An enterprise-wide management data security storage optimization method and system

Abstract

The application discloses a kind of enterprise global management data-oriented safe storage optimization method and system, its method includes the following steps: S1: global data intelligent perception and asset mapping;S2: multi-dimensional data classification and sensitive label labeling.This application establishes unified data asset directory and hierarchical system by global data automation scanning and multi-dimensional classification and grading, breaks cross-departmental authority fragmentation;Through unified strategy engine centralized control encryption, permission, backup strategy, based on hierarchical results automatic matching and eliminating conflict, eliminating policy fragmentation;Through dynamic permission model real-time calculation trust and adjust permissions, realize minimum permission control;Through intelligent hierarchical storage, according to access frequency and sensitive level, data is distributed to hot, warm, cold layer, combined with deduplication compression to save space;Through life cycle audit feedback operation data, drive model and strategy self-optimization, finally realize dynamic balance between data security, collaboration efficiency and storage cost.

Description

Technical Field

[0001] This invention relates to the field of enterprise data security storage technology, and in particular to a secure storage optimization method and system for enterprise-wide data management. Background Technology

[0002] As enterprises deepen their digital transformation, the data they manage across the entire enterprise domain covers a wide range of types, including office documents, financial statements, contracts and agreements, R&D drawings, customer information, operation and maintenance logs, and video surveillance. These data are widely distributed across file servers, databases, cloud storage, terminal devices, and business systems. This data is not only massive in scale and diverse in type, but also varies significantly in security level. Therefore, there is an urgent need for a secure storage system that can achieve full-domain awareness, unified governance, and dynamic optimization.

[0003] Existing secure storage optimization systems for enterprise-wide data management have the following drawbacks during use: 1. Existing technologies lack the ability to uniformly perceive and govern data across the entire domain. Massive amounts of unstructured data (documents, images, audio and video, etc.) are scattered across various business systems and terminals. Traditional methods cannot automatically identify their content and sensitivity levels, and it is difficult to establish a data asset catalog. At the same time, the storage architectures of cross departments and cross systems are independent of each other, the permission system is fragmented, and there is a lack of unified classification and grading standards and access control policies. 2. Existing technologies are mostly deployed in a decentralized and isolated manner. Encryption, permission, and backup policies are executed independently in different systems, leading to frequent policy conflicts and high management costs. Permission control is lax, with prominent issues of over-authorization and delayed revocation. Forced encryption can easily block collaborative processes. The storage architecture lacks dynamic optimization capabilities: fixed threshold policies cannot adapt to differences in data importance. Redundant and low-value data occupy a large amount of storage space. Performance bottlenecks exist when dealing with massive amounts of small files or high concurrency, making it difficult to achieve an effective balance between security, efficiency, and cost. In summary, this application proposes a secure storage optimization method and system for enterprise-wide data management. Summary of the Invention

[0004] Based on the technical problems existing in the background technology, this invention proposes a secure storage optimization method and system for enterprise-wide data management.

[0005] This invention proposes a secure storage optimization method for enterprise-wide data management, comprising the following steps: S1: Full-Domain Data Intelligent Sensing and Asset Mapping: Automated scanning and discovery of data storage nodes for enterprise full-domain management, identification of structured data, unstructured data and semi-structured data, extraction of data metadata, and construction of a full-domain data asset catalog and data distribution heat map; S2: Multi-dimensional data classification and grading with sensitive labeling: Based on data content, data type, data source and business attributes, a multi-dimensional classification and grading model is built, and data sensitivity level labels are automatically labeled to form a unified data grading system; S3: Unified Security Policy Engine Construction and Policy Orchestration: Based on the data classification results, a unified security policy engine is built to automatically match differentiated encryption policies, access control policies, backup policies and retention policies for data of different security levels, forming a policy orchestration and conflict resolution mechanism; S4: Dynamic optimization and intelligent tiering of storage architecture: Based on data access frequency, data value and security level, the storage architecture is dynamically optimized and intelligently tiered, allocating high-frequency access data to the high-performance storage layer and low-frequency access data to the low-cost storage layer, and performing data deduplication and compression optimization. S5: Dynamic permission control and zero-trust access control: Based on user identity, device status, access behavior and data sensitivity level, a dynamic permission evaluation model is built to calculate access trust level in real time and dynamically adjust access permissions to achieve fine-grained access control under the principle of least privilege. S6: Full lifecycle security audit and closed-loop optimization: Conduct security audits on the entire lifecycle of data from generation, storage, access, migration to destruction, and continuously optimize the classification and grading model, security policies and storage architecture based on the audit results to form a closed-loop self-optimization mechanism.

[0006] Preferably, in step S1, the intelligent perception of the entire domain data includes: automatically discovering the enterprise's entire domain data storage nodes through network scanning, proxy collection, and API integration; extracting file type, file size, creation time, modification time, access frequency, department, and business system metadata; and constructing an entire domain data asset catalog. ,in Indicates the first Each data asset is analyzed; simultaneously, the data distribution density of each storage node is calculated, and a data distribution heatmap is generated.

[0007] Preferably, the specific logical steps of S2 are as follows: S201: Data Content Sensitivity Analysis: This involves content analysis and recognition of the data assets identified in S1. For document-type data, the main text is extracted; for image-type data, text is recognized using OCR; for audio / video-type data, speech-to-text conversion is extracted; and for structured data, field annotations and sample values ​​are extracted. Then, based on a pre-defined sensitive word library and regular expression matching rules, various sensitive data features are detected, and a content sensitivity score is calculated. The calculation formula is as follows: ; in Indicates the first Content sensitivity score for each data asset This indicates the number of sensitive features matched. This represents the total number of features in the data asset. For the first Preset weights for sensitive features, for data assets without text content, The default value is 0; S202: Data Type Sensitivity Assessment: Based on file extensions, MIME types, and data format characteristics, identify the data type of the data asset, establish a pre-defined data type risk mapping table, and assign values ​​according to the inherent sensitivity of the data type. The assignment rules for data type sensitivity scores are as follows: ; in A higher value indicates a stronger inherent sensitivity of the data type. S203: Data Source Sensitivity Assessment: Based on the business system, department, and collection method to which the data asset belongs, assess the sensitivity of the data source. Data generated by key business systems or core departments is generally more sensitive. The formula for calculating the source sensitivity score is as follows: ; in A higher value indicates a stronger inherent sensitivity of the data type. S203: Data Source Sensitivity Assessment: Based on the business system, department, and collection method to which the data asset belongs, assess the sensitivity of the data source. Data generated by key business systems or core departments is generally more sensitive. The formula for calculating the source sensitivity score is as follows: ; in Indicate whether the data involves personal privacy. Indicate whether trade secrets are involved. Indicates whether it is subject to industry regulatory compliance requirements. The maximum value of each dimension is taken, and the business sensitivity is automatically set to 1 when any compliance-sensitive attribute exists, to ensure that compliance data is protected first. S205: Comprehensive Sensitivity Level Scoring and Labeling: [The following text appears to be incomplete and possibly contains errors: "will..."] , , , The sensitivity scores from the four dimensions are weighted and fused to calculate the overall sensitivity level score of the data asset. The calculation formula is as follows: ; in , , , The weight coefficients for the corresponding dimensions satisfy... + + + =1 + + + =1, the default weighting coefficients are content sensitivity weight 0.35, data type weight 0.25, source weight 0.20, and business attribute weight 0.20, and can be customized according to the compliance requirements of different industries; S206: Data Hierarchical Label Mapping and Unified Hierarchical System Construction: Based on the calculated comprehensive sensitivity level score According to the preset hierarchical mapping rules, the data is automatically assigned to the corresponding sensitivity level. The hierarchical determination rules are as follows: ; in Indicates the first Sensitivity level labels for each data asset; after labeling, synchronize the sensitivity level labels of each data asset to the global data asset catalog built by S1. In this process, a unified data classification system containing sensitivity level dimension information is formed, providing a classification basis for the subsequent differentiated strategy matching of the S3 unified strategy engine; at the same time, the feature matching records, scoring details and classification results generated during the classification and classification process are written to the audit log in full to ensure that the classification and classification process is traceable and auditable.

[0008] Preferably, the specific logical steps of S3 are as follows: S301: Policy Library Construction and Policy Template Definition: Based on enterprise security compliance requirements and data classification system, a unified security policy library is pre-built. Each strategy Defined as a quadruple ,in Indicates the triggering condition of the strategy. Indicates the action to be executed by the strategy. Indicates policy priority. These tags represent policy types, forming a policy template library that covers all data security management needs. S302: Data-Policy Match Calculation: When data assets When entering the policy engine, extract its sensitivity level. Department Storage location Construct data feature vectors based on attributes and features. This is compared with the trigger conditions of each strategy in the strategy library. The matching degree is calculated using the following formula: ; in Indicates the first The data asset and the first The normalized matching degree of the strategy, This represents the similarity between the data feature vector and the policy triggering condition. The strategy priority weights are determined by normalization to ensure that the sum of the matching degrees of all strategies is 1. S303: Policy Conflict Detection and Type Attribution Determination: When the same data asset matches multiple... Strategies of the same type and When the value is greater than 0, a strategy conflict is determined to exist, triggering the conflict resolution process; its strategy conflict determination flag... The calculation formula is as follows: ; when When =1, that is, when there are two or more matching strategies of the same type and the actions are mutually exclusive, conflict resolution is triggered. S304: Policy Conflict Resolution and Optimal Policy Selection: Based on Policy Priority Matching degree The weighted fusion is used to calculate the comprehensive optimal score of conflict resolution strategies, and the strategy with the highest score is selected as the final execution strategy. The formula for calculating the optimal score of conflict resolution is as follows: ; in For the first The optimal score for conflict resolution of the strategy. For data-strategy matching degree, For strategy priority, This is the highest priority value in the policy library. The balance coefficient is selected; [the coefficient is then chosen to satisfy...] =max The strategy is used as the final execution strategy; at the same time, the conflict detection record, conflict resolution process and final strategy selection result are written to the audit log in full. S305: Differentiated Security Policy Combination Generation and Policy Orchestration: Based on Data Assets Sensitivity level And matching various types of policies, automatically generating complete security policy combinations. The strategy combination generation rules are as follows: ; in This indicates the strategy action with the highest matching degree among each type; it is also differentiated according to sensitivity level: Top Secret data is subject to mandatory encrypted storage, strict access control, daily full backup, and permanent retention; Confidential data is recommended to be encrypted, with departmental access control, weekly full backup, and long-term retention; Internal data is encrypted on demand, accessible to all, with monthly incremental backup and medium-term retention; Public data is not encrypted, accessible to all, not backed up, and retained for a short period; the strategy action combinations for each level are shown in the table below: ; S306: Strategy Execution Effectiveness Evaluation and Dynamic Updates to the Strategy Library: Record compliance coverage, strategy hit accuracy, and false positive rate during strategy execution; periodically conduct quantitative evaluations of the overall effectiveness of the strategy library; and define a comprehensive strategy performance score. The calculation formula is as follows: ; in To score the overall effectiveness of the strategy, Indicates policy compliance coverage. Indicates the policy mismatch rate. Indicates the strategy hit rate. , , For weighting coefficients; when For three consecutive evaluation periods, the value is below the preset threshold. When the policy library optimization process is triggered automatically, the policy administrator intervenes to adjust the policy conditions, priorities and action parameters, so as to realize the dynamic optimization and iteration of the policy library. Finally, it outputs a combination of differentiated security policies adapted to each data level, which is then distributed to the data storage layer, network layer and application layer for execution, so as to complete the precise orchestration and automated control of the unified security policy for enterprise-wide data management.

[0009] Preferably, the specific logical steps of S4 are as follows: S401: Calculation of Comprehensive Popularity Value of Data Assets: For each data asset in the global data asset catalog constructed in S1, extract its access frequency, most recent access time, data size, and sensitivity level, and calculate its comprehensive popularity value. The calculation formula is as follows: ; in Indicates the first The overall popularity value of each data asset This represents the normalized value of the access frequency per unit time. This represents the recent access time decay factor, and its calculation formula is: , The time interval between the current moment and the last access. This is the attenuation coefficient, with a default value of 0.01. Data sensitivity levels are assigned scores, with Top Secret assigned 1.0, Confidential assigned 0.7, Internal assigned 0.4, and Public assigned 0.1. , , These are the weighting coefficients; S402: Intelligent Storage Tier Decision: Based on the overall data heat value Based on preset tiering thresholds, data is automatically allocated to the corresponding storage tier. The tiering determination rules are as follows: ; in Indicates the first The storage layer ownership of each data asset. The threshold for thermal stratification. The temperature and cold storage layers are defined as follows: the hot storage layer is used for frequently accessed hot data and uses high-performance SSD storage media; the warm storage layer is used for frequently accessed warm data and uses ordinary HDD storage media; the cold storage layer is used for rarely accessed cold data and uses Blu-ray storage, tape library or cloud archiving; at the same time, top secret and confidential data are forced to be stored in a local controlled storage environment and are prohibited from being stored in the public cloud cold storage layer. S403: Storage Space Deduplication and Compression Optimization: Performs data deduplication and compression optimization on data assets in each storage layer to release redundant storage space; firstly, duplicate data copies are identified and deleted through byte-level or file-level fingerprint comparison, retaining only unique instances and establishing reference mappings; then, a compression algorithm is adaptively selected based on the data type, and the storage space optimization rate is calculated using the following formula: ; in Indicates storage space optimization rate. To optimize the total storage space usage before, To optimize the actual storage space usage; and at the same time set the optimization rate target threshold. ,when The system triggers deep compression or archive cleanup strategies in a timely manner to ensure that storage resource utilization efficiency continues to meet standards. S404: Dynamic Migration and Periodic Reassessment of Storage Tiers: Set an assessment period. Within each assessment period, the system will evaluate the overall heat value of each data asset in the hot storage tier, warm storage tier, and cold storage tier. Periodic reassessment is performed when the data popularity value crosses the preset stratification threshold boundary and the duration exceeds [a certain period of time]. At that time, a data migration task is automatically generated to perform transparent migration between storage layers. The migration triggering logic is as follows: ; in For the first The overall popularity value of each data asset in the current assessment period; at the same time, the S6 full lifecycle audit module continuously monitors changes in data access patterns and dynamically adjusts [the data]. and Threshold parameters enable adaptive optimization of the storage architecture; S405: Secure Storage Strategy and Tiered Execution: This strategy links the differentiated security policies generated by S3 with the intelligent tiering results, implementing differentiated security hardening measures based on the security level requirements of each storage tier. Hot storage tier data uses online encryption and real-time permission verification to ensure data security and low-latency response under high-frequency access. Warm storage tier data uses standard encrypted storage and periodic permission auditing to meet compliance requirements and balance cost. Cold storage tier data uses batch encryption and archive permission control, supporting only batch decryption and recovery access. Simultaneously, it links data sensitivity levels to ensure that top-secret data, regardless of whether it is stored in a hot, warm, or cold tier, is subject to the highest level of encryption and access control policies, ensuring that security standards are not lowered due to storage tier demotion. Finally, it outputs a complete storage optimization plan including storage tier affiliation, storage location, security policy combinations, and optimization rate metrics, and pushes it to the storage execution layer to complete policy implementation and effect verification.

[0010] Preferably, the specific logical steps of S5 are as follows: S501: Constructing a dynamic permission assessment multi-dimensional feature vector: When a user initiates a data access request, the system collects information in real time from four dimensions: user authentication strength, device security status, user behavior characteristics, and the sensitivity level of the target data, to form the feature vector of this access request. ,in This indicates the strength score of user authentication. This indicates the equipment's safety status score. Indicates user behavior risk score, Indicates the sensitivity level score of the target data; S502: Access Trust Calculation: Input the four-dimensional feature vector into the dynamic permission assessment model, and calculate the access trust level using weighted fusion. The calculation formula is as follows: ; in Indicates user Data Trust level of this visit , , , These are weighting coefficients, please note. The larger the data, the more sensitive it is (1− The smaller the value, the higher the trust level required to access sensitive data; at the same time, a Bayesian dynamic update mechanism is introduced to score the user's behavior risk based on the actual behavior results after each access. The online correction is performed using the following formula: ; in This is the actual risk assessment result of this visit. The probability of access risk predicted by the model. The learning rate enables the model to continuously learn user behavior patterns; S503: Dynamic permission granting and least privilege access control: Calculated permissions will be used to grant permissions. Compare the permissions with the preset multi-level trust thresholds and grant differentiated permissions accordingly: when ≥ At that time, grant full access permissions; At this time, grant read-only access, and prohibit writing, downloading, and exporting; At that time, grant restricted read-only permissions; when If this occurs, access will be denied directly, triggering a multi-factor authentication upgrade process; Its permission decision-making rules are as follows: ; S504: Continuous Behavior Monitoring and Real-Time Dynamic Permission Adjustment: During user access, the system continuously monitors user behavior characteristics, and when a behavior risk score is detected... When abnormal changes occur or the cumulative risk score falls below a preset lower limit, automatic permission downgrade or session interruption will be triggered. The dynamic adjustment logic is as follows: ; The results of permission adjustments take effect in real time, ensuring the dynamic implementation of the principle of least privilege. S505: Access Control Change Audit and Closed-Loop Feedback: Record all detailed information about every access control grant, adjustment, and revocation operation in the audit log. Its recording format is as follows: , , ; in Indicates the operation type; simultaneously, the access control results are periodically fed back to the S6 full lifecycle audit module for continuous optimization of the weighting coefficients of the access assessment model. - and trust thresholds at each level , , This enables the dynamic access control model to have the ability to adaptively optimize based on historical access results, ultimately achieving continuous evolution and refined closed-loop management of access control.

[0011] Preferably, the specific logical steps of S6 are as follows: S601: Full Lifecycle Audit Log Collection and Structured Storage: Audit logs are collected for each stage of the data lifecycle, from generation, storage, access, migration to destruction, with each operation recorded as a structured audit entry. Its format is as follows: ; in For operation timestamp, To operate the user identifier, As a unique identifier for data assets, For operation type, For the operation result, and Sensitivity ratings for the data asset were assigned before and after the operation; all audit entries were appended to the audit log database in chronological order. This ensures the integrity and immutability of log data; S602: Self-optimization of the classification and grading model based on audit feedback: Periodically extract access records and permission decision records from the audit log library, statistically analyze the distribution of user access behavior under each sensitivity level, identify biases and misjudgments in the classification and grading model, and iteratively update the weight coefficients of the classification and grading model in S2 using gradient descent. The parameter update formula is as follows: ; in This indicates the weight coefficients of the classification and grading model in S2. , This is a sample set of feedback from the audit log. The loss function is constructed based on the classification error. The learning rate is used to continuously iterate and update the classification and grading model so that it gradually approximates the real data distribution. At the same time, the parameter versions and update records after model iteration are written into the audit log to achieve rollbackable and traceable model evolution management. S603: Security Policy Parameter Self-Optimization Based on Audit Feedback: The number of policy matches, policy conflicts, policy misjudgments, and manual corrections recorded in the audit log library provide quantitative evaluation data for the policy engine. Based on the cumulative audit feedback data, the matching parameters and priority weights of security policies at each level are dynamically adjusted. The policy performance score and policy parameter update formula are as follows: ; ; in To score the overall effectiveness of the strategy, To ensure compliance coverage, For mismatch rate, For strategy hit rate, , , These are the weighting coefficients. and These represent the priority weights before and after the policy update. The target performance threshold, To correct the step size, The average matching degree of the strategy; when the strategy effectiveness score is... When the value remains below the target value, the strategy parameters are automatically adjusted to dynamically adjust the strategy execution conditions and priorities. S604: Self-optimization of storage tiering thresholds based on audit feedback: The data access frequency change trend, storage migration records, and access latency data recorded in the audit log library provide a quantitative basis for the dynamic adjustment of storage tiering thresholds. The thresholds for each storage tier are adjusted based on the statistical results of actual access patterns. Periodic adjustments are performed, and the threshold adjustment formula is as follows: ; ; in , For the corrected hot-temperature stratification threshold and warm-cold stratification threshold, This represents the actual heat to temperature migration ratio. For the target heat → temperature migration ratio, This represents the actual temperature to cold migration ratio. The target temperature → cold migration ratio, To adjust the step size; when audit data shows that the actual migration ratio deviates from the target value, the tiering threshold is automatically adjusted so that the actual operating state of the storage architecture gradually approaches the preset optimization target; S605: Comprehensive Closed-Loop Optimization Performance Evaluation and Continuous Iteration: A comprehensive closed-loop performance score is constructed by integrating the accuracy of the S2 classification and grading model, the S3 strategy matching accuracy, the S4 storage optimization rate, and the S5 access control interception rate. The calculation formula is as follows: ; in For the accuracy of the classification and grading model, For strategy matching accuracy, To optimize storage space efficiency, For abnormal access interception rate, , , , For weighting coefficients; when The system is judged to be operating well overall; when When the values ​​fall below the target, the weak links are identified based on the deviations of each sub-indicator from the target value, triggering targeted optimization processes to form a continuous self-optimization closed loop of "audit data collection → deviation analysis → parameter correction → effect verification," ensuring that the overall system performance continues to approach the optimal state.

[0012] This invention also proposes a secure storage optimization system for enterprise-wide data management, including a full-domain data perception module, a classification and hierarchical labeling module, a unified policy engine module, an intelligent storage layering module, a dynamic access control module, and a full lifecycle auditing module; The full-domain data perception module is used to automatically scan and discover enterprise full-domain data storage nodes, extract data element information, and construct a full-domain data asset catalog and data distribution heat map. The classification and grading labeling module is used to build a multi-dimensional classification and grading model based on data content, type, source and business attributes, and automatically label the data sensitivity level. The unified policy engine module is used to build a unified security policy engine based on the data classification results, and automatically match differentiated encryption policies, access control policies, backup policies and retention policies; its built-in policy conflict resolution unit, when multiple policies match the same data asset and there is a conflict in the execution action, sorts them according to policy priority, selects the policy with the highest priority to execute, and records the conflict information to the audit log. The intelligent storage tiering module is used to dynamically optimize and intelligently tier the storage architecture based on data access frequency, data value, and security level, and to perform data deduplication and compression optimization. The dynamic access control module is used to build a dynamic access evaluation model based on user identity, device status, access behavior and data sensitivity level, calculate access trust level in real time and dynamically adjust access permissions. The full lifecycle audit module is used to perform security audits on the entire lifecycle of data from generation to destruction, and continuously optimizes the model parameters of each module based on the audit results, forming a closed-loop self-optimization mechanism. The full lifecycle audit module establishes a data feedback channel with all other modules, regularly collects the operating parameters and strategy execution effects of each module, and iteratively updates the classification and grading model weights, strategy matching parameters, and heat calculation coefficients through gradient descent, so as to achieve continuous self-optimization of the system.

[0013] Compared with existing technologies, the beneficial effects of this invention are: 1. Through automated scanning and multi-dimensional feature analysis of the entire data domain, unified perception and management of massive amounts of unstructured data scattered across various business systems and terminals are achieved, solving the problem of difficulty in establishing a data asset catalog. At the same time, a multi-dimensional classification and grading model is constructed by integrating data content, type, source, and business attributes, automatically labeling sensitivity level tags, forming a unified data grading system. This breaks down the independent state of cross-departmental and cross-system storage architecture and the fragmented permission system, effectively eliminating blind spots in data governance, enabling enterprises to clearly understand the distribution and sensitivity level of data assets across the entire domain, and laying the foundation for compliance evidence and differentiated security control. 2. A unified security policy engine centrally manages encryption, permissions, backup, and retention policies. It automatically matches differentiated policy combinations based on hierarchical results and incorporates a conflict resolution mechanism, eliminating the frequent conflicts and high costs caused by the decentralized deployment and independent execution of policies in traditional solutions. A dynamic permission assessment model calculates access trust levels in real time and dynamically adjusts permissions, achieving fine-grained control under the least privilege principle. This effectively addresses pain points such as over-authorization, delayed data eviction, and forced encryption hindering collaboration. Intelligent tiered storage automatically allocates data to hot, warm, and cold storage layers based on access frequency, time decay, and sensitivity levels. Combined with deduplication and compression, it releases redundant space, adapts to data differences, and alleviates performance bottlenecks associated with massive amounts of small files and high concurrency. Simultaneously, continuous feedback of operational data through full lifecycle auditing drives the self-optimization of classification and hierarchical models, policy parameters, and tiered thresholds, ultimately achieving a dynamic balance between enterprise-wide data security, collaboration efficiency, and storage costs. This invention establishes a unified data asset catalog and hierarchical system through automated scanning and multi-dimensional classification and grading of data across the entire domain, breaking down the fragmentation of cross-departmental permissions. A unified policy engine centrally manages encryption, permissions, and backup policies, automatically matching and resolving conflicts based on grading results to eliminate policy fragmentation. A dynamic permission model calculates trust levels and adjusts permissions in real time, achieving least privilege control. Intelligent tiered storage allocates data to hot, warm, and cold layers based on access frequency and sensitivity levels, combined with deduplication and compression to save space. Full lifecycle audit feedback of operational data drives model and policy self-optimization, ultimately achieving a dynamic balance between data security, collaborative efficiency, and storage costs. This effectively improves the comprehensiveness of enterprise data security governance, the consistency of security policy execution, and the efficiency of storage resource utilization. Attached Figure Description

[0014] Figure 1 This is a flowchart of a secure storage optimization method for enterprise-wide data management proposed in this invention; Figure 2 This is a block diagram of a secure storage optimization system for enterprise-wide data management proposed in this invention. Detailed Implementation

[0015] The present invention will be further explained below with reference to specific embodiments. Example

[0016] Reference Figure 1 This embodiment proposes a secure storage optimization method for enterprise-wide data management, including the following steps: S1: Full-Domain Data Intelligent Sensing and Asset Mapping: Automated scanning and discovery of data storage nodes for enterprise full-domain management, identification of structured data, unstructured data and semi-structured data, extraction of data metadata, and construction of a full-domain data asset catalog and data distribution heat map; The comprehensive data intelligent perception includes: automatically discovering enterprise-wide data storage nodes through network scanning, proxy collection, and API integration; extracting file type, file size, creation time, modification time, access frequency, department, and business system metadata; and constructing a comprehensive data asset catalog. ,in Indicates the first Each data asset; simultaneously, the data distribution density of each storage node is calculated, and a data distribution heatmap is generated; S2: Multi-dimensional data classification and grading with sensitive labeling: Based on data content, data type, data source and business attributes, a multi-dimensional classification and grading model is built, and data sensitivity level labels are automatically labeled to form a unified data grading system; The specific logical steps are as follows: S201: Data Content Sensitivity Analysis: This involves content analysis and recognition of the data assets identified in S1. For document-type data, the main text is extracted; for image-type data, text is recognized using OCR; for audio / video-type data, speech-to-text conversion is extracted; and for structured data, field annotations and sample values ​​are extracted. Then, based on a pre-defined sensitive word library and regular expression matching rules, various sensitive data features are detected, and a content sensitivity score is calculated. The calculation formula is as follows: ; in Indicates the first Content sensitivity score for each data asset This indicates the number of sensitive features matched. This represents the total number of features in the data asset. For the first Preset weights for sensitive features, for data assets without text content, The default value is 0; S202: Data Type Sensitivity Assessment: Based on file extensions, MIME types, and data format characteristics, identify the data type of the data asset, establish a pre-defined data type risk mapping table, and assign values ​​according to the inherent sensitivity of the data type. The assignment rules for data type sensitivity scores are as follows: ; in A higher value indicates a stronger inherent sensitivity of the data type. S203: Data Source Sensitivity Assessment: Based on the business system, department, and collection method to which the data asset belongs, assess the sensitivity of the data source. Data generated by key business systems or core departments is generally more sensitive. The formula for calculating the source sensitivity score is as follows: ; in This indicates the weight value of the business system to which the data asset belongs. This indicates the weight value of the department to which it belongs. For adjustment coefficients, The value range is 0-1; S204: Business Attribute Sensitivity Assessment: Based on the business functions and compliance attributes carried by the data assets, assess their business sensitivity. The assessment dimensions include whether the data involves personal privacy, whether it involves trade secrets, and whether it is subject to industry regulations and requirements. The formula for calculating the business attribute sensitivity score is as follows: ; in Indicate whether the data involves personal privacy. Indicate whether trade secrets are involved. Indicates whether it is subject to industry regulatory compliance requirements. The maximum value of each dimension is taken, and the business sensitivity is automatically set to 1 when any compliance-sensitive attribute exists, to ensure that compliance data is protected first. S205: Comprehensive Sensitivity Level Scoring and Labeling: [The following text appears to be incomplete and possibly contains errors: "will..."] , , , The sensitivity scores from the four dimensions are weighted and fused to calculate the overall sensitivity level score of the data asset. The calculation formula is as follows: ; in , , , The weight coefficients for the corresponding dimensions satisfy... + + + =1 + + + =1, the default weighting coefficients are content sensitivity weight 0.35, data type weight 0.25, source weight 0.20, and business attribute weight 0.20, and can be customized according to the compliance requirements of different industries; S206: Data Hierarchical Label Mapping and Unified Hierarchical System Construction: Based on the calculated comprehensive sensitivity level score According to the preset hierarchical mapping rules, the data is automatically assigned to the corresponding sensitivity level. The hierarchical determination rules are as follows: ; in Indicates the first Sensitivity level labels for each data asset; after labeling, synchronize the sensitivity level labels of each data asset to the global data asset catalog built by S1. In this process, a unified data classification system containing sensitivity level dimension information is formed, providing a classification basis for the subsequent differentiated strategy matching of the S3 unified strategy engine; at the same time, the feature matching records, scoring details and classification results generated during the classification and classification process are all written to the audit log to ensure that the classification and classification process is traceable and auditable. S3: Unified Security Policy Engine Construction and Policy Orchestration: Based on the data classification results, a unified security policy engine is built to automatically match differentiated encryption policies, access control policies, backup policies and retention policies for data of different security levels, forming a policy orchestration and conflict resolution mechanism; The specific logical steps are as follows: S301: Policy Library Construction and Policy Template Definition: Based on enterprise security compliance requirements and data classification system, a unified security policy library is pre-built. Each strategy Defined as a quadruple ,in Indicates the triggering condition of the strategy. Indicates the action to be executed by the strategy. Indicates policy priority. These tags represent policy types, forming a policy template library that covers all data security management needs. S302: Data-Policy Match Calculation: When data assets When entering the policy engine, extract its sensitivity level. Department Storage location Construct data feature vectors based on attributes and features. This is compared with the trigger conditions of each strategy in the strategy library. The matching degree is calculated using the following formula: ; in Indicates the first The data asset and the first The normalized matching degree of the strategy, This represents the similarity between the data feature vector and the policy triggering condition. The strategy priority weights are determined by normalization to ensure that the sum of the matching degrees of all strategies is 1. S303: Policy Conflict Detection and Type Attribution Determination: When the same data asset matches multiple... Strategies of the same type and When the value is greater than 0, a strategy conflict is determined to exist, triggering the conflict resolution process; its strategy conflict determination flag... The calculation formula is as follows: ; when When =1, that is, when there are two or more matching strategies of the same type and the actions are mutually exclusive, conflict resolution is triggered. S304: Policy Conflict Resolution and Optimal Policy Selection: Based on Policy Priority Matching degree The weighted fusion is used to calculate the comprehensive optimal score of conflict resolution strategies, and the strategy with the highest score is selected as the final execution strategy. The formula for calculating the optimal score of conflict resolution is as follows: ; in For the first The optimal score for conflict resolution of the strategy. For data-strategy matching degree, For strategy priority, This is the highest priority value in the policy library. The balance coefficient is selected; [the coefficient is then chosen to satisfy...] =max The strategy is used as the final execution strategy; at the same time, the conflict detection record, conflict resolution process and final strategy selection result are written to the audit log in full. S305: Differentiated Security Policy Combination Generation and Policy Orchestration: Based on Data Assets Sensitivity level And matching various types of policies, automatically generating complete security policy combinations. The strategy combination generation rules are as follows: ; in This indicates the strategy action with the highest matching degree among each type; it is also differentiated according to sensitivity level: Top Secret data is subject to mandatory encrypted storage, strict access control, daily full backup, and permanent retention; Confidential data is recommended to be encrypted, with departmental access control, weekly full backup, and long-term retention; Internal data is encrypted on demand, accessible to all, with monthly incremental backup and medium-term retention; Public data is not encrypted, accessible to all, not backed up, and retained for a short period; the strategy action combinations for each level are shown in the table below: ; S306: Strategy Execution Effectiveness Evaluation and Dynamic Updates to the Strategy Library: Record compliance coverage, strategy hit accuracy, and false positive rate during strategy execution; periodically conduct quantitative evaluations of the overall effectiveness of the strategy library; and define a comprehensive strategy performance score. The calculation formula is as follows: ; in To score the overall effectiveness of the strategy, Indicates policy compliance coverage. Indicates the policy mismatch rate. Indicates the strategy hit rate. , , Weighting coefficients (default value) =0.4、 =0.3、 =0.3); when For three consecutive evaluation periods, the value is below the preset threshold. When the default value is 0.70, the policy library optimization process is automatically triggered. The policy administrator intervenes to adjust the policy conditions, priorities and action parameters to achieve dynamic optimization and iteration of the policy library. Finally, it outputs differentiated security policy combinations adapted to each data level and distributes them to the data storage layer, network layer and application layer for execution, so as to complete the precise orchestration and automated control of the unified security policy for enterprise-wide data management. S4: Dynamic optimization and intelligent tiering of storage architecture: Based on data access frequency, data value and security level, the storage architecture is dynamically optimized and intelligently tiered, allocating high-frequency access data to the high-performance storage layer and low-frequency access data to the low-cost storage layer, and performing data deduplication and compression optimization. The specific logical steps are as follows: S401: Calculation of Comprehensive Popularity Value of Data Assets: For each data asset in the global data asset catalog constructed in S1, extract its access frequency, most recent access time, data size, and sensitivity level, and calculate its comprehensive popularity value. The calculation formula is as follows: ; in Indicates the first The overall popularity value of each data asset This represents the normalized value of the access frequency per unit time. This represents the recent access time decay factor, and its calculation formula is: , The time interval between the current moment and the last access. This is the attenuation coefficient, with a default value of 0.01. Data sensitivity levels are assigned scores, with Top Secret assigned 1.0, Confidential assigned 0.7, Internal assigned 0.4, and Public assigned 0.1. , , Weighting coefficients (default value) =0.4、 =0.3、 =0.3); S402: Intelligent Storage Tier Decision: Based on the overall data heat value Based on preset tiering thresholds, data is automatically allocated to the corresponding storage tier. The tiering determination rules are as follows: ; in Indicates the first The storage layer ownership of each data asset. This is the threshold for thermal stratification (default value is 0.60). The threshold for warm and cold storage tiers is set to 0.25 by default. The hot storage tier is used for frequently accessed hot data and uses high-performance SSD storage media. The warm storage tier is used for frequently accessed warm data and uses ordinary HDD storage media. The cold storage tier is used for rarely accessed cold data and uses Blu-ray storage, tape library or cloud archiving. At the same time, top secret and confidential data are forced to be stored in a local controlled storage environment and are prohibited from being stored in the public cloud cold storage tier. S403: Storage Space Deduplication and Compression Optimization: Performs data deduplication and compression optimization on data assets in each storage layer to release redundant storage space; firstly, duplicate data copies are identified and deleted through byte-level or file-level fingerprint comparison, retaining only unique instances and establishing reference mappings; then, a compression algorithm is adaptively selected based on the data type, and the storage space optimization rate is calculated using the following formula: ; in Indicates storage space optimization rate. To optimize the total storage space usage before, To optimize the actual storage space usage; and at the same time set the optimization rate target threshold. (Default value is 0.30), when The system triggers deep compression or archive cleanup strategies in a timely manner to ensure that storage resource utilization efficiency continues to meet standards. S404: Dynamic Migration and Periodic Reassessment of Storage Tiers: Set the assessment period (default value is 7 days). Within each assessment period, the system will evaluate the overall popularity of each data asset in the hot storage tier, warm storage tier, and cold storage tier. Periodic reassessment is performed when the data popularity value crosses the preset stratification threshold boundary and the duration exceeds [a certain period of time]. When the default value is 3 days, a data migration task is automatically generated to perform transparent migration between storage layers. The migration triggering logic is as follows: ; in For the first The overall popularity value of each data asset in the current assessment period; at the same time, the S6 full lifecycle audit module continuously monitors changes in data access patterns and dynamically adjusts [the data]. and Threshold parameters enable adaptive optimization of the storage architecture; S405: Secure Storage Strategy and Tiered Execution: This strategy links the differentiated security policies generated by S3 with the intelligent tiering results, implementing differentiated security hardening measures based on the security level requirements of each storage tier: Hot storage tier data uses online encryption and real-time permission verification to ensure data security and low-latency response under high-frequency access; Warm storage tier data uses standard encrypted storage and periodic permission auditing to meet compliance requirements and balance cost; Cold storage tier data uses batch encryption and archive permission control, supporting only batch decryption and recovery access; Simultaneously, it links data sensitivity levels to ensure that top-secret data, regardless of whether it is stored in a hot, warm, or cold tier, is subject to the highest level of encryption and access control policies, ensuring that security standards are not lowered due to storage tier demotion; Finally, it outputs a complete storage optimization plan including storage tier affiliation, storage location, security policy combination, and optimization rate indicators, and pushes it to the storage execution layer to complete policy implementation and effect verification. S5: Dynamic permission control and zero-trust access control: Based on user identity, device status, access behavior and data sensitivity level, a dynamic permission evaluation model is built to calculate access trust level in real time and dynamically adjust access permissions to achieve fine-grained access control under the principle of least privilege. The specific logical steps are as follows: S501: Constructing a dynamic permission assessment multi-dimensional feature vector: When a user initiates a data access request, the system collects information in real time from four dimensions: user authentication strength, device security status, user behavior characteristics, and the sensitivity level of the target data, to form the feature vector of this access request. ,in This represents the strength score of user authentication (based on multi-factor authentication levels: password + SMS = 0.5, password + biometrics = 0.7, password + biometrics + UKey = 1.0). The rating represents the security status of the device (1.0 for compliant and risk-free devices, 0.5 for devices with known vulnerabilities, and 0.2 for abnormal or unmanaged devices). This represents the user behavior risk score (initially 0.8 by default, dynamically adjusted based on access time, access frequency, access volume, and historical abnormal behavior). The sensitivity level score of the target data is indicated (Top Secret is 1.0, Confidential is 0.7, Internal is 0.4, and Public is 0.1). S502: Access Trust Calculation: Input the four-dimensional feature vector into the dynamic permission assessment model, and calculate the access trust level using weighted fusion. The calculation formula is as follows: ; in Indicates user Data Trust level for this visit (value range 0-1). , , , Weighting coefficients (default value) =0.3、 =0.25、 =0.25、 =0.2), note The larger the data, the more sensitive it is (1− The smaller the value, the higher the trust level required to access sensitive data; at the same time, a Bayesian dynamic update mechanism is introduced to score the user's behavior risk based on the actual behavior results after each access. The online correction is performed using the following formula: ; in This represents the actual risk assessment result for this visit (0 or 1). The probability of access risk predicted by the model. Set as the learning rate (default is 0.1) to enable the model to continuously learn user behavior patterns; S503: Dynamic permission granting and least privilege access control: Calculated permissions will be used to grant permissions. Compare the permissions with the preset multi-level trust thresholds and grant differentiated permissions accordingly: when ≥ (Default 0.85) Grants full access permissions (read + write + download); ( When the default value is 0.60, read-only access is granted, and writing, downloading, and exporting are prohibited. ( When the default value is 0.40, grant restricted read-only permissions (only allow previewing of de-identified data); when If this occurs, access will be denied directly, triggering a multi-factor authentication upgrade process; Its permission decision-making rules are as follows: ; S504: Continuous Behavior Monitoring and Real-Time Dynamic Permission Adjustment: During user access, the system continuously monitors user behavior characteristics (page dwell time, abnormal download frequency, access outside working hours, batch export operations, etc.). When a behavioral risk score is detected, the system will adjust the settings accordingly. When abnormal changes occur (a single decrease exceeding 0.3) or the cumulative risk score falls below the preset lower limit, permission downgrade or session interruption will be automatically triggered. The dynamic adjustment logic is as follows: ; The results of permission adjustments take effect in real time, ensuring the dynamic implementation of the principle of least privilege. S505: Permission Change Audit and Closed-Loop Feedback: Record all detailed information (including user identity, accessed data assets, granted permissions, trust score, behavioral risk score, operation timestamp, etc.) for each permission granting, adjusting, and revoking operation in the audit log. Its recording format is as follows: , , ; in This indicates the operation type (granting, escalating, downgrading, and revoking permissions); simultaneously, it periodically feeds back the permission control results (normal access rate, abnormal interception rate, false interception rate, etc.) to the S6 full lifecycle audit module for continuous optimization of the permission evaluation model's weighting coefficients. - and trust thresholds at each level , , This enables the dynamic access control model to have adaptive optimization capabilities based on historical access results, ultimately achieving continuous evolution and refined closed-loop management of access control. S6: Full lifecycle security audit and closed-loop optimization: Conduct security audits on the entire lifecycle of data from generation, storage, access, migration to destruction, and continuously optimize the classification and grading model, security policies and storage architecture based on the audit results to form a closed-loop self-optimization mechanism; The specific logical steps are as follows: S601: Full Lifecycle Audit Log Collection and Structured Storage: Audit logs are collected for each stage of the data lifecycle, from generation, storage, access, migration to destruction, with each operation recorded as a structured audit entry. Its format is as follows:

[0017] in For operation timestamp, To operate the user identifier, As a unique identifier for data assets, For operation types (create, store, access, migrate, destroy). The result of the operation (success / failure / rejection). and Each data asset is assigned a sensitivity rating before and after the operation (used to track changes in data sensitivity); all audit entries are appended to the audit log database in chronological order. This ensures the integrity and immutability of log data; S602: Self-optimization of the classification and grading model based on audit feedback: Periodically extract access records and permission decision records from the audit log library, statistically analyze the distribution of user access behavior under each sensitivity level, identify biases and misjudgments in the classification and grading model, and iteratively update the weight coefficients of the classification and grading model in S2 using gradient descent. The parameter update formula is as follows: ; in This indicates the weight coefficients of the classification and grading model in S2. , This is a sample set of feedback from the audit log (including results of manual review). The loss function is constructed based on the classification error (using cross-entropy loss). The learning rate is set to 0.05 by default. Through continuous iterative updates, the classification and grading model gradually approximates the real data distribution. At the same time, the parameter versions and update records after model iterations are written to the audit log to achieve rollback-friendly and traceable model evolution management. S603: Security Policy Parameter Self-Optimization Based on Audit Feedback: The number of policy matches, policy conflicts, policy misjudgments, and manual corrections recorded in the audit log library provide quantitative evaluation data for the policy engine. Based on the cumulative audit feedback data, the matching parameters and priority weights of security policies at each level are dynamically adjusted. The policy performance score and policy parameter update formula are as follows: ; ; in To score the overall effectiveness of the strategy, To ensure compliance coverage, For mismatch rate, For strategy hit rate, , , Weighting coefficients (default value) =0.4、 =0.3、 =0.3), and These represent the priority weights before and after the policy update. The target performance threshold (default value is 0.70). To adjust the step size (default is 0.1), The average matching degree of the strategy; when the strategy effectiveness score is... When the value remains below the target value, the strategy parameters are automatically adjusted to dynamically adjust the strategy execution conditions and priorities. S604: Self-optimization of storage tiering thresholds based on audit feedback: The data access frequency change trend, storage migration records, and access latency data recorded in the audit log library provide a quantitative basis for the dynamic adjustment of storage tiering thresholds. The thresholds for each storage tier are adjusted based on the statistical results of actual access patterns. Periodic adjustments are performed, and the threshold adjustment formula is as follows: ; ; in , For the corrected hot-temperature stratification threshold and warm-cold stratification threshold, This represents the actual heat to temperature migration ratio. The target heat to temperature migration ratio (default value is 0.15). This represents the actual temperature to cold migration ratio. The target temperature → cold migration ratio (default value is 0.10). To adjust the step size (default is 0.05); when audit data shows that the actual migration ratio deviates from the target value, the tiering threshold is automatically adjusted so that the actual operating state of the storage architecture gradually approaches the preset optimization target; in For the accuracy of the classification and grading model, For strategy matching accuracy, To optimize storage space efficiency, For abnormal access interception rate, , , , Weighting coefficients (default value) =0.25、 =0.25、 =0.25、 =0.25); when When the default value is 0.80, the system is considered to be running well overall; when When the performance falls below the target value, weak links are identified based on the deviations of each sub-indicator from the target value, triggering targeted optimization processes. This forms a continuous self-optimization closed loop of "audit data collection → deviation analysis → parameter correction → effect verification," ensuring that the overall system performance continuously approaches the optimal state. S605: Comprehensive Closed-Loop Optimization Effect Evaluation and Continuous Iteration: A comprehensive closed-loop performance score is constructed by integrating the accuracy of the S2 classification and grading model, the S3 strategy matching accuracy, the S4 storage optimization rate, and the S5 access control interception rate. The calculation formula is as follows: ; in For the accuracy of the classification and grading model, For strategy matching accuracy, To optimize storage space efficiency, For abnormal access interception rate, , , , Weighting coefficients (default value) =0.25、 =0.25、 =0.25、 =0.25); when When the default value is 0.80, the system is considered to be running well overall; when When the values ​​fall below the target, the weak links are identified based on the deviations of each sub-indicator from the target value, triggering targeted optimization processes to form a continuous self-optimization closed loop of "audit data collection → deviation analysis → parameter correction → effect verification," ensuring that the overall system performance continues to approach the optimal state.

[0018] Reference Figure 2 This embodiment also proposes a secure storage optimization system for enterprise-wide data management, including a full-domain data perception module, a classification and hierarchical labeling module, a unified policy engine module, an intelligent storage layering module, a dynamic access control module, and a full lifecycle auditing module; The global data perception module is used to automatically scan and discover all data storage nodes of an enterprise, extract data metadata, and build a global data asset catalog and data distribution heat map. The classification and grading labeling module is used to build a multi-dimensional classification and grading model based on data content, type, source, and business attributes, and automatically label the data with sensitivity level tags; The unified policy engine module is used to build a unified security policy engine based on the data classification results, automatically matching differentiated encryption policies, access control policies, backup policies, and retention policies; its built-in policy conflict resolution unit, when multiple policies match the same data asset and there are conflicts in the execution actions, sorts them according to policy priority, selects the policy with the highest priority for execution, and records the conflict information to the audit log. The intelligent storage tiering module is used to dynamically optimize and intelligently tier the storage architecture based on data access frequency, data value, and security level, and to perform data deduplication and compression optimization. The dynamic access control module is used to build a dynamic access assessment model based on user identity, device status, access behavior and data sensitivity level, calculate access trust level in real time and dynamically adjust access permissions. The full lifecycle audit module is used to perform security audits on data from generation to destruction, and continuously optimizes the model parameters of each module based on the audit results, forming a closed-loop self-optimization mechanism. The full lifecycle audit module establishes a data feedback channel with all other modules, regularly collects the operating parameters and strategy execution effects of each module, and iteratively updates the classification and grading model weights, strategy matching parameters and heat calculation coefficients through gradient descent, so as to achieve continuous self-optimization of the system.

[0019] This embodiment establishes a unified data asset catalog and hierarchical system through automated scanning of all data and multi-dimensional classification and grading, breaking down cross-departmental permission barriers. A unified policy engine centrally manages encryption, permission, and backup policies, automatically matching and resolving conflicts based on grading results to eliminate policy fragmentation. A dynamic permission model calculates trust levels and adjusts permissions in real time, achieving least privilege control. Intelligent tiered storage allocates data to hot, warm, and cold tiers based on access frequency and sensitivity level, combined with deduplication and compression to save space. Full lifecycle audit feedback of operational data drives model and policy self-optimization, ultimately achieving a dynamic balance between data security, collaborative efficiency, and storage costs. This effectively improves the comprehensiveness of enterprise data security governance, the consistency of security policy execution, and the efficiency of storage resource utilization.

[0020] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for optimizing secure storage of enterprise-wide data management, characterized in that, Includes the following steps: S1: Full-Domain Data Intelligent Sensing and Asset Mapping: Automated scanning and discovery of data storage nodes for enterprise full-domain management, identification of structured data, unstructured data and semi-structured data, extraction of data metadata, and construction of a full-domain data asset catalog and data distribution heat map; S2: Multi-dimensional data classification and grading with sensitive labeling: Based on data content, data type, data source and business attributes, a multi-dimensional classification and grading model is built, and data sensitivity level labels are automatically labeled to form a unified data grading system; S3: Unified Security Policy Engine Construction and Policy Orchestration: Based on the data classification results, a unified security policy engine is built to automatically match differentiated encryption policies, access control policies, backup policies and retention policies for data of different security levels, forming a policy orchestration and conflict resolution mechanism; S4: Dynamic optimization and intelligent tiering of storage architecture: Based on data access frequency, data value and security level, the storage architecture is dynamically optimized and intelligently tiered, allocating high-frequency access data to the high-performance storage layer and low-frequency access data to the low-cost storage layer, and performing data deduplication and compression optimization. S5: Dynamic permission control and zero-trust access control: Based on user identity, device status, access behavior and data sensitivity level, a dynamic permission evaluation model is built to calculate access trust level in real time and dynamically adjust access permissions to achieve fine-grained access control under the principle of least privilege. S6: Full lifecycle security audit and closed-loop optimization: Conduct security audits on the entire lifecycle of data from generation, storage, access, migration to destruction, and continuously optimize the classification and grading model, security policies and storage architecture based on the audit results to form a closed-loop self-optimization mechanism.

2. The secure storage optimization method for enterprise-wide data management according to claim 1, characterized in that, In S1, the intelligent perception of the entire domain data includes: automatically discovering the enterprise's entire domain data storage nodes through network scanning, proxy collection, and API integration; extracting file type, file size, creation time, modification time, access frequency, department, and business system metadata; and constructing a comprehensive data asset catalog. ,in Indicates the first Each data asset is analyzed; simultaneously, the data distribution density of each storage node is calculated, and a data distribution heatmap is generated.

3. The secure storage optimization method for enterprise-wide data management according to claim 2, characterized in that, The specific logical steps of S2 are as follows: S201: Data Content Sensitivity Analysis: Perform content analysis and recognition on the data assets discovered in S1, extract the main text from document data, recognize the text in image data through OCR, extract speech-to-text results from audio and video data, and extract field annotations and sample values ​​from structured data; Then, based on a pre-defined sensitive word library and regular expression matching rules, various sensitive data features are detected, and a content sensitivity score is calculated. The calculation formula is as follows: ； in Indicates the first Content sensitivity score for each data asset This indicates the number of sensitive features matched. This represents the total number of features in the data asset. For the first Preset weights for sensitive features, for data assets without text content, The default value is 0; S202: Data Type Sensitivity Assessment: Based on file extensions, MIME types, and data format characteristics, identify the data type of the data asset, establish a pre-defined data type risk mapping table, and assign values ​​according to the inherent sensitivity of the data type. The assignment rules for data type sensitivity scores are as follows: ； in A higher value indicates a stronger inherent sensitivity of the data type. S203: Data Source Sensitivity Assessment: Based on the business system, department, and collection method to which the data asset belongs, assess the sensitivity of the data source. Data generated by key business systems or core departments is generally more sensitive. The formula for calculating the source sensitivity score is as follows: ； in A higher value indicates a stronger inherent sensitivity of the data type. S203: Data Source Sensitivity Assessment: Based on the business system, department, and collection method to which the data asset belongs, assess the sensitivity of the data source. Data generated by key business systems or core departments is generally more sensitive. The formula for calculating the source sensitivity score is as follows: ； in Indicate whether the data involves personal privacy. Indicate whether trade secrets are involved. Indicates whether it is subject to industry regulatory compliance requirements. The maximum value of each dimension is taken, and the business sensitivity is automatically set to 1 when any compliance-sensitive attribute exists, to ensure that compliance data is protected first. S205: Comprehensive Sensitivity Level Scoring and Labeling: [The following text appears to be incomplete and possibly contains errors: "will..."] , , , The sensitivity scores from the four dimensions are weighted and fused to calculate the overall sensitivity level score of the data asset. The calculation formula is as follows: ； in , , , The weight coefficients for the corresponding dimensions satisfy... + + + =1 + + + =1, the default weighting coefficients are content sensitivity weight 0.35, data type weight 0.25, source weight 0.20, and business attribute weight 0.20, and can be customized according to the compliance requirements of different industries; S206: Data Hierarchical Label Mapping and Unified Hierarchical System Construction: Based on the calculated comprehensive sensitivity level score According to the preset hierarchical mapping rules, the data is automatically assigned to the corresponding sensitivity level. The hierarchical determination rules are as follows: ； in Indicates the first Sensitivity level labels for individual data assets; After completing the labeling, synchronize the sensitivity level tags of each data asset to the global data asset catalog built by S1. In this process, a unified data classification system containing sensitivity level dimension information is formed, providing a classification basis for the subsequent differentiated strategy matching of the S3 unified strategy engine; at the same time, the feature matching records, scoring details and classification results generated during the classification and classification process are written to the audit log in full to ensure that the classification and classification process is traceable and auditable.

4. The secure storage optimization method for enterprise-wide data management according to claim 3, characterized in that, The specific logical steps of S3 are as follows: S301: Policy Library Construction and Policy Template Definition: Based on enterprise security compliance requirements and data classification system, a unified security policy library is pre-built. Each strategy Defined as a quadruple ,in Indicates the triggering condition of the strategy. Indicates the action to be executed by the strategy. Indicates policy priority. These tags represent policy types, forming a policy template library that covers all data security management needs. S302: Data-Policy Match Calculation: When data assets When entering the policy engine, extract its sensitivity level. Department Storage location Construct data feature vectors based on attributes and features. This is compared with the trigger conditions of each strategy in the strategy library. The matching degree is calculated using the following formula: ； in Indicates the first The data asset and the first The normalized matching degree of the strategy, This represents the similarity between the data feature vector and the policy triggering condition. The strategy priority weights are determined by normalization to ensure that the sum of the matching degrees of all strategies is 1. S303: Policy Conflict Detection and Type Attribution Determination: When the same data asset matches multiple... Strategies of the same type and When the value is greater than 0, a strategy conflict is determined to exist, and the conflict resolution process is triggered. Its strategy conflict determination indicator The calculation formula is as follows: ； when When =1, that is, when there are two or more matching strategies of the same type and the actions are mutually exclusive, conflict resolution is triggered. S304: Policy Conflict Resolution and Optimal Policy Selection: Based on Policy Priority Matching degree The weighted fusion is used to calculate the comprehensive optimal score of conflict resolution strategies, and the strategy with the highest score is selected as the final execution strategy. The formula for calculating the optimal score of conflict resolution is as follows: ； in For the first The optimal score for conflict resolution of the strategy. For data-strategy matching degree, For strategy priority, This is the highest priority value in the policy library. The balance coefficient is selected; [the coefficient is then chosen to satisfy...] =max The strategy is used as the final execution strategy; at the same time, the conflict detection record, conflict resolution process and final strategy selection result are written to the audit log in full. S305: Differentiated Security Policy Combination Generation and Policy Orchestration: Based on Data Assets Sensitivity level And matching various types of policies, automatically generating complete security policy combinations. The strategy combination generation rules are as follows: ； in This indicates the strategy action with the highest matching degree among each type; it is also differentiated according to sensitivity level: Top Secret data is subject to mandatory encrypted storage, strict access control, daily full backup, and permanent retention; Confidential data is recommended to be encrypted, with departmental access control, weekly full backup, and long-term retention; Internal data is encrypted on demand, accessible to all, with monthly incremental backup and medium-term retention; Public data is not encrypted, accessible to all, not backed up, and retained for a short period; the strategy action combinations for each level are shown in the table below: ； S306: Strategy Execution Effectiveness Evaluation and Dynamic Updates to the Strategy Library: Record compliance coverage, strategy hit accuracy, and false positive rate during strategy execution; periodically conduct quantitative evaluations of the overall effectiveness of the strategy library; and define a comprehensive strategy performance score. The calculation formula is as follows: ； in To score the overall effectiveness of the strategy, Indicates policy compliance coverage. Indicates the policy mismatch rate. Indicates the strategy hit rate. , , For weighting coefficients; when For three consecutive evaluation periods, the value is below the preset threshold. When the policy library optimization process is triggered automatically, the policy administrator intervenes to adjust the policy conditions, priorities and action parameters, so as to realize the dynamic optimization and iteration of the policy library. Finally, it outputs a combination of differentiated security policies adapted to each data level, which is then distributed to the data storage layer, network layer and application layer for execution, so as to complete the precise orchestration and automated control of the unified security policy for enterprise-wide data management.

5. The secure storage optimization method for enterprise-wide data management according to claim 4, characterized in that, The specific logical steps of S4 are as follows: S401: Calculation of Comprehensive Popularity Value of Data Assets: For each data asset in the global data asset catalog constructed in S1, extract its access frequency, most recent access time, data size, and sensitivity level, and calculate its comprehensive popularity value. The calculation formula is as follows: ； in Indicates the first The overall popularity value of each data asset This represents the normalized value of the access frequency per unit time. This represents the recent access time decay factor, and its calculation formula is: , The time interval between the current moment and the last access. This is the attenuation coefficient, with a default value of 0.

01. Data sensitivity levels are assigned scores, with Top Secret assigned 1.0, Confidential assigned 0.7, Internal assigned 0.4, and Public assigned 0.

1. , , These are the weighting coefficients; S402: Intelligent Storage Tier Decision: Based on the overall data heat value Based on preset tiering thresholds, data is automatically allocated to the corresponding storage tier. The tiering determination rules are as follows: ； in Indicates the first The storage layer ownership of each data asset. The threshold for thermal stratification. The temperature and cold storage layers are defined as follows: the hot storage layer is used for frequently accessed hot data and uses high-performance SSD storage media; the warm storage layer is used for frequently accessed warm data and uses ordinary HDD storage media; the cold storage layer is used for rarely accessed cold data and uses Blu-ray storage, tape library or cloud archiving; at the same time, top secret and confidential data are forced to be stored in a local controlled storage environment and are prohibited from being stored in the public cloud cold storage layer. S403: Storage Space Deduplication and Compression Optimization: Performs data deduplication and compression optimization on data assets in each storage layer to release redundant storage space; firstly, duplicate data copies are identified and deleted through byte-level or file-level fingerprint comparison, retaining only unique instances and establishing reference mappings; then, a compression algorithm is adaptively selected based on the data type, and the storage space optimization rate is calculated using the following formula: ； in Indicates storage space optimization rate. To optimize the total storage space usage before, To optimize the actual storage space usage; and at the same time set the optimization rate target threshold. ,when The system triggers deep compression or archive cleanup strategies in a timely manner to ensure that storage resource utilization efficiency continues to meet standards. S404: Dynamic Migration and Periodic Reassessment of Storage Tiers: Set an assessment period. Within each assessment period, the system will evaluate the overall heat value of each data asset in the hot storage tier, warm storage tier, and cold storage tier. Periodic reassessment is performed when the data popularity value crosses the preset stratification threshold boundary and the duration exceeds [a certain period of time]. At that time, a data migration task is automatically generated to perform transparent migration between storage layers. The migration triggering logic is as follows: ； in For the first The overall popularity value of each data asset in the current assessment period; at the same time, the S6 full lifecycle audit module continuously monitors changes in data access patterns and dynamically adjusts [the data]. and Threshold parameters enable adaptive optimization of the storage architecture; S405: Secure Storage Strategy and Tiered Execution: This strategy links the differentiated security policies generated by S3 with the intelligent tiering results, implementing differentiated security hardening measures based on the security level requirements of each storage tier. Hot storage tier data uses online encryption and real-time permission verification to ensure data security and low-latency response under high-frequency access. Warm storage tier data uses standard encrypted storage and periodic permission auditing to meet compliance requirements and balance cost. Cold storage tier data uses batch encryption and archive permission control, supporting only batch decryption and recovery access. Simultaneously, it links data sensitivity levels to ensure that top-secret data, regardless of whether it is stored in a hot, warm, or cold tier, is subject to the highest level of encryption and access control policies, ensuring that security standards are not lowered due to storage tier demotion. Finally, it outputs a complete storage optimization plan including storage tier affiliation, storage location, security policy combinations, and optimization rate metrics, and pushes it to the storage execution layer to complete policy implementation and effect verification.

6. The secure storage optimization method for enterprise-wide data management according to claim 5, characterized in that, The specific logical steps of S5 are as follows: S501: Constructing a dynamic permission assessment multi-dimensional feature vector: When a user initiates a data access request, the system collects information in real time from four dimensions: user authentication strength, device security status, user behavior characteristics, and the sensitivity level of the target data, to form the feature vector of this access request. ,in This indicates the strength score of user authentication. This indicates the equipment's safety status score. Indicates user behavior risk score, This indicates the sensitivity level score of the target data; S502: Access Trust Calculation: Input the four-dimensional feature vector into the dynamic permission assessment model, and calculate the access trust level using weighted fusion. The calculation formula is as follows: ； in Indicates user Data Trust level of this visit , , , These are weighting coefficients, please note. The larger the data, the more sensitive it is (1− The smaller the value, the higher the trust level required to access sensitive data; at the same time, a Bayesian dynamic update mechanism is introduced to score the user's behavior risk based on the actual behavior results after each access. The online correction is performed using the following formula: ； in This is the actual risk assessment result of this visit. The probability of access risk predicted by the model. The learning rate enables the model to continuously learn user behavior patterns; S503: Dynamic permission granting and least privilege access control: Calculated permissions will be used to grant permissions. Compare the permissions with the preset multi-level trust thresholds and grant differentiated permissions accordingly: when ≥ At that time, grant full access permissions; At this time, grant read-only access, and prohibit writing, downloading, and exporting; At that time, grant restricted read-only permissions; when If this occurs, access will be denied directly, triggering a multi-factor authentication upgrade process; Its permission decision-making rules are as follows: ； S504: Continuous Behavior Monitoring and Real-Time Dynamic Permission Adjustment: During user access, the system continuously monitors user behavior characteristics, and when a behavior risk score is detected... When abnormal changes occur or the cumulative risk score falls below a preset lower limit, automatic permission downgrade or session interruption will be triggered. The dynamic adjustment logic is as follows: ； The results of permission adjustments take effect in real time, ensuring the dynamic implementation of the principle of least privilege. S505: Access Control Change Audit and Closed-Loop Feedback: Record all detailed information about every access control grant, adjustment, and revocation operation in the audit log. Its recording format is as follows: ， ， ； in Indicates the operation type; simultaneously, it periodically feeds back the access control results to the S6 full lifecycle audit module for continuous optimization of the weighting coefficients of the access assessment model. - and trust thresholds at each level , , This enables the dynamic access control model to have the ability to adaptively optimize based on historical access results, ultimately achieving continuous evolution and refined closed-loop management of access control.

7. The secure storage optimization method for enterprise-wide data management according to claim 6, characterized in that, The specific logical steps of S6 are as follows: S601: Full Lifecycle Audit Log Collection and Structured Storage: Audit logs are collected for each stage of the data lifecycle, from generation, storage, access, migration to destruction, with each operation recorded as a structured audit entry. Its format is as follows: ； in For operation timestamp, To operate the user identifier, As a unique identifier for data assets, For operation type, For the operation result, and Sensitivity ratings for the data asset were assigned before and after the operation; all audit entries were appended to the audit log database in chronological order. This ensures the integrity and immutability of log data; S602: Self-optimization of the classification and grading model based on audit feedback: Periodically extract access records and permission decision records from the audit log library, statistically analyze the distribution of user access behavior under each sensitivity level, identify biases and misjudgments in the classification and grading model, and iteratively update the weight coefficients of the classification and grading model in S2 using gradient descent. The parameter update formula is as follows: ； in This indicates the weight coefficients of the classification and grading model in S2. , This is a sample set of feedback from the audit log. The loss function is constructed based on the classification error. The learning rate is used to continuously iterate and update the classification and grading model so that it gradually approximates the real data distribution. At the same time, the parameter versions and update records after model iteration are written into the audit log to achieve rollbackable and traceable model evolution management. S603: Security Policy Parameter Self-Optimization Based on Audit Feedback: The number of policy matches, policy conflicts, policy misjudgments, and manual corrections recorded in the audit log library provide quantitative evaluation data for the policy engine. Based on the cumulative audit feedback data, the matching parameters and priority weights of security policies at each level are dynamically adjusted. The policy performance score and policy parameter update formula are as follows: ； ； in To score the overall effectiveness of the strategy, To ensure compliance coverage, For mismatch rate, For strategy hit rate, , , These are the weighting coefficients. and These represent the priority weights before and after the policy update. The target performance threshold, To correct the step size, This represents the average matching degree of the strategy; When the strategy effectiveness score When the value remains below the target value, the strategy parameters are automatically adjusted to dynamically adjust the strategy execution conditions and priorities. S604: Self-optimization of storage tiering thresholds based on audit feedback: The data access frequency change trend, storage migration records, and access latency data recorded in the audit log library provide a quantitative basis for the dynamic adjustment of storage tiering thresholds. The thresholds for each storage tier are adjusted based on the statistical results of actual access patterns. Periodic adjustments are performed, and the threshold adjustment formula is as follows: ； ； in , For the corrected hot-temperature stratification threshold and warm-cold stratification threshold, This represents the actual heat to temperature migration ratio. For the target heat to temperature migration ratio, This represents the actual temperature to cold migration ratio. The target temperature → cold migration ratio, To adjust the step size; when audit data shows that the actual migration ratio deviates from the target value, the tiering threshold is automatically adjusted so that the actual operating state of the storage architecture gradually approaches the preset optimization target; S605: Comprehensive Closed-Loop Optimization Performance Evaluation and Continuous Iteration: A comprehensive closed-loop performance score is constructed by integrating the accuracy of the S2 classification and grading model, the S3 strategy matching accuracy, the S4 storage optimization rate, and the S5 access control interception rate. The calculation formula is as follows: ； in For the accuracy of the classification and grading model, For strategy matching accuracy, To optimize storage space efficiency, For abnormal access interception rate, , , , For weighting coefficients; when The system is judged to be operating well overall; when When the values ​​fall below the target, the weak links are identified based on the deviations of each sub-indicator from the target value, triggering targeted optimization processes to form a continuous self-optimization closed loop of "audit collection → deviation analysis → parameter correction → effect verification," ensuring that the overall system performance continues to approach the optimal state.

8. A secure storage optimization system for enterprise-wide data management, used to implement the method described in any one of claims 1-7, characterized in that, It includes a global data perception module, a classification and hierarchical labeling module, a unified strategy engine module, an intelligent storage layering module, a dynamic access control module, and a full lifecycle auditing module; The full-domain data perception module is used to automatically scan and discover enterprise full-domain data storage nodes, extract data element information, and construct a full-domain data asset catalog and data distribution heat map. The classification and grading labeling module is used to build a multi-dimensional classification and grading model based on data content, type, source and business attributes, and automatically label the data sensitivity level. The unified policy engine module is used to build a unified security policy engine based on the data classification results, and automatically match differentiated encryption policies, access control policies, backup policies and retention policies. Its built-in policy conflict resolution unit sorts multiple policies that match the same data asset and have conflicting execution actions based on policy priority, selects the policy with the highest priority for execution, and records the conflict information to the audit log. The intelligent storage tiering module is used to dynamically optimize and intelligently tier the storage architecture based on data access frequency, data value, and security level, and to perform data deduplication and compression optimization. The dynamic access control module is used to build a dynamic access evaluation model based on user identity, device status, access behavior and data sensitivity level, calculate access trust level in real time and dynamically adjust access permissions. The full lifecycle audit module is used to perform security audits on data from generation to destruction, and continuously optimizes the model parameters of each module based on the audit results, forming a closed-loop self-optimization mechanism. The full lifecycle audit module establishes a data feedback channel with all other modules, regularly collects the operating parameters and strategy execution effects of each module, and iteratively updates the classification and grading model weights, strategy matching parameters, and heat calculation coefficients through gradient descent, thereby achieving continuous self-optimization of the system.

Images