decryption and identification of the personal information set, finding a new key or signature as the target key or signature for recovery when key decryption is detected, triggering an information recovery instruction for the specified key, issuing recovery security risk reports according to different strategies, and synchronizing routing information after recovery, also includes: After receiving the information recovery instruction, the security risk control unit generates a security risk queue for information block recovery of the key based on the security identification code statistics of the information block group to which each information block to be recovered belongs and the recovery control strategy of the package. Different security types employ different control strategies, requiring personalized selection based on the specific security type. After the security risk control unit completes the construction of the recovery security risk queue, it issues the recovery security risks to the information encapsulation unit according to different strategies. After the recovery is complete, synchronize the synchronization routing information in the personal information set management unit.

9. A method for encrypting and protecting personal information according to claim 8, characterized in that, The recovery control strategy also includes: The first recovery control strategy prioritizes information from the higher-importance identification code for recovery. The second recovery control strategy prioritizes information from higher-importance identification codes for recovery. The third recovery control strategy: Based on the first and second recovery control strategies, if the information recovery time may be longer than the expiration time of low-importance security information after assessment by the security risk control unit, then the information blocks of the low-importance security information will not participate in the sorting of the recovery queue.

10. A personal information encryption protection system, characterized in that, It includes a personal information set association unit, an information encapsulation unit, a security risk control unit, a personal information set management unit, and a listening device unit; The personal information collection and association unit receives external instructions and performs verification; The information encapsulation unit encapsulates information and performs copy migration or checksum calculation based on a complexity strategy. The security risk control unit controls and manages the backend security risks of encapsulating personal information sets in the network security system. Backend security risks include at least information recovery, information balancing, and garbage collection. The importance and concurrency scale of security risks are controlled according to the management strategy. The personal information set management unit manages the key view, saves debugging information, and provides information routing information for the personal information set association unit. The listening unit, the control plane of the network security encapsulation system, provides functions for personal data set generation, debugging, management, operation and maintenance. The aforementioned personal information encryption protection system is used to execute a personal information encryption protection method as described in any one of claims 1-9.

Images