Data access method and apparatus, storage medium, and electronic device

Abstract

Embodiments of the present application provide a data access method and device, a storage medium and an electronic device, wherein the method comprises: receiving a first access request for requesting access to data in a database; parsing the first access request to obtain the following data corresponding to the first access request: a first access parameter, a first request type and a first controlled field list; performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result; synthesizing a second access request based on the target result, and accessing the data in the database based on the second access request to obtain an access result. Through the present application, the problem of coarse data protection granularity and security risks in the related art is solved, the effect of efficiently protecting data is achieved, and the security of data is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communications, and in particular, to a data access method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the advent of the big data era, user privacy leakage is becoming increasingly serious. At the same time, various big data technologies are emerging, and new technical architectures, support platforms and big data software are constantly emerging, making data security and privacy protection technologies face greater challenges.

[0003] In the related art, in order to protect some highly sensitive information (such as credit cards, names and ID numbers or other data considered to be critical), permission control and transparent encryption technology is usually used. Transparent encryption performs data encryption at the database layer to prevent possible attackers from bypassing the database and directly reading sensitive information from storage. Applications and users authenticated by the database can continue to access encrypted data transparently, while operating system users attempting to read sensitive data in table space files and unscrupulous individuals attempting to read disk or backup information will not be allowed to access plaintext data. At the same time, privileged accounts can access any application data in the database. Since privileged accounts and roles can access the database without restriction, they are also the main target of hackers and can be misused by insiders to obtain confidential information. Transparent encryption and permissions are often ineffective for privileged users. Therefore, the related art only uses permissions as the premise and main means of sensitive field protection, and the protection granularity is coarse, which has security risks.

[0004] Therefore, the related art has the problem of coarse data protection granularity and security risks.

[0005] In view of the above problems in the related art, no effective solution has been proposed so far. SUMMARY

[0006] Embodiments of the present application provide a data access method and device, a storage medium and an electronic device to at least solve the problem of coarse data protection granularity and security risks in the related art.

[0007] According to one embodiment of the present application, a data access method is provided, comprising: receiving a first access request for requesting access to data in a database; parsing the first access request to obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list; performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result; synthesizing a second access request based on the target result, and accessing the data in the database based on the second access request to obtain an access result.

[0008] According to another embodiment of the present application, a data access apparatus is provided, comprising: a receiving module configured to receive a first access request for requesting access to data in a database; an obtaining module configured to parse the access request to obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list; an executing module configured to perform a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result; and an accessing module configured to synthesize a second access request based on the target result, and access the data in the database based on the second access request to obtain an access result.

[0009] According to still another embodiment of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, wherein the computer program is configured to execute the steps in any of the method embodiments when running.

[0010] According to still another embodiment of the present application, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the method embodiments.

[0011] According to the present application, a first access request for requesting access to data in a database is parsed to obtain a first access parameter, a first request type, and a first controlled field list corresponding to the first access request, a first data protection operation is performed on the first controlled field list based on the first access parameter and the first request type to obtain a target result, and then a second access request is synthesized based on the target result, and the data in the database is accessed by using the second access request. Since the field-level data protection operation is performed on the accessed data, the problem of coarse data protection granularity and security risks existing in the related art can be solved, the effect of efficiently protecting data is achieved, and the security of the data is improved. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 This is a hardware structure block diagram of a mobile terminal for a data access method according to an embodiment of the present invention.

[0013] Figure 2 This is a flowchart of a data access method according to an embodiment of the present invention;

[0014] Figure 3 This is a flowchart of a data access method according to a specific embodiment of the present invention;

[0015] Figure 4 This is a flowchart illustrating the management of field-level security policies according to a specific embodiment of the present invention;

[0016] Figure 5 This is a flowchart of a field-level security policy according to a specific embodiment of the present invention;

[0017] Figure 6 This is a structural diagram of a data protection device according to a specific embodiment of the present invention;

[0018] Figure 7 This is a flowchart of a data access method according to a specific embodiment of the present invention;

[0019] Figure 8 This is a schematic diagram illustrating a data access method implementation scenario according to a specific embodiment of the present invention;

[0020] Figure 9 This is a structural block diagram of a data access device according to an embodiment of the present invention. Detailed Implementation

[0021] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0023] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a data access method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that...Figure 1 The illustrated structure is merely schematic and does not limit the structure of the mobile terminal described above. For example, the mobile terminal can include more or less components than those shown, or have a different configuration of components than shown. Figure 1 Figure 1

[0024] The memory 104 is operable to store a computer program, for example, a software program of an application and a module, such as a computer program corresponding to the data access method in the embodiments of the present application. The processor 102 performs various functional applications and data processing, i.e., implements the method described above, by running the computer program stored in the memory 104. The memory 104 can include a high-speed random access memory, and further include a nonvolatile memory, such as one or more magnetic storage devices, a flash memory, or other nonvolatile solid-state memories. In some examples, the memory 104 can further include a memory remotely disposed relative to the processor 102, which can be connected to the mobile terminal through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0025] The transmission device 106 is operable to receive or send data via a network. A specific example of the network can include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is operable to communicate with the Internet in a wireless manner.

[0026] In the embodiments, a data access method is provided, Figure 2 which is a flowchart of the data access method according to the embodiments of the present application, as shown in Figure 2 which includes the following steps:

[0027] Step S202, receiving a first access request for requesting to access data in a database;

[0028] Step S204, parsing the first access request to obtain the following data corresponding to the first access request: a first access parameter, a first request type, and a first controlled field list;

[0029] Step S206, performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result;

[0030] ​​Step S208, synthesizing a second access request based on the target result, and accessing data in the database based on the second access request to obtain an access result.

[0031] In the above embodiment, the first access request can be a SQL (Structured Query Language). After receiving the SQL of the client, the SQL can be parsed to obtain the access parameters, the request type and the controlled field list of the client. Then, the data protection operation can be performed on each field in the controlled field list one by one, that is, the first data protection operation is performed, and after all the controlled fields are processed, the first SQL statement is re-synthesized to obtain the second access request, and the database engine executes the first SQL statement to feed back the result to the client. The client can be various applications, programs, commands or scripts, etc. that access the database.

[0032] In the above embodiment, the access parameters include but are not limited to: original request, such as request SQL, etc.; user identity, such as username, user group, role, etc.; user access level; access time; network parameters, such as IP address, host name, etc.

[0033] According to the application, the first access request for requesting to access data in the database is parsed to obtain the first access parameters, the first request type and the first controlled field list corresponding to the first access request, the first data protection operation is performed on the first controlled field list according to the first access parameters and the first request type, the target result is obtained, the second access request is synthesized according to the target result, and the data in the database is accessed by using the second access request. Since the field-level data protection operation is performed on the accessed data, the problem of coarse data protection granularity and security risks existing in the related art can be solved, the effect of efficiently protecting data is achieved, and the security of the data is improved.

[0034] In one example embodiment, parsing the access request to obtain the first controlled field list corresponding to the first access request includes: in the case that the first access request is a data query language DQL type request, determining the top layer output field list of the DQL type request as the first controlled field list; in the case that the first access request is other than the DQL type request, determining the target field list operated by the other request, and determining the target field as the first controlled field list. In this embodiment, the top layer output field list of the DQL (Select query) type request can be obtained first, and then the top layer output field list is taken as the controlled field list; for other types of requests, the fields operated by the SQL statement can be parsed and added to the controlled field list.

[0035] For example, for the following DQL-like request:

[0036] select ename,deptno,sal

[0037] from emp

[0038] where deptno=

[0039] (select deptno from dept where loc='NEW YORK');

[0040] The list of controlled fields obtained is:

[0041] emp.ename, dept.deptno, emp.sal;

[0042] For example, for the following DML-like update request:

[0043] UPDATE Customers SET ContactName='Alfred Schmidt',

[0044] City='Frankfurt'

[0045] WHERE CustomerID=1;

[0046] The list of controlled fields obtained is:

[0047] Customers.ContactName, Customers.City.

[0048] In an example embodiment, performing a first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result comprises: selecting a controlled field as a first controlled field from the first controlled field list in a preset order; determining a first field protection rule, a data security classification, and a data security level corresponding to the first controlled field, wherein different field protection rules correspond to different combinations of trusted conditions, request types, and processing actions, and the trusted conditions include an allowed access condition corresponding to the first access parameter; and performing the first data protection operation on the first controlled field list based on a first processing action corresponding to the first field protection rule to obtain the target result. In this embodiment, the first controlled field can be selected from the controlled field list in a preset order, and the field protection rule corresponding to the first controlled field can be obtained. The field protection rule can include the data security classification and the data security level. Determining the field protection rule can determine the data security level corresponding to the controlled field. The data security level itself can be included as a trusted condition in a set of trusted conditions, i.e., it can be determined whether the security level of the user is greater than or equal to the data security level. In this embodiment, the first controlled field is classified and protected, and the same class of fields can be set with the same protection rule and data security level. When the data security level of the first controlled field is empty, the data security level of the data security classification of the first controlled field can be obtained as the data level of the first controlled field. Alternatively, when the data security level of the first controlled field is empty, the field protection rule of the data classification of the first controlled field can also be obtained as the protection rule of the first controlled field.

[0049] In an example embodiment, performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result comprises: performing a set of trusted conditions corresponding to the first field protection rule based on the obtained first access parameter; wherein the first access parameter comprises at least one of the following: original request statement, user identity, user access level, access time, network parameter; determining a first action type and a first action factor included in the first processing action according to the execution result of the set of trusted conditions, wherein the first action type is used to indicate a specific protection operation, and the first action factor is used to indicate an actual parameter to be processed and a specific protection operation operator name; and performing protection processing on the first controlled field based on the first action factor to obtain the target result. In this embodiment, a set of trusted conditions corresponding to the field protection rule of the first controlled field is executed according to the obtained first access parameter, and a corresponding action type is selected according to the trusted condition calculation result, and a specific protection action factor is executed. The first processing action represents a protection method executed on sensitive data, and includes an action type and an action factor. The action type can include: rejecting access, allowing access, displaying original data, desensitization, encryption, decryption, anonymization, auditing, alarming, and self-defined action. The action factor can represent a specific protection operation operator name and an actual parameter, wherein the actual parameter mainly includes content to be processed in the first controlled field. It should be noted that the action type and the action factor can be customized and extended to cope with data protection in different scenarios. For the reject execution action, the result can be directly fed back to the client, and the process is exited.

[0050] In an example embodiment, performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result comprises: in a case where the first processing action type comprises one of desensitization action, encryption processing action, decryption processing action, anonymization action, and self-defined action, synthesizing the first controlled field into a new SQL statement segment based on the first action factor to obtain the target result. In this embodiment, for desensitization action, encryption processing action, decryption processing action, anonymization action, and self-defined action, a new SQL statement segment can be synthesized according to the action factor in the field protection rule to replace the original corresponding SQL statement segment.

[0051] In an example embodiment, the method further comprises: configuring a field protection rule based on the received first configuration instruction, wherein the field protection rule comprises a combination of a request type, a set of trusted conditions, and a processing action; wherein the request type comprises at least one of: a data query language (DQL) type, a data manipulation language (DML) type; the trusted condition is used to define a basic judgment unit of trusted access, and at least comprises a trusted access type, a trusted access parameter name, a judgment operator, and a parameter value; the trusted access type comprises at least one of: an identity trusted condition, a level trusted condition, a network trusted condition, and a time trusted condition; the judgment operator comprises greater than, greater than or equal to, less than or equal to, less than, equal to, and not equal to; the processing action comprises an action type and an action factor, the action type is used to indicate a specific protection operation, and the action factor is used to indicate an actual parameter to be processed and a specific protection operation operator name; the action type comprises at least one of: rejecting access, allowing access, displaying original data, desensitization processing, encryption processing, decryption processing, anonymization processing, audit processing, and alarm processing. In this embodiment, the record field protection rule can be configured according to the first configuration instruction, wherein the field protection rule comprises a combination of a request type, a trusted condition, and a processing action, and the processing action can comprise an action type and an action factor. The field protection rule can be different for different command types (i.e., request types) and different field protection methods, and is expressed by a combination of a command type and a set of trusted conditions. The corresponding action is executed according to the execution result of the set of trusted conditions. The command type comprises at least a DQL type (data query language) and a DML type (data manipulation language). The logical operation can comprise and, or, and not operations.

[0052] In an example embodiment, in the case that the user access level is included in the first access parameter, the level trusted condition corresponding to the user access level is included in the trusted condition, wherein the level trusted condition is used to determine that the user access level satisfies the level trusted condition when it is determined that the user access level is greater than or equal to the data security level. In this embodiment, the trusted condition can define a basic judgment unit of trusted access. The basic judgment unit can comprise at least one of:

[0053] An identity trusted condition is used to limit user identity, including but not limited to username, user group, role, etc.

[0054] A level trusted condition is used to limit user access to sensitive data according to user access level, data security level, and data security classification.

[0055] A network trusted condition is used to limit access to a network, including but not limited to IP address, host name, etc.

[0056] Time trust condition, used to limit access time, including but not limited to access time, etc.

[0057] Wherein, the user access level can be used to describe the user identity level, including the user access level name and the user access level value. It should be noted that the user access level and the data type of the data security level are of the same type, and need to be kept in the same order. The trust condition can include a trusted access type, a trusted access parameter name, a decision operator and a parameter value. Wherein, the decision operator can include greater than, greater than or equal to, less than or equal to, less than, equal to, not equal to, etc.

[0058] In an exemplary embodiment, the method further comprises: configuring the data security classification corresponding to each controlled field and the data security level based on the received second configuration instruction, wherein the data security levels corresponding to multiple controlled fields under the same data security classification are the same. In this embodiment, the data security classification can be classified according to the business type of sensitive data, and can include classification name, default data security level, and default field protection rule. The data security level can include data security level name and data security level value, etc.

[0059] In the above embodiment, the field protection rule can be set through the following steps:

[0060] Step 1: Define classification hierarchy level (including user access level, data security level, data security classification);

[0061] Step 2: Set the user access level;

[0062] Step 3: Assign data protection classification category and data security level to sensitive fields;

[0063] Step 4: Set the trust condition;

[0064] Step 5: Set the field protection rule.

[0065] In an optional embodiment, the above method can be run in a data access device. The device includes a data protection module and a policy module to implement the sensitive data protection function of the database engine. The device can be built into the database engine. The data protection module can obtain the sensitive data protection policy from the policy module and perform corresponding data protection actions, such as access denial, full desensitization processing, partial desensitization processing, encryption processing, anonymization processing, auditing, and alarming. The policy module includes a classification level unit, a policy management unit, and a policy storage unit to provide policy support for the data protection module. The classification level unit is used for classified management of users and data, including user access level, data security level, and data security category. The policy management unit is responsible for managing data protection policies and providing a policy access interface. The policy storage unit is responsible for storing data protection policies.

[0066] The access data is described below in combination with a specific embodiment:

[0067] Figure 3 is a flowchart of a data access method according to an embodiment of the present application, as shown in the figure, the flow includes: Figure 3

[0068] Step S302, receiving a client access request;

[0069] Step S304, obtaining client access parameters;

[0070] Step S306, parsing the access request SQL and obtaining the request type and the controlled field list;

[0071] Step S308, performing data protection operations on each field in the controlled field list one by one;

[0072] Step S310, after all controlled fields are processed, re-combining the first SQL statement;

[0073] Step S312, the database engine executes the first SQL statement and feeds back the result to the client.

[0074] The client can be various applications, programs, commands, or scripts that access the database; the access parameters can include:

[0075] ① Original request, including but not limited to request SQL;

[0076] ② User identity, including but not limited to username, user group, role, etc.

[0077] ③ User access level;

[0078] ④ Access time;

[0079] ​(5) Network parameters, including but not limited to IP address, host name, etc.

[0080] In step S306, the operation of obtaining the controlled field list can include:

[0081] For a DQL (Select query) type request, the top-level output field list is first obtained, and then the top-level output field list is taken as the controlled field list; for other types of requests, the fields operated by the SQL statement are parsed first, and the operation fields are added to the controlled field list.

[0082] In step S308, the data protection operation includes:

[0083] Step 1: selecting a first controlled field from the controlled field list in a preset order;

[0084] Step 2: obtaining the data security classification, data security level and field protection rule corresponding to the first controlled field;

[0085] It should be noted that the same field protection rule and data security level can be set for the same type of sensitive field for classified protection; if the data security level of the first controlled field is empty, the data security level of the data security classification of the first controlled field is taken as the data level of the first controlled field; if the field protection rule of the first controlled field is empty, the field protection rule of the data classification of the first controlled field is taken as the field protection rule of the first controlled field.

[0086] Step 3: executing a set of trusted conditions corresponding to the field protection rule of the first controlled field, selecting a corresponding action type according to the calculation result of the trusted conditions, and executing a specific protection action factor. For example, for the reject execution action, directly feedback the result to the client and exit the process. For desensitization action, encryption processing action, decryption processing action, anonymization action, etc., a new SQL statement segment is synthesized according to the action factor in the field protection rule to replace the original corresponding SQL statement segment.

[0087] Figure 4 is a workflow diagram for managing field-level security policies according to an embodiment of the present application, as shown in Figure 4 The process includes field protection rules, data security classification, data security level, client access parameters, etc.

[0088] The field protection rule is used to define different field protection methods for different command types, and can include a command type and a logical operation expression of a set of trusted conditions, and a corresponding processing action is executed according to the execution result of the set of trusted conditions. The command type at least includes DQL (data query language) and DML (data manipulation language). The logical operation includes but is not limited to AND, OR and NOT operations.

[0089] Wherein, the trusted condition can define a basic judgment unit of trusted access, at least including one of them:

[0090] Identity trusted condition, used to limit user identity, including but not limited to username, user group, role, etc.

[0091] Level trusted condition, according to user access level, data security level, data security classification to limit user access to sensitive data.

[0092] Network trusted condition, used to limit access to network, including but not limited to IP address, host name, etc.

[0093] Time trusted condition, used to limit access time, including but not limited to access time, etc.

[0094] The trusted condition at least includes trusted access type, trusted access parameter name, judgment operator and parameter value. Among them, the judgment operator includes greater than, greater than or equal to, less than or equal to, less than, equal to, not equal to, etc.

[0095] Among them, the processing action represents the protection method executed on the sensitive data, including action type and action factor. The action type at least includes one of them: reject access, allow access, display original data, desensitization, encryption, decryption, anonymization, audit, alarm, custom action, etc. The action factor represents the specific protection action operator name and actual parameter executed. It should be noted that the dynamic type and action factor can be customized and extended to cope with different scenarios of data protection.

[0096] Data security classification can be classified according to the business type of sensitive data, at least including classification name, default data security level, and default field protection rule.

[0097] Data security level, at least including data security level name and data security level value.

[0098] The client access parameter can include parameters similar to the above client access parameter, which will not be repeated here. Among them, the user access level is used to describe the user identity level, at least including user access level name and user access level value. It should be noted that the data type of user access level and data security level is the same type, and needs to keep the same sequence.

[0099] By using the above steps, the field-level access control and attack defense function can be provided flexibly and effectively according to the strategy, a plurality of command types are supported, access to sensitive data based on a plurality of trusted factor combinations is authorized, sensitive data access authorization or dynamic data acquisition based on elements such as a user name, an IP address and access time is implemented, a user can be limited to only access to original data that can be completely decrypted, partially desensitized data, label data, anonymized data and the like allowed to be accessed by the user according to a data confidentiality level and a user identity level, different display of the same sensitive data is implemented when different users access the sensitive data, and thus illegal access is effectively blocked.

[0100] Meanwhile, the processing capability of the database engine itself is directly used, and thus the privacy data can be efficiently and real-timely protected, and the user can not be aware of the data protection process at all.

[0101] Figure 5 is a flowchart of the field-level security strategy according to an embodiment of the present application, as shown in Figure 5 , the flowchart includes the following steps.

[0102] Step S502, defining a classification hierarchical level.

[0103] Step S502-1, defining a user access level.

[0104] The user can be classified according to a permission level of the user, or can be classified according to a user group type (such as a low-power user group, a partially authorized user group or a high-power user group), or can be classified according to a geographical location where the user is located (such as China, Europe or North America), and the like. As shown in Table 1, Table 1 is a schematic table of a user classification access level.

[0105] Table 1

[0106] User Access Level Value Remark LOWLEVEL 0 Low-privilege user MIDDLEVEL 5 Partially authorized user HIGHLEVEL 10 High-privilege user

[0107] Step S502-2, defining a data security level.

[0108] The sensitive fields can be classified according to data confidentiality (such as public, secret, confidential or top secret), or can be classified according to a data ownership department (core department data or non-core department data), and the like. As shown in Table 2, Table 2 is a schematic table of a data security level.

[0109] Table 2

[0110] Data Security Level Value Remark PUBLIC 0 Internal public SECRET 2 Secret CONFIDENTIAL 5 Confidential TOPSECRET 10 Top secret

[0111] Step S502-3, defining a data security classification.

[0112] Data protection classification is used to categorize sensitive data, grouping data with similar functions and meanings together. For example, "ID number" is classified as a sensitive data category. This category manages all ID number data fields in all databases and allows for the implementation of a unified default data level and default field protection rules. As shown in Table 3, Table 3 is a schematic table illustrating data security levels.

[0113] Table 3

[0114] Data Security Classification Default Data Protection Level Default Field Protection Rule Remark ID SECRET Rule 1 Identity card number type NAME SECRET Rule 2 Name type ADDRESS SECRET Rule 3 Address type CARD TOPSECRET Rule 4 Card type

[0115] Step S504: Set user access levels.

[0116] As shown in Table 4, Table 4 is a schematic table for assigning access levels to users.

[0117] Table 4

[0118] User Name User Access Level Zhang San LOWLEVEL Li Si MIDDLEVEL Wang Wu HIGHLEVEL

[0119] Step S506: Assign data protection categories and data security levels to sensitive fields.

[0120] As shown in Table 5, Table 5 is a schematic table of data protection categories and data security levels assigned to sensitive fields.

[0121] Table 5

[0122] Database Table Field Data Security Level Data Protection Classification DBS1 T1 f1 SECRET ID DBS1 T1 f2 SECRET NAME DBS1 T1 f3 ADDRESS DBS1 T1 f4 TOPSECRET CARD

[0123] Step S508: Set trusted conditions.

[0124] As shown in Table 6, Table 6 is a schematic table of credible conditions.

[0125] Table 6

[0126]

[0127] Step S510: Set field protection rules.

[0128] Field protection rules define different field protection methods for different command types. They can include the command type and a set of logical operation expressions for trusted conditions, and execute corresponding actions based on the execution result of the set of trusted conditions.

[0129] As shown in Table 7, Table 7 is a schematic table of field protection rules.

[0130] Table 7

[0131] Database Table Field Command Type Trusted Condition Action DBS1 T1 f1 select Selector Action 1 DBS1 T1 f2 insert Selector 2 Action 2 DBS1 T1 f3 update (Selector)‖‖(Selector 3) Action 3

[0132] As shown in Table 8, Table 8 is a schematic table of processing actions.

[0133] Table 8

[0134] Action ID Action Type Action Factor Action 1 Reject access Action 2 Desensitization partialMask(XXX, 1, '*', 100) Action 3 Anonymization processing K-Anonymity(f, 3)

[0135] The above method can flexibly and effectively provide a protection strategy, flexibly control the access mode and access content of the database in the database according to the strategy, and effectively block illegal access.

[0136] Figure 6 is a data protection device structure diagram according to an embodiment of the application, and the above-mentioned methods can be run on the network architecture shown in Figure 6 as shown in Figure 6 The device comprises:

[0137] The database client 62 can be an application, program, command or script, etc. that accesses the database service, initiates an access request to the database engine through the network and receives the processing result. The client uses existing technology and does not need to be changed.

[0138] The database engine 64 is responsible for completing the business logic processing of the client request. A data protection device can be added to the database engine, which comprises a data protection module and a policy module to realize the sensitive data protection function of the database engine. The data protection device is built-in in the database engine. The data protection module can obtain the sensitive data protection policy from the policy module and execute the corresponding data protection action, such as access denial, desensitization processing, encryption processing, decryption processing, anonymization processing, auditing, and alarm, etc. The policy module comprises a classification level unit, a policy management unit, and a policy storage unit to provide policy support for the data protection module. The classification level unit is used for classified management of users and data, including user access level, data security level, and data security category, etc. The policy management unit is responsible for managing the data protection policy and providing a policy access interface. The policy storage unit is responsible for storing the data protection policy.

[0139] The database 66 can be the actual data storage place. One database engine can support multiple database instances. When the database engine receives the access request of the client, the access request is parsed by the receiving module to obtain the client access parameters. The data protection module parses the access request SQL and obtains the request type and the controlled field list. The data protection module executes the data protection operation on each field in the controlled field list one by one. After all the controlled fields are processed, the first SQL statement is synthesized again, and the database engine executes the first SQL statement to feed back the result to the client.

[0140] For SQL type database engines (including but not limited to Hive, SparkSQL, etc.), taking the Hive database as an example, Figure 7is a data access method flow chart according to an embodiment of the present application, as shown in the figure, the flow includes: Figure 7

[0141] Step S702, the Hive (Hive is a data warehouse tool based on hadoop, which can map structured data files to a database table, and provide SQL query function) client initiates a SQL access request to the Hive database engine directly through the network.

[0142] Step S704, the Hive database engine acquires client access parameters. Wherein, the access parameters include at least one of them:

[0143] ① original request, including but not limited to request SQL;

[0144] ② user identity, including but not limited to user name, user group, role, etc.;

[0145] ③ user access level;

[0146] ④ access time;

[0147] ⑤ network parameters, including but not limited to IP address, host name, etc.

[0148] Step S706, the SQL parser of the Hive database engine parses the SQL statement in the original request, constructs the syntax tree, abstracts and structures the SQL, and generates the abstract syntax tree after reconstruction.

[0149] Step S708, parse the abstract syntax tree, parse the request SQL statement, get the SQL statement request type, get the top layer output field list as the controlled field list for DQL type request, and parse the field operated by the SQL statement first, and add the operation field to the controlled field list.

[0150] Step S710, judge the command type, when the command type is DQL type, execute step S712, when the command type is non DQL type, execute step S714.

[0151] Step S712, generate the top layer output field list as the controlled field list.

[0152] Take DQL type query statement as an example:

[0153] select ename, deptno, sal

[0154] from emp

[0155] where deptno = 10

[0156] ​(select deptno from dept where loc = 'NEW YORK') ;

[0157] In this step, the controlled field list obtained is:

[0158] emp.ename, dept.deptno, emp.sal

[0159] Wherein, emp, dept are database table names, and the others are field names;

[0160] Step S714, the field name is obtained and added to the controlled field list.

[0161] Taking the DML type update statement as an example:

[0162] UPDATE Customers SET ContactName = 'Alfred Schmidt', City = 'Frankfurt'

[0163] WHERE CustomerID = 1;

[0164] In this step, the controlled field list obtained is:

[0165] Customers.ContactName, Customers.City

[0166] Wherein, Customers is a database table name, and the others are field names;

[0167] Step S716, the first controlled field is selected from the controlled field list in a preset order, and the data protection classification, data security level and field protection rule corresponding to the first controlled field are obtained.

[0168] As shown in Table 9, Table 9 is a schematic table of the obtained field protection rule.

[0169] Table 9

[0170]

[0171] In particular, if the data security level of the first controlled field is empty, the data security level of the data classification of the first controlled field is obtained as the data security level of the first controlled field;

[0172] In particular, if the field protection rule of the first controlled field is empty, the field protection rule of the data classification of the first controlled field is obtained as the protection rule of the first controlled field;

[0173] Step S718, a set of trusted conditions corresponding to the field protection rule of the first controlled field is executed, and according to the calculation result of the trusted conditions, a corresponding action type is selected, and a specific protection action factor is executed.

[0174] Step S720, the action type is judged, if the action type is rejection execution, step S722 is executed, if the action type is desensitization processing, encryption processing, decryption processing, anonymization processing, etc., step S724 is executed, and if the action type is audit, step S726 is executed.

[0175] Step S722, the result is directly fed back to the client, and the process is exited.

[0176] Step S724, a new SQL statement segment is synthesized according to the action factor in the field protection rule to replace the original corresponding SQL statement segment.

[0177] For example, for the ename field, the protection rule of the select statement type is: Selector2->Action1; Selector2 is executed, that is, it is judged whether the user access level value is < the data protection level value, if yes, Action1 is executed, that is, rejection execution, otherwise, it is continued to be executed. For the sal field, the protection rule of the select statement type is: Selector1->Action2; Selector1 is executed, that is, it is judged whether the user is Zhang San, if yes, Action2 is executed, that is, partialMask(sal,1,'*',100) is used as a partial desensitization algorithm for execution, and in this step, partialMask(sal,1,'*',100) is used to replace the original value sal of the abstract syntax tree node corresponding to the controlled field sal.

[0178] Step S726, audit.

[0179] Step S728, it is judged whether all fields are processed, if the judgment result is yes, step S730 is executed, if the judgment result is no, step S716 is executed.

[0180] Step S730, the abstract syntax tree is traversed, and the first SQL statement is synthesized again to determine that the first SQL statement is the final executed SQL statement.

[0181] select ename,deptno,partialMask(sal,1,’*’,100)

[0182] from emp

[0183] where deptno=

[0184] (select deptno from dept where loc='NEW YORK');

[0185] The rewritten SQL statement automatically performs partial desensitization on the sensitive field sal.

[0186] Similarly, for the following SQL statement

[0187] UPDATE Customers SET ContactName='Alfred Schmidt',City='Frankfurt'

[0188] WHERE CustomerID=1;

[0189] According to the protection rule, it can be rewritten as:

[0190] UPDATE Customers SET ContactName=Mask('Alfred Schmidt',’*’),City='Frankfurt'

[0191] WHERE CustomerID=1;

[0192] Where Mask is a protection algorithm factor that sets the string to *.

[0193] Step S732, the database executes the rewritten SQL statement.

[0194] Step S734, the database feeds back the processing result to the client according to the final executed SQL statement.

[0195] By using the above steps, field-level access control and attack defense functions can be flexibly and effectively provided according to the policy, a plurality of command types are supported, access authorization based on a plurality of trusted factor combinations is supported to obtain sensitive data, sensitive data access authorization or dynamic data acquisition based on elements such as username, IP address, and access time is realized, the user can only obtain the original data that may be completely decrypted, partially desensitized data, labeled data, anonymized data, etc. allowed to access according to the data confidentiality level and the user identity level, different users can access the same sensitive data to achieve different displays, thereby effectively blocking illegal access. At the same time, by directly using the processing capability of the database engine itself, the privacy data can be efficiently, real-timely, and transparently protected, and the user can be completely unaware of the data protection process.

[0196] The Hive database stores a large amount of sensitive data, and by setting a flexible data protection policy, the sensitive data in the Hive database can be transparently protected in real time during the client access process.Figure 8 is a scenario diagram of a data access method according to an embodiment of the present application, for performing the following steps:

[0197] Step 1, login, specifically, the compliance administrator logs into the database system using his own account and password;

[0198] Step 2, set protection policy, the compliance administrator sets the field protection policy through command mode or interface configuration mode;

[0199] Step 3, the user initiates an access request through the client, specifically, initiates a query request directly to the database engine;

[0200] Step 4, execute data protection, specifically, when the database engine receives the access request of the client, the access request is parsed by the receiving module, the client access parameters are obtained, the data protection module parses the access request SQL and obtains the request type and the controlled field list, and the data protection operation is performed on each field in the controlled field list one by one; after all the controlled fields are processed, the first SQL statement is synthesized again, the database engine executes the first SQL statement, and the result is fed back to the client.

[0201] Among them, steps 1-2 are performed by the compliance administrator, step 3 is performed by the user, and step 4 is performed by the data protection device.

[0202] Through the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, or network device, etc.) execute the method described in each embodiment of the present application.

[0203] In this embodiment, a data access device is also provided, which is used to implement the above embodiments and preferred embodiments, which have been described and will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0204] Figure 9 is a structure block diagram of a data access device according to an embodiment of the present application, as Figure 9 shown, the device comprises:

[0205] The receiving module 92 is configured to receive a first access request for requesting access to data in a database;

[0206] The obtaining module 94 is configured to parse the access request and obtain, from the first access request, a first access parameter, a first request type, and a first controlled field list;

[0207] The execution module 96 is configured to perform a first data protection operation on the first controlled field list based on the first access parameter and the first request type, to obtain a target result;

[0208] The access module 98 is configured to synthesize a second access request based on the target result, and access data in the database based on the second access request to obtain an access result.

[0209] In the data access apparatus, the database engine corresponds to Figure 6 The receiving module 92 corresponds to the receiving module shown in Figure 6 The execution module 96 corresponds to the data protection module shown in Figure 6 The access module 98 corresponds to the execution engine. Specifically, the obtaining module 94 corresponds to a classification and grading unit in the policy module, and the access module 98 corresponds to a policy storage unit and a policy management unit in the policy module.

[0210] In an example embodiment, the obtaining module 94 can parse the access request and obtain the first controlled field list corresponding to the first access request in the following manner: in a case where the first access request is a data query language (DQL) type request, determining a top-level output field list of the DQL type request as the first controlled field list; in a case where the first access request is other than the DQL type request, determining a target field list operated by the other request as the first controlled field list.

[0211] In an example embodiment, the execution module 96 can implement the first data protection operation on the first controlled field list based on the first access parameter and the first request type to obtain a target result by: selecting a controlled field as a first controlled field from the first controlled field list in a preset order; determining a first field protection rule, a data security classification, and a data security level corresponding to the first controlled field, wherein different field protection rules correspond to different combinations of trusted conditions, request types, and processing actions, and the trusted conditions include an allowed access condition corresponding to the first access parameter; and performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result.

[0212] In an example embodiment, the execution module 96 can implement the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result by: performing a set of trusted conditions corresponding to the first field protection rule based on the obtained first access parameter, wherein the first access parameter includes at least one of the following: an original request statement, a user identity, a user access level, an access time, and a network parameter; determining a first action type and a first action factor included in the first processing action according to a set of trusted condition execution results, wherein the first action type is used to indicate a specific protection operation, and the first action factor is used to indicate an actual parameter to be processed and an operator name of the specific protection operation; and performing protection processing on the first controlled field based on the first action factor to obtain the target result.

[0213] In an example embodiment, the execution module 96 can implement the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result by: in a case where the first processing action type includes one of a desensitization action, an encryption processing action, a decryption processing action, an anonymization action, and a custom action, synthesizing the first controlled field into a new SQL statement segment based on the first action factor to obtain the target result.

[0214] In an example embodiment, the apparatus can be configured to configure a field protection rule based on a received first configuration instruction, wherein the field protection rule comprises a combination of a request type, a set of trusted conditions, and a processing action; wherein the request type comprises at least one of: a data query language (DQL) type, a data manipulation language (DML) type; the trusted condition is used to define a basic judgment unit of trusted access, and at least comprises a trusted access type, a trusted access parameter name, a judgment operator, and a parameter value; the trusted access type comprises at least one of: an identity trusted condition, a level trusted condition, a network trusted condition, and a time trusted condition; the judgment operator comprises at least one of: greater than, greater than or equal to, less than or equal to, less than, equal to, and not equal to; the processing action comprises an action type and an action factor, the action type is used to indicate a specific protection operation, and the action factor is used to indicate an actual parameter to be processed and a specific protection operation operator name; and the action type comprises at least one of: rejecting access, allowing access, displaying original data, desensitization processing, encryption processing, decryption processing, anonymization processing, audit processing, and alarm processing.

[0215] In an example embodiment, in a case where the first access parameter comprises the user access level, the trusted condition comprises the level trusted condition corresponding to the user access level, wherein the level trusted condition is used to determine that the user access level satisfies the level trusted condition when it is determined that the user access level is greater than or equal to the data security level.

[0216] In an example embodiment, the apparatus can be further configured to configure a data security classification and a data security level corresponding to each controlled field based on a received second configuration instruction, wherein a plurality of controlled fields under the same data security classification correspond to the same data security level.

[0217] It should be noted that each of the above modules can be implemented by software or hardware, and for the latter, the following implementation manners can be used, but are not limited thereto: all of the above modules are located in the same processor; or the above modules are located in different processors in any combination.

[0218] Embodiments of the present application also provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0219] In an example embodiment, the computer readable storage medium described above can include, but is not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0220] Embodiments of the present application also provide an electronic device including a memory and a processor, the memory storing a computer program, and the processor being configured to execute the computer program to perform the steps in any of the method embodiments described above.

[0221] In an example embodiment, the electronic device described above can further include a transmission device connected to the processor and an input and output device connected to the processor.

[0222] The specific examples in the embodiments can refer to the examples described in the above embodiments and example embodiments, and will not be repeated here.

[0223] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be realized by general computing devices, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices, and can be realized by program codes executable by computing devices, so that they can be stored in storage devices and executed by computing devices, and in some cases, the steps shown or described can be executed in different order, or they can be manufactured into individual integrated circuit modules, or multiple modules or steps can be manufactured into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.

[0224] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data access method, characterized by, The method comprises: receiving a first access request for requesting access to data in a database; parsing the first access request to obtain the following data corresponding to the first access request: first access parameters, first request type, and first controlled field list; performing a first data protection operation on the first controlled field list based on the first access parameters and the first request type to obtain a target result, wherein the first access parameters at least include one of the following: original request statement, user identity, user access level, access time, network parameter; synthesizing a second access request based on the target result, and accessing data in the database based on the second access request to obtain an access result; parsing the access request to obtain the first controlled field list corresponding to the first access request comprises: in the case of a data query language (DQL) request, determining the top-level output field list of the DQL request as the first controlled field list; in the case of a request other than the DQL request, determining a target field list operated by the other request, and determining the target field list as the first controlled field list.

2. The method of claim 1, wherein, Performing a first data protection operation on the first controlled field list based on the first access parameters and the first request type to obtain a target result comprises: selecting a controlled field as a first controlled field from the first controlled field list in a predetermined order; determining a first field protection rule, data security classification, and data security level corresponding to the first controlled field, wherein different field protection rules correspond to different combinations of trusted conditions, request types, and processing actions, and the trusted conditions include allowed access conditions corresponding to the first access parameters; performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result.

3. The method of claim 2, wherein, Performing the first data protection operation on the first controlled field based on the corresponding first processing action in the first field protection rule to obtain the target result comprises: performing a set of trusted conditions corresponding to the first field protection rule based on the obtained first access parameters; determining a first action type and a first action factor included in the first processing action according to the execution result of the set of trusted conditions, wherein the first action type is used to indicate a specific protection operation, and the first action factor is used to indicate an actual parameter to be processed and an operator name of the specific protection operation; performing protection processing on the first controlled field based on the first action factor to obtain the target result.

4. The method of claim 3, wherein, Performing protection processing on the first controlled field based on the first action factor to obtain the target result comprises: in the case where the first processing action type includes one of the following: desensitization action, encryption processing action, decryption processing action, anonymization action, and custom action, synthesizing the first controlled field into a new SQL statement segment based on the first action factor to obtain the target result.

5. The method of claim 2, wherein, The method further comprises: configure a field protection rule based on the received first configuration instruction, wherein the field protection rule comprises a combination of a request type, a set of trusted conditions, and a processing action; wherein the request type comprises at least one of a data query language (DQL) type and a data manipulation language (DML) type; the trusted condition is used to define a basic judgment unit of trusted access, and at least comprises a trusted access type, a trusted access parameter name, a judgment operator, and a parameter value; the trusted access type comprises at least one of an identity trusted condition, a level trusted condition, a network trusted condition, and a time trusted condition; the judgment operator comprises greater than, greater than or equal to, less than or equal to, less than, equal to, and not equal to; the processing action comprises an action type and an action factor, the action type is used to indicate a specific protection operation, and the action factor is used to indicate an actual parameter to be processed and a specific protection operation operator name; the action type comprises at least one of rejection of access, permission of access, display of original data, desensitization processing, encryption processing, decryption processing, anonymization processing, audit processing, and alarm processing.

6. The method of claim 5, wherein, In a case where the user access level is included in the first access parameter, the level trusted condition corresponding to the user access level is included in the trusted condition, and the level trusted condition is used to determine that the user access level satisfies the level trusted condition when it is determined that the user access level is greater than or equal to the data security level.

7. The method of claim 6, wherein, The method further comprises: configuring a data security classification and a data security level corresponding to each controlled field based on a received second configuration instruction, wherein the data security levels corresponding to a plurality of controlled fields under a same data security classification are the same.

8. A data access device, characterized by comprises: a receiving module configured to receive a first access request for requesting access to data in a database; an obtaining module configured to parse the access request and obtain, corresponding to the first access request, first access parameters, a first request type, and a first controlled field list; an executing module configured to perform a first data protection operation on the first controlled field list based on the first access parameters and the first request type, to obtain a target result, and the first access parameters at least comprise one of an original request statement, a user identity, a user access level, an access time, and a network parameter; an accessing module configured to synthesize a second access request based on the target result, and access data in the database based on the second access request to obtain an access result; the obtaining module parses the access request and obtains the first controlled field list corresponding to the first access request in the following manner: in a case where the first access request is a data query language (DQL) request, a top-level output field list of the DQL request is determined as the first controlled field list; and in a case where the first access request is other than the DQL request, a target field list operated by the other request is determined as the first controlled field list.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is configured to execute the method in any one of claims 1 to 7 when running. 10.An electronic device comprising a memory and a processor, the electronic device characterized by, The memory stores a computer program, and the processor is configured to execute the computer program to execute the method in any one of claims 1 to 7.

Images