Employee privacy data protection method and system based on attribute-based encryption

Abstract

The present application relates to the technical field of information security, in particular to an employee privacy data protection method and system based on attribute-based encryption. The method comprises: in response to a state change event of an employee, obtaining an initial accessible data range of the employee, a change type and multi-dimensional access features; analyzing the initial accessible data range, the change type and the multi-dimensional access features to obtain a sensitivity level of the employee; matching a corresponding target update strategy based on the sensitivity level and a double constraint condition, so as to perform a corresponding permission change operation according to the target update strategy. The present application can improve the employee privacy data protection effect based on attribute-based encryption.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method and system for protecting employee privacy data based on attribute-based encryption. Background Technology

[0002] Attribute-Based Encryption (ABE) is a mainstream encryption solution for fine-grained access control of enterprise privacy data. Its core principle is to bind access control policies to user attributes; only user attributes matching the preset policy can decrypt the ciphertext. This solution eliminates the need to assign individual keys to each user, making it suitable for enterprise management scenarios with multiple users and multi-level access control. Enterprises need to protect data in two categories: sensitive personal privacy data of employees and confidential business data. The former includes salary information, health records, and family privacy information, while the latter covers project documents, customer information, and core technical data. Currently, the industry commonly uses ABE to encrypt and store these two types of confidential data. By combining employee job titles, departments, and job levels, differentiated access control policies are configured to achieve hierarchical control of internal privacy and confidential data for different personnel, meeting the basic needs of daily data security access management for enterprises.

[0003] Existing attribute-based encryption schemes have flaws in their handling mechanisms for personnel changes such as promotions, job transfers, and resignations. The access policy update methods in existing schemes are too simplistic, failing to differentiate the information leakage risks associated with different job positions. The same logic is applied to the departure of employees in core confidential positions and ordinary administrative positions: full re-encryption of all data significantly increases server computational overhead, while updating only user keys leaves expired keys, posing a data leakage risk. Furthermore, existing schemes do not quantify and constrain key management overhead and re-encryption computational consumption. Policy update processes can easily consume significant system computing power, causing business delays, and may even lead to key storage capacity exceeding the system memory limit. In addition, policy updates rely heavily on manual configuration, which has a high probability of human error, failing to achieve a dynamic balance between security risks and system resource consumption.

[0004] In other words, existing attribute-based encryption technologies offer poor protection for employee privacy data. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for protecting employee privacy data based on attribute-based encryption, in order to solve the technical problem that the protection effect of employee privacy data based on attribute-based encryption is poor in the prior art.

[0006] In a first aspect, one embodiment of the present invention provides a method for protecting employee privacy data based on attribute-based encryption, the method comprising: In response to employee status change events, the system acquires the employee's initial accessible data range, change type, and multi-dimensional access characteristics. The status change event is generated by personnel relocation instructions that trigger dynamic adjustments to permissions. The initial accessible data range characterizes the set of privacy data an employee is authorized to access. The change type characterizes the employee's flow direction within the organizational structure. Multi-dimensional access characteristics include the employee's privacy data semantic features, identity features, and historical behavioral features. Semantic features characterize the sensitivity level and content attributes of privacy data in business scenarios, while identity features characterize the employee's role positioning and data access qualifications. Historical behavioral features characterize the employee's past operational habits and abnormal access tendencies. The sensitivity level of an employee is obtained by analyzing the initial accessible data range, change type, and multidimensional access characteristics. The sensitivity level is used to characterize the potential risk of privacy data leakage for an employee under status change events and the corresponding level of security protection requirements. Based on the sensitivity level and dual constraints, a corresponding target update strategy is matched to execute the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundary between the system resource baseline value and the actual resource usage.

[0007] In one embodiment, the step of analyzing the initial accessible data range, change type, and multidimensional access characteristics to obtain the employee's sensitivity level includes: Based on the initial scope of accessible data, the permission coverage is calculated; whereby the permission coverage is used to characterize the scale of confidential data associated with an employee's permissions. Based on multidimensional access characteristics, an access risk value is calculated; whereby the access risk value is used to characterize the depth of an employee's historical contact with classified data and their proficiency in operating it. Based on the type of change, determine the weight of the change type; whereby the weight of the change type is used to characterize the degree of risk to the continuity of an employee's original permissions caused by changes in the scope of permissions. The sensitivity quantification value is obtained by combining the permission coverage, access risk value and change type weight according to the preset weighting coefficient. Based on the sample size of cumulative state change events, the sensitivity quantification value is mapped to multiple sensitivity levels.

[0008] In one embodiment, the step of calculating permission coverage based on the initial accessible data range includes: Based on the initial accessible data range, calculate the total amount of classified data that employees can access under their corresponding permissions; Obtain the total amount of all classified data. Based on the ratio of the total amount of classified data that employees can access under their corresponding permissions to the total amount of all classified data, obtain the permission coverage.

[0009] In one embodiment, the step of calculating the access risk value based on multidimensional access characteristics includes: Extract historical behavioral features from multidimensional access characteristics to obtain employees' access records of confidential data within a preset historical period; Based on the access records of classified data, identify the highest-level classified data that employees have accessed, and match the classification weight corresponding to the highest-level classified data; Count the cumulative number of times employees access the highest-level confidential data within a preset historical period; Obtain the highest number of single accesses to the highest-level confidential data by all current employees within a preset historical period, and use it as the normalization benchmark value; The access risk value is calculated based on the security level weight, the cumulative number of visits, and the normalized baseline value.

[0010] In one embodiment, the step of determining the change type weight based on the change type includes: Identify the types of employee changes, which include at least permission removal, permission expansion, and permission adjustment. Configure the highest weight for permission-removal type changes; Configure the lowest possible weight for permission expansion-type changes; For permission adjustment changes, obtain information on changes in the employee's accessible security level before and after the change, and determine the corresponding change type weight based on the information on changes in accessible security level.

[0011] In one embodiment, the step of fusing permission coverage, access risk value, and change type weight according to a preset weighting coefficient to obtain a sensitivity quantification value includes: These are preset weighting coefficients corresponding to the allocation of permission coverage, access risk value, and change type weight, respectively; among them, the sum of the weighting coefficients corresponding to permission coverage and access risk value is greater than the weighting coefficient corresponding to change type weight; The sensitivity quantification value is obtained by combining the permission coverage, access risk value, and change type weight with their respective weighting coefficients.

[0012] In one embodiment, the step of mapping sensitivity quantification values ​​to multiple sensitivity levels based on the sample size of cumulative state change events includes: When the sample size of the cumulative state change events is greater than or equal to the preset sample size, clustering is performed based on the sensitivity quantification value to obtain multiple sensitivity levels; among them, the sensitivity levels include low sensitivity level, medium sensitivity level and high sensitivity level; If the sample size of cumulative state change events is less than the preset sample size, a preset static threshold is used to classify the levels, resulting in multiple sensitivity levels.

[0013] In one embodiment, the dual constraints include a key management burden constraint and a re-encryption overhead constraint. The step of matching the corresponding target update strategy based on the sensitivity level and the dual constraints includes: Obtain key management burden constraints and re-encryption overhead constraints; among which, the key management burden constraint is related to the system's key storage capacity, and the re-encryption overhead constraint is related to the available computing power resources during off-peak business periods; For high-sensitivity levels, the full data re-encryption strategy is preferred. If the re-encryption overhead exceeds the preset constraints, the target update strategy is determined from the partial data re-encryption strategy and the access credential update strategy. For medium-sensitivity levels, the local data re-encryption strategy is preferred. If the re-encryption overhead exceeds the preset constraint, the access credential update strategy is determined as the target update strategy. For low-sensitivity levels, the access credential update policy is determined as the target update policy.

[0014] Secondly, another embodiment of the present invention provides an employee privacy data protection system based on attribute-based encryption, the system comprising: The response module is used to respond to employee status change events; The acquisition module is used to acquire the initial accessible data range, change type, and multi-dimensional access characteristics of employees. Among them, the status change event is generated by personnel change instructions that trigger dynamic adjustment of permissions; the initial accessible data range is used to characterize the set of privacy data that employees are authorized to access; the change type is used to characterize the employee's flow direction in the organizational structure; the multi-dimensional access characteristics include the employee's privacy data semantic characteristics, identity characteristics, and historical behavior characteristics. The semantic characteristics are used to characterize the sensitivity level and content attribute numerical results of privacy data in business scenarios; the identity characteristics are used to characterize the employee's role positioning and data access qualifications; and the historical behavior characteristics are used to characterize the employee's past operating habits and abnormal access tendencies. The analysis module is used to analyze the initial accessible data range, change type, and multi-dimensional access characteristics to obtain the employee's sensitivity level. The sensitivity level is used to characterize the potential risk of privacy data leakage for employees under status change events and the corresponding level of security protection requirements. The permission change module is used to match the corresponding target update strategy based on the sensitivity level and dual constraints, and to perform the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundaries between the system resource baseline value and the actual resource usage.

[0015] In one embodiment, the analysis module includes: The calculation module is used to calculate the permission coverage based on the initial accessible data range; whereby the permission coverage is used to characterize the scale of confidential data associated with an employee's permissions; and to calculate the access risk value based on multi-dimensional access characteristics; whereby the access risk value is used to characterize the depth of an employee's historical contact with confidential data and their proficiency in operating it. The determination module is used to determine the change type weight based on the change type; whereby the change type weight is used to characterize the degree of risk to the continuity of an employee's original permissions due to changes in the scope of permissions. The fusion module is used to fuse permission coverage, access risk value and change type weight according to preset weighting coefficients to obtain sensitivity quantification value; The mapping module is used to map sensitivity quantification values ​​to multiple sensitivity levels based on the sample size of cumulative state change events.

[0016] Thirdly, in another embodiment of the present invention, an electronic device is provided, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect.

[0017] Fourthly, in another embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0018] The present invention has the following beneficial effects: This invention uses employee status change events as trigger points to comprehensively collect data access scope, personnel change types, and multi-dimensional access characteristics. It completes risk assessment from the perspectives of data sensitivity, employee identity, and historical operational behavior. The risk assessment dimensions are complete, and the judgment basis is objective, accurately classifying the leakage risk level. Simultaneously, it combines system computing power and memory storage resource constraints to match permission update strategies, abandoning the traditional fixed threshold processing mode. This approach implements differentiated security protection measures for different risk levels, strengthening data security defenses, while strictly controlling system resource load to avoid system lag and memory overflow caused by re-encryption and key updates. While balancing data security protection and system stability, it can adapt to the privacy data protection needs of enterprises of different sizes, thereby improving the effectiveness of attribute-based encryption for protecting employee privacy data. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an employee privacy data protection method based on attribute-based encryption provided in an embodiment of the present invention; Figure 2This is a schematic diagram of the structure of an employee privacy data protection system based on attribute-based encryption provided in an embodiment of the present invention. Detailed Implementation

[0020] The following description, in conjunction with the accompanying drawings, details a specific scheme for an attribute-based encryption-based method for protecting employee privacy data provided by the present invention.

[0021] This invention proposes a method for protecting employee privacy data based on attribute-based encryption. Please refer to [link / reference]. Figure 1 The diagram illustrates a schematic flowchart of an attribute-based encryption-based employee privacy data protection method according to an embodiment of the present invention. The method includes the following steps: Step S1: Respond to employee status change events and obtain the employee's initial accessible data range, change type, and multi-dimensional access characteristics; wherein, the status change event is generated by personnel change instructions that trigger dynamic adjustment of permissions; the initial accessible data range is used to characterize the set of privacy data that the employee is authorized to access; the change type is used to characterize the employee's flow direction in the organizational structure; the multi-dimensional access characteristics include the employee's privacy data semantic characteristics, identity characteristics, and historical behavior characteristics. Semantic characteristics are used to characterize the sensitivity level and content attribute numerical results of privacy data in business scenarios; identity characteristics are used to characterize the employee's role positioning and data access qualifications; historical behavior characteristics are used to characterize the employee's past operating habits and abnormal access tendencies.

[0022] Among them, employee status change events refer to events triggered by personnel change approval instructions in the enterprise's HR system, including employee promotions, job transfers, and resignations, which will cause adjustments to data access permissions. These events are prerequisites for initiating permission and encryption policy updates.

[0023] The initial accessible data scope refers to the overall scale and coverage of all confidential and private data of the enterprise that can be accessed based on the employee's job position, rank, department, and other attributes.

[0024] For example, the change type refers to the form and direction of employee movement within the enterprise's organizational structure, including categories such as resignation, promotion, lateral transfer, and demotion / transfer, which are used to determine the basic leakage risk level in different scenarios.

[0025] Multidimensional access characteristics refer to a set of multidimensional indicators for comprehensively assessing the risk of employee data access, consisting of three parts: privacy data semantic characteristics, identity characteristics, and historical behavior characteristics.

[0026] Semantic features of privacy data refer to the result of numerically converting the business attributes and sensitivity levels of privacy data according to established rules.

[0027] Identity characteristics refer to the role positioning and data access qualifications formed based on employee positions, departments, and job levels, and serve as the basis for ABE encrypted access policy configuration and permission division.

[0028] Historical behavioral characteristics refer to behavioral indicators formed based on employees' long-term data access records, including access frequency, access time period, access data type, etc., which are used to identify routine operating habits and abnormal access tendencies.

[0029] For example, personnel change events can be broken down into two basic elements based on risk impact: the scope of accessible data and the type of personnel change. These can be further subdivided into three categories of access characteristics: semantics, identity, and historical behavior. Clear definitions and representation dimensions for each characteristic are also specified. The risk of employee privacy data leakage is influenced by multiple factors, primarily including data sensitivity level, employee identity and permissions, personnel turnover status, and historical access behavior.

[0030] Step S2: Analyze the initial accessible data range, change type, and multidimensional access characteristics to obtain the employee's sensitivity level; whereby the sensitivity level is used to characterize the potential risk of privacy data leakage for employees under status change events and the corresponding level of security protection requirements.

[0031] Among them, the employee sensitivity level refers to the level result obtained by quantifying the initial accessible data range, change type and multi-dimensional access characteristics. It is divided into three levels: low, medium and high. It intuitively reflects the potential risk of enterprise privacy data leakage after an employee's job / status changes, and at the same time matches different strengths of security protection strategies.

[0032] Privacy data breach refers to the unauthorized acquisition, viewing, or dissemination of sensitive privacy data such as corporate salaries, health information, project materials, and customer information by unauthorized personnel.

[0033] The potential danger level refers to the degree of risk that employees may use their original permissions and keys to steal confidential data after a change in personnel.

[0034] Security protection requirement levels refer to the different levels of security protection measures required, such as key updates, partial re-encryption, and full re-encryption, depending on the level of leakage risk.

[0035] Furthermore, the step of analyzing the initial accessible data range, change type, and multidimensional access characteristics to obtain the employee's sensitivity level includes: Based on the initial scope of accessible data, the permission coverage is calculated; whereby the permission coverage is used to characterize the scale of confidential data associated with an employee's permissions.

[0036] Among them, the access control coverage refers to the metric that quantifies the scope of classified data that employees can access with their existing permissions. It is the ratio of the amount of classified data that employees can access to the total amount of classified data in the enterprise, and is used to measure the overall scale of classified data that employees can access.

[0037] Based on multidimensional access characteristics, an access risk value is calculated; whereby the access risk value is used to characterize the depth of an employee's historical contact with classified data and their proficiency in operating it.

[0038] The access risk value is a quantitative indicator calculated by combining the confidentiality level and access frequency of employee access data. The value range is [0,1], and it is used to assess the level of leakage risk caused by employees accessing confidential data.

[0039] Based on the type of change, determine the weight of the change type; whereby the weight of the change type is used to characterize the degree of risk to the continuity of an employee's original permissions caused by changes in the scope of permissions.

[0040] Among them, the change type weight refers to the value set according to the different types of job changes and permission changes of employees, such as promotion, job transfer, and resignation, to reflect the level of risk of data leakage caused by the continued retention of employees' original access permissions.

[0041] The sensitivity quantification value is obtained by combining the permission coverage, access risk value, and change type weight according to the preset weighting coefficient.

[0042] The sensitivity quantification value is an indicator for comprehensively assessing the risk of employee data breaches. This value is based on three risk dimensions: access coverage, access risk value, and change type weight. It is calculated by weighting these dimensions according to a preset fixed weight ratio, providing a comprehensive and quantitative reflection of the overall data breach risk level for employees whose positions have changed. This provides objective data for subsequently developing tiered security protection and policy update plans.

[0043] Based on the sample size of cumulative state change events, the sensitivity quantification value is mapped to multiple sensitivity levels.

[0044] The sensitivity level refers to the risk level divided by the sensitivity quantification value based on the sample size of employee job change events, combined with clustering algorithms or preset thresholds, and is used to distinguish the leakage risk level of different employees.

[0045] For example, based on the level of risk, they can be divided into three categories: low sensitivity, medium sensitivity, and high sensitivity, corresponding to different security protection strategies.

[0046] For example, by comprehensively assessing the risk of data leakage of employees from three dimensions—data access scope, historical operation behavior, and job change type—it breaks away from the traditional evaluation model, distinguishes the risk differences of employees with different changes, and provides an objective and quantitative basis for subsequent differentiated configuration of encryption strategy update schemes. While ensuring the security of corporate privacy data, it effectively controls the system's computing and storage overhead.

[0047] For example, three independent risk dimensions—access coverage, access risk value, and change type weight—are first calculated separately. Then, they are fused using a fixed weighting coefficient to obtain a comprehensive sensitivity quantification value. Finally, based on the number of job change event samples, a preset threshold or K-Means clustering algorithm is used to classify the quantification value into three sensitivity levels: low, medium, and high. This calculation method is adopted because the risk of employee data leakage is jointly determined by the scale of accessible data, historical contact, and the nature of job change. Each of the three indicators has its own risk emphasis, and the weighted fusion can take into account the impact of each dimension. Combining the sample size with dynamic classification of levels can adapt to the actual scenario of personnel changes in enterprises and avoid rigid classification standards.

[0048] It should be noted that, in the embodiments of the present invention, the multi-dimensional indicator decomposition makes risk assessment no longer dependent on subjective judgment, realizing risk quantification and standardization of the assessment process; the weighted allocation of weights is in line with the degree of influence of each factor on the leakage risk, ensuring the accuracy and reliability of the assessment results; combined with the dynamic update of the level classification rules based on the sample size, it can adapt to changes in enterprise personnel structure and security needs in the long term, and finally lay a solid foundation for subsequent differentiated selection of encryption strategy update methods, achieving a dynamic balance between security protection and system operating overhead.

[0049] Furthermore, the step of calculating permission coverage based on the initial accessible data range includes: Based on the initial accessible data range, calculate the total amount of classified data that employees can access under their corresponding permissions.

[0050] For example, based on the employee's initial permissions and the corresponding scope of accessible data before personnel changes, the total size and amount of all confidential data that employees can legally access under the existing permission rules are calculated by traversing all types of confidential resources within the enterprise.

[0051] Obtain the total amount of all classified data. Based on the ratio of the total amount of classified data that employees can access under their corresponding permissions to the total amount of all classified data, obtain the permission coverage.

[0052] In this context, permissions refer to the access rights that an enterprise assigns to employees based on their attributes, granting them the ability to read and manipulate corresponding confidential data.

[0053] Confidential data refers to internal corporate data that includes employee privacy, business information, core technologies, etc., and requires encryption protection and restricted access by unauthorized personnel.

[0054] The total amount of classified data refers to the overall capacity of all data within an enterprise that is marked as classified and is subject to privacy protection system control.

[0055] For example, the ratio calculation is used because the total size of confidential data varies greatly among different enterprises. It is impossible to compare the risk level horizontally by simply relying on the absolute size of the data. The normalized ratio can eliminate the interference caused by the difference in data volume, unify the evaluation criteria, and make the scope of permissions of different employees comparable.

[0056] It should be noted that calculating permission coverage by ratio can intuitively and quantitatively measure the scope of confidential data access corresponding to employee permissions, accurately determine the potential data leakage impact after employee changes, and provide objective data basis for subsequent classification of leakage risk levels and selection of appropriate encryption strategy update schemes, avoiding subjective risk assessment.

[0057] Furthermore, the step of calculating the access risk value based on multidimensional access characteristics includes: Historical behavioral features are extracted from multidimensional access features to obtain employees' access records of confidential data within a preset historical period.

[0058] The preset historical period (e.g., 180 days) refers to the fixed time range for collecting and statistically analyzing employee access records.

[0059] Access logs for classified data refer to the complete logs of employees accessing classified and private data of the enterprise, which are stored in the log system and include information such as the access level, time, and number of times.

[0060] Based on the access records of classified data, identify the highest-level classified data that employees have accessed, and match the classification weight corresponding to the highest-level classified data.

[0061] Among them, the highest level of confidentiality data refers to the enterprise confidential data with the highest security level that the employee has accessed within a preset period.

[0062] For example, the security classification weight refers to the quantitative value that an enterprise assigns to the security classification of data. The weights for public, internal, secret, confidential, and top secret are 1, 2, 3, 4, and 5, respectively.

[0063] The system tracks the cumulative number of times employees access the highest-level confidential data within a preset historical period.

[0064] The cumulative number of visits refers to the total frequency of an employee's access to the highest-level confidential data within a preset period.

[0065] Obtain the highest number of single accesses to the highest-level confidential data by all current employees within a preset historical period, and use it as the normalization baseline value.

[0066] The normalized baseline value refers to the maximum number of times all employees access the highest-level confidential data within a preset period, which is used to constrain the calculation results to a uniform numerical range.

[0067] The access risk value is calculated based on the security level weight, the cumulative number of visits, and the normalized baseline value.

[0068] For example, firstly, the highest security level accessed by an employee is identified from their access records over the past 6 months, and then the density weight corresponding to that security level is determined (denoted as ). At the same time, the cumulative number of times the employee accessed this highest-level confidential data is counted (denoted as...). Then, in all employees' access logs, find the maximum number of times the same highest-level confidential data was accessed within the past 6 months, and use this as the normalization baseline (denoted as ). ).

[0069] For example, access risk value It can be represented as: in, Indicates dense weights, This indicates the total number of visits. 5 represents the normalized baseline value, and 5 represents the security level weight corresponding to the top-secret data.

[0070] It should be noted that, in the embodiments of the present invention, the numerator represents the individual risk score of the employee, that is, the higher the security level of the visit and the more times it is accessed, the higher the risk score; the denominator is used as a normalization factor, which compares the individual risk score with the theoretical maximum risk value to finally obtain a relative risk assessment value normalized to the [0,1] interval.

[0071] For example, on the one hand, risk is quantified by two dimensions: security level and access frequency, taking into account both the confidentiality level of the data itself and the degree of contact with employees, making the risk assessment more comprehensive; on the other hand, normalization processing eliminates the impact of differences in data volume and access base, making the risk value standard uniform, which can be directly used for subsequent employee sensitivity weighted calculation and risk level classification, and also facilitates the system to automatically identify high-risk personnel and support the adaptive selection of encryption strategies.

[0072] Furthermore, the step of determining the weight of the change type based on the change type includes: Identify the types of employee changes, which include at least permission removal, permission expansion, and permission adjustment changes.

[0073] Among them, permission-removal changes refer to personnel changes such as employees leaving the company or being transferred to positions with no access to confidential information, in which the original data access permissions are completely revoked.

[0074] Changes involving expanded access permissions refer to personnel changes such as employee promotions or transfers to higher-permission positions, which expand the scope and level of data access compared to before the change.

[0075] Changes related to access permissions refer to personnel changes other than the removal or expansion of permissions. This mainly refers to situations where the access level of data an employee can access decreases or remains unchanged after a job transfer.

[0076] Configure the highest weight for change types that involve removing permissions.

[0077] For example, for personnel changes such as employee departures that completely revoke existing data access permissions, the maximum weight for the change type is configured based on risk level rules. This setting stems from the fact that such personnel are no longer bound by company policies, and the risk of data leakage is far higher than other change types such as job transfers or promotions, thus highlighting their risk priority.

[0078] Configure the lowest possible weight for permission expansion-type changes.

[0079] For example, for personnel change events such as promotions that expand access permissions, the lowest change type weight is configured according to the risk classification standard to objectively reflect the degree of leakage risk caused by the retention of original permissions in this scenario, and to provide reliable parameters for subsequent overall sensitivity quantification calculation.

[0080] For permission adjustment changes, obtain information on changes in the employee's accessible security level before and after the change, and determine the corresponding change type weight based on the information on changes in accessible security level.

[0081] For example, to achieve a quantitative assessment of change risks, a mapping table between data security levels and change type weights is pre-established, converting qualitative security information into calculable quantitative values. Specifically, the system assigns weights to security levels based on data sensitivity; for example, public data is assigned a weight of 1, internal data a weight of 2, secret data a weight of 3, confidential data a weight of 4, and top secret data (the highest security level weight) a weight of 5. Based on this, when a change in employee position is detected, the system obtains the value corresponding to the highest accessible security level before the employee's change as the security level weight accessible before the job transfer. The highest accessible security level after the change will be used as the security level weight for the job transfer. This provides standardized input parameters for subsequent calculation of change type weights.

[0082] For example, for departing employees (removal of permissions), considering their departure from organizational oversight and the potential presence of sensitive historical data, posing a high risk of privacy breaches, the corresponding change type weight is set to the highest value of 1. For regular job transfers (permission adjustment), the risk level depends on the relative change in the security level weight before and after the transfer: when the security level remains the same before and after the transfer (i.e., a lateral transfer), it is considered a standard change scenario, with a baseline weight of 0.2; simultaneously, a linear adjustment mechanism is introduced, stipulating that the weight difference step between adjacent security levels is 0.2, meaning that for every decrease in the employee's accessible security level, the psychological gap or motivation for violation due to loss of authority may increase, and the risk weight increases accordingly; conversely, if the security level increases (usually corresponding to promotion or increased trust), the risk weight is maintained at a lower level of 0.1.

[0083] For example, change type weight It can be represented as: in, This indicates the security level weight that can be accessed before the job transfer. This indicates the security level weight that can be accessed after the job transfer.

[0084] Among them, the information on changes in accessibility classification refers to the difference in the classification weight of data that employees can access before and after the change. The classification weight corresponds to five levels from public to top secret, and the larger the value, the higher the degree of data confidentiality.

[0085] For example, by differentiating the weights according to the risk of leakage caused by employee changes, the risk levels of different change scenarios can be distinguished, providing a reliable basis for subsequent quantitative calculation of the overall leakage sensitivity of employees. This allows the data security protection strategy to match the actual risk level, and reasonably control the system operation and maintenance costs while protecting the security of corporate privacy data.

[0086] It should be noted that personnel whose permissions are revoked due to resignation or other reasons are no longer subject to corporate management constraints, and therefore face the highest risk of data leakage; personnel whose permissions are expanded due to promotion or other reasons are subject to corporate system control and only have new access permissions added, and therefore face the lowest risk of leakage of existing data; the risk for ordinary personnel who are transferred to other positions increases as the level of confidentiality they can access decreases, and different weights can be used to reflect the real risk patterns of different change scenarios.

[0087] Further, the step of fusing the permission coverage, access risk value, and change type weight according to a preset weighting coefficient to obtain a sensitivity quantification value includes: These are preset weighting coefficients corresponding to the allocation of permission coverage, access risk value, and change type weight, respectively; among them, the sum of the weighting coefficients corresponding to permission coverage and access risk value is greater than the weighting coefficient corresponding to change type weight.

[0088] The weighting coefficient refers to the pre-set weight values ​​used to distinguish the degree of impact of the three types of risk indicators on the overall leakage risk.

[0089] The sensitivity quantification value is obtained by combining the permission coverage, access risk value, and change type weight with their respective weighting coefficients.

[0090] For example, by comprehensively considering the risk characteristics of three dimensions—access coverage, access risk value, and change type weight—and configuring exclusive weighting coefficients according to the importance of each indicator, the values ​​of each indicator are weighted and integrated with the corresponding coefficients to obtain a sensitivity quantification value that can comprehensively measure the risk of employee leakage.

[0091] It should be noted that, in the embodiments of the present invention, weighting coefficients are configured differently for different risk indicators, and a weighted fusion method is used to calculate the sensitivity quantification value. This highlights the leading role of the two risk factors of permission coverage and access behavior, while taking into account the auxiliary impact of personnel change types. This can objectively and comprehensively quantify the risk of employee privacy leakage, and provide numerical basis for subsequent selection of encryption strategy update schemes based on different levels.

[0092] Furthermore, the step of mapping the sensitivity quantification value to multiple sensitivity levels based on the sample size of cumulative state change events includes: When the sample size of cumulative state change events is greater than or equal to the preset sample size, clustering is performed based on the sensitivity quantification value to obtain multiple sensitivity levels; among them, the sensitivity levels include low sensitivity level, medium sensitivity level and high sensitivity level.

[0093] The sample size refers to the total number of employee status change events recorded by the system.

[0094] The preset sample size refers to the threshold number of events set in advance by the system (e.g., 20 events).

[0095] Clustering refers to using the K-Means algorithm to classify sensitivity quantification values ​​and automatically divide data intervals.

[0096] If the sample size of cumulative state change events is less than the preset sample size, a preset static threshold is used to classify the levels, resulting in multiple sensitivity levels.

[0097] Among them, the preset static threshold refers to the fixed numerical standard set in advance at the initial stage of system launch.

[0098] For example, in the initial stage of system deployment, if the cumulative number of employee change events is less than 20, 0.3 and 0.7 will be temporarily used as sensitivity level thresholds. Specifically: a sensitivity value less than 0.3 indicates low sensitivity, a sensitivity value greater than or equal to 0.3 and less than 0.7 indicates medium sensitivity, and a sensitivity value greater than or equal to 0.7 indicates high sensitivity. Once the cumulative number of change events reaches 20, the system will automatically perform cluster analysis and update the grading thresholds to adapt the grading rules to the enterprise's personnel structure and data security management requirements.

[0099] The classification of sensitivity levels refers to the process of categorizing sensitivity quantification values ​​into different sensitivity levels according to corresponding rules.

[0100] It should be noted that, in the embodiments of the present invention, the segmented classification rule takes into account the usage needs of different operating stages of the system. In the early stage of the system, the risk classification is quickly completed by relying on static thresholds to ensure the normal operation of the functions. After accumulating a sufficient number of samples, the risk distribution of the actual personnel in the enterprise is dynamically adapted through clustering algorithms, so that the classification standard is more in line with the real scenario and the accuracy of risk judgment is improved.

[0101] Step S3: Match the corresponding target update strategy based on the sensitivity level and dual constraints, and execute the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundary between the system resource baseline value and the actual resource usage.

[0102] The dual constraints include key management burden constraints and re-encryption overhead constraints. Based on benchmark parameters such as system memory and computing power, the upper limit of resource usage for key storage and data re-encryption is defined, thus defining the operational boundaries of system computing power and performance.

[0103] The target update strategy refers to the permission and encryption policy update scheme that is matched by combining the employee's sensitivity level and system resource constraints. It is divided into three categories: access credential update, partial data re-encryption, and full data re-encryption.

[0104] Permission change operations refer to specific actions performed according to the selected update strategy, including revoking / generating private keys, reencrypting partial or all classified data, and setting key validity periods.

[0105] For example, first determine the sensitivity level of each employee, then calculate the current key storage occupancy rate and the proportion of time spent on re-encryption. Compare this with the dual constraints of memory and computing power thresholds, and according to the predetermined priority of high, medium, and low sensitivity levels, sequentially match three strategies: full re-encryption, partial re-encryption, and key update. Simultaneously, when key storage is nearing its limit, the simple key update scheme is forcibly abandoned. Because different sensitivity levels correspond to different security protection requirements, and system memory and computing power have fixed capacity limits, both must be considered together. Resources cannot be consumed indiscriminately in pursuit of security, nor can security protection be weakened to save resources.

[0106] It should be noted that, in the embodiments of the present invention, by combining the employee risk level with the system resource boundary matching update strategy, differentiated security protection is implemented for different leakage risks, while strictly controlling the usage range of server computing power and memory to avoid system lag or memory overflow caused by re-encryption and key expansion. Under the premise of ensuring the security of employee privacy data, a balance is achieved between security protection and stable system operation.

[0107] Furthermore, the dual constraints include key management burden constraints and re-encryption overhead constraints. The step of matching the corresponding target update strategy based on the sensitivity level and the dual constraints includes: Obtain key management burden constraints and re-encryption overhead constraints; among which, the key management burden constraint is related to the system's key storage capacity, and the re-encryption overhead constraint is related to the available computing power resources during off-peak business periods.

[0108] Among them, the key management burden constraint refers to the restriction condition that controls the key storage occupancy rate by using the maximum memory of the system key storage as the upper limit, in order to prevent memory overflow caused by an excessive number of keys.

[0109] The re-encryption overhead constraint refers to the condition that limits the proportion of time spent on re-encryption tasks based on the maximum re-encryption time available during off-peak business periods, so as to avoid consuming computing power for normal business operations.

[0110] System key storage margin refers to the maximum memory allocated to key storage by the system, minus the space already used, and the remaining storage capacity.

[0111] Off-peak business periods refer to the time when a company's business traffic is extremely low and its computing power is largely idle. These are also the main periods when the system performs re-encryption tasks.

[0112] Available computing resources refer to the server computing power and duration that can be allocated to data re-encryption operations during off-peak business periods.

[0113] For high-sensitivity levels, the full data re-encryption strategy is preferred. If the re-encryption overhead exceeds the preset constraints, the target update strategy is determined from the partial data re-encryption strategy and the access credential update strategy.

[0114] For example, for high sensitivity levels, the system prioritizes a full data re-encryption strategy. When the overhead of full re-encryption exceeds preset constraints, the system will initiate tiered degradation logic to determine the final target update strategy.

[0115] First, the system will attempt to downgrade to a local data re-encryption strategy. Specifically, the system will calculate the overhead required to execute the local data re-encryption strategy and determine whether it meets the preset re-encryption overhead constraint. If it does, the local data re-encryption strategy will be selected as the target update strategy.

[0116] If the conditions are not met, the system will temporarily adopt the access credential update strategy as the target update strategy. In this case, the system will immediately initiate an asynchronous compensation process, which will split the employee's accessible data into multiple batches and complete the partial data re-encryption in batches during several consecutive off-peak business periods, while setting the validity period of the original access credentials (e.g., 24 hours) to ensure that the policy update of all data is completed before the credentials expire, thereby ultimately achieving data security while ensuring business continuity.

[0117] The "high sensitivity level" refers to a level where the risk of employee disclosure is extremely high (e.g., a sensitivity value greater than or equal to 0.7).

[0118] The full data re-encryption strategy refers to the method of re-encrypting all confidential data of an enterprise and updating the global access policy, which has the highest level of security.

[0119] Preset constraints refer to the threshold for the proportion of re-encryption time set in advance by the system (based on experience, the usual preset value is 0.5).

[0120] The partial data re-encryption strategy refers to re-encrypting only the confidential data that the changed employees originally had access to. The security and overhead are at a moderate level.

[0121] Access credential update policy, also known as key update policy, revoks the old private key and generates a new one, without re-encrypting data, resulting in minimal system overhead.

[0122] For medium-sensitivity levels, the local data re-encryption strategy is preferred. If the re-encryption overhead exceeds the preset constraints, the access credential update strategy is determined as the target update strategy.

[0123] The medium sensitivity level refers to a level where the risk of employee disclosure is moderate (e.g., a sensitivity value between 0.3 and 0.7).

[0124] For low-sensitivity levels, the access credential update policy is determined as the target update policy.

[0125] The low sensitivity level refers to a level where the risk of employee disclosure is low (e.g., sensitivity value less than 0.3).

[0126] For example, the constraints of key storage and re-encryption time are extracted first, and then a strategy is matched step by step according to the employee's sensitivity level: high sensitivity is given priority for full re-encryption, and if the limit is exceeded, it is downgraded to partial re-encryption and key update in turn; medium sensitivity is given priority for partial re-encryption, and if the limit is exceeded, key update is used instead; low sensitivity is directly used for key update. This hierarchical selection logic is adopted because different sensitivity levels correspond to different leakage risks and need to be matched with corresponding security level strategies. At the same time, key storage and computing power are hard boundaries for system operation and must be used as pre-judgment conditions to avoid failures such as memory overflow and business lag during strategy execution.

[0127] It should be noted that, in the embodiments of the present invention, by combining the two hard constraints of key storage and computing resources, a differentiated update strategy is matched according to the sensitivity level of employees. This not only ensures the corresponding security protection strength based on the level of leakage risk, but also strictly controls the system storage and computing power consumption, thereby achieving a dynamic balance between data security, system load and normal business operation. At the same time, it standardizes and automates the strategy selection process, reducing the error rate of human operation.

[0128] In summary, this invention uses employee status change events as trigger points to comprehensively collect data access scope, personnel change types, and multi-dimensional access characteristics. It completes risk assessment from the perspectives of data sensitivity, employee identity, and historical operational behavior. The risk assessment dimensions are complete, and the judgment basis is objective, accurately classifying the leakage risk level. Simultaneously, it combines system computing power and memory storage constraints to match permission update strategies, abandoning the traditional fixed threshold processing mode. This approach implements differentiated security protection measures for different risk levels, strengthening data security defenses, while strictly controlling system resource load to avoid system lag and memory overflow caused by re-encryption and key updates. While balancing data security protection and system stability, it can adapt to the privacy data protection needs of enterprises of different sizes, thereby improving the effectiveness of attribute-based encryption for protecting employee privacy data.

[0129] This invention proposes an employee privacy data protection system based on attribute-based encryption. Please refer to [link / reference]. Figure 2 The diagram illustrates a structural schematic of an attribute-based encryption-based employee privacy data protection system 200 according to an embodiment of the present invention. The system includes: Response module 201 is used to respond to employee status change events; The acquisition module 202 is used to acquire the initial accessible data range, change type, and multi-dimensional access characteristics of employees. Among them, the status change event is generated by personnel change instructions that trigger dynamic adjustment of permissions; the initial accessible data range is used to characterize the set of privacy data that employees are authorized to access; the change type is used to characterize the employee's flow direction in the organizational structure; the multi-dimensional access characteristics include the employee's privacy data semantic characteristics, identity characteristics, and historical behavior characteristics. The semantic characteristics are used to characterize the sensitivity level and content attribute numerical results of privacy data in business scenarios; the identity characteristics are used to characterize the employee's role positioning and data access qualifications; and the historical behavior characteristics are used to characterize the employee's past operating habits and abnormal access tendencies. Analysis module 203 is used to analyze the initial accessible data range, change type, and multi-dimensional access characteristics to obtain the employee's sensitivity level; wherein, the sensitivity level is used to characterize the potential risk of privacy data leakage of employees under status change events and the corresponding level of security protection requirements. The permission change module 204 is used to match the corresponding target update strategy based on the sensitivity level and dual constraints, so as to perform the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundary between the system resource baseline value and the actual resource usage.

[0130] In one embodiment, the analysis module 203 includes: The calculation module is used to calculate the permission coverage based on the initial accessible data range; whereby the permission coverage is used to characterize the scale of confidential data associated with an employee's permissions; and to calculate the access risk value based on multi-dimensional access characteristics; whereby the access risk value is used to characterize the depth of an employee's historical contact with confidential data and their proficiency in operating it. The determination module is used to determine the change type weight based on the change type; whereby the change type weight is used to characterize the degree of risk to the continuity of an employee's original permissions due to changes in the scope of permissions. The fusion module is used to fuse permission coverage, access risk value and change type weight according to preset weighting coefficients to obtain sensitivity quantification value; The mapping module is used to map sensitivity quantification values ​​to multiple sensitivity levels based on the sample size of cumulative state change events.

[0131] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the employee privacy data protection system based on attribute-based encryption and the employee privacy data protection method based on attribute-based encryption provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiment, which will not be repeated here.

Claims

1. A method for protecting employee privacy data based on attribute-based encryption, characterized in that, The method includes: In response to employee status change events, the system acquires the employee's initial accessible data range, change type, and multi-dimensional access characteristics. The status change event is generated by a personnel change instruction that triggers dynamic permission adjustments. The initial accessible data range characterizes the set of privacy data the employee is authorized to access. The change type characterizes the employee's flow direction within the organizational structure. The multi-dimensional access characteristics include the employee's privacy data semantic features, identity features, and historical behavioral features. The semantic features characterize the sensitivity level and content attributes of the privacy data in the business scenario, and the identity features characterize the employee's role positioning and data access qualifications. The historical behavioral features characterize the employee's past operating habits and abnormal access tendencies. The initial accessible data range, the change type, and the multidimensional access characteristics are analyzed to obtain the employee's sensitivity level; wherein, the sensitivity level is used to characterize the potential risk of privacy data leakage of the employee under the state change event and the corresponding level of security protection requirements; Based on the sensitivity level and the dual constraints, a corresponding target update strategy is matched to perform the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundary between the system resource baseline value and the actual resource occupancy.

2. The employee privacy data protection method based on attribute-based encryption according to claim 1, characterized in that, The step of analyzing the initial accessible data range, the type of change, and the multidimensional access characteristics to obtain the employee's sensitivity level includes: Based on the initial accessible data range, the permission coverage is calculated; wherein, the permission coverage is used to characterize the scale of confidential data associated with the employee based on permissions; Based on the multidimensional access characteristics, an access risk value is calculated; wherein, the access risk value is used to characterize the employee's historical depth of contact with and proficiency in operating classified data; Based on the change type, a change type weight is determined; wherein, the change type weight is used to characterize the degree of risk to the continuity of the employee's original permissions caused by the change in the scope of permissions. The permission coverage, the access risk value, and the change type weight are fused together according to a preset weighting coefficient to obtain a sensitivity quantification value; Based on the sample size of cumulative state change events, the sensitivity quantification value is mapped to multiple sensitivity levels.

3. The employee privacy data protection method based on attribute-based encryption according to claim 2, characterized in that, The step of calculating permission coverage based on the initial accessible data range includes: Based on the initial accessible data range, the total amount of confidential data that the employee can access under the corresponding permissions is calculated. Obtain the total amount of all classified data, and obtain the permission coverage based on the ratio of the total amount of classified data that the employee can access under the corresponding permissions to the total amount of all classified data.

4. The employee privacy data protection method based on attribute-based encryption according to claim 2, characterized in that, The step of calculating the access risk value based on the multidimensional access characteristics includes: Extract the historical behavior features from the multidimensional access features to obtain the employee's confidential data access records within a preset historical period; Based on the access records of the classified data, identify the highest-level classified data accessed by the employee, and match the classification weight corresponding to the highest-level classified data; The number of times the employee accessed the highest-level confidential data within the preset historical period is counted. The highest number of single accesses to the highest-security-level data by all current employees within the preset historical period is obtained and used as a normalized baseline value. The access risk value is calculated based on the security level weight, the cumulative number of visits, and the normalized baseline value.

5. The employee privacy data protection method based on attribute-based encryption according to claim 2, characterized in that, The step of determining the change type weight based on the change type includes: Identify the types of changes to the employee, including at least permission removal, permission expansion, and permission adjustment. Configure the highest change type weight for the aforementioned permission removal type changes; For the aforementioned permission expansion type changes, configure the lowest possible change type weight; For the aforementioned permission adjustment type change, obtain the employee's access security level change information before and after the change, and determine the corresponding change type weight based on the access security level change information.

6. The employee privacy data protection method based on attribute-based encryption according to claim 2, characterized in that, The step of fusing the permission coverage, the access risk value, and the change type weight according to a preset weighting coefficient to obtain a sensitivity quantification value includes: These are preset weighting coefficients corresponding to the permission coverage, the access risk value, and the change type weight, respectively; wherein the sum of the weighting coefficients corresponding to the permission coverage and the access risk value is greater than the weighting coefficient corresponding to the change type weight; The sensitivity quantification value is obtained by fusing the permission coverage, the access risk value, and the change type weight with their respective weighting coefficients.

7. The employee privacy data protection method based on attribute-based encryption according to claim 2, characterized in that, The step of mapping the sensitivity quantification value to multiple sensitivity levels based on the sample size of cumulative state change events includes: If the sample size of the cumulative state change events is greater than or equal to the preset sample size, clustering is performed based on the sensitivity quantification value to obtain multiple sensitivity levels; wherein, the sensitivity levels include low sensitivity level, medium sensitivity level and high sensitivity level; If the sample size of the cumulative state change events is less than the preset sample size, a preset static threshold is used to classify the levels, resulting in multiple sensitivity levels.

8. The employee privacy data protection method based on attribute-based encryption according to claim 7, characterized in that, The dual constraints include key management burden constraints and re-encryption overhead constraints. The step of matching the corresponding target update strategy based on the sensitivity level and the dual constraints includes: Obtain the key management burden constraint and the re-encryption overhead constraint; wherein, the key management burden constraint is related to the system key storage capacity, and the re-encryption overhead constraint is related to the available computing power resources during off-peak business periods; For the high sensitivity level, the full data re-encryption strategy is preferred. If the re-encryption overhead constraint exceeds the preset constraint, the target update strategy is determined from the local data re-encryption strategy and the access credential update strategy. For the medium sensitivity level, the local data re-encryption strategy is preferred. If the re-encryption overhead constraint exceeds the preset constraint, the access credential update strategy is determined as the target update strategy. For the low sensitivity level, the access credential update strategy is determined as the target update strategy.

9. An employee privacy data protection system based on attribute-based encryption, characterized in that, The system includes: The response module is used to respond to employee status change events; The acquisition module is used to acquire the initial accessible data range, change type, and multi-dimensional access characteristics of an employee. The status change event is generated by a personnel change instruction that triggers dynamic adjustment of permissions. The initial accessible data range represents the set of privacy data that the employee is authorized to access. The change type represents the employee's flow direction within the organizational structure. The multi-dimensional access characteristics include the employee's privacy data semantic features, identity features, and historical behavioral features. The semantic features represent the sensitivity level and content attribute numerical results of the privacy data in the business scenario. The identity features represent the employee's role positioning and data access qualifications. The historical behavioral features represent the employee's past operating habits and abnormal access tendencies. The analysis module is used to analyze the initial accessible data range, the change type, and the multidimensional access characteristics to obtain the employee's sensitivity level; wherein, the sensitivity level is used to characterize the potential risk of privacy data leakage for the employee under the state change event and the corresponding security protection requirement level; The permission change module is used to match the corresponding target update strategy based on the sensitivity level and the dual constraints, so as to perform the corresponding permission change operation according to the target update strategy; wherein, the dual constraints are used to characterize the computing power and performance boundary between the system resource baseline value and the actual resource usage.

10. The employee privacy data protection system based on attribute-based encryption according to claim 9, characterized in that, The analysis module includes: The calculation module is used to calculate the permission coverage based on the initial accessible data range; wherein the permission coverage is used to characterize the scale of confidential data associated with the employee based on permissions; and to calculate the access risk value based on the multi-dimensional access characteristics; wherein the access risk value is used to characterize the employee's historical depth of contact with confidential data and proficiency in operating it. The determination module is used to determine the change type weight based on the change type; wherein the change type weight is used to characterize the degree of risk to the continuity of the employee's original permissions caused by the change in the scope of permissions; The fusion module is used to fuse the permission coverage, the access risk value, and the change type weight according to a preset weighting coefficient to obtain a sensitivity quantification value. The mapping module is used to map the sensitivity quantification value into multiple sensitivity levels based on the sample size of cumulative state change events.

Images