Micro-service-based data permission control method and system

Abstract

The application provides a micro-service-based data authority control method and system, which comprises the following steps: based on a link identifier and an identity credential carried in a data access request to be processed, a privacy environment context of current data access is constructed, and based on the privacy environment context and metadata records of a target data resource, a dynamic sensitivity label of the target data resource is determined; based on the dynamic sensitivity label and a preset privacy protection strategy rule library, mapping is performed to obtain an encryption strength parameter and a desensitization instruction of the current data access; based on the encryption strength parameter and the desensitization instruction and public key information in the identity credential, a dynamic access token for the target data resource is determined; and based on the desensitization instruction in the dynamic access token, original data flow intercepted at a micro-service gateway is subjected to authority compliance deformation to obtain initial compliance data flow. Under the premise of protecting data privacy and security, the application realizes flexible and safe data cooperation between micro-services.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data access control method and system based on microservices. Background Technology

[0002] As enterprises continue to deepen their digital transformation, microservice architecture, with its core characteristics of loose coupling, independent scalability, and ease of iterative maintenance, has become the mainstream architectural pattern supporting large-scale business scenarios. Consequently, the demand for cross-microservice data sharing and interaction has exploded, making the frequency and scenarios of data access between different microservices increasingly complex, and placing higher demands on the security and flexibility of data access.

[0003] Existing data access control methods in microservice architecture systems mostly adopt a role-based access control (RBAC) model. This involves assigning a fixed, static list of data resource access permissions to each predefined role within the system. When a user initiates a data access request, the system identifies the user and their role, then compares this information to the predefined permission list. If the data resource is listed, access is granted; otherwise, access is denied. However, existing methods rely solely on the static label of the user's role for permission judgment, failing to consider the dynamic changes in the sensitivity of data across different business scenarios. For example, the same business data may have low sensitivity in an internal enterprise data analysis scenario, but its sensitivity increases significantly in cross-enterprise or cross-domain sharing scenarios, requiring higher levels of access restrictions. Furthermore, these methods ignore differences in the trustworthiness of upstream services and the privacy risk level of the current network environment. They cannot dynamically adjust access control strategies based on the security conditions of the actual access environment. This makes existing access control mechanisms prone to privacy leaks due to overly broad permission configurations, or restrictions on normal cross-microservice data interaction and business processes due to overly strict permission configurations. Ultimately, they fail to achieve flexible and secure data collaboration between microservices while effectively protecting data privacy. Summary of the Invention

[0004] This invention provides a data access control method and system based on microservices to solve the problems of privacy leakage risks and business flow obstruction caused by relying solely on static role tags for access control in existing technologies. Ultimately, it achieves flexible and secure data collaboration between microservices while protecting data privacy and security.

[0005] In a first aspect, the present invention provides a data access control method based on microservices, comprising: Based on the link identifier and identity credentials carried in the data access request to be processed, a privacy environment context for the current data access is constructed, and based on the privacy environment context and the metadata record of the target data resource, the dynamic sensitivity label of the target data resource is determined. Based on the dynamic sensitivity tag and the preset privacy protection policy rule base, the encryption strength parameter and desensitization instruction for the current data access are obtained by mapping. Based on the encryption strength parameter and the de-identification instruction, combined with the public key information in the identity credential, a dynamic access token for the target data resource is determined; Based on the de-identification instructions in the dynamic access token, the original data stream intercepted at the microservice gateway is transformed for permission compliance to obtain a preliminary compliant data stream; The preliminary compliance data stream is encapsulated and encrypted based on the encryption strength parameter in the dynamic access token and the public key information to obtain authorized data ciphertext, which is then sent to the requester.

[0006] Secondly, the present invention also provides a microservice-based data access control system, applied to the microservice-based data access control method described in the first aspect; the microservice-based data access control system includes: The context construction and sensitivity label determination module is used to construct the privacy environment context of the current data access based on the link identifier and identity credentials carried in the data access request to be processed, and to determine the dynamic sensitivity label of the target data resource based on the privacy environment context and the metadata record of the target data resource. The parameter and instruction mapping module is used to map the dynamic sensitivity label and the preset privacy protection policy rule base to obtain the encryption strength parameter and desensitization instruction for the current data access. An access token generation module is used to determine a dynamic access token for the target data resource based on the encryption strength parameter, the de-identification instruction, and the public key information in the identity credential. The permission compliance transformation module is used to perform permission compliance transformation on the original data stream intercepted at the microservice gateway based on the de-identification instructions in the dynamic access token, so as to obtain a preliminary compliant data stream; The encapsulation encryption and ciphertext distribution module is used to encapsulate and encrypt the preliminary compliance data stream based on the encryption strength parameter in the dynamic access token and the public key information to obtain authorized data ciphertext, and send the authorized data ciphertext to the requester.

[0007] Thirdly, the present invention also provides an electronic device, comprising: a memory for storing computer software programs; and a processor for reading and executing the computer software programs, thereby implementing the microservice-based data access control method as described above.

[0008] Fourthly, the present invention also provides a non-transitory computer-readable storage medium storing a computer software program, which, when executed by a processor, implements the microservice-based data access control method described above.

[0009] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the microservice-based data access control method as described above.

[0010] The microservice-based data access control method provided in this invention constructs a current data access privacy environment context containing access link information and user identity information by using the link identifier and identity credentials in the data access request to be processed. Combined with the metadata record of the target data resource, a dynamic sensitivity label adapted to the current scenario is determined for the target data resource. This solves the problem of ignoring changes in dynamic data sensitivity and the access environment in existing technologies. Based on this dynamic sensitivity label, a pre-set privacy protection policy rule base is used for mapping to obtain the encryption strength parameter and de-identification instruction corresponding to the current data access. Based on the encryption strength parameter, de-identification instruction, and public key information in the identity credentials, a dynamic access token for the target data resource is determined. This achieves the binding of sensitivity, protection policy, and user identity information, breaking the limitations of traditional methods. Overcoming the limitations of static permission lists in existing technologies, this paper addresses the issue of using de-identification instructions in dynamic access tokens to transform the raw data stream intercepted at the microservice gateway into a preliminary compliant data stream. This ensures that the data stream meets the permission requirements of the current scenario, preventing unauthorized access due to improper permission configuration. Based on the encryption strength parameters and public key information in the dynamic access token, the preliminary compliant data stream is encapsulated and encrypted to obtain authorized data ciphertext, which is then sent to the requester. This not only guarantees the security of data transmission and access but also avoids over-encryption that could hinder business processes through dynamically adapted encryption strategies. This solves the privacy leakage risks and business process obstruction problems caused by relying solely on static role tags for permission judgment in existing technologies. Ultimately, this achieves flexible and secure data collaboration between microservices while protecting data privacy and security. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the microservice-based data access control method provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a microservice-based data access control system provided in an embodiment of the present invention; Figure 3 An embodiment diagram of the electronic device provided in this invention; Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0014] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0015] See Figure 1 , Figure 1 This is a flowchart illustrating the microservice-based data access control method provided by the present invention. In this embodiment, the executing entity of the microservice-based data access control method is the data access control system. Therefore, the microservice-based data access control method includes: Step 10: Based on the link identifier and identity credentials carried in the data access request to be processed, construct the privacy environment context of the current data access, and determine the dynamic sensitivity label of the target data resource based on the privacy environment context and the metadata record of the target data resource.

[0016] Optionally, the data access control system obtains a data access request initiated by a requester seeking to access target data resources. It then extracts the link identifier used to uniquely identify the access link and the identity credentials used to verify the requester's identity, carried in the request. Based on these two extracted pieces of information, a complete privacy environment context is constructed, as described in steps 101 to 105. This privacy environment context refers to a collection of various environmental information related to privacy and security during the current data access process. Specifically, it includes data transmission area attributes, call link risk level, and initiator credibility index. The link identifier is the identification information used to uniquely identify the current data access call link, and the identity credentials are the set of relevant information carried by the requester when initiating the data access request to prove their identity, including but not limited to the requester's identifier, the microservice information, and public key information.

[0017] Optionally, after the data access control system constructs a complete privacy environment context, it retrieves the metadata record corresponding to the target data resource, performs correlation analysis between the constructed privacy environment context and the metadata record, and determines the dynamic sensitivity label of the target data resource in the current access scenario based on the analysis results, as described in steps 106 to 109. Here, the metadata record of the target data resource refers to the data record describing the basic information of the target data resource, including but not limited to the type, source, creation time, associated business module, data storage region identifier, preset static basic sensitivity level, list of data field semantic types, and data access environment security threshold, etc.; the dynamic sensitivity label refers to the label dynamically determined according to the current privacy environment context and used to identify the current sensitivity level of the target data resource.

[0018] Step 20: Based on the dynamic sensitivity label and the preset privacy protection policy rule base, a mapping is performed to obtain the encryption strength parameters and desensitization instructions for the current data access.

[0019] Optionally, the data access control system retrieves a pre-defined privacy protection policy rule base based on dynamic sensitivity tags. This rule base is a set of rules pre-built according to the enterprise's data security needs, business scenario characteristics, and relevant compliance requirements, used to associate dynamic sensitivity tags with privacy protection operation parameters. The rule base stores encryption strength parameters and de-identification instructions corresponding to different dynamic sensitivity tags, and each dynamic sensitivity tag corresponds to a unique set of encryption strength parameters and de-identification instructions to ensure the consistency and specificity of the protection strategy. The encryption strength parameters are used to determine core encryption attributes such as data encryption algorithm complexity and key length. The higher the encryption strength parameter, the higher the security of the encrypted data. Specific details include encryption algorithm type, key length, and encryption iteration count. De-identification instructions are specific operation instructions used to process sensitive information in target data resources, making it unidentifiable while retaining data usability. The type of de-identification instruction is determined according to the type of sensitive information and the level of the dynamic sensitivity tag, and common de-identification instructions include replacement de-identification, mask de-identification, truncation de-identification, and encryption de-identification. The data access control system compares and matches dynamic sensitivity tags with the mapping relationship in the privacy protection policy rule base. Based on the matching result, it extracts the encryption strength parameters and desensitization instructions corresponding to the dynamic sensitivity tag, ensuring that the extracted encryption strength parameters and desensitization instructions can be adapted to the sensitivity level of the current target data resource, so as to effectively protect data privacy without excessively restricting the normal use of data.

[0020] Step 30: Based on the encryption strength parameter and the de-identification instruction combined with the public key information in the identity certificate, determine the dynamic access token for the target data resource.

[0021] Optionally, the data access control system integrates the encryption strength parameter, the de-identification instruction, and the public key information in the identity credential to generate a dynamic access token for authorizing the requester to access the target data resource, as described in steps 301 to 305. The public key information in the identity credential is a public key that the requester pre-registers and submits to the data access control system before initiating a data access request. It is used for subsequent data encryption and authentication, and only the corresponding private key can decrypt the encrypted data.

[0022] Step 40: Based on the de-identification instructions in the dynamic access token, perform permission compliance transformation on the original data stream intercepted at the microservice gateway to obtain a preliminary compliant data stream.

[0023] Optionally, after the data access control system generates a dynamic access token, it first confirms whether the target data resource corresponding to the original data stream intercepted by the microservice gateway is consistent with the target data resource in step 10 to avoid data confusion. If the data is consistent, according to the de-identification instructions contained in the dynamic access token, the sensitive information in the original data stream is strictly transformed according to the de-identification instructions. That is, only the sensitive fields specified by the de-identification instructions are processed so that the processed data stream no longer contains identifiable sensitive information, while retaining the normal use value of the data, to ensure that the structure of the original data stream and the integrity of non-sensitive information are not destroyed. After processing, the data access control system performs compliance verification on the transformed data stream. The verification includes whether the de-identification operation fully complies with the de-identification instructions, whether the data stream structure is complete, and whether non-sensitive information has been tampered with. If the verification passes, the data stream is determined to be a preliminary compliant data stream; if the verification fails, an exception message is returned, and the de-identification operation is re-executed until the verification passes.

[0024] The raw data stream refers to the set of raw data that has been intercepted by the microservice gateway after the requester initiates a data access request, without undergoing any privacy protection processing; the microservice gateway refers to the core component in the microservice architecture that is used to uniformly receive, intercept, and forward data access requests and data streams, and is responsible for unified management and control of all cross-microservice data access.

[0025] In one embodiment, assume the de-identification instructions extracted from the dynamic access token are: "De-identify ID card numbers using a mask (retain the first 6 and last 4 digits, replace the middle 8 digits with '*'), de-identify mobile phone numbers using a mask (retain the first 3 and last 4 digits, replace the middle 4 digits with '*'), and de-identify bank card numbers using truncation (retain the first 6 and last 4 digits, truncate the middle part)". The raw data stream intercepted by the microservice gateway contains the following data: ID card number "110101199001011234", mobile phone number "13800138000", bank card number "6222020108012345678", name "Zhang San", and business transaction number "202603190001".

[0026] The data access control system processes the original data stream according to the desensitization instructions: the ID card number is processed as "110101********1234", the mobile phone number as "138****8000", and the bank card number as "622202****5678". The name "Zhang San" and the transaction number "202603190001" are non-sensitive information and are not processed. After the above desensitization processing, the preliminary compliant data stream is as follows: ID card number "110101********1234", mobile phone number "138****8000", bank card number "6222025678", name "Zhang San", and transaction number "202603190001".

[0027] Step 50: Encapsulate and encrypt the preliminary compliant data stream based on the encryption strength parameter and public key information in the dynamic access token to obtain the authorized data ciphertext, and send the authorized data ciphertext to the requester.

[0028] Optionally, after receiving the initial compliant data stream, the data access control system extracts the encryption strength parameter contained in the dynamic access token and the public key information contained in the identity credential. Based on the encryption algorithm and key length set by the encryption strength parameter, it encapsulates and encrypts the initial compliant data stream using the public key information. During the encapsulation and encryption process, the initial compliant data stream is grouped, with each group's size meeting the requirements of the encryption algorithm. Each group is then encrypted using the public key information and the key corresponding to the encryption strength parameter, generating encrypted data blocks. All encrypted data blocks are then integrated and encapsulated, with encryption identifiers and data verification codes added to ultimately generate authorized data ciphertext. Simultaneously, the public key information is integrated into the encryption process to ensure that only the requester holding the corresponding private key can decrypt the encrypted data. After encryption, the authorized data ciphertext is obtained. This ciphertext is an authorized data format that has undergone both de-identification and encryption processing, meeting privacy protection requirements. It can only be restored to the initial compliant data stream after decryption and verification using the corresponding private key.

[0029] After the encrypted authorization data is generated, the data access control system performs integrity verification on the encrypted authorization data. The verification includes whether the encryption is complete, whether the data verification code is correct, and whether the encapsulation format meets the requirements. After the verification is passed, the encrypted authorization data is sent to the requester through the microservice gateway. At the same time, the data sending time, the requester's identifier, and the relevant information of the encrypted authorization data are recorded for subsequent traceability and auditing.

[0030] Continuing with the above embodiment, assume that the encryption strength parameter extracted from the dynamic access token is "key length 256 bits, using AES encryption algorithm", and the public key information in the identity credential is a 2048-bit asymmetric public key that has been submitted in advance by the requester and verified to be valid.

[0031] The data access control system divides the initial compliant data flow into three groups: customer basic information (customer name), identity identification (ID card number, mobile phone number), and address information (detailed address). Each group's data size conforms to the AES encryption algorithm requirements. Then, each group is encrypted using the public key and a 256-bit private key, generating three encrypted data blocks. These three encrypted data blocks are then integrated, with an AES encryption identifier and a data checksum added, and encapsulated into authorized data ciphertext. Next, the data access control system performs integrity verification on this authorized data ciphertext. After confirming that the encryption is complete, the checksum is correct, and the encapsulation format is compliant, the ciphertext is sent to the requesting party through a secure transmission channel between microservices. Upon receiving the authorized data ciphertext, the requesting party decrypts it using its corresponding private key, obtaining the initial compliant data flow and thus acquiring the required business data.

[0032] This invention constructs a current data access privacy environment context containing access link information and user identity information by using the link identifier and identity credentials in the data access request to be processed. Combined with the metadata record of the target data resource, a dynamic sensitivity tag adapted to the current scenario is determined for the target data resource. This solves the problem of ignoring changes in dynamic data sensitivity and the access environment in existing technologies. Based on this dynamic sensitivity tag, a pre-set privacy protection policy rule base is used for mapping to obtain the encryption strength parameter and de-identification instruction corresponding to the current data access. Based on the encryption strength parameter, de-identification instruction, and public key information in the identity credentials, a dynamic access token for the target data resource is determined. This achieves the binding of sensitivity, protection policy, and user identity information, breaking the static permissions of existing technologies. Overcoming the limitations of the list, this approach uses de-identification instructions in dynamic access tokens to transform the raw data stream intercepted at the microservice gateway into a preliminary compliant data stream. This ensures the data stream meets the permission requirements of the current scenario, preventing unauthorized access due to improper permission configuration. Based on the encryption strength parameters and public key information in the dynamic access token, the preliminary compliant data stream is encapsulated and encrypted to obtain authorized data ciphertext, which is then sent to the requester. This ensures the security of data transmission and access while avoiding over-encryption that could hinder business processes through dynamically adaptable encryption strategies. It solves the privacy leakage risks and business process obstruction problems caused by relying solely on static role tags for permission judgment in existing technologies. Ultimately, it achieves flexible and secure data collaboration between microservices while protecting data privacy and security.

[0033] Optionally, the process of steps 101 to 105 includes: Step 101: Based on the link identifier and identity credentials carried in the data access request to be processed, the unique path sequence group of the current microservice call link, the identity identifier of the requester, and the validity status information of the requester's digital certificate are parsed to obtain the requester's digital certificate.

[0034] Optionally, the data access control system acquires the data access request to be processed, extracts the link identifier and identity credentials carried in the request, and parses the link identifier and identity credentials. During the parsing process, the link identifier is first decoded to extract the microservice call node information contained therein, and the information of each node is organized into a unique path sequence group for the current microservice call link. This unique path sequence group refers to an ordered set containing the names of all microservice nodes passed through, arranged in the order of microservice calls, and it is unique. Then, the identity credentials are parsed to extract the requester's identity identifier and the validity period status information of the requester's digital certificate. The requester's identity identifier refers to the information used to uniquely identify the requester's identity, including the company name, user account, device number, etc., to ensure that different requesters can be accurately distinguished. The validity period status information of the requester's digital certificate refers to the status description of whether the digital certificate submitted by the requester is currently within the validity period, including two statuses: valid and expired, used to determine the legality of the requester's identity credentials. The digital certificate is a digital document issued by an authoritative institution to prove the identity of the requester, and it contains information such as the certificate holder, validity period, and encryption key.

[0035] Step 102: Based on the name of each microservice node in the unique path sequence group, a matching search is performed one by one with the preset microservice security domain division record table to obtain the number of cross-domain jumps in the current microservice call chain, the list of names of untrusted domain nodes passed through, and the deployment area codes of the microservice nodes at the beginning and end of the chain.

[0036] Optionally, the data access control system extracts each microservice node from the unique path sequence group and retrieves a preset microservice security domain partitioning record table. It then matches each microservice node name in the unique path sequence group with the microservice node names in the microservice security domain partitioning record table. Based on the matching results, it counts the number of times the current microservice call chain jumps from one security domain to another, thus obtaining the cross-domain jump count. It collects the names of microservice nodes belonging to untrusted domains from the matching results and compiles them into a list of untrusted domain node names. Simultaneously, it extracts the deployment region codes corresponding to the first microservice node (the starting microservice node of the link) and the last microservice node (the ending microservice node of the link) in the unique path sequence group. These deployment region codes are unique identifiers pre-assigned by the data access control system for each deployment region, used to distinguish different deployment regions.

[0037] The microservice security domain partitioning record table is a record table formed after the security domains of all microservice nodes are partitioned in advance according to the security requirements of the enterprise's microservice architecture. The table stores the correspondence between the name of each microservice node and the corresponding security domain type and deployment area code. The security domain type is divided into trusted domain and untrusted domain. The trusted domain refers to the area where microservice nodes that have undergone security authentication and can guarantee data security are located, while the untrusted domain refers to the area where microservice nodes that have not undergone complete security authentication and have data security risks are located.

[0038] Step 103: Based on the number of cross-domain jumps and the list of untrusted domain node names, a pre-set link risk assessment rule base is used for matching to obtain the call link risk level of the current data access process.

[0039] Optionally, the data access control system, based on the number of cross-domain jumps and the list of names of untrusted domain nodes traversed, retrieves a pre-defined link risk assessment rule base. It matches the number of cross-domain jumps and the list of untrusted domain node names with the rules in the link risk assessment rule base. First, it counts the number of nodes in the list of untrusted domain node names traversed, and then, combined with the number of cross-domain jumps, finds the corresponding link risk level. This risk level is the call link risk level of the current data access process, reflecting the security status of the current call link. The link risk assessment rule base is a set of rules pre-defined based on the security risk characteristics of microservice call links, used to assess link risk levels. The base stores the correspondence between the number of cross-domain jumps, the number of untrusted domain nodes, and the link risk level. The link risk level refers to the degree of data security risk present in the current microservice call link, divided into three levels: low risk, medium risk, and high risk. The risk level is determined by the number of cross-domain jumps and the number of untrusted domain nodes traversed; the higher the link risk level.

[0040] Step 104: Based on the requester's identity identifier and the validity period status information of the requester's digital certificate, a logical comparison is performed using a preset identity credibility judgment rule table to obtain the initiator's credibility index.

[0041] Optionally, the data access control system retrieves a preset identity credibility judgment rule table based on the requester's identity identifier and the validity period status information of the requester's digital certificate. It matches the requester's identity identifier with the identity identifier in the identity credibility judgment rule table to obtain the corresponding basic credibility score. Then, based on the validity period status information of the requester's digital certificate, it adjusts the basic credibility score according to the score adjustment rules to finally obtain the initiator credibility index. The identity credibility determination rule table is a pre-defined rule table for determining the initiator's credibility index based on factors such as the requester's identity attributes and the validity of their identity credentials. The table stores the basic credibility score corresponding to the requester's identity identifier and the score adjustment rules corresponding to the digital certificate's validity period. The initiator credibility index is a quantitative indicator used to measure the requester's identity credibility, ranging from 0 to 100. A higher index indicates higher credibility and greater trustworthiness of the requester. The basic credibility score is a fixed score pre-set based on factors such as the requester's identity type and historical access records. The score adjustment rules are rules for adjusting the basic credibility score based on the digital certificate's validity period. If the digital certificate is valid, a certain number of points are added to the basic credibility score; if the digital certificate has expired, a certain number of points are deducted from the basic credibility score. The adjusted score is the initiator credibility index.

[0042] Step 105: Based on the deployment area code of the microservice nodes at the beginning and end of the link, and combined with the preset data cross-border transmission compliance rule library, perform region matching to obtain the data transmission area attribute. Then, assemble the data transmission area attribute, the risk level of the call link, and the credibility index of the initiator to obtain the privacy environment context of the current data access.

[0043] Optionally, the data access control system retrieves a pre-defined cross-border data transmission compliance rule base. It matches the deployment region codes of the starting and ending microservice nodes with the rules in the rule base, determining the data transmission region attribute based on the matching results. Subsequently, it integrates and assembles the determined data transmission region attribute, the call link risk level, and the initiator's credibility index into a set containing these three core parameters. This set constitutes the privacy environment context for the current data access. The cross-border data transmission compliance rule base is a set of rules pre-defined based on national laws and regulations related to cross-border data transmission and enterprise data security compliance requirements. The base stores the correspondence between different combinations of deployment region codes and data transmission region attributes. The data transmission region attribute refers to the region type during the current data access process, from the deployment region of the starting microservice node to the deployment region of the ending microservice node. It is mainly divided into two types: domestic transmission and cross-border transmission. Domestic transmission refers to transmission where both the starting and ending deployment regions are within the same country, while cross-border transmission refers to transmission where the starting and ending deployment regions are in different countries.

[0044] This invention enables comprehensive and accurate collection and integration of key privacy environment parameters such as link security status, requester identity credibility, and data transmission area in the current data access scenario. It constructs a privacy environment context that can truly reflect the security status of the current access scenario, breaking the limitations of existing technologies that rely solely on static role tags for permission judgment and ignore dynamic changes in the access environment. It solves the core problem from the source that existing permission control methods cannot adapt to dynamic changes in data sensitivity.

[0045] Optionally, steps 106 to 109 include: Step 106: Based on the data transmission area attribute in the privacy environment context and the data storage area identifier in the metadata record of the target data resource, perform a regional consistency comparison to obtain the regional compliance matching status of data storage and transmission. Based on the regional compliance matching status, perform the first correction on the preset static basic sensitivity level in the metadata record of the target data resource to obtain the first sensitivity label.

[0046] Optionally, the data access control system retrieves the data storage region identifier from the metadata record of the target data resource based on the data transmission region attribute in the privacy environment context, and compares it with a preset static basic sensitivity level. The data storage region identifier refers to the region code used to identify the actual physical storage location of the target data resource, and this code is consistent with the deployment region code encoding rules in the privacy environment context. The static basic sensitivity level refers to a fixed sensitivity level pre-set based on the sensitive attributes of the target data resource itself (such as data type, scope, etc.); the higher the level, the higher the basic sensitivity of the data itself. The system compares the region range corresponding to the data transmission region attribute with the region range corresponding to the data storage region identifier to determine whether they are within the same compliant region, thus obtaining the region compliance matching status of data storage and transmission. The region compliance matching status is divided into two types: matching and non-matching. Matching means that the data storage region is consistent with the region range corresponding to the data transmission region attribute, meeting the data transmission compliance requirements; non-matching means that the data storage region is inconsistent with the region range corresponding to the data transmission region attribute, failing to meet the data transmission compliance requirements.

[0047] Optionally, the data access control system performs an initial correction on the preset static basic sensitivity level in the metadata record of the target data resource based on the regional compliance matching status. If the regional compliance matching status is matched, the static basic sensitivity level remains unchanged; if the regional compliance matching status is not matched, the static basic sensitivity level is increased by one level. The sensitivity identifier obtained after the initial correction is the first sensitivity label, which includes the hierarchical code after the static basic sensitivity level correction and the corresponding basic sensitivity description.

[0048] Step 107: Based on the risk level of the call chain in the privacy environment context and the preset data access environment security threshold in the metadata record of the target data resource, a risk tolerance logic judgment is made to obtain the risk acceptance conclusion of the current link environment for the target data resource. Based on the risk acceptance conclusion, the sensitivity classification code contained in the first sensitivity label is upgraded a second time to obtain the second sensitivity label.

[0049] Optionally, the data access control system retrieves a preset data access environment security threshold from the metadata record of the target data resource. This data access environment security threshold is a pre-set critical value used to measure whether the current call link risk level is acceptable. This threshold corresponds to the risk level classification standard of the call link and is divided into three levels: low risk threshold, medium risk threshold, and high risk threshold, corresponding to the low, medium, and high risk levels of the call link, respectively. It is used to determine whether the current link environment can securely support access to the target data resource. The call link risk level and the data access environment security threshold are used for risk tolerance logic judgment. If the call link risk level is lower than or equal to the data access environment security threshold, the current link environment can accept access to the target data resource, and the risk acceptance conclusion is "accepted"; if the call link risk level is higher than the data access environment security threshold, the current link environment cannot accept access to the target data resource, and the risk acceptance conclusion is "not accepted".

[0050] Optionally, based on the risk acceptance conclusion, the data access control system performs a secondary upgrade on the sensitivity classification code contained in the first sensitivity label. If the risk acceptance conclusion is "accepted", the sensitivity classification code remains unchanged; if the risk acceptance conclusion is "not accepted", the sensitivity classification code of the first sensitivity label is upgraded by one level. The sensitivity identifier obtained after the secondary upgrade is the second sensitivity label, which contains the upgraded sensitivity classification code, basic sensitivity description, and corresponding link risk adaptation instructions.

[0051] Step 108: Based on the initiator's credibility index in the privacy environment context and the minimum credibility access index registered in the metadata record of the target data resource, perform subject qualification compliance verification to obtain the data access qualification determination result of the requesting subject, and perform three replacements on the de-identification strategy identifier bound in the second sensitivity label based on the data access qualification determination result to obtain the third sensitivity label.

[0052] Optionally, the data access control system extracts the initiator's credibility index from the privacy environment context and simultaneously retrieves the minimum credibility access index registered in the metadata record of the target data resource. This minimum credibility access index refers to a pre-set minimum credibility standard required for the requester to access the target data resource, with a value range consistent with the initiator's credibility index (0-100). Different sensitivity levels of target data resources correspond to different minimum credibility access indices; the higher the sensitivity level, the higher the minimum credibility access index, used to verify whether the requesting entity is qualified to access the target data resource. The initiator's credibility index and the minimum credibility access index are used for entity qualification compliance verification. The verification logic is as follows: if the initiator's credibility index is greater than or equal to the minimum credibility access index, the requesting entity is qualified to access the target data resource, and the data access qualification judgment result is "qualified"; if the initiator's credibility index is less than the minimum credibility access index, the requesting entity is not qualified to access the target data resource, and the data access qualification judgment result is "unqualified".

[0053] Optionally, based on the data access qualification determination result, the data access control system performs three replacements on the de-identification policy identifier bound to the second sensitivity label. The de-identification policy identifier is a unique code used to identify a specific de-identification policy, and different de-identification policy identifiers correspond to different de-identification operation requirements. The replacement rules are preset. If the data access qualification determination result is "qualified", the de-identification policy identifier remains unchanged. If the data access qualification determination result is "unqualified", the de-identification policy identifier bound to the second sensitivity label is replaced with a de-identification policy identifier corresponding to a higher security level. The sensitivity label obtained after three replacements is the third sensitivity label. The third sensitivity label includes a sensitivity classification code, a basic sensitivity description, a link risk adaptation description, and the replaced de-identification policy identifier.

[0054] Step 109: Based on the third sensitivity tag and combined with the metadata record of the target data resource, perform semantic mapping and encapsulation to obtain the dynamic sensitivity tag.

[0055] Optionally, the data access control system performs semantic mapping between the third sensitivity label and the metadata record of the target data resource. Subsequently, the mapped information is standardized and encapsulated to form a dynamic sensitivity label containing all core sensitive information and adaptation information, as described in steps 1091 to 1093.

[0056] This invention deeply integrates the dynamic changes of the privacy environment context with the basic sensitive attributes of the target data resource, breaking the limitation of relying solely on static sensitivity labels in the prior art. It can accurately determine the actual sensitivity of the target data resource in the current access scenario, and the generated dynamic sensitivity labels comprehensively cover various scenario factors such as regional compliance, link risk, and requester credibility.

[0057] Optionally, the process of steps 1091 to 1093 includes: Step 1091: Based on the desensitization strategy identifier currently bound in the third sensitivity label and the list of semantic types of data fields described in the metadata record of the target data resource, perform semantic mapping matching to obtain the specific desensitization action instruction set corresponding to each data field.

[0058] Optionally, the data access control system extracts the desensitization policy identifier currently bound to the third sensitivity label, and simultaneously retrieves the list of data field semantic types described in the metadata record of the target data resource. This list of data field semantic types refers to a list that records the name, semantic meaning, and field type of all data fields in the target data resource. Each data field corresponds to a unique semantic type, which is used to clarify the specific meaning and purpose of each data field. For example, the name field corresponds to "personal identification type", the mobile phone number field corresponds to "personal contact information type", and the business serial number field corresponds to "business identification type", etc. Based on the complete desensitization strategy corresponding to the desensitization strategy identifier in the third sensitivity label, each data field and its semantic type in the list of data field semantic types are extracted one by one. The semantic type of each data field is matched with the "semantic type-desensitization action" correspondence specified in the desensitization strategy. A specific desensitization action is assigned to each data field. After integrating the specific desensitization actions corresponding to all data fields, a specific desensitization action instruction set for each data field is formed. The specific desensitization action instruction set refers to the collection of all data fields of the target data resource and the specific desensitization operation instructions corresponding to each data field. Each desensitization operation instruction clearly specifies the operation method, operation scope and other details to ensure that the desensitization operation can be implemented and executed.

[0059] Step 1092: Configure the field-level control mask in the third sensitivity label four times based on the specific desensitization action instruction set to obtain the fourth sensitivity label.

[0060] Optionally, the data access control system retrieves the field-level control mask contained in the third sensitivity label. This field-level control mask is a binary identifier mask used to identify whether each data field in the target data resource needs to be desensitized and the strength of the desensitization control. Each bit of the mask corresponds to a data field, and the value of each bit (0 or 1) represents the desensitization control status of the field. 0 means no desensitization control is performed, and 1 means desensitization control is required. The field-level control mask corresponds one-to-one with the data fields in the data field semantic type list. Subsequently, based on the specific desensitization action instruction set, the field-level control mask in the third sensitivity label is configured four times. The configuration process includes: confirming that the number and order of data fields in the field-level control mask are completely consistent with the list of data field semantic types; if inconsistent, adjusting the mask length and order; determining whether each data field needs desensitization control based on the desensitization actions in the specific desensitization action instruction set; setting the corresponding bit of the mask to 1 if needed, and 0 if not; verifying the consistency of the mask bit values ​​corresponding to each field with the specific desensitization action instruction set to avoid configuration errors; and standardizing the configured field-level control mask to ensure its format can be recognized and parsed by subsequent encapsulation stages. The sensitivity identifier obtained after these four configurations is the fourth sensitivity label, which contains all the information of the third sensitivity label (sensitivity classification code, basic sensitivity description, link risk adaptation description, desensitization strategy identifier) ​​and the configured field-level control mask.

[0061] Step 1093: Based on the field-level control mask in the fourth sensitivity label and the sensitivity classification code currently carried, perform consistent encapsulation to obtain the dynamic sensitivity label of the target data resource.

[0062] Optionally, the data access control system extracts the field-level control mask and the currently carried sensitivity classification code from the fourth sensitivity label. The currently carried sensitivity classification code refers to the sensitivity classification code retained in the fourth sensitivity label after the first correction and second upgrade, used to identify the overall sensitivity level of the target data resource. The field-level control mask and the currently carried sensitivity classification code are encapsulated for consistency. The encapsulation includes: first, verifying whether the desensitization control strength of the field-level control mask is consistent with the sensitivity level corresponding to the sensitivity classification code. If they are inconsistent, the configuration of the field-level control mask is adjusted (without re-executing step 1092, only the mask bit values ​​are fine-tuned). If they are consistent, they are directly integrated and encapsulated. Subsequently, all relevant information is organized according to the preset label format to ensure that the label information is complete, logically clear, and can be identified by subsequent steps, ultimately obtaining the dynamic sensitivity label of the target data resource.

[0063] This invention enables the refined and standardized generation of dynamic sensitivity tags, implementing desensitization strategies in specific data fields. It overcomes the shortcomings of relying solely on the overall sensitivity level to achieve precise field-level control, further enhancing the adaptability of dynamic sensitivity tags to the current access scenario and target data resource attributes. This ensures that the generated dynamic sensitivity tags not only comprehensively cover scenario factors but also possess implementable field-level control capabilities.

[0064] Optionally, the processes of steps 301 to 305 include: Step 301: Based on the symmetric encryption algorithm identifier and key length value in the encryption strength parameter, and combined with the current system timestamp in the privacy environment context, generate a time-sensitive temporary session key seed, and based on the temporary session key seed and a preset key derivation function, determine the key binary string of the current data access session.

[0065] Optionally, the data access control system extracts the symmetric encryption algorithm identifier and key length value from the encryption strength parameter. Simultaneously, it extracts the current system timestamp from the privacy environment context. The symmetric encryption algorithm identifier is a unique code used to identify the type of symmetric encryption algorithm; different codes correspond to different symmetric encryption algorithms, clarifying the algorithmic basis for subsequent key generation. The key length value refers to the number of bits in the key of the symmetric encryption algorithm; the more bits, the higher the key's security. The current system timestamp is the time code corresponding to the current system time of the data access control system, accurate to milliseconds, used to provide timeliness for the temporary session key seed. The symmetric encryption algorithm identifier, key length value, and current system timestamp are combined to generate a time-sensitive temporary session key seed. This temporary session key seed refers to the basic data used to derive the session key, has a time limit, and its validity period is bound to the current system timestamp; it automatically expires after a preset validity period.

[0066] Optionally, the data access control system retrieves a preset key derivation function. This key derivation function is a pre-defined function used to convert a temporary session key seed into a key binary string that meets encryption requirements. The temporary session key seed is input into the preset key derivation function, and processed according to the function's preset operation rules to finally determine the key binary string of the current data access session. The key binary string is a binary data sequence composed of 0s and 1s used for subsequent data encryption, and its length is consistent with the key length value.

[0067] Step 302: Based on the public key modulus and public key exponent of the requester subject in the identity credential, and combined with the key binary string, perform asymmetric encryption encapsulation to obtain the encrypted key payload ciphertext block.

[0068] Optionally, the data access control system extracts the requester's public key modulus and public key exponent from the public key information in the identity credentials. The requester's public key modulus refers to the core parameter in the requester's public key, used for modulo operations in asymmetric encryption. The public key exponent refers to the exponent parameter in the requester's public key, used in conjunction with the public key modulus for exponential operations in asymmetric encryption. It is a pre-set fixed integer to ensure the consistency of encryption operations. The extracted modulus and exponent of the requester's public key are verified to ensure they are valid, unaltered, and match the requester's identity. After successful verification, the binary key string is used as the data to be encrypted. Combined with the modulus and exponent of the requester's public key, an asymmetric encryption encapsulation operation is performed. Specifically, the binary key string is first converted to its corresponding integer form. Then, using this integer as the base, the exponent as the exponent, and the modulus as the modulus, a power-law operation is performed to obtain the encrypted integer result. This integer result is then converted to binary ciphertext, ultimately yielding the encrypted key payload ciphertext block. This ciphertext block refers to the ciphertext data block obtained after asymmetric encryption of the binary key string, which can only be decrypted using the requester's private key.

[0069] Step 303: Based on the field-level mask rule sequence and data replacement value mapping table in the de-identification instruction, serialize and concatenate each rule code in the field-level mask rule sequence and each mapping entry in the data replacement value mapping table to obtain a standardized de-identification execution instruction byte stream.

[0070] Optionally, the data access control system extracts the field-level masking rule sequence and data replacement value mapping table from the de-identification instructions. The field-level masking rule sequence refers to a set of rules used to de-identify different fields in the target data resource, arranged in field order. Each rule corresponds to a data field and includes information such as rule code, field identifier, and masking method. The rule code is a unique identifier for each de-identification rule, ensuring its identifiability. The data replacement value mapping table is a table used to store the correspondence between replacement values ​​and original sensitive values ​​during the de-identification process. It contains multiple mapping entries, each consisting of a fragment of the original sensitive value and its corresponding replacement value, used to quickly find the replacement content during the de-identification process. After extraction, the field-level masking rule sequence and data replacement value mapping table are validated to confirm the completeness of the rule sequence, the absence of missing mapping table entries, and the correct correspondence. Subsequently, each rule code in the field-level masking rule sequence is sequentially serialized and concatenated with each mapping entry in the data replacement value mapping table. This involves converting the rule code and mapping entry into a unified byte format and concatenating them in the order of "rule code + mapping entry" to form a continuous byte sequence. During the concatenation process, each concatenation unit undergoes format standardization to ensure that it can be recognized and parsed by the microservice gateway. The final result is a standardized de-identification execution instruction byte stream, which refers to the standardized instruction data used to guide the microservice gateway to perform de-identification operations. It contains complete de-identification rules and replacement information.

[0071] Step 304: Based on the de-identification execution instruction byte stream and the unique identifier string of the data resource contained in the metadata record of the target data resource, determine the instruction integrity verification hash value that represents the binding relationship between the de-identification rule and the data resource.

[0072] Optionally, the data access control system retrieves the metadata records of the target data resource and extracts the unique identifier string contained therein. This unique identifier string is a string encoding used to uniquely identify the target data resource, pre-assigned by the data access control system. Each target data resource corresponds to a unique identifier to distinguish different data resources and ensure the accurate binding of the de-identification rules to the data resource. The de-identification execution instruction byte stream is combined with the unique identifier string of the data resource to obtain combined data. Then, a preset hash algorithm is retrieved. This hash algorithm is a pre-defined algorithm used to convert input data of arbitrary length into a fixed-length hash value to verify the integrity of the data and prevent data tampering. The combined data is input into the preset hash algorithm, and the combined data is hashed according to the algorithm's preset operation rules to obtain a fixed-length hash value. This hash value is the instruction integrity verification hash value representing the binding relationship between the de-identification rule and the data resource. It is used to verify whether the subsequent de-identification execution instruction has been tampered with and whether it matches the target data resource. If the verification hash value is inconsistent, it indicates that the instruction has been tampered with or does not match, and the de-identification operation is refused.

[0073] Step 305: Based on the encrypted key payload ciphertext block, instruction integrity verification hash value, and link tracing identifier in the privacy environment context, construct a token core data structure containing key payload, integrity verification value, and link tracing information, and encapsulate the token core data structure with trust endorsement to obtain a dynamic access token.

[0074] Optionally, the data access control system extracts a link tracing identifier from the privacy environment context. This link tracing identifier is an identification information used to uniquely track the current data access link, consistent with the link identifier in step 101, and is used to bind the dynamic access token to the data access link. The three core data elements—the encrypted key payload ciphertext block, the instruction integrity verification hash value, and the link tracing identifier—are integrated to construct a token core data structure. This token core data structure is a data structure used to store the core information of the dynamic access token, containing three fields: encrypted key payload, integrity verification value, and link tracing information. Each field corresponds to one core data element, ensuring the orderly storage and rapid retrieval of core information.

[0075] Optionally, the data access control system performs trust endorsement encapsulation on the core data structure of the token, and after encapsulation, forms a dynamic access token that conforms to a preset format and contains complete authorization information, as described in steps 3051 to 3053.

[0076] The embodiments of the present invention achieve deep binding of encryption keys, de-identification instructions, link information and user identity information. The generated dynamic access token has timeliness, security and integrity, breaking the limitations of static permission lists in the prior art. It ensures that the dynamic access token can accurately adapt to the security requirements of the current data access scenario, and protects the security and compliance of data access.

[0077] Optionally, the processes of steps 3051 to 3053 include: Step 3051: Based on the token core data structure and the token validity expiration time stamp string contained in the privacy environment context, add a version information field and an expiration control field to the header of the token core data structure to obtain the complete token payload object.

[0078] Optionally, the data access control system extracts the token validity expiration time stamp string contained in the privacy environment context. This string is a pre-defined timestamp encoding corresponding to the expiration time of the dynamic access token, consistent with the current system timestamp encoding rules in step 301. It controls the validity of the dynamic access token, avoiding security risks associated with long-term token validity. Subsequently, two core fields are added to the token core data structure: a version information field and a validity control field. The version information field identifies the format version of the dynamic access token, storing the token's version code, which is a pre-defined integer. Different versions correspond to different token format specifications. The validity control field stores the token's validity information, specifically storing the extracted token validity expiration time stamp string, used by the microservice gateway to verify the token's validity. Add the version information field to the header of the token core data structure, and follow the expiration control field immediately after the version information field. Integrate these fields with the three fields of the original token core data structure (encryption key payload, integrity verification value, and link traceability information) to form a complete data object containing five fields. This data object is the complete token payload object, which contains all the core information required for dynamic access tokens.

[0079] Step 3052: Perform a full-domain digital signature on the complete token payload object based on the gateway private key held by the microservice gateway to obtain a signed data block.

[0080] Optionally, the data access control system retrieves the gateway private key held by the microservice gateway. This gateway private key is a private key exclusive to the microservice gateway, pre-negotiated and generated by the data access control system and the microservice gateway. After retrieval, the complete token payload object is standardized, converting it into a unified data format suitable for digital signature operations to avoid signature failures or unverifiable signatures due to format inconsistencies. Subsequently, using the gateway private key held by the microservice gateway, a global digital signature operation is performed on the standardized complete token payload object. The specific signing process is as follows: a preset digital signature algorithm (such as the RSA digital signature algorithm) is retrieved; the standardized complete token payload object is input into the algorithm; the gateway private key is used to perform a hash operation on it; after obtaining the hash value, the gateway private key is used to encrypt the hash value to generate fixed-length signature data. This signature data is the signature data block, which is used by the microservice gateway to verify the integrity and source legitimacy of the complete token payload object. If the complete token payload object is tampered with, the signature data block will fail verification.

[0081] Step 3053: Based on the signed data block and the complete token payload object, append the signed data block to the end of the complete token payload object according to the preset token encoding format specification and perform serialization encoding to obtain the dynamic access token.

[0082] Optionally, the data access control system retrieves a preset token encoding format specification. This token encoding format specification refers to a pre-defined format rule for encoding a signature data block and a complete token payload object into a dynamic access token. The specification clarifies the combination order, encoding method, and format requirements of the signature data block and the complete token payload object to ensure that the generated dynamic access token can be recognized, parsed, and verified by the microservice gateway. The encoding method adopts a pre-defined standardized encoding method to convert the data into a transmittable and storable string format, avoiding loss or corruption during data transmission.

[0083] Optionally, the data access control system, following the token encoding format specification, first preserves the original format and order of the complete token payload object, then appends the signature data block to the end of the complete token payload object, forming a combined data of "complete token payload object + signature data block". Subsequently, the combined data undergoes serialization encoding processing, that is, it is converted into a string sequence conforming to the token encoding format specification, and the binary information and field information in the combined data are converted into a unified character encoding to ensure the integrity and transmissibility of the combined data. The string sequence obtained after encoding is the dynamic access token, which contains complete token payload information and signature information.

[0084] The embodiments of this invention enhance the security, timeliness, and standardization of dynamic access tokens, and achieve deep binding of encryption keys, de-identification instructions, link information, and user identity information. This solves the problems of existing dynamic access tokens lacking effective trust endorsement, being easily tampered with, and having insufficient timeliness control. It ensures that the generated dynamic access tokens can accurately adapt to the security requirements of the current data access scenario, breaks the limitations of static permission lists, and guarantees the security and compliance of data access.

[0085] Furthermore, the microservice-based data access control system provided by the present invention will be described below. The microservice-based data access control system described below can be referred to in correspondence with the microservice-based data access control method described above.

[0086] Optional, refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of the microservice-based data access control system provided by the present invention. The microservice-based data access control system includes: The context construction and sensitivity label determination module 210 is used to construct the privacy environment context of the current data access based on the link identifier and identity credentials carried in the data access request to be processed, and to determine the dynamic sensitivity label of the target data resource based on the privacy environment context combined with the metadata record of the target data resource. The parameter and instruction mapping module 220 is used to map based on dynamic sensitivity tags and a preset privacy protection policy rule base to obtain the encryption strength parameters and desensitization instructions for the current data access. Access token generation module 230 is used to determine a dynamic access token for the target data resource based on encryption strength parameters and de-identification instructions combined with public key information in the identity credential. The permission compliance transformation module 240 is used to perform permission compliance transformation on the original data stream intercepted at the microservice gateway based on the de-identification instructions in the dynamic access token, so as to obtain a preliminary compliant data stream; The encapsulation, encryption, and ciphertext distribution module 250 is used to encapsulate and encrypt the initial compliant data stream based on the encryption strength parameters and public key information in the dynamic access token, obtain the authorized data ciphertext, and send the authorized data ciphertext to the requester.

[0087] The embodiments of the present invention solve the problems of privacy leakage risks and business flow obstruction caused by the prior art that only relies on static role tags for permission judgment. Ultimately, it realizes flexible and secure data collaboration between microservices while protecting data privacy and security.

[0088] Please see Figure 3 , Figure 3 An embodiment diagram of an electronic device provided in accordance with the present invention. For example... Figure 3As shown, this embodiment of the invention provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, it performs the following steps: Based on the link identifier and identity credentials carried in the data access request to be processed, a privacy environment context for the current data access is constructed, and based on the privacy environment context and the metadata record of the target data resource, the dynamic sensitivity label of the target data resource is determined. Based on the mapping of dynamic sensitivity tags and the preset privacy protection policy rule base, the encryption strength parameters and desensitization instructions for the current data access are obtained; Based on the encryption strength parameter and de-identification instruction combined with the public key information in the identity credential, a dynamic access token for the target data resource is determined. Based on the de-identification instructions in the dynamic access token, the original data stream intercepted at the microservice gateway is transformed for permission compliance to obtain a preliminary compliant data stream; The initial compliant data stream is encapsulated and encrypted based on the encryption strength parameter and public key information in the dynamic access token to obtain the authorized data ciphertext, which is then sent to the requester.

[0089] Please see Figure 4 , Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with an embodiment of the present invention is shown. Figure 4 As shown, this embodiment provides a computer-readable storage medium 400 on which a computer program 311 is stored. When the computer program 311 is executed by a processor, it performs the following steps: Based on the link identifier and identity credentials carried in the data access request to be processed, a privacy environment context for the current data access is constructed, and based on the privacy environment context and the metadata record of the target data resource, the dynamic sensitivity label of the target data resource is determined. Based on the mapping of dynamic sensitivity tags and the preset privacy protection policy rule base, the encryption strength parameters and desensitization instructions for the current data access are obtained; Based on the encryption strength parameter and de-identification instruction combined with the public key information in the identity credential, a dynamic access token for the target data resource is determined. Based on the de-identification instructions in the dynamic access token, the original data stream intercepted at the microservice gateway is transformed for permission compliance to obtain a preliminary compliant data stream; The initial compliant data stream is encapsulated and encrypted based on the encryption strength parameter and public key information in the dynamic access token to obtain the authorized data ciphertext, which is then sent to the requester.

[0090] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the microservice-based data access control method provided by the above methods, the method including: Based on the link identifier and identity credentials carried in the data access request to be processed, a privacy environment context for the current data access is constructed, and based on the privacy environment context and the metadata record of the target data resource, the dynamic sensitivity label of the target data resource is determined. Based on the mapping of dynamic sensitivity tags and the preset privacy protection policy rule base, the encryption strength parameters and desensitization instructions for the current data access are obtained; Based on the encryption strength parameter and de-identification instruction combined with the public key information in the identity credential, a dynamic access token for the target data resource is determined. Based on the de-identification instructions in the dynamic access token, the original data stream intercepted at the microservice gateway is transformed for permission compliance to obtain a preliminary compliant data stream; The initial compliant data stream is encapsulated and encrypted based on the encryption strength parameter and public key information in the dynamic access token to obtain the authorized data ciphertext, which is then sent to the requester.

[0091] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0092] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data access control method based on microservices, characterized in that, include: Based on the link identifier and identity credentials carried in the data access request to be processed, a privacy environment context for the current data access is constructed, and based on the privacy environment context and the metadata record of the target data resource, the dynamic sensitivity label of the target data resource is determined. Based on the dynamic sensitivity tag and the preset privacy protection policy rule base, the encryption strength parameter and desensitization instruction for the current data access are obtained by mapping. Based on the encryption strength parameter and the de-identification instruction, combined with the public key information in the identity credential, a dynamic access token for the target data resource is determined; Based on the de-identification instructions in the dynamic access token, the original data stream intercepted at the microservice gateway is transformed for permission compliance to obtain a preliminary compliant data stream; The preliminary compliance data stream is encapsulated and encrypted based on the encryption strength parameter in the dynamic access token and the public key information to obtain authorized data ciphertext, which is then sent to the requester.

2. The data access control method based on microservices according to claim 1, characterized in that, The privacy environment context includes data transmission area attributes, call chain risk level, and initiator credibility index.

3. The data access control method based on microservices according to claim 2, characterized in that, The process of constructing a privacy environment context for the current data access based on the link identifier and identity credentials carried in the data access request to be processed includes: Based on the link identifier and identity credentials carried in the data access request to be processed, the unique path sequence group of the current microservice call link, the identity identifier of the requester, and the validity status information of the requester's digital certificate are obtained. Based on the name of each microservice node in the unique path sequence group, a matching search is performed one by one with the preset microservice security domain division record table to obtain the number of cross-domain jumps in the current microservice call chain, the list of names of untrusted domain nodes passed through, and the deployment area codes of the microservice nodes at the beginning and end of the chain. The risk level of the call link in the current data access process is obtained by matching the number of cross-domain jumps with the list of untrusted domain node names in combination with a preset link risk assessment rule base. Based on the requester's identity identifier and the validity status information of the requester's digital certificate, a logical comparison is performed using a preset identity credibility judgment rule table to obtain the initiator credibility index. Based on the deployment region codes of the microservice nodes at the start and end of the link, combined with a preset data cross-border transmission compliance rule base, region matching is performed to obtain the data transmission region attribute. The data transmission region attribute, the call link risk level, and the initiator credibility index are then assembled to obtain the privacy environment context of the current data access.

4. The data access control method based on microservices according to claim 3, characterized in that, The step of determining the dynamic sensitivity label of the target data resource based on the privacy environment context and the metadata record of the target data resource includes: Based on the data transmission area attribute in the privacy environment context and the data storage area identifier in the metadata record of the target data resource, a regional consistency comparison is performed to obtain the regional compliance matching status of data storage and transmission. Based on the regional compliance matching status, the preset static basic sensitivity level in the metadata record of the target data resource is corrected for the first time to obtain the first sensitivity label. Based on the risk level of the call chain in the privacy environment context and the preset data access environment security threshold in the metadata record of the target data resource, a risk tolerance logic judgment is made to obtain the risk acceptance conclusion of the current link environment for the target data resource. Based on the risk acceptance conclusion, the sensitivity classification code contained in the first sensitivity label is upgraded a second time to obtain the second sensitivity label. Based on the initiator's credibility index in the privacy environment context and the minimum credibility access index registered in the metadata record of the target data resource, the subject qualification compliance verification is performed to obtain the data access qualification determination result of the requesting subject. Based on the data access qualification determination result, the de-identification strategy identifier bound in the second sensitivity label is replaced three times to obtain the third sensitivity label. Based on the third sensitivity tag and the metadata record of the target data resource, semantic mapping and encapsulation are performed to obtain the dynamic sensitivity tag.

5. The data access control method based on microservices according to claim 4, characterized in that, The process of semantic mapping and encapsulation based on the third sensitivity tag and the metadata records of the target data resource to obtain the dynamic sensitivity tag includes: Based on the desensitization strategy identifier currently bound in the third sensitivity tag and the list of semantic types of data fields described in the metadata record of the target data resource, a semantic mapping match is performed to obtain the specific desensitization action instruction set corresponding to each data field; Based on the specific desensitization action instruction set, the field-level control mask in the third sensitivity label is configured four times to obtain the fourth sensitivity label; Based on the field-level control mask in the fourth sensitivity label and the sensitivity classification code currently carried, the dynamic sensitivity label of the target data resource is obtained by consistent encapsulation.

6. The data access control method based on microservices according to claim 1, characterized in that, The step of determining a dynamic access token for the target data resource based on the encryption strength parameter, the de-identification instruction, and the public key information in the identity credential includes: Based on the symmetric encryption algorithm identifier and key length value in the encryption strength parameter, and combined with the current system timestamp in the privacy environment context, a time-sensitive temporary session key seed is generated. Based on the temporary session key seed and a preset key derivation function, the key binary string of the current data access session is determined. Based on the public key modulus and public key exponent of the requesting party's public key information in the identity credential, and combined with the key binary string, asymmetric encryption encapsulation is performed to obtain the encrypted key payload ciphertext block. Based on the field-level mask rule sequence and data replacement value mapping table in the de-identification instruction, each rule code in the field-level mask rule sequence and each mapping entry in the data replacement value mapping table are serialized and concatenated to obtain a standardized de-identification execution instruction byte stream; Based on the de-identification execution instruction byte stream and the unique identifier string of the data resource contained in the metadata record of the target data resource, determine the instruction integrity verification hash value that represents the binding relationship between the de-identification rule and the data resource; Based on the encrypted key payload ciphertext block, the instruction integrity verification hash value, and the link tracing identifier in the privacy environment context, a token core data structure containing key payload, integrity verification value, and link tracing information is constructed, and the token core data structure is encapsulated with trust endorsement to obtain the dynamic access token.

7. The data access control method based on microservices according to claim 6, characterized in that, The process of encapsulating trust endorsement based on the core token data structure to obtain the dynamic access token includes: Based on the token core data structure and the token validity expiration time stamp string contained in the privacy environment context, a version information field and an expiration control field are added to the header of the token core data structure to obtain a complete token payload object; The complete token payload object is digitally signed using the gateway private key held by the microservice gateway to obtain a signed data block. Based on the signature data block and the complete token payload object, the signature data block is appended to the end of the complete token payload object according to the preset token encoding format specification and then serialized and encoded to obtain the dynamic access token.

8. A microservice-based data access control system, characterized in that, Applied to the microservice-based data access control method as described in any one of claims 1 to 7; The microservice-based data access control system includes: The context construction and sensitivity label determination module is used to construct the privacy environment context of the current data access based on the link identifier and identity credentials carried in the data access request to be processed, and to determine the dynamic sensitivity label of the target data resource based on the privacy environment context and the metadata record of the target data resource. The parameter and instruction mapping module is used to map the dynamic sensitivity label and the preset privacy protection policy rule base to obtain the encryption strength parameter and desensitization instruction for the current data access. An access token generation module is used to determine a dynamic access token for the target data resource based on the encryption strength parameter, the de-identification instruction, and the public key information in the identity credential. The permission compliance transformation module is used to perform permission compliance transformation on the original data stream intercepted at the microservice gateway based on the de-identification instructions in the dynamic access token, so as to obtain a preliminary compliant data stream; The encapsulation encryption and ciphertext distribution module is used to encapsulate and encrypt the preliminary compliance data stream based on the encryption strength parameter in the dynamic access token and the public key information to obtain authorized data ciphertext, and send the authorized data ciphertext to the requester.

9. An electronic device, characterized in that, include: Memory, used to store computer software programs; A processor is configured to read and execute the computer software program, wherein when the processor executes the computer software program, it implements the microservice-based data access control method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer software program, which, when executed by a processor, implements the microservice-based data access control method as described in any one of claims 1 to 7.

Images