Air passenger-based data encryption processing method and system

Abstract

The application discloses an aviation passenger-based data encryption processing method and system, and relates to the technical field of aviation passenger data encryption processing. The method comprises the following steps: collecting passenger data of aviation passengers, classifying the passenger data according to data attributes of the passenger data to obtain a plurality of unit data; acquiring a transmission node of the passenger data, collecting node calling information of the transmission node, and determining a transmission path of the unit data according to the node calling information; determining the encryption strength corresponding to the unit data according to the transmission path, and sequentially arranging the encryption strength from high to low to obtain a strength sequence; collecting interaction information between the transmission paths, and sequentially matching the unit data with corresponding encryption modes according to the strength sequence and the interaction information; and performing encryption processing on all the unit data with the determined encryption modes according to the respective corresponding encryption modes. The application improves the dynamic adaptability of aviation passenger-based data encryption processing.

Description

Technical Field

[0001] This application relates to the technical field of encrypted processing of air passenger data, and in particular to methods and systems for encrypted processing of air passenger data. Background Technology

[0002] With the rapid development of the aviation industry, air passenger data is experiencing massive growth and increasing complexity, involving sensitive content with multiple attributes such as identity information, travel records, and payment data. Current mainstream data encryption methods mostly employ static, uniform encryption strategies, which are ill-suited to the complex scenarios of frequent data transfer between heterogeneous transmission nodes, varying call precision, and dynamic path changes. On the one hand, existing technologies lack fine-grained awareness of data attribute differences and transmission node call behavior, easily leading to over-encryption of low-sensitivity data and under-encryption of high-sensitivity data, resulting in both resource waste and security risks. On the other hand, traditional encryption methods are often isolated, failing to consider the risk of collaborative leakage arising from the reuse of encryption methods at shared transmission paths or intersection nodes. For example, an attack on a node could lead to the leakage of multiple data streams. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for encrypting data of air passengers, so as to solve the problems mentioned in the background art.

[0004] Firstly, the data encryption processing method for air passengers provided in this application adopts the following technical solution: Collect passenger data from air travelers, classify the passenger data according to its data attributes, and obtain multiple data units; The system acquires the transmission nodes for passenger data, collects node call information for these transmission nodes, and determines the transmission path for unit data based on the node call information. The encryption strength of the unit data is determined according to the transmission path, and the encryption strength is sorted from high to low to obtain the strength order; Collect the interaction information between transmission paths, and match the corresponding encryption method for the unit data according to the strength order and interaction information; All data units with determined encryption methods will be encrypted according to their respective encryption methods.

[0005] Preferably, the steps of acquiring passenger data transmission nodes, collecting node call information of transmission nodes, and determining the transmission path of unit data based on node call information are as follows: Obtain node call information for each transmission node, including data call precision, data call type, and data call frequency; Determine whether the transmission node calls unit data based on the data call type. If unit data is called, collect the call content corresponding to the unit data based on the node call information. Determine whether the content to be called can only be obtained from the unit data. If it can only be obtained from the unit data, then determine whether the data precision of the content to be called is completely consistent with the data precision of the unit data. If they are completely identical, then the transmission node is determined to be a circulation node; otherwise, the transmission node is not a circulation node. If it is not only obtainable from unit data, then collect the reasoning information from the unit data; The circulation necessity index of the transmission node is obtained based on the reasoning information and data call frequency, and the transmission node is determined as a circulation node based on the circulation necessity index. By statistically analyzing all circulation nodes and their corresponding order, a transmission path is formed for each unit of data.

[0006] Preferably, the step of obtaining the circulation necessity index of a transmission node based on inference information and data call frequency, and determining whether a transmission node is a circulation node based on the circulation necessity index, specifically includes: Based on the inference information, the unit inference data associated with the unit data is obtained, and the unit inference data called by the transmission node is collected according to the data call type and recorded as inference call data; The probability that the inference call data will use the transmission node as the circulation node is estimated and recorded as the inference circulation probability; The reasoning accuracy of the unit data is estimated based on the reasoning call data, and the reasoning index is determined by combining the reasoning circulation probability. Collect historical call timestamps of inference call data at the transmission node, calculate the time difference between the historical arrival time of inference call data and the call time of unit data, and generate a time series matching index based on the time difference; A call frequency index is generated based on the data call frequency of the inference call data. The circulation necessity index is generated based on the inference index, timing matching index, and call frequency index. The relationship between the circulation necessity index and the preset necessity index threshold is used to determine whether the transmission node is a circulation node.

[0007] Preferably, the step of estimating the inference accuracy of unit data based on inference call data and determining the inference index by combining the inference circulation probability is as follows: Obtain at least two inference call data and their corresponding inference flow probabilities, and combine the inference call data into at least two different inference data combinations; For each inference data combination, the product of the inference flow probabilities of all inference call data in the combination is taken as the joint flow probability of the combination, and the inference accuracy of the combination for the unit data is obtained. The product of the joint circulation probability and the inference accuracy is used as the inference index of the combination. Select the combination with the highest inference index among all combinations, and use the inference index of that combination as the final inference index.

[0008] Preferably, the step of determining the encryption strength corresponding to the unit data based on the transmission path, and sorting the encryption strengths from high to low to obtain the strength order, specifically involves: Obtain all transmission nodes included in the transmission path of the unit data, and collect the node type, node security level, node historical leakage count and node geographical location of each transmission node; Calculate the link risk value for each link segment based on the transmission distance between adjacent nodes in the transmission path and the type of transmission medium. Determine whether the transmission node is a data aggregation node based on the node type. If it is a data aggregation node, generate an aggregation risk increment based on the number of unit data aggregated by the node. The system determines whether a transmission node crosses a geographical boundary based on its geographical location. If it does, it generates a cross-border risk increment based on the type of geographical boundary it crosses. The cumulative risk value of the path nodes is calculated based on the node security level and the number of historical leaks of all transmission nodes. Calculate the cumulative path link risk value based on the link risk value of each link segment; The encryption strength is obtained by summing the cumulative values ​​of path node risks, path link risks, convergence risk increments, and cross-border risk increments.

[0009] Preferably, the step of collecting interaction information between transmission paths and matching the corresponding encryption method for the unit data according to the strength order and interaction information is as follows: Obtain the encrypted data with a determined encryption method and the corresponding selected encryption method, and determine whether there is encrypted data between the data in the current unit; If there is no previously encrypted data in the current cell, then select the encryption method with the smallest difference from the preset encryption methods, provided that the encryption strength is not lower than the required encryption strength of the current cell data. If there is encrypted data, the path interaction information between the transmission path of the current unit data and the transmission path of each encrypted data is collected. The path interaction information includes the number of intersecting nodes, the data mixing status at the intersecting nodes, historical leakage records, and time arrival difference. Based on the path interaction information, assess the risk of collaborative leakage if the same encryption method as the already encrypted data is used, which could lead to the leakage of the current unit's data due to the cracking of the already encrypted data. Iterate through all selected and idle encryption methods, and calculate the comprehensive leakage risk value for each encryption method. The comprehensive leakage risk value is obtained by combining the basic security value of the encryption method itself with the collaborative leakage risk value. The encryption method with the lowest overall risk of leakage is selected as the matching encryption method for the current unit data.

[0010] Preferably, the step of assessing the collaborative leakage risk value based on path interaction information is as follows: Extract all intersection nodes between the current cell data and the encrypted data; For each intersecting node, determine whether the node exhibits an indicator that performs joint computation or cross-validation on two data points: If it exists, it is set as the first preset value; if it does not exist, a weakly coupled collaborative leakage coefficient is generated based on the node’s historical leakage count, repair time and replacement strategy. The time decay factor is determined based on the relationship between the time difference between the current unit data and the encrypted data at this node and the preset encryption validity period threshold. The product of the collaborative leakage coefficient and the time decay factor of each intersecting node is taken as the node collaborative risk of that node. The collaborative leakage risk of all nodes is accumulated to obtain the collaborative leakage risk value between the current unit data and the encrypted data.

[0011] The preferred step of calculating the overall leakage risk value by iterating through all encryption methods is as follows: For the selected encryption method, the comprehensive leakage risk value is obtained based on the collaborative leakage risk value and the basic security value corresponding to the selected encryption method. The basic security value is determined by the encryption strength, and the higher the strength, the lower the value. For the idle encryption method, if the encryption strength of the idle encryption method is lower than the required strength of the current unit data, a strength compensation risk value is generated based on the strength difference as the comprehensive leakage risk value; if it is not lower than the required strength, the basic security value is used as the comprehensive leakage risk value. When there is no available encryption method and the overall leakage risk value of all selected encryption methods is higher than the preset security threshold, reuse optimization is triggered: select the encryption method with the lowest collaborative leakage risk value from the selected encryption methods. If the time difference between the current unit data and the encrypted data corresponding to this method at the intersection node is greater than the preset time difference isolation threshold, the overall leakage risk value is recalculated.

[0012] Preferably, the specific method for recalculating the overall leakage risk value when triggering reuse optimization is as follows: Collect the time arrival difference between the current cell data and the encrypted data at each intersection node, as well as the data replacement cycle of that node; Nodes whose arrival time difference is greater than the data replacement cycle are marked as time-isolated nodes; otherwise, they are marked as time-overlapping nodes. The ratio of the number of time-isolated nodes to the total number of intersecting nodes is calculated. If the ratio is greater than the preset isolation ratio threshold, and the node security level of all intersecting nodes is higher than the preset security level threshold, then the collaborative leakage risk value of the encryption method of the encrypted data is directly set to zero. Otherwise, maintain the original collaborative leakage risk value unchanged; The overall leakage risk value is recalculated using the collaborative leakage risk value after being set to zero or maintained.

[0013] Secondly, the data encryption processing system for air passengers provided in this application adopts the following technical solution: The data classification module collects passenger data from air travelers and classifies the passenger data according to its attributes to obtain multiple data units. The transmission path module acquires the transmission nodes of passenger data, collects the node call information of the transmission nodes, and determines the transmission path of the unit data based on the node call information. The strength sorting module determines the encryption strength corresponding to the unit data based on the transmission path, and sorts the data from high to low according to the encryption strength to obtain the strength order; The encryption matching module collects the interaction information between transmission paths and matches the corresponding encryption methods for the unit data according to the strength order and the interaction information. The encryption processing module performs encryption processing on all unit data with determined encryption methods according to their respective encryption methods.

[0014] In summary, this application includes at least one of the following beneficial technical effects: 1. By classifying data attributes from collected air passenger data to obtain unit data, and accurately identifying circulation nodes based on node call information (such as data call precision, type, and frequency), the transmission path of each unit data is determined. Based on this, the encryption strength is comprehensively calculated according to factors such as node type, security level, historical leakage count, link risk, aggregation risk increment, and cross-border risk increment in the transmission path, and sorted by strength from high to low. This allows unit data with different sensitivity levels and transmission risks to receive differentiated encryption protection, avoiding the problems of over-encryption of low-sensitivity data and insufficient encryption of high-sensitivity data under traditional static encryption methods. This significantly improves the rationality of encryption resource allocation and the security of data transmission throughout the entire link.

[0015] 2. After determining the encryption strength of the unit data, further interaction information between transmission paths is collected (such as the number of intersecting nodes, data mixing status, historical leakage records, and time arrival differences). The risk of collaborative leakage if the same encryption method as the already encrypted data is used is assessed, and a comprehensive leakage risk value is calculated by combining this with the basic security value of the encryption method itself. This allows for the matching of the encryption method with the lowest comprehensive leakage risk to the current unit data. This mechanism effectively addresses the potential for cascading leakage of different data at shared transmission nodes or intersection nodes due to encryption method reuse. It is particularly suitable for scenarios where airline passenger data flows frequently in complex node networks, significantly reducing the security coupling risk between multiple data streams.

[0016] 3. By employing a joint matching strategy of strength order and interactive information, the encryption method selection process considers both the encryption strength requirements of the unit data itself (processing from high to low) and the interaction relationship with existing encrypted data along the path. When the combined leakage risk value of all selected encryption methods exceeds the security threshold, a reuse optimization mechanism is triggered. Based on the comparison between the time arrival difference and the node data replacement cycle, time-isolated nodes are identified, and the collaborative leakage risk value may be set to zero, thus allowing secure encryption method reuse while ensuring security. This avoids the computational overhead caused by redundant switching of encryption methods and achieves an optimal balance between encryption efficiency and security protection through refined time-series and node behavior analysis. Attached Figure Description

[0017] Figure 1 This is a schematic diagram illustrating the specific steps of an embodiment of the data encryption processing method for air passengers according to the present invention.

[0018] Figure 2 This is a schematic diagram of the module connections in an embodiment of the data encryption processing system for air passengers according to the present invention. Detailed Implementation

[0019] The following examples and... Figures 1-2 The present invention will be described in further detail, but the embodiments of the present invention are not limited thereto.

[0020] This invention discloses a data encryption processing method for air passengers, specifically including the following steps: Step S1: Collect passenger data of air passengers, classify the passenger data according to the data attributes, and obtain multiple data units.

[0021] Collect passenger data from air travelers, such as passenger name, ID number, flight number, and seat number. Data attributes refer to the field type or information category to which the data belongs. Using existing technologies such as database field mapping or ETL tools, passenger data is categorized according to field names or semantic tags: for example, extracting the name field from all records and grouping it into one data unit, grouping all ID number fields into another data unit, and grouping itinerary-related fields such as flight number and seat number into itinerary data units. Each data unit contains only field content of the same category, facilitating subsequent differentiated encryption based on the sensitivity and flow characteristics of different fields.

[0022] Step S2: Obtain the transmission node of passenger data, collect the node call information of the transmission node, and determine the transmission path of unit data based on the node call information.

[0023] Step S3: Determine the encryption strength corresponding to the unit data according to the transmission path, and sort the encryption strengths from high to low to obtain the strength order.

[0024] Step S4: Collect the interaction information between transmission paths, and match the corresponding encryption method for the unit data according to the strength order and interaction information.

[0025] Step S5: Encrypt all unit data with the determined encryption method according to their respective encryption methods.

[0026] All data units with determined encryption methods are encrypted according to their respective encryption methods. In practice, symmetric encryption algorithms (such as AES) or asymmetric encryption algorithms (such as RSA) can be used. Based on the encryption method matched in step S4, the corresponding encryption module is called to independently encrypt each data unit, generating ciphertext data which is then forwarded or stored along the transmission path. The encryption process does not change the original semantic structure of the data units; it only performs cryptographic transformations on their content, ensuring that even if intercepted at the transmission node, it cannot be directly read.

[0027] In practical applications, by classifying data by field type (e.g., all names in one category, all ID numbers in another), a refined encryption foundation is provided for airline passenger data. Unlike existing technologies that package and encrypt the entire passenger record, this solution first uses step S1 to decompose mixed data into homogeneous unit data, allowing different sensitive fields to be independently assessed for risk and matched with encryption strength. For example, ID numbers are highly sensitive fields, and their transmission path may involve more cross-border or convergence nodes; steps S2 and S3 can calculate a higher encryption strength for them. Low-sensitivity fields such as seat numbers use correspondingly lower strengths, avoiding resource waste. Step S4 further considers the intersection of transmission paths of different fields at nodes. For example, at a gateway node, ID number unit data and name unit data are jointly queried by the same business logic. If both use the same encryption method, once that node is compromised, both types of information will be leaked simultaneously. This solution, by assessing the risk value of collaborative leakage, can select different encryption methods for subsequent data or utilize time differences for secure reuse, thereby effectively blocking the chain of related leaks. After performing differentiated encryption in step S5, data for each field category is transmitted independently using an encryption method adapted to its risk level. Overall, this solution dynamically allocates encryption resources based on field sensitivity and actual transmission risk, improving the security of highly sensitive data while reducing overall encryption overhead, significantly outperforming traditional unified encryption methods.

[0028] The steps for acquiring passenger data transmission nodes, collecting node call information of transmission nodes, and determining the transmission path of unit data based on node call information are as follows: Step S21: Obtain the node call information for each transmission node. The node call information includes data call precision, data call type, and data call frequency.

[0029] Transmission nodes refer to the physical or logical nodes through which air passenger data passes during collection, flow, and processing, such as check-in servers, security gateways, departure system interfaces, and data middleware. Node call information includes data call precision, data call type, and data call frequency. Data call precision indicates whether the node requires the original, precise value when using the data: high precision means the node requires complete, unprocessed raw data (such as a complete ID number). Low precision means the node only receives fuzzy data (such as hash values ​​or anonymized fields) or aggregated statistical values ​​(such as counts or averages). Data call type indicates which type of field data the node specifically calls, such as ID number data, seat number data, or name data. Data call frequency is the number of calls per unit time. This information can be obtained by parsing query fields, aggregate functions, or anonymized tags in node logs; existing log analysis tools (such as ELK) support this type of identification.

[0030] Step S22: Determine whether the transmission node calls unit data based on the data call type. If unit data is called, collect the call content corresponding to the unit data based on the node call information.

[0031] The system determines whether a node is calling the currently processed unit data based on the data call type. For example, if the current unit data is of the "ID card number" type, and the node's call type includes a read or write operation on the ID card number field, then it is determined to be a call. Once a call is determined, the specific call content is further collected from the logs or message load, such as the actual queried ID card number value or seat number "12A". Collection methods can include field mapping or regular expression matching.

[0032] Step S23: Determine whether the content to be called can only be obtained from the unit data. If it can only be obtained from the unit data, then determine whether the data precision of the content to be called is completely consistent with the data precision of the unit data.

[0033] The process determines whether the retrieved content can only be obtained from the data in that specific cell. This means checking if the content is unique to that cell and cannot be obtained from other data sources (such as aggregated values ​​of other fields, external databases, or inference rules). For example, ID card numbers are typically stored only in the ID card number cell data and cannot be inferred from seat numbers or flight numbers; therefore, it is determined that the content can only be retrieved from the cell data. However, a passenger's average spending amount might be calculated from both the payment cell data and directly read from the marketing cell data; therefore, it is determined that the content cannot only be retrieved from the cell data. If it is determined that the content can only be retrieved from the cell data, the retrieval precision is further compared with the precision of the cell data itself: retrieval precision refers to the precision required by the node (raw precise value or fuzzy / statistical value), while the precision of the cell data is fixed at the raw precise value. If the node requires a raw precise value (high precision) and it is completely consistent with the precision of the cell data, then it passes. Otherwise (if the node only requires fuzzy or statistical data), it fails.

[0034] Step S24: If they are completely identical, then the transmission node is determined to be a circulation node; otherwise, the transmission node is not a circulation node.

[0035] A circulation node indicates that the node is a crucial link in the actual flow path of unit data that cannot be bypassed and must access the original data.

[0036] Step S25: If the information is not only obtainable from the unit data, then collect the reasoning information from the unit data.

[0037] Step S26: Obtain the circulation necessity index of the transmission node based on the reasoning information and data call frequency, and determine whether the transmission node is a circulation node based on the circulation necessity index.

[0038] Step S27: Count all circulation nodes and their corresponding order to form the transmission path corresponding to each unit data.

[0039] In practical applications, all transmission nodes identified as circulation nodes are statistically analyzed and sorted according to the order in which they accessed the data unit, forming the complete transmission path of that data unit. The transmission paths for different data units are independent of each other. Data access precision is further subdivided into "raw precise value access" and "fuzzy / statistical value access," and this is used to determine whether a transmission node is a true circulation node. Existing technologies often consider all nodes that have accessed data as part of the transmission path, leading to overestimation of risk and excessive encryption. This solution determines that only nodes requiring raw precise values ​​that cannot be derived from other sources are included as circulation nodes. For example, in an airport security system, a security node needs to read a passenger's complete ID number for identity verification, and this information cannot be derived from seat number or flight number; therefore, it is identified as a circulation node. However, a statistical report node only needs to access the statistical data of "number of passengers on a certain flight," whose precision is an aggregated value rather than the raw ID number; therefore, it is not identified as a circulation node. Further processing is applied to cases where inference is possible: for example, a node might indirectly infer a passenger's identity through frequent flyer status and cabin class code, but the inference accuracy is low and the call frequency is high, so the calculated circulation necessity index might be below the threshold, thus excluding it from the circulation path. The final generated transmission path accurately reflects the key node chain that unit data must flow as the original accurate value, avoiding the inclusion of unnecessary nodes in the encryption risk assessment, thereby significantly reducing encryption computation overhead and key management complexity while ensuring security. This mechanism is particularly suitable for complex scenarios where airline passenger data flows through multiple nodes and for multiple purposes, achieving a precise balance between security and efficiency.

[0040] The steps for determining whether a transmission node is a circulation node based on the circulation necessity index obtained from the inference information and data call frequency are as follows: Step S261: Find the unit inference data associated with the unit data based on the inference information, and collect the unit inference data called by the transmission node according to the data call type and record it as inference call data.

[0041] Inference information refers to information from other data sources obtained from metadata lineage or data transformation rules that can be used to indirectly deduce the content of the current unit data. For example, if the current unit data is a passenger's ID number, data lineage analysis can reveal that the combination of frequent flyer class and cabin class code can indirectly infer the passenger's identity range. Therefore, the frequent flyer class unit data and cabin class code unit data are the unit inference data. Based on the data call type (i.e., which field the node specifically called, such as the frequent flyer class field), these unit inference data actually called by the transmission node are collected and recorded as inference call data. In existing technologies, the above lookup and collection can be achieved through data lineage tools (such as ApacheAtlas, Amundsen) or by parsing field mapping relationships in ETL scripts.

[0042] Step S262: Estimate the probability that the inference call data will use the transmission node as the circulation node and record it as the inference circulation probability.

[0043] A circulation node refers to a node that requires the original, precise value of the inference call data to complete its business function. This probability can be estimated based on the proportion of times the node calls the inference call data with the original, precise value out of the total number of calls in historical logs. For example, if 80% of the historical calls to frequent flyer class data require the original, precise class value, then the inference circulation probability is 0.8. If historical statistical data is unavailable, a default value can be manually preset based on the node's business logic.

[0044] Step S263: Based on the inference call data, the inference accuracy of the unit data is estimated, and the inference index is determined by combining the inference flow probability.

[0045] Step S264: Collect the historical call timestamps of the inference call data at the transmission node, calculate the time difference between the historical arrival time of the inference call data and the call time of the unit data, and generate a time series matching index based on the time difference.

[0046] For example, if cell data is invoked at time T, and the time when inference invoked data last arrived at that node is T-Δt, then the time difference is Δt. A timing matching index is generated based on this time difference: the smaller the time difference, the closer the inference invoked data and cell data are in time, the higher the probability that the node will use the inference data for a substitute invocation, and the larger the timing matching index. Specifically, an exponential decay function can be used: timing matching index = e^{-λ·Δt}, where λ is the decay coefficient (e.g., 0.1 / s), or a piecewise function can be used: the index is 1 when the time difference is less than 1 second, 0.5 for 1-5 seconds, and 0.1 for greater than 5 seconds.

[0047] Step S265: Generate a call frequency index based on the data call frequency of the inference call data.

[0048] Data retrieval frequency is the average number of times a node retrieves the inference data per unit of time. A higher retrieval frequency indicates a greater reliance on the inference data, resulting in a higher retrieval frequency exponent. A normalization method can be used: Retrieval Frequency Exponent = min(1, Actual Frequency / Preset Baseline Frequency). For example, if the baseline frequency is set to 10 times / second and the actual frequency is 8 times / second, the exponent is 0.8. Values ​​exceeding the baseline are taken as 1. If a node has never retrieved the inference data, the frequency is 0, and the exponent is 0.

[0049] Step S266: Generate a circulation necessity index based on the inference index, timing matching index, and call frequency index; determine whether a transmission node is a circulation node based on the relationship between the circulation necessity index and a preset necessity index threshold.

[0050] The circulation necessity index = 1 - (Inference Index × Timing Matching Index × Call Frequency Index). The Inference Index reflects the likelihood that a node can reconstruct unit data through inference data; the Timing Matching Index reflects the degree of synchronization between inference data and unit data in time; and the Call Frequency Index reflects the strength of a node's dependence on inference data. For a node to truly "replace direct calls with inference" and become a non-circulation node, all three conditions must be met simultaneously—namely, accurate and high-probability inference, high temporal synchronization, and a sufficiently high call frequency. When the three events are independent, the probability of their joint occurrence is equal to the product of their individual probabilities, which conforms to the principle of probability multiplication. Therefore, the circulation necessity index in product form is essentially the comprehensive probability that a node "can rely on inference rather than the original data." Compare the circulation necessity index with a preset necessity index threshold (e.g., a threshold of 0.7): If the index is greater than or equal to 0.7, it indicates that the node has a high necessity for the circulation of the original data, and the node is determined to be a circulation node and should be included in the transmission path; if the index is less than 0.7, it indicates that the node can replace direct calls with inference, and the node is determined not to be a circulation node and should not be included in the transmission path. In actual calculations, the values ​​of each index are all in the range of [0,1], and the product result is also in the range of [0,1], which makes it easy to directly compare with the preset threshold.

[0051] In practical applications, the circulation necessity index is comprehensively calculated using multi-dimensional indicators (inference circulation probability, inference accuracy, time sequence matching degree, and call frequency), achieving objective and refined node selection. For example, in an embodiment of an aviation data platform, a marketing analysis node needs to infer passenger identity information (such as whether the passenger is a high-value passenger) using passenger seat number unit data. When it is determined that the node is not a circulation node for ID number unit data, it can avoid mistakenly including the marketing analysis node in the transmission path of ID number unit data, thereby preventing unnecessary high-strength encryption of the data, reducing encryption computation overhead, and reducing the complexity of key management. Therefore, this solution, by introducing a quantitative evaluation model, accurately distinguishes between "nodes that must rely on original data" and "nodes that can indirectly obtain information through inference," significantly improving the accuracy of path identification and the rationality of resource allocation in the encrypted processing of aviation passenger data.

[0052] The steps for obtaining the inference accuracy of unit data based on inference call data and determining the inference index by combining the inference circulation probability are as follows: Step S2631: Obtain at least two inference call data and their corresponding inference flow probabilities, and combine the inference call data into at least two different inference data combinations.

[0053] Inference call data refers to other unit data collected in step S261 that can be used to indirectly deduce the current unit data. For example, for ID number unit data, its inference call data may be frequent flyer class unit data and cabin class code unit data. The inference flow probability corresponding to each inference call data has been estimated in step S262. These inference call data are grouped into at least two different inference data combinations. For example, combination one contains only frequent flyer class, combination two contains both frequent flyer class and cabin class code, and combination three contains only cabin class code.

[0054] Step S2632: For each inference data combination, the product of the inference flow probabilities of all inference call data in the combination is taken as the joint flow probability of the combination, and the inference accuracy of the combination for the unit data is obtained.

[0055] In a combination, each inference call data point must act as a circulation node (i.e., be called by nodes with the original precise value) to participate in the inference of the current unit data. The joint circulation probability is equal to the product of the probabilities of each independent event. Simultaneously, the inference accuracy of this combination for the current unit data is obtained. Inference accuracy refers to the probability that the original value of the current unit data can be correctly reconstructed using all the inference data in the combination according to established inference rules (such as table lookup, computational model, or rule engine). Different combinations may have significantly different inference accuracy due to the different inference data they contain. Inference accuracy can be pre-read from the inference rule base or obtained through backtesting of historical data.

[0056] Step S2633: The product of the joint circulation probability and the inference accuracy is used as the inference index of the combination.

[0057] Step S2634: Select the combination with the highest inference index among all combinations, and use the inference index of this combination as the final inference index.

[0058] In practical applications, this solution addresses the problem of comprehensively evaluating inference capabilities when multiple inference data sources exist. Existing technologies often consider only a single inference path or simply average multiple inference data, ignoring the complementary and redundant relationships between different combinations. This solution enumerates all possible combinations of inference data, calculates the joint circulation probability (the probability that all inference data are available simultaneously) and inference accuracy (the probability of correct combined inference) for each combination, multiplies the two to obtain the inference index, and finally selects the inference index of the optimal combination as the final inference index. This mechanism fully reflects the practical business logic of "selectively using multiple inference paths." For example, in one embodiment, for ID number unit data, there are two inference call data: frequent flyer class (inference circulation probability 0.8, individual inference accuracy 0.3) and cabin class code (inference circulation probability 0.6, individual inference accuracy 0.2). The combined inference index using the frequent flyer class alone is 0.8 × 0.3 = 0.24. The index using the cabin class code alone is 0.6 × 0.2 = 0.12. Using both methods simultaneously, the joint circulation probability is 0.8 × 0.6 = 0.48, while the combined inference accuracy (due to complementary information) increases to 0.7. Therefore, the inference index is 0.48 × 0.7 = 0.336, higher than the previous two methods. Thus, the final inference index is 0.336. If this value is still lower than the necessary circulation index threshold in subsequent steps, the node may still be judged as a non-circulating node. This scheme, through optimal combination, avoids underestimating the node's inference ability due to inefficient inference paths and also prevents overestimating the node's dependence on the original data due to ignoring complementary information, thereby making the judgment of circulating nodes more accurate and reasonable.

[0059] The steps for determining the encryption strength corresponding to the unit data based on the transmission path, and sorting the encryption strengths from high to low to obtain the strength order are as follows: Step S31: Obtain all transmission nodes included in the transmission path of the unit data, and collect the node type, node security level, node historical leakage count and node geographical location of each transmission node.

[0060] Node types include edge nodes (such as check-in terminals and security gates) and aggregation nodes (such as data centers and cloud platforms), which can be identified through the node's role label in the architecture diagram. Node security levels are pre-determined based on national security compliance certifications or internal enterprise security audit results, typically ranging from 1 to 5. The number of historical data breaches is statistically analyzed from security event logs. Node geographical locations are obtained through IP address databases or data center registration information to determine whether the node is located across borders.

[0061] Step S32: Calculate the link risk value for each link segment based on the transmission distance and transmission medium type between adjacent nodes in the transmission path.

[0062] Transmission distance refers to the physical distance or network hops between two nodes, which can be obtained through network topology measurement tools (such as traceroute). Transmission media types include fiber optic, copper cable, and wireless, with wireless media posing a higher risk than wired media. The link risk value can be calculated using the formula: Link Risk Value = Basic Risk Coefficient (Media) × (1 + α × Normalized Distance), where the basic risk coefficient is set to 0.7 for wireless, 0.3 for copper cable, and 0.1 for fiber optic, and α is a preset distance weighting coefficient.

[0063] Step S33: Determine whether the transmission node is a data aggregation node based on the node type. If it is a data aggregation node, generate an aggregation risk increment based on the number of unit data aggregated by the node.

[0064] A data aggregation node is a node that receives and aggregates unit data from multiple upstream nodes, such as a data platform, API gateway, or bus. If it is an aggregation node, the aggregation risk increment is generated based on the number of unit data units aggregated by that node. The larger the number of aggregated unit data units, the greater the amount of data leaked if the node is compromised, and the higher the risk increment. The aggregation risk increment can be set as: Increment = β × log(1 + number of aggregated data units), where β is a proportionality coefficient (e.g., 0.1). This information can be obtained by analyzing the data flow relationship graph of the nodes; existing technologies such as graph databases support this type of query.

[0065] Step S34: Determine whether the transmission node crosses a geographical boundary based on the node's geographical location. If it crosses a geographical boundary, generate a cross-border risk increment based on the type of geographical boundary crossed.

[0066] Geographic boundaries include national borders, regional borders (such as those between the EU and non-EU countries), or jurisdictional boundaries. The determination method is to compare the boundary coding tables (such as ISO 3166 or GB / T 2659 standards) of adjacent nodes; if the codes differ, it is considered a crossing. Based on the type of geographic boundary crossed, a cross-border risk increment is generated. Specific quantification can employ existing technologies such as the regulatory element scoring method, the Analytic Hierarchy Process (AHP), or the risk quantification model specified in the national standard GB / T 45577-2025.

[0067] Step S35: Calculate the cumulative risk value of path nodes based on the node security level and the number of historical leaks of all transmission nodes.

[0068] Node risk can be expressed as: Single node risk = (X - Node security level) × (1 + γ × Number of historical leaks), where X is the maximum security level of the node + 1, and the higher the security level (the smaller the number), the lower the risk. The single node risks of all nodes are summed to obtain the cumulative risk value of the path nodes. This summation uses addition rather than multiplication because node risks are independent and have a cumulative effect (multiple low-security nodes connected in series will accumulate risk), which conforms to the risk superposition theory.

[0069] Step S36: Calculate the cumulative path link risk value based on the link risk value of each link segment.

[0070] The link risk values ​​between all adjacent nodes calculated in step S32 are summed up.

[0071] Step S37: The cumulative value of path node risk, the cumulative value of path link risk, the incremental value of convergence risk, and the incremental value of cross-border risk are summed to obtain the encryption strength.

[0072] The four components mentioned above represent different sources of risk—the vulnerability of the node itself, the vulnerability during transmission, the amplification effect of centralized data storage, and cross-border legal risks—they are independent of each other, but together constitute the total risk of the unit data along the entire transmission path. The higher the total risk, the greater the required encryption strength. The accumulated encryption strength is a dimensionless value, which will be used later for strength ranking and encryption method matching.

[0073] In practical applications, unlike existing technologies that allocate fixed encryption strength based solely on the static sensitivity level of data, this scheme fully considers dynamic risk factors along the actual transmission path of unit data, including the security level and leakage history of nodes, the transmission medium and distance of the link, the node aggregation effect, and the additional compliance risks brought about by cross-border transmission. For example, in one embodiment, the transmission path of passenger ID number unit data passes through a low-security-level (level 2) aggregation node (aggregating 5000 data entries), crosses a national border, and includes a wireless link. The node risk accumulation value calculated in step S35 is relatively high, the link risk accumulation value in step S36 increases due to the wireless medium, the aggregation risk increment in step S33 (β×log(5001)≈0.1×8.5=0.85), and the cross-border risk increment in step S34 (set to 0.5), when accumulated, result in a high encryption strength, thus matching a high-strength encryption algorithm (such as AES-256). The transmission path for another type of low-sensitivity data (such as seat numbers) only passes through high-security internal nodes, fiber optic links, and has no aggregation or cross-border connections. The resulting encryption strength is relatively low, but still compatible with AES-128. Through this cumulative risk quantification, this solution achieves a precise match between encryption strength and actual risk, avoiding both insufficient protection for high-sensitivity data and over-encryption of low-sensitivity data, significantly improving the security and resource efficiency of encrypted processing of airline passenger data.

[0074] The steps of collecting interaction information between transmission paths and matching the corresponding encryption methods for unit data according to the strength order and interaction information are as follows: Step S41: Obtain the encrypted data with the determined encryption method and the corresponding selected encryption method, and determine whether there is encrypted data between the current unit data.

[0075] Encrypted data refers to unit data that has been matched and encrypted according to its strength order. Current unit data is processed sequentially according to strength order, with higher strength data processed first. The process checks whether there is already encrypted data preceding the current unit data, i.e., it checks if the unit data preceding the current unit data exists. This check can be achieved by maintaining a list of processed data. Preset encryption methods include, but are not limited to, AES-128, AES-256, SM4, RSA-2048, etc., each corresponding to a preset encryption strength value.

[0076] Step S42: If there is no previously encrypted data in the current cell, select the encryption method with an encryption strength not lower than the required encryption strength of the current cell and the smallest difference from the preset encryption methods as the matching encryption method.

[0077] If there is no previously encrypted data in the current cell (i.e., the current cell is the first one with the highest encryption strength), an encryption method is selected from the preset encryption method library. This library contains various optional encryption algorithms and their corresponding encryption strength values, such as AES-128 with a strength of 3, AES-256 with a strength of 5, and SM4 with a strength of 4. The selection rule is: the encryption strength must be no less than the required encryption strength for the current cell, and the difference between the two must be minimal, to ensure security while avoiding over-encryption.

[0078] Step S43: If there is encrypted data, collect the path interaction information between the transmission path of the current unit data and the transmission path of each encrypted data. The path interaction information includes the number of intersecting nodes, the data mixing status at the intersecting nodes, historical leakage records, and time arrival difference.

[0079] If encrypted data existed before the current data unit, the path interaction information between the current data unit's transmission path and the transmission paths of each encrypted data unit is collected. The number of intersecting nodes refers to the number of transmission nodes traversed by both paths, which can be obtained by comparing the intersection of the two node sequences. The data mixing status at the intersecting node indicates whether the two data units were jointly computed or cross-validated (e.g., concatenation, hash combination, join query) at that node, which can be determined by parsing the operation identifiers in the node logs. Historical leakage records refer to the number of data leakage events that occurred at this intersecting node in the past. The time arrival difference refers to the absolute value of the time difference between the arrival times of the two data units at the same intersecting node.

[0080] Step S44: Based on the path interaction information, assess the risk of collaborative leakage, which would result in the leakage of the current unit data due to the cracking of the encrypted data if the same encryption method as the encrypted data is used.

[0081] Collaborative leakage risk value refers to the degree of risk that if the current unit data uses the same encryption method as a certain encrypted data, and the encrypted data is cracked due to its own path risk or node attack, the current unit data will be leaked along with it because it shares the same encryption key or algorithm.

[0082] Step S45: Iterate through all selected encryption methods and idle encryption methods, and calculate the comprehensive leakage risk value corresponding to each encryption method. The comprehensive leakage risk value is obtained by combining the basic security value of the encryption method itself and the collaborative leakage risk value.

[0083] Calculate the overall leakage risk value for each encryption method. Overall leakage risk value = Collaborative leakage risk value - Basic security value. The basic security value is determined by the encryption strength of the encryption method. Higher encryption strength results in a larger basic security value, indicating greater security of the encryption method itself, thus reducing the overall leakage risk value. The basic security value can be obtained through a preset mapping table, for example, encryption strength 1 corresponds to a basic security value of 0.1, strength 2 corresponds to 0.2, and so on, or calculated using a linear function. This mapping relationship can be preset based on industry security standards or experience. For idle encryption methods, if their encryption strength is lower than the required strength for the current data unit, an additional strength compensation risk value (e.g., a multiple of the strength difference) is added to reflect the additional risk caused by insufficient encryption strength. In this case, the overall leakage risk value = Collaborative leakage risk value - Basic security value + Strength compensation risk value. If the strength of the idle encryption method is not lower than the required strength, no compensation is needed.

[0084] Step S46: Select the encryption method with the lowest overall leakage risk value as the matching encryption method for the current unit data.

[0085] In practical applications, encryption methods are dynamically matched for each data unit according to the order of encryption strength from high to low, fully considering the risk of collaborative leakage caused by path interaction. Unlike existing technologies where all data independently selects an encryption method or uniformly adopts a fixed encryption method, this solution assesses the risk of collaborative leakage by collecting information such as intersecting nodes, data mixing status, historical leakage, and time arrival difference in step S43. This avoids a chain reaction of leakage at shared nodes due to encryption method reuse, where a single breach leads to widespread leakage. For example, in an airline embodiment, passenger ID number data (high strength) and name data (medium strength) are processed sequentially. The ID number has already been matched with AES-256. When processing the name data, step S43 finds that the transmission paths of the two intersect at the API gateway node, and this node has an operation flag indicating joint verification of the ID number and name (high data mixing status), with two historical leakage occurrences and a time arrival difference of 0.3 seconds. Step S44 calculates that if the name also uses AES-256, the risk of collaborative leakage is high. However, if SM4 (a moderately strong, idle encryption method) is used, there is no risk of collaborative leakage. After comparing the comprehensive leakage risk values ​​in step S45, step S46 selects SM4 for the name data. Ultimately, even if the API gateway is attacked, because the two data encryption methods are different and the keys are independent, the attacker cannot decrypt both simultaneously, thus effectively isolating the leakage risk. This solution, through fine-grained matching, achieves reasonable reuse and differentiated deployment of encryption methods while ensuring security, significantly improving the robustness of end-to-end protection for aviation passenger data.

[0086] The steps for assessing the risk of collaborative leakage based on path interaction information are as follows: Step S441: Extract all intersecting nodes between the current cell data and the encrypted data.

[0087] Step S442: For each intersecting node, determine whether the node has an indicator indicating that it performs joint computation or cross-validation of two data points. Behavioral identifiers refer to whether a node uses two data units simultaneously and performs a join operation when processing data, such as a JOIN query in SQL, field concatenation in an ETL script, or a combined response in an API. These identifiers can be obtained by parsing the node's operation logs, data flow graphs, or label fields in the call chain. If the logs contain records of operations that use two data units as input simultaneously, a behavioral identifier is determined to exist.

[0088] Step S443: If it exists, set it as the first preset value; if it does not exist, generate a weakly coupled collaborative leakage coefficient based on the node's historical leakage count, repair time, and replacement strategy.

[0089] If a behavioral identifier exists, the collaborative leakage coefficient of that node is set to the first preset value (e.g., 1.0), indicating a strong coupling relationship. Once the node is compromised, both data are highly likely to be leaked simultaneously. If no behavioral identifier exists, a weakly coupled collaborative leakage coefficient is generated based on the node's historical leakage count, repair time, and replacement strategy. The historical leakage count is statistically analyzed from the security event log. The repair time refers to the average time from the last leakage to the node's return to normal operation, which can be obtained from the operation and maintenance records. The replacement strategy refers to whether the node adopts mitigation measures such as key rotation and data refresh after a data leakage. The weakly coupled collaborative leakage coefficient can be generated using the formula: Coefficient = (Historical leakage count × Weight 1) / (1 + Repair time × Weight 2) × (1 - Replacement strategy effectiveness coefficient), where the replacement strategy effectiveness coefficient is preset according to the strategy type (e.g., 0.7 for key rotation, 0 for no strategy). This formula reflects that the more frequent the leakage history, the slower the repair, and the weaker the mitigation measures, the higher the collaborative risk under weak coupling. All the above parameters can be collected through CMDB and the operation and maintenance monitoring system. The number of historical leaks, repair time, and effectiveness of replacement strategies were used as independent variables, while the actual consequences of collaborative leaks (such as the amount of leaked data and the number of leaks) were used as dependent variables. Multiple linear regression or logistic regression was used to fit the data, and the regression coefficients of each factor were used as weights.

[0090] Step S444: Determine the time decay factor based on the relationship between the time difference between the current unit data and the encrypted data at the node and the preset encryption validity period threshold.

[0091] The time arrival difference refers to the absolute value of the time difference between the arrival times of two data items at the node, which can be calculated using the timestamps of the link tracing system. The preset encryption validity threshold indicates the duration (e.g., 5 seconds) for which the encryption method can effectively protect the data. If the time arrival difference is less than or equal to the threshold, it indicates that the two data items highly overlap in time, and an attacker can intercept both within the same time window; in this case, the time decay factor is set to its maximum value of 1. If the time arrival difference is greater than the threshold, the factor decays exponentially with the increase in the difference, for example, decay factor = e^{-λ×(time difference - threshold)}. This decay model reflects that the larger the time difference, the lower the probability that the two data items will be intercepted simultaneously and cracked using the same key. λ can be determined based on the average data capture window length at the node. For example, if security audits reveal that attackers can typically complete data capture within Δt_capture seconds after the data arrives at the node, then λ can be set to 1 / Δt_capture, so that for every increase in the time difference by one capture window length, the decay factor decreases to approximately 0.368 (e^{-λ×(time difference - threshold)}). -1 The capture window length can be obtained through simulated attack tests or historical intrusion event statistics.

[0092] Step S445: The product of the collaborative leakage coefficient and the time decay factor of each intersecting node is taken as the node collaborative risk of that node. The collaborative risk of all nodes is accumulated to obtain the collaborative leakage risk value between the current unit data and the encrypted data.

[0093] In practical applications, this solution achieves a refined and quantitative assessment of the collaborative leakage risk between two data units. Existing technologies typically ignore the interaction risk of different data streams on shared nodes, or simply consider path overlap as equivalent risk. This solution distinguishes between strong coupling (with joint computation behavior identifiers) and weak coupling (without identifiers but with historical leakage risks), and introduces a time decay factor to reflect the impact of data arrival time difference on the probability of cascading leakage, making the risk assessment more aligned with actual business scenarios. For example, in a certain aviation data processing embodiment, the transmission paths of ID card number data and name data intersect at a certain API gateway node. Step S442, after parsing the logs, finds that the gateway contains a script that performs joint verification of ID card number and name, thus exhibiting a behavior identifier. Step S443 sets the collaborative leakage coefficient of this node to 1.0. Step S444 calculates the time difference between the two data arrivals at the gateway to be 0.2 seconds, which is less than the preset encryption validity period threshold of 5 seconds, and the time decay factor is 1. Step S445 obtains the collaborative risk of this node as 1.0 × 1 = 1.0. If there is another intersecting node on the path (such as a data platform), this node has no joint computation behavior, but its historical leakage count is 3, the repair time is 2 hours, the replacement strategy effectiveness coefficient is 0.3, the calculated weak coupling coefficient is 0.4, the time difference is 8 seconds (greater than the threshold), and the decay factor is 0.2. Therefore, the collaborative risk of this node is 0.4 × 0.2 = 0.08. The total collaborative leakage risk value is 1.08. This value will be used in subsequent step S45 to calculate the comprehensive leakage risk value. Through this quantification mechanism, the system can accurately identify strongly coupled and time-overlapping key nodes, thereby prioritizing the avoidance of reusing high-risk combinations when matching encryption methods, effectively cutting off the chain of related leakage.

[0094] The steps for calculating the overall risk of data leakage by iterating through all encryption methods are as follows: Step S451: For the selected encryption method, the comprehensive leakage risk value is obtained based on the collaborative leakage risk value and the basic security value corresponding to the selected encryption method. The basic security value is determined by the encryption strength, and the higher the strength, the lower the value.

[0095] For the selected encryption method (i.e., the encryption method already used in previous unit data), the comprehensive leakage risk value is obtained by subtracting the basic security value from the collaborative leakage risk value, i.e., comprehensive leakage risk value = collaborative leakage risk value - basic security value. The collaborative leakage risk value, calculated in step S445, represents the risk of collateral leakage between the current unit data and the encrypted data due to shared nodes. The basic security value is determined by the encryption strength of the encryption method; the higher the encryption strength, the larger the basic security value, indicating that the encryption method itself is more secure, thus reducing the risk from the collaborative leakage risk. The basic security value can be obtained through a preset mapping table, for example, assigning corresponding values ​​(e.g., 0.2, 0.5, 0.8) to each encryption algorithm (e.g., AES-128, AES-256, SM4) according to their strength levels. This mapping table can be set according to industry security standards or cryptographic assessment reports and is a common technique in this field.

[0096] Step S452: For the idle encryption method, if the encryption strength of the idle encryption method is lower than the required strength of the current unit data, a strength compensation risk value is generated based on the strength difference as the comprehensive leakage risk value. If it is not lower than the required strength, the basic security value is used as the comprehensive leakage risk value.

[0097] For idle encryption methods (i.e., encryption methods not yet used by any unit data), first determine whether its encryption strength is lower than the strength required by the current unit data. The required strength is determined by the encryption strength value calculated in step S37. If the strength of the idle method is lower than the required strength, a strength compensation risk value is generated based on the strength difference, and this compensation value is directly used as the comprehensive leakage risk value. The strength compensation risk value can be set as a multiple of the strength difference, for example, compensation value = (required strength - actual strength) × compensation coefficient, where the compensation coefficient can be preset to 0.2, representing the additional risk caused by insufficient strength. If the strength of the idle method is not lower than the required strength, no compensation is needed, and the comprehensive leakage risk value is directly taken as the basic security value of this method.

[0098] Step S453: When there is no available encryption method and the overall leakage risk value of all selected encryption methods is higher than the preset security threshold, trigger reuse optimization: select the method with the lowest collaborative leakage risk value from the selected encryption methods. If the time difference between the current unit data and the encrypted data corresponding to this method at the intersection node is greater than the preset time difference isolation threshold, then recalculate the overall leakage risk value.

[0099] When no available encryption method exists (i.e., all available encryption methods have been used) and the overall leakage risk value of all selected encryption methods is higher than a preset security threshold (e.g., 0.5), it indicates that an encryption method with acceptable security risk cannot be found at present, triggering a reuse optimization mechanism. Specifically, the method with the lowest collaborative leakage risk value (i.e., the method used by the encrypted data least associated with the current unit data) is selected from all selected encryption methods. Then, it checks whether the time arrival difference between the current unit data and the encrypted data at all intersecting nodes is greater than a preset time difference isolation threshold (e.g., 10 seconds). If this condition is met, it indicates that the two data are sufficiently isolated in time, making it difficult for an attacker to intercept both simultaneously within the same time window. Therefore, the encryption method can be securely reused, and the overall leakage risk value is recalculated (usually by setting the collaborative leakage risk value to 0 before recalculation). If the condition is not met, the original overall leakage risk value is maintained, and other methods are selected or an error is reported. This optimization mechanism allows secure reuse through time isolation conditions when no new encryption method can be introduced, avoiding system blocking.

[0100] It's important to note that the reuse optimization mechanism requires the current unit data to satisfy temporal isolation conditions with all data that have used the same encryption method, not just with any one of them. This is because if any encrypted data overlaps with the current unit data at any intersection node, collaborative leakage may still occur at that node. An attacker could exploit this overlap window to simultaneously obtain both types of data. Therefore, only by achieving temporal isolation with all existing data at all intersection nodes can the same encryption method be securely reused.

[0101] In practical applications, encryption methods are dynamically matched for each data unit according to strength order, and reuse optimization is triggered when there are no available encryption methods and all reuse schemes are too risky. Unlike existing technologies that either force the use of new keys leading to resource exhaustion or blindly reuse data ignoring risks, this scheme achieves a balance between security and resource efficiency by setting preset security thresholds and time-difference isolation thresholds. For example, in an airline embodiment, the system has already matched three different encryption methods—AES-256, SM4, and AES-128—for the ID number, name, and flight number data units, respectively. Currently, the seat number data unit needs to be processed, and no more available encryption methods are available. Step S451 calculates the comprehensive leakage risk value of all selected methods, which is higher than the security threshold of 0.5 (because the seat number and the above data have joint query behavior at multiple intersection nodes). Step S453 triggers reuse optimization: The method with the lowest collaborative leakage risk value is selected, i.e., the one with the largest time difference from the seat number. Upon inspection, the time difference between the seat number and flight number at a certain node is 15 seconds, exceeding the time difference isolation threshold of 10 seconds. Other nodes also meet the conditions. Therefore, the system determines that the AES-128 encryption method for the flight number can be safely reused, sets the collaborative leakage risk value to 0, and recalculates the overall leakage risk value, which is below the threshold. Finally, AES-128 is matched to the seat number. This mechanism avoids processing failures due to the lack of a new encryption method, while ensuring reuse security through time isolation conditions, significantly improving the system's robustness and efficiency under limited encryption resources.

[0102] When reusing optimization is triggered, the specific method for recalculating the overall leakage risk value is as follows: Step S4531: Collect the time arrival difference between the current cell data and the encrypted data at each intersecting node, as well as the data replacement cycle of that node.

[0103] The time arrival difference is calculated using timestamps recorded by the link tracing system. The data replacement cycle refers to the average interval between refreshes, rotations, or expirations of cached data or session keys by the node, which can be obtained from the node's configuration parameters or operation and maintenance scripts. This information can be provided by the metadata interface of the configuration management database or service mesh. If the node does not define a data replacement cycle, it defaults to infinity, which is considered as time overlap.

[0104] Step S4532: Mark nodes whose time arrival difference is greater than the data replacement cycle as time-isolated nodes; otherwise, mark them as time-overlapping nodes.

[0105] If the time difference between two data arrivals at a node exceeds that node's own data refresh cycle, the data that arrives first will have already been replaced or become invalid on that node, and the data that arrives later cannot coexist with it within the same valid time window, thus achieving temporal isolation. Conversely, if the time difference is less than or equal to the replacement cycle, the two data may coexist on the node, constituting temporal overlap.

[0106] Step S4533: Calculate the ratio of the number of time-series isolated nodes to the total number of intersecting nodes.

[0107] This ratio reflects the overall temporal isolation between the two data points along the path. A higher ratio indicates that the two data points are separated by time windows on more nodes, and the lower the possibility of collaborative leakage.

[0108] Step S4534: If the ratio is greater than the preset isolation ratio threshold, and the node security level of all intersecting nodes is higher than the preset security level threshold, then the collaborative leakage risk value of the encryption method of the encrypted data is directly set to zero.

[0109] Step S4535, otherwise, maintain the original collaborative leakage risk value unchanged.

[0110] Step S4536: Recalculate the overall leakage risk value using the collaborative leakage risk value after it has been set to zero or maintained.

[0111] In practical applications, by introducing a data replacement cycle and linking the time difference with the dynamic refresh behavior of nodes, it is possible to more accurately determine whether two pieces of data truly coexist on a node. For example, in one embodiment, there are three intersecting nodes on the transmission path of an ID number and a name. Node A has a data replacement cycle of 2 seconds, and the arrival time difference between the two pieces of data is 3 seconds (greater than 2 seconds), which is marked as temporally isolated. Node B has a replacement cycle of 5 seconds, and the time difference is 3 seconds (less than 5 seconds), which is marked as temporally overlapping. Node C has a replacement cycle of 10 seconds, and the time difference is 8 seconds (less than 10 seconds), which is also marked as temporally overlapping. The proportion of temporally isolated nodes is 1 / 3 ≈ 33%, which is lower than the preset isolation ratio threshold of 80%, and the security level of node B is level 2 (lower than the threshold level 3). Therefore, the condition for zeroing is not met, and the original collaborative leakage risk value is maintained. Conversely, if the time difference of three out of the four intersecting nodes in another pair of data exceeds their respective replacement cycles (75%), although not reaching 80%, if the threshold is set to 70% and all nodes have a security level higher than 3, the risk of collaborative leakage can be set to zero, allowing secure reuse. This mechanism avoids the conservative approach of completely denying the possibility of reuse due to a few overlapping time sequences of nodes, while preventing additional risks from low-security nodes through security level conditions, thus achieving precise security reuse decisions and further improving the efficiency of encrypted resource utilization.

[0112] The data encryption processing system for air passengers, by applying the data encryption processing method for air passengers as described above, includes: The data classification module collects passenger data from air travelers and classifies the passenger data according to its attributes, resulting in multiple data units.

[0113] The transmission path module acquires the transmission nodes for passenger data, collects node call information of the transmission nodes, and determines the transmission path for unit data based on the node call information.

[0114] The strength sorting module determines the encryption strength corresponding to the unit data based on the transmission path, and sorts the data from high to low according to the encryption strength to obtain the strength order.

[0115] The encryption matching module collects the interaction information between transmission paths and matches the corresponding encryption methods for the unit data according to the strength order and the interaction information.

[0116] The encryption processing module performs encryption processing on all unit data with determined encryption methods according to their respective encryption methods.

[0117] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A data encryption processing method for air passengers, characterized in that, Includes the following steps: Collect passenger data from air travelers, classify the passenger data according to its data attributes, and obtain multiple data units; The system acquires the transmission nodes for passenger data, collects node call information for these transmission nodes, and determines the transmission path for unit data based on the node call information. The encryption strength of the unit data is determined according to the transmission path, and the encryption strength is sorted from high to low to obtain the strength order; Collect the interaction information between transmission paths, and match the corresponding encryption method for the unit data according to the strength order and interaction information; All data units with determined encryption methods will be encrypted according to their respective encryption methods.

2. The data encryption processing method based on air passengers according to claim 1, characterized in that, The steps for acquiring passenger data transmission nodes, collecting node call information of transmission nodes, and determining the transmission path of unit data based on node call information are as follows: Obtain node call information for each transmission node, including data call precision, data call type, and data call frequency; Determine whether the transmission node calls unit data based on the data call type. If unit data is called, collect the call content corresponding to the unit data based on the node call information. Determine whether the content to be called can only be obtained from the unit data. If it can only be obtained from the unit data, then determine whether the data precision of the content to be called is completely consistent with the data precision of the unit data. If they are completely identical, then the transmission node is determined to be a circulation node; otherwise, the transmission node is not a circulation node. If it is not only obtainable from unit data, then collect the reasoning information from the unit data; The circulation necessity index of the transmission node is obtained based on the reasoning information and data call frequency, and the transmission node is determined as a circulation node based on the circulation necessity index. By statistically analyzing all circulation nodes and their corresponding order, a transmission path is formed for each unit of data.

3. The data encryption processing method based on air passengers according to claim 2, characterized in that, The steps for determining whether a transmission node is a circulation node based on the circulation necessity index obtained from the inference information and data call frequency are as follows: Based on the inference information, the unit inference data associated with the unit data is obtained, and the unit inference data called by the transmission node is collected according to the data call type and recorded as inference call data; The probability that the inference call data will use the transmission node as the circulation node is estimated and recorded as the inference circulation probability; The reasoning accuracy of the unit data is estimated based on the reasoning call data, and the reasoning index is determined by combining the reasoning circulation probability. Collect historical call timestamps of inference call data at the transmission node, calculate the time difference between the historical arrival time of inference call data and the call time of unit data, and generate a time series matching index based on the time difference; A call frequency index is generated based on the data call frequency of the inference call data. The circulation necessity index is generated based on the inference index, timing matching index, and call frequency index. The relationship between the circulation necessity index and the preset necessity index threshold is used to determine whether the transmission node is a circulation node.

4. The data encryption processing method based on air passengers according to claim 3, characterized in that, The steps for obtaining the inference accuracy of unit data based on inference call data and determining the inference index by combining the inference circulation probability are as follows: Obtain at least two inference call data and their corresponding inference flow probabilities, and combine the inference call data into at least two different inference data combinations; For each inference data combination, the product of the inference flow probabilities of all inference call data in the combination is taken as the joint flow probability of the combination, and the inference accuracy of the combination for the unit data is obtained. The product of the joint circulation probability and the inference accuracy is used as the inference index of the combination. Select the combination with the highest inference index among all combinations, and use the inference index of that combination as the final inference index.

5. The data encryption processing method for air passengers according to claim 1, characterized in that, The steps for determining the encryption strength corresponding to the unit data based on the transmission path, and sorting the encryption strengths from high to low to obtain the strength order are as follows: Obtain all transmission nodes included in the transmission path of the unit data, and collect the node type, node security level, node historical leakage count and node geographical location of each transmission node; Calculate the link risk value for each link segment based on the transmission distance between adjacent nodes in the transmission path and the type of transmission medium. Determine whether the transmission node is a data aggregation node based on the node type. If it is a data aggregation node, generate an aggregation risk increment based on the number of unit data aggregated by the node. The system determines whether a transmission node crosses a geographical boundary based on its geographical location. If it does, it generates a cross-border risk increment based on the type of geographical boundary it crosses. The cumulative risk value of the path nodes is calculated based on the node security level and the number of historical leaks of all transmission nodes. Calculate the cumulative path link risk value based on the link risk value of each link segment; The encryption strength is obtained by summing the cumulative values ​​of path node risks, path link risks, convergence risk increments, and cross-border risk increments.

6. The data encryption processing method for air passengers according to claim 1, characterized in that, The steps of collecting interaction information between transmission paths and matching the corresponding encryption methods for unit data according to the strength order and interaction information are as follows: Obtain the encrypted data with a determined encryption method and the corresponding selected encryption method, and determine whether there is encrypted data between the data in the current unit; If there is no previously encrypted data in the current cell, then select the encryption method with the smallest difference from the preset encryption methods, provided that the encryption strength is not lower than the required encryption strength of the current cell data. If there is encrypted data, the path interaction information between the transmission path of the current unit data and the transmission path of each encrypted data is collected. The path interaction information includes the number of intersecting nodes, the data mixing status at the intersecting nodes, historical leakage records, and time arrival difference. Based on the path interaction information, assess the risk of collaborative leakage if the same encryption method as the already encrypted data is used, which could lead to the leakage of the current unit's data due to the cracking of the already encrypted data. Iterate through all selected and idle encryption methods, and calculate the comprehensive leakage risk value for each encryption method. The comprehensive leakage risk value is obtained by combining the basic security value of the encryption method itself with the collaborative leakage risk value. The encryption method with the lowest overall risk of leakage is selected as the matching encryption method for the current unit data.

7. The data encryption processing method for air passengers according to claim 6, characterized in that, The steps for assessing the risk of collaborative leakage based on path interaction information are as follows: Extract all intersection nodes between the current cell data and the encrypted data; For each intersecting node, determine whether the node exhibits an indicator that performs joint computation or cross-validation of two data points: If it exists, it is set as the first preset value; if it does not exist, a weakly coupled collaborative leakage coefficient is generated based on the node’s historical leakage count, repair time and replacement strategy. The time decay factor is determined based on the relationship between the time difference between the current unit data and the encrypted data at this node and the preset encryption validity period threshold. The product of the collaborative leakage coefficient and the time decay factor of each intersecting node is taken as the node collaborative risk of that node. The collaborative leakage risk of all nodes is accumulated to obtain the collaborative leakage risk value between the current unit data and the encrypted data.

8. The data encryption processing method for air passengers according to claim 6, characterized in that, The steps for calculating the overall risk of data leakage by iterating through all encryption methods are as follows: For the selected encryption method, the comprehensive leakage risk value is obtained based on the collaborative leakage risk value and the basic security value corresponding to the selected encryption method. The basic security value is determined by the encryption strength, and the higher the strength, the lower the value. For the idle encryption method, if the encryption strength of the idle encryption method is lower than the required strength of the current unit data, a strength compensation risk value is generated based on the strength difference as the comprehensive leakage risk value. If it is not lower than, the basic safety value will be used as the comprehensive leakage risk value; When there is no available encryption method and the overall leakage risk value of all selected encryption methods is higher than the preset security threshold, reuse optimization is triggered: select the encryption method with the lowest collaborative leakage risk value from the selected encryption methods. If the time difference between the current unit data and the encrypted data corresponding to this method at the intersection node is greater than the preset time difference isolation threshold, the overall leakage risk value is recalculated.

9. The data encryption processing method for air passengers according to claim 8, characterized in that, When reusing optimization is triggered, the specific method for recalculating the overall leakage risk value is as follows: Collect the time arrival difference between the current cell data and the encrypted data at each intersection node, as well as the data replacement cycle of that node; Nodes whose arrival time difference is greater than the data replacement cycle are marked as time-isolated nodes; otherwise, they are marked as time-overlapping nodes. The ratio of the number of time-isolated nodes to the total number of intersecting nodes is calculated. If the ratio is greater than the preset isolation ratio threshold, and the node security level of all intersecting nodes is higher than the preset security level threshold, then the collaborative leakage risk value of the encryption method of the encrypted data is directly set to zero. Otherwise, maintain the original collaborative leakage risk value unchanged; The overall leakage risk value is recalculated using the collaborative leakage risk value after being set to zero or maintained.

10. A data encryption processing system for air passengers, characterized in that, The data encryption processing method for air passengers as described in any one of claims 1-9 includes: The data classification module collects passenger data from air travelers and classifies the passenger data according to its attributes to obtain multiple data units. The transmission path module acquires the transmission nodes of passenger data, collects the node call information of the transmission nodes, and determines the transmission path of the unit data based on the node call information. The strength sorting module determines the encryption strength corresponding to the unit data based on the transmission path, and sorts the data from high to low according to the encryption strength to obtain the strength order; The encryption matching module collects the interaction information between transmission paths and matches the corresponding encryption methods for the unit data according to the strength order and the interaction information. The encryption processing module performs encryption processing on all unit data with determined encryption methods according to their respective encryption methods.

Images