IT system security control method, device and computing equipment for preventing data leakage

Abstract

Embodiments of the present invention relate to the field of computer technology and disclose a security management method, apparatus, and computing device for preventing data leakage in an IT system. The method comprises: obtaining a data transmission request for data interaction from any process in the IT system and temporarily storing the requested data in a push stack; obtaining encryption information corresponding to the process; encrypting the data according to the encryption information and transmitting it to a pop stack; and outputting the encrypted data from the pop stack to continue the data interaction in the process. Through the above-described method, the embodiments of the present invention greatly improve the security factor of the IT system by encrypting data interaction within the IT system, preventing the leakage of sensitive data.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more particularly to a method, apparatus, and computing device for preventing data leakage in an IT system. Background Art

[0002] In the existing technology, there is no system device customized for the data security requirements of IT systems; only local encryption devices exist. Furthermore, existing technologies are not suitable for the security requirements of IT systems. Existing technologies receive an encryption instruction for a target plaintext password; obtain at least two keys that indicate the identity of the user holding the target plaintext password; and encrypt the target plaintext password using these at least two keys. This can be applied to the encryption process of local plaintext keys.

[0003] Existing technologies perform independent encryption during data transmission and storage, lacking systematic, unified management. Furthermore, there's a lack of comprehensive encryption methods for web applications. Almost all existing technologies only encrypt data at specific steps. Some technologies limit data encryption to the entire system interacting with external data or messages, leaving internal data interactions unaddressed. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention provide a method, apparatus, and computing device for preventing data leakage in an IT system, which overcome the above problems or at least partially solve the above problems.

[0005] According to one aspect of an embodiment of the present invention, a security management and control method for preventing data leakage in an IT system is provided, the method comprising: obtaining a data transmission request for data interaction by any process in the IT system, and temporarily storing the requested data in a push stack; obtaining encryption information corresponding to the process; encrypting the data according to the encryption information and transmitting it to a pop stack; and outputting the encrypted data from the pop stack to continue completing the process data interaction.

[0006] In an optional manner, before obtaining the encryption information corresponding to the process, it includes: configuring the encryption information required for use in the encryption processing of any process in the IT system to form a basic configuration table; configuring the WEB layer host, application host and database host that allow data interaction in the IT system; configuring the interaction configuration table for data interaction with different WEB layer hosts, application hosts and database hosts; and caching the basic configuration table and the interaction configuration table in an encryption cache pool.

[0007] In an optional manner, the configuration of encryption information required for encryption processing of any process in the IT system includes: configuring the protocol type adopted by the IT system for external interaction; configuring the IP address of the data source and the IP address of the destination of the processed data; configuring encryption algorithms for different types of data; storing all encryption algorithms used in the system; configuring all keys required in the IT system and managing them in a unified manner.

[0008] In an optional manner, the obtaining of the encryption information corresponding to the process includes: obtaining the encryption configuration in the interaction configuration table of the interaction host; and obtaining the encryption information corresponding to the process in the basic configuration table.

[0009] In an optional manner, obtaining the encryption information corresponding to the process in the basic configuration table includes: obtaining the encryption information corresponding to the process from the basic configuration table of the encryption cache pool; if the encryption information is not obtained from the encryption cache pool, querying the corresponding configuration in the configuration and storing the obtained encryption information in the encryption cache pool.

[0010] In an optional manner, the encrypting the data according to the encryption information includes: encrypting the data according to the encryption configuration in the interaction configuration table; and further encrypting the data according to the encryption information corresponding to the process in the basic configuration table.

[0011] In an optional manner, after encrypting the data according to the encryption information, the method further includes: recording an encryption log of each encryption and storing it in a database, wherein the encryption log includes at least: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

[0012] According to another aspect of an embodiment of the present invention, a security management and control device for preventing data leakage in an IT system is provided, wherein the device includes: a stacking unit, used to obtain a data transmission request for data interaction of any process in the IT system, and temporarily store the data requested to be transmitted in the stack; an encryption information acquisition unit, used to obtain encryption information corresponding to the process; an encryption processing unit, used to encrypt the data according to the encryption information and transmit it to the stack; and a data transmission unit, used to output the encrypted data from the stack to continue to complete the data transmission of the process.

[0013] According to another aspect of an embodiment of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0014] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the steps of the above-mentioned IT system security management and control method for preventing data leakage.

[0015] According to another aspect of an embodiment of the present invention, a computer storage medium is provided, wherein the storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute the steps of the above-mentioned IT system security management and control method for preventing data leakage.

[0016] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0017] The above description is only an overview of the technical solutions of the embodiments of the present invention. In order to more clearly understand the technical means of the embodiments of the present invention, they can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiments of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0019] Figure 1 A schematic diagram of a process for a security management and control method for preventing data leakage in an IT system provided by an embodiment of the present invention is shown;

[0020] Figure 2 Schematic diagrams of multiple data transmission processes of a security management and control method for preventing data leakage in an IT system provided by an embodiment of the present invention are shown;

[0021] Figure 3 A schematic diagram illustrating a security management and control method for preventing data leakage in an IT system provided by another embodiment of the present invention is shown;

[0022] Figure 4 A schematic diagram of the structure of a security control device for preventing data leakage in an IT system provided by an embodiment of the present invention is shown;

[0023] Figure 5 A schematic structural diagram of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0024] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0025] Figure 1 The flowchart of the security control method for preventing data leakage in IT system provided by the embodiment of the present invention is shown. The security control method for preventing data leakage in IT system is mainly applied to servers. Figure 1 As shown, the IT system's security control methods for preventing data leakage include:

[0026] Step S11: Obtain a data transmission request for data interaction from any process in the IT system, and temporarily store the requested data in a stack.

[0027] In the embodiment of the present invention, it can be any process in the IT system, including interaction with the outside of the IT system, interaction with the IT system WEB layer host, interaction with the IT system application layer host and interaction with the IT system database, etc. Figure 2 As shown, the requested data is temporarily stored in the push stack for subsequent encryption processing, and then the encrypted data is transmitted to the pop stack and then output to the corresponding IT system layer.

[0028] Step S12: Obtain encryption information corresponding to the process.

[0029] In an embodiment of the present invention, before step S12, the encryption information required for encryption processing in any process in the IT system is configured to form a basic configuration table. This includes encryption rule configuration, encryption algorithm configuration, and encryption key configuration. Specifically, the protocol type used by the IT system for external interaction is configured; the IP address of the data source and the IP address of the destination of the processed data are configured; the encryption algorithms for different types of data are configured; all encryption algorithms used in the system are stored; and all keys required in the IT system are configured and managed in a unified manner. The embodiment of the present invention integrates all commonly used symmetric and asymmetric encryption algorithms, including all signature encryption algorithms, message digest algorithm (MD5), secure hash algorithm (SHA1), hash message authentication code (HMAC), advanced encryption standard (AES), data encryption algorithm (DEA), public key encryption algorithm (RSA), etc., which can meet the encryption requirements of all systems. The commonly used encryption methods in the embodiment of the present invention are shown in Table 1.

[0030] Table 1 Common encryption methods

[0031]

[0032] Taking typical plaintext data fields in the payment system, such as bank card number, reserved mobile phone number, user name, ID number, expiration date, and credit card security code (CVV2), as an example, since the IT system requires different encryption algorithms for these plaintext data, the following configuration is performed in the database for the encryption field table, interaction object table, and interaction protocol table:

[0033] 1) Encrypted field table:

[0034]

[0035]

[0036] 2) Interaction object table:

[0037] Interactive Objects Source IP address of the interaction object Target IP WEB host 1.1.1.1 0.0.0.0 Application Host 0.0.0.0 0.0.0.1 database 0.0.0.1 1.1.1.1

[0038] 3) Interaction protocol table:

[0039] Interaction Protocol Encryption method Key Interaction Protocol Corresponding host HTTP AES Key 1 HTTP 0.0.0.1 FTP DES Key 2 FTP 0.0.0.0 SSH MD5 Key 3 SSH 0.0.0.2

[0040] Unified management of basic configuration tables facilitates subsequent maintenance, and security management of different IT systems can be performed by modifying the configuration, greatly improving the versatility of the device.

[0041] For data security reasons, to avoid malicious requests, only data interactions with fixed hosts are allowed. The web hosts, application hosts, and database hosts that are allowed to interact, as well as the encryption rules for interactions with different hosts, need to be configured in the basic configuration module. Thus, this embodiment of the present invention also configures the web-layer hosts, application hosts, and database hosts that are allowed to interact with data in the IT system; and configures an interaction configuration table for data interaction with different web-layer hosts, application hosts, and database hosts. The details are as follows:

[0042] 1) WEB layer interaction configuration table:

[0043] WEB host IP Interaction Field encryption algorithm Key 0.0.0.0 Request message RSA 123 0.0.0.1 Request message RSA 123 0.0.0.2 Request message RSA 123

[0044] 2) Application layer interaction configuration table:

[0045] Application host IP Interaction data (field) encryption algorithm Key 0.0.0.0 User ID number RSA 123 0.0.0.1 Username ECC 123 0.0.0.2 Reserve mobile phone number MD5 123

[0046] 3) Database interaction configuration table:

[0047] Database host IP Interaction Field encryption algorithm Key 0.0.0.0 User ID number RSA 123 0.0.0.0 Bank card number AES 123 0.0.0.1 Username ECC 123 0.0.0.2 Reserve mobile phone number MD5 123

[0048] The basic configuration table and the interactive configuration table are cached in an encryption cache pool, and the encryption algorithm, key, etc. used for the encrypted data are temporarily stored in a cache manner, thereby improving the speed of data processing.

[0049] In step S12, the encryption configuration is retrieved from the interaction host's interaction configuration table. The encryption information corresponding to the process is also retrieved from the basic configuration table. Specifically, the encryption information corresponding to the process is retrieved from the basic configuration table of the encryption cache pool. If the encryption information is not retrieved from the encryption cache pool, the corresponding configuration is searched in the configuration and the retrieved encryption information is stored in the encryption cache pool. This speeds up the next processing of the same data. Information that has not been used for a certain period of time is cleared from the encryption cache pool to free up space.

[0050] Step S13: encrypt the data according to the encryption information and send it to the stack.

[0051] In this embodiment of the present invention, the data is encrypted according to the encryption configuration in the interaction configuration table; the data is further encrypted according to the encryption information corresponding to the process in the basic configuration table. By encrypting data interactions within the IT system, the security factor of the IT system is greatly improved, ensuring data security even in the event of malicious intrusion and preventing the leakage of sensitive data.

[0052] During the interaction with each process of the IT system, different encryption rules need to obtain corresponding encryption information from the above-mentioned interaction configuration table and basic configuration table. When the WEB layer initiates a data transmission to the application layer, the corresponding information will be obtained from the WEB interaction configuration table and the basic configuration table, such as the target IP and other information. The data transmission initiated from the WEB host with an IP address of 0.0.0.1 needs to be encrypted with a key of 123 in the device, and then the encrypted data is sent to the corresponding application layer host according to the configuration in the basic configuration table. For requests sent from outside the system to the IT system, the request must first be inspected and processed to check whether the request is legal. If it passes the verification, the request is encrypted and sent to the corresponding host. After the specific encryption processing is completed, the encrypted data is sent to the stack for delivery to the destination host.

[0053] In this embodiment of the present invention, after data is encrypted according to the encryption information, an encryption log of each encryption is recorded and stored in a database. The encryption log includes at least the encrypted data object, the time of the encryption action, and the encryption algorithm used. After uniform encryption, these logs are stored in the database. Saving such logs makes it easy to track the details of data encryption, facilitating subsequent maintenance. Furthermore, the encryption of the logs ensures data security.

[0054] For example, the user name was encrypted with AES at 19:00:00 on October 20, 2019. The following encrypted log is generated after the encryption is completed:

[0055] Time:2019.10.20 19.00.00

[0056] Encryption algorithm: AES

[0057] Key: 123

[0058] Encryption time: 0.1s

[0059] Encryption target data: User name

[0060] Encryption result: U2FsdGVkX19lDxo / yuq2ud0tqOL2EhokHD3fugnLLtM=

[0061] Encrypt the above logs according to the rules configured in the basic configuration, such as:

[0062] U2FsdGVkX1+jnqgYF4TO / VHk2kTkVAFnhUu5llMTDIpXTyKbWX / 9bS0u27XArZYa

[0063] cAuRnOmhgZAs1IhnEL2MvdB03 / 7IiZguX62Lw8qfJgq4oheikLUvrDi14QILc1+S

[0064] RDr7hMhYXuJjiip2n1nvFiNRwCdIRy22+lnsDsE1OtnBznSbdxr8G2wWwCSKX653

[0065] B66TmhvzhBpYr89v35BVfKnO5uxhWbXDEOK3PsAiqOjqmv / pTZ5aO9pGe / N1bUfJ

[0066] +HSAztD8i+mWjUqQgFlwOw==.

[0067] Then write it into the database.

[0068] The embodiment of the present invention achieves complete control over the data transmission process by recording encrypted logs, making subsequent maintenance very convenient.

[0069] Step S14: Output the encrypted data from the stack to continue completing the process data interaction.

[0070] In an embodiment of the present invention, for example, when data needs to be transferred from a web-layer host in an IT system to an application-layer host, the encrypted data is output from the pop stack and transferred to the application-layer host. By understanding the source and destination of the data, the embodiment of the present invention implements encryption processing based on different rules for different processes in the same IT system. Compared to existing technologies, this effectively manages various encryption methods and significantly improves data security.

[0071] In the embodiment of the present invention, Figure 3As shown, when a data transmission request is sent from the outside to the IT system, the data transmission request will first be verified to be legitimate. If the verification is passed, the data transmission request will be encrypted according to the corresponding encryption rules and sent to the corresponding WEB layer host. The WEB layer host will then initiate data transmission to the application layer, encrypt the data according to the data encryption rules from the WEB layer to the application layer, and then send the data to the application layer. Finally, the application layer needs to write data to the database and encrypt the data to be stored according to the encryption rules for interacting with the database. Each encryption process requires first temporarily storing the data to be encrypted in the push stack, then obtaining the corresponding encryption configuration from the encryption buffer pool, encrypting the data according to the obtained encryption configuration, and then transmitting it to the pop stack. At the same time, the encryption log is recorded and stored in the database. Finally, the encrypted data is transmitted from the pop stack to the IT system layer host.

[0072] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0073] Figure 4 FIG. 1 shows a schematic diagram of the structure of a security control device for preventing data leakage in an IT system according to an embodiment of the present invention. Figure 4 As shown, the IT system anti-data leakage security control device includes: a stacking unit 401, an encryption information acquisition unit 402, an encryption processing unit 403, a data transmission unit 404, a configuration unit 405 and a log recording unit 406. Among them:

[0074] The push unit 401 is used to obtain a data transmission request for data interaction of any process in the IT system, and temporarily stores the data requested to be transmitted in the push stack; the encryption information acquisition unit 402 is used to obtain the encryption information corresponding to the process; the encryption processing unit 403 is used to encrypt the data according to the encryption information and transmit it to the pop stack; the data transmission unit 404 is used to output the encrypted data from the pop stack to continue to complete the data transmission of the process.

[0075] In an optional manner, the configuration unit 405 is used to: configure the encryption information required for use in the encryption processing of any process in the IT system to form a basic configuration table; configure the WEB layer host, application host and database host that allow data interaction in the IT system; configure the interaction configuration table for data interaction with different WEB layer hosts, application hosts and database hosts; cache the basic configuration table and the interaction configuration table in the encryption cache pool.

[0076] In an optional manner, the configuration unit 405 is used to: configure the protocol type used by the IT system to interact with the outside world; configure the IP address of the data source and the destination IP address of the processed data; configure encryption algorithms for different types of data; store all encryption algorithms used in the system; configure all keys required in the IT system and manage them in a unified manner.

[0077] In an optional manner, the encryption information obtaining unit 402 is configured to: obtain the encryption configuration in the interaction configuration table of the interaction host; and obtain the encryption information corresponding to the process in the basic configuration table.

[0078] In an optional manner, the encryption information acquisition unit 402 is used to: obtain encryption information corresponding to the process from the basic configuration table of the encryption cache pool; if not obtained from the encryption cache pool, query the corresponding configuration in the configuration and store the obtained encryption information into the encryption cache pool.

[0079] In an optional manner, the encryption processing unit 403 is configured to: encrypt the data according to the encryption configuration in the interaction configuration table; and further encrypt the data according to the encryption information corresponding to the process in the basic configuration table.

[0080] In an optional manner, the log recording unit 406 is used to record an encryption log of each encryption and store it in a database, wherein the encryption log at least includes: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

[0081] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0082] An embodiment of the present invention provides a non-volatile computer storage medium storing at least one executable instruction. The computer executable instruction can execute the security management and control method for preventing data leakage of an IT system in any of the above method embodiments.

[0083] The executable instructions can be used to cause the processor to perform the following operations:

[0084] Obtain data transmission requests for data interaction from any process in the IT system and temporarily store the requested data in the stack;

[0085] Obtaining encrypted information corresponding to the process;

[0086] Encrypting the data according to the encryption information and delivering it to the stack;

[0087] The encrypted data is output from the stack to continue to complete the process data interaction.

[0088] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0089] Configure the encryption information required for encryption processing in any process of the IT system to form a basic configuration table;

[0090] Configure the WEB layer host, application host and database host that allow data interaction in the IT system;

[0091] Configuring an interaction configuration table for data interaction with different WEB layer hosts, application hosts, and database hosts;

[0092] The basic configuration table and the interaction configuration table are cached in an encryption cache pool.

[0093] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0094] Configure the protocol type used by the IT system to interact with the outside world;

[0095] Configure the IP address of the data source and the destination IP address of the processed data;

[0096] Configure encryption algorithms for different types of data;

[0097] Store all encryption algorithms used in the system;

[0098] Configure all the keys required in the IT system and manage them in a unified manner.

[0099] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0100] Get the encryption configuration in the interaction configuration table of the interaction host;

[0101] Obtain the encryption information corresponding to the process in the basic configuration table.

[0102] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0103] Obtain encryption information corresponding to the process from the basic configuration table of the encryption cache pool;

[0104] If the encryption information is not obtained from the encryption cache pool, the corresponding configuration is queried in the configuration and the obtained encryption information is stored in the encryption cache pool.

[0105] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0106] encrypting the data according to the encryption configuration in the interaction configuration table;

[0107] The data is further encrypted according to the encryption information corresponding to the process in the basic configuration table.

[0108] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0109] An encryption log is recorded for each encryption and stored in a database, wherein the encryption log includes at least: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

[0110] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0111] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the security management and control method for preventing data leakage of an IT system in any of the above method embodiments.

[0112] The executable instructions can be used to cause the processor to perform the following operations:

[0113] Obtain data transmission requests for data interaction from any process in the IT system and temporarily store the requested data in the stack;

[0114] Obtaining encrypted information corresponding to the process;

[0115] Encrypting the data according to the encryption information and delivering it to the stack;

[0116] The encrypted data is output from the stack to continue to complete the process data interaction.

[0117] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0118] Configure the encryption information required for encryption processing in any process of the IT system to form a basic configuration table;

[0119] Configure the WEB layer host, application host and database host that allow data interaction in the IT system;

[0120] Configuring an interaction configuration table for data interaction with different WEB layer hosts, application hosts, and database hosts;

[0121] The basic configuration table and the interaction configuration table are cached in an encryption cache pool.

[0122] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0123] Configure the protocol type used by the IT system to interact with the outside world;

[0124] Configure the IP address of the data source and the destination IP address of the processed data;

[0125] Configure encryption algorithms for different types of data;

[0126] Store all encryption algorithms used in the system;

[0127] Configure all the keys required in the IT system and manage them in a unified manner.

[0128] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0129] Get the encryption configuration in the interaction configuration table of the interaction host;

[0130] Obtain the encryption information corresponding to the process in the basic configuration table.

[0131] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0132] Obtain encryption information corresponding to the process from the basic configuration table of the encryption cache pool;

[0133] If the encryption information is not obtained from the encryption cache pool, the corresponding configuration is queried in the configuration and the obtained encryption information is stored in the encryption cache pool.

[0134] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0135] encrypting the data according to the encryption configuration in the interaction configuration table;

[0136] The data is further encrypted according to the encryption information corresponding to the process in the basic configuration table.

[0137] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0138] An encryption log is recorded for each encryption and stored in a database, wherein the encryption log includes at least: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

[0139] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0140] Figure 5 The schematic diagram of the structure of the computing device provided by the embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the device.

[0141] like Figure 5 As shown, the computing device may include: a processor (processor) 502 , a communications interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0142] Processor 502, communication interface 504, and memory 506 communicate with each other via communication bus 508. Communication interface 504 is used to communicate with other devices, such as clients or other server network elements. Processor 502 is used to execute program 510, which may specifically perform the steps described in the aforementioned embodiment of the IT system data leakage prevention security management and control method.

[0143] Specifically, the program 510 may include program codes, which include computer operation instructions.

[0144] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement an embodiment of the present invention. The one or more processors included in the device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0145] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0146] The program 510 may be specifically configured to enable the processor 502 to perform the following operations:

[0147] Obtain data transmission requests for data interaction from any process in the IT system and temporarily store the requested data in the stack;

[0148] Obtaining encrypted information corresponding to the process;

[0149] Encrypting the data according to the encryption information and delivering it to the stack;

[0150] The encrypted data is output from the stack to continue to complete the process data interaction.

[0151] In an optional manner, the program 510 enables the processor to perform the following operations:

[0152] Configure the encryption information required for encryption processing in any process of the IT system to form a basic configuration table;

[0153] Configure the WEB layer host, application host and database host that allow data interaction in the IT system;

[0154] Configuring an interaction configuration table for data interaction with different WEB layer hosts, application hosts, and database hosts;

[0155] The basic configuration table and the interaction configuration table are cached in an encryption cache pool.

[0156] In an optional manner, the program 510 enables the processor to perform the following operations:

[0157] Configure the protocol type used by the IT system to interact with the outside world;

[0158] Configure the IP address of the data source and the destination IP address of the processed data;

[0159] Configure encryption algorithms for different types of data;

[0160] Store all encryption algorithms used in the system;

[0161] Configure all the keys required in the IT system and manage them in a unified manner.

[0162] In an optional manner, the program 510 enables the processor to perform the following operations:

[0163] Get the encryption configuration in the interaction configuration table of the interaction host;

[0164] Obtain the encryption information corresponding to the process in the basic configuration table.

[0165] In an optional manner, the program 510 enables the processor to perform the following operations:

[0166] Obtain encryption information corresponding to the process from the basic configuration table of the encryption cache pool;

[0167] If the encryption information is not obtained from the encryption cache pool, the corresponding configuration is queried in the configuration and the obtained encryption information is stored in the encryption cache pool.

[0168] In an optional manner, the program 510 enables the processor to perform the following operations:

[0169] encrypting the data according to the encryption configuration in the interaction configuration table;

[0170] The data is further encrypted according to the encryption information corresponding to the process in the basic configuration table.

[0171] In an optional manner, the program 510 enables the processor to perform the following operations:

[0172] An encryption log is recorded for each encryption and stored in a database, wherein the encryption log includes at least: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

[0173] The embodiment of the present invention obtains a data transmission request for data interaction of any process in the IT system, temporarily stores the requested data in a push stack; obtains encryption information corresponding to the process; encrypts the data according to the encryption information and transmits it to a pop stack; outputs the encrypted data from the pop stack to continue completing the process data interaction. By encrypting the internal data interaction of the IT system, the security factor of the IT system is greatly improved, and the leakage of sensitive data is prevented.

[0174] The algorithm or demonstration provided herein are not inherently relevant to any particular computer, virtual system or other equipment. Various general-purpose systems may also be used together with the teachings based on this. According to the above description, it is apparent that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0175] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0176] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims that follow the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0177] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0178] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0179] It should be noted that the above embodiments illustrate rather than limit the invention, and that alternative embodiments may be devised by a person skilled in the art without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments should not be understood as limiting the order of execution unless otherwise specified.

Claims

1. A security control method for preventing data leakage in an IT system, characterized in that: The method comprises: Configuring a basic configuration table required for encryption processing of any process in the IT system, the basic configuration table including at least one of the following: the protocol type used by the IT system to interact with the outside world, the IP address of the data source and the destination IP address of the processed data, encryption algorithms for different types of data, all encryption algorithms used in the system, and all keys required in the IT system; Configure an interaction configuration table for the web layer hosts, application hosts, and database hosts that allow data interaction in the IT system, wherein the interaction configuration table includes data interaction fields with different hosts and corresponding encryption algorithms and keys; Cache the basic configuration table and the interactive configuration table into an encrypted cache pool; Obtain data transmission requests for data interaction from any process in the IT system and temporarily store the requested data in the stack; Obtaining encryption information in a basic configuration table and an interaction configuration table corresponding to the process from the encryption cache pool; Encrypting the data according to the encryption information and delivering it to the stack; The encrypted data is output from the stack to continue to complete the process data interaction.

2. The method according to claim 1, characterized in that The method further comprises: If the encryption information is not obtained from the encryption cache pool, the corresponding configuration is queried in the configuration and the obtained encryption information is stored in the encryption cache pool.

3. The method according to claim 1, characterized in that The encrypting the data according to the encryption information includes: encrypting the data according to the encryption configuration in the interaction configuration table; The data is further encrypted according to the encryption information corresponding to the process in the basic configuration table.

4. The method according to claim 1, wherein After encrypting the data according to the encryption information, the method includes: An encryption log is recorded for each encryption and stored in a database, wherein the encryption log includes at least: the encrypted data object, the encryption behavior time, and the encryption algorithm used.

5. A security control device for preventing data leakage in IT systems, characterized in that: The device comprises: A stacking unit is used to configure a basic configuration table required for encryption processing of any process in the IT system, wherein the basic configuration table includes at least one of the following items: the protocol type adopted by the IT system for external interaction, the IP address of the data source and the destination IP address of the processed data, the encryption algorithms for different types of data, all encryption algorithms used in the system, and all keys required in the IT system; configure an interaction configuration table for the WEB layer host, application host, and database host that allow data interaction in the IT system, wherein the interaction configuration table includes data interaction fields with different hosts and corresponding encryption algorithms and keys; cache the basic configuration table and the interaction configuration table in an encryption cache pool; obtain a data transmission request for data interaction by any process in the IT system, and temporarily store the data requested for transmission in the stack; An encryption information acquisition unit, configured to acquire encryption information in a basic configuration table and an interaction configuration table corresponding to the process from the encryption buffer pool; An encryption processing unit, configured to encrypt the data according to the encryption information and transmit the encrypted data to a stack; The data transmission unit is used to output the encrypted data from the stack to continue to complete the process data transmission.

6. A computing device comprising: A processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the steps of the security management and control method for preventing data leakage of an IT system according to any one of claims 1 to 4.

7. A computer storage medium, wherein the storage medium stores at least one executable instruction, wherein the executable instruction causes a processor to execute the steps of the IT system security management and control method for preventing data leakage according to any one of claims 1 to 4.

Images