A data management method and device, electronic equipment and storage medium

Abstract

The application discloses a data management method and device, electronic equipment and storage medium. The method comprises the following steps: receiving a data access request sent by a user end, querying an access database based on the data access request to determine to-be-returned data and a first security policy implemented on the to-be-returned data; determining an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data; determining whether the first security policy is consistent with the access standard security policy; when the first security policy is inconsistent with the access standard security policy, blocking the current data access and recording the current abnormal access. That is, an embodiment of the application automatically identifies an access label of data by using enterprise classification and grading rules, determines a standard security policy required to be implemented on to-be-returned data by using the access label, and determines whether the to-be-returned data security policy is completely implemented according to the standard security policy, so that the safety of the current data access is ensured, and the integrity of a database is reserved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to computer technology, and particularly relate to a data management method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of network information, big data information spreads rapidly on the network and penetrates into people's production and life, and has a huge impact on all aspects of people's life. However, big data information has gathered more and more enterprise confidential information and personal privacy information. If all data is applied to differential or anonymous processing, it cannot be accurately protected according to data classification, and there will be risks of enterprise data leakage and personal information insecurity. In the prior art, the classification and grading are generally sorted by expert experience and artificial intelligence, and an integrated system is used to complete data sorting, classification and grading, and data security policy implementation, but it cannot provide data security protection for open architecture interconnection industry data and digital enterprise data. SUMMARY

[0003] The present application provides a data management method, device, electronic equipment and storage medium to detect the security policy implemented on data of different categories and levels to ensure the security of data access and transmission.

[0004] In a first aspect, embodiments of the present application provide a data management method applied to a gateway, comprising:

[0005] receiving a data access request sent by a user end, querying an access database based on the data access request to determine to-be-returned data and a first security policy implemented on the to-be-returned data;

[0006] determining an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data;

[0007] determining whether the first security policy is consistent with the access standard security policy;

[0008] when the first security policy is inconsistent with the access standard security policy, blocking this data access and recording this abnormal access.

[0009] Further, determining an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data comprises:

[0010] querying a classification and grading rule based on the field information of the to-be-returned data to determine an access label corresponding to the to-be-returned data, wherein the classification and grading rule includes a rule for judging the category and level corresponding to the field information;

[0011] query an access identification library based on the access tag to determine a tag identification corresponding to the access tag, the access identification library including tag identifications of all access categories identified according to the classification and grading rules;

[0012] query an access identification strategy library based on the tag identification to determine an access standard security strategy corresponding to the access tag, the access identification strategy library including security strategies corresponding to all tag identifications in the access identification library.

[0013] Further, the access identification library is established in the following manner:

[0014] determine classification and grading rules of an enterprise according to industry rules and enterprise data specifications to which an access database belongs;

[0015] create an access identification library corresponding to the classification and grading rules based on tags of all access category levels identified according to the classification and grading rules, the access identification library being used to distinguish different data category levels.

[0016] Further, the access identification strategy library is obtained in the following manner:

[0017] determine an access security rule library corresponding to the classification and grading rules according to the classification and grading rules and industry security rules;

[0018] store the access identification library and the access security rule library corresponding to the same classification and grading rules according to category levels to obtain an access identification strategy library corresponding to the access identification library.

[0019] In a second aspect, an embodiment of the present application further provides a data management method applied to a gateway, the method comprising:

[0020] obtain transmission information and a second security strategy corresponding to the transmission information;

[0021] determine a transmission tag corresponding to the transmission information and a transmission standard security strategy corresponding to the transmission tag according to field information of the transmission information;

[0022] determine whether the second security strategy is consistent with the transmission standard security strategy;

[0023] when the second security strategy is not consistent with the transmission standard security strategy, block the current data transmission and record the current abnormal transmission.

[0024] Further, the determination of the transmission tag corresponding to the transmission information and the transmission standard security strategy corresponding to the transmission tag according to the field information of the transmission information comprises:

[0025] query a classification and grading rule based on field information of the transmission information to determine a transmission label corresponding to the transmission data, the classification and grading rule including a rule for judging a category level corresponding to the field information;

[0026] query a transmission identification library based on the transmission label to determine a label identification corresponding to the transmission label, the transmission identification library including label identifications of all transmission category levels identified according to the classification and grading rule;

[0027] query a transmission identification strategy library based on the label identification to determine a transmission standard security strategy corresponding to the transmission label, the transmission identification strategy library including a security strategy corresponding to all label identifications in the transmission identification library.

[0028] Further, the transmission identification library creation method is as follows:

[0029] determine a classification and grading rule of an enterprise according to an industry rule and an enterprise data specification corresponding to an application program interface (API) of the enterprise data platform;

[0030] create a transmission identification library corresponding to the classification and grading rule based on labels of all transmission category levels identified according to the classification and grading rule, the transmission identification library being used to distinguish category levels of different information.

[0031] Further, the transmission identification strategy library acquisition method is as follows:

[0032] determine a transmission security rule library corresponding to the classification and grading rule according to the classification and grading rule and an industry security rule;

[0033] store the transmission identification library and the transmission security rule library corresponding to the same classification and grading rule according to category levels to obtain a transmission identification strategy library corresponding to the transmission identification library.

[0034] In a third aspect, an embodiment of the present application further provides a data management device, which comprises:

[0035] a data strategy determination module configured to receive a data access request sent by a user end, query an access database based on the data access request to determine to-be-returned data and determine a first security strategy implemented on the to-be-returned data;

[0036] a standard strategy determination module configured to determine an access label of the to-be-returned data and an access standard security strategy corresponding to the access label according to field information of the to-be-returned data;

[0037] a strategy consistency determination module configured to determine whether the first security strategy is consistent with the access standard security strategy;

[0038] An access blocking module is configured to block the data access and record the abnormal access when the first security policy is inconsistent with the access standard security policy.

[0039] In a fourth aspect, an embodiment of the present application further provides a data management device, which comprises:

[0040] A policy obtaining module is configured to obtain transmission information and a second security policy corresponding to the transmission information.

[0041] A policy determining module is configured to determine a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information.

[0042] A consistency judging module is configured to determine whether the second security policy is consistent with the transmission standard security policy.

[0043] A transmission blocking module is configured to block the data transmission and record the abnormal transmission when the second security policy is inconsistent with the transmission standard security policy.

[0044] In a fifth aspect, an embodiment of the present application further provides an electronic device, which comprises:

[0045] One or more processors;

[0046] A storage device configured to store one or more programs,

[0047] When the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the data management method.

[0048] In a sixth aspect, an embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the data management method.

[0049] The embodiment of the present application receives a data access request sent by a user end, determines a first security policy implemented by the to-be-returned data corresponding to the access request from a database, determines a label of the to-be-returned data and a first standard security policy corresponding to the label from a first label library according to field information of the to-be-returned data, determines whether the first security policy is consistent with the first standard security policy, blocks the current data access when the first security policy is inconsistent with the first standard security policy, and records the current abnormal access, thereby solving the problem that security guarantee cannot be provided when liquidity data is accessed, determining the access standard security policy needed to be implemented by the to-be-returned data through the access label corresponding to the field information of the to-be-returned data, determining the first security policy implemented by the to-be-returned data, determining the implementation of the security policy corresponding to the to-be-returned data by comparing the consistency of the first security policy and the access standard security policy, and guaranteeing the security of the current data access, while guaranteeing the integrity of the access database and the security of dynamic data flow. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a flowchart of a data management method provided by the embodiment of the present application;

[0051] Figure 2 is another flowchart of the data management method provided by the embodiment of the present application;

[0052] Figure 3 is still another flowchart of the data management method provided by the embodiment of the present application;

[0053] Figure 4 is a structural diagram of a data management device provided by the embodiment of the present application;

[0054] Figure 5 is another structural diagram of the data management device provided by the embodiment of the present application;

[0055] Figure 6 is a structural diagram of an electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0056] The present application will be further described below in conjunction with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures.

[0057] Figure 1A flowchart of a data management method provided by an embodiment of the present application is shown in FIG. 1. The method can be performed by a data management device provided by an embodiment of the present application, which can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in an electronic device, such as a server. The following embodiments will be described by way of example with the device integrated in an electronic device. Referring to FIG. 1, the method can include the following steps: Figure 1 The method can specifically include the following steps:

[0058] In step 110, a data access request sent by a user terminal is received, and an access database is queried based on the data access request to determine data to be returned and a first security policy to be implemented on the data to be returned.

[0059] By way of example, the data access request can be understood as a request for obtaining data in the access database from the user terminal according to the needs of the user side. The user terminal can be an electronic device used in an enterprise, or an external electronic device allowed to access the access database according to an agreement between the enterprise and the external electronic device. The access database can be understood as a database storing all data in the enterprise. The access database can include multiple sub-databases of different categories, or can store data of different categories according to different addresses in the database. The access database can be a structured database. The data to be returned can be understood as data corresponding to the data access request determined by querying the access database. The data corresponding to the data access request is not obtained or sent out, but only the field information of the data to be accessed is determined. The data to be returned includes the field information and the data content. The first security policy can be understood as a security policy to be implemented on the data to be accessed in the access database. The security policy can be encryption, desensitization, identity authentication, authorization, recording, early warning, etc.

[0060] In a specific implementation, the access database is provided with a gateway for receiving the data access request sent by the user terminal, and querying the access database based on the data access request to determine the data to be returned and the first security policy to be implemented on the data to be returned in the access database. The data to be returned corresponding to the data access request is not returned to the user terminal immediately, but only the field information of the data to be returned is determined, so as to determine the security category level of the data to be returned according to the field information of the data to be returned.

[0061] In step 120, the access label of the data to be returned and the access standard security policy corresponding to the access label are determined according to the field information of the data to be returned.

[0062] For example, the field information of the to-be-returned data can be understood as the field names in each data table, wherein the data content of the to-be-returned data is the corresponding data information in the field names in the data table, and each field name corresponds to different data content. The access label of the to-be-returned data can be understood as determining the safe category level corresponding to the field information of the to-be-returned data based on the classification and grading rules of the enterprise to which the accessed database belongs. The access standard security policy corresponding to the access label can be understood as a security policy that needs to be implemented according to the safe category level corresponding to the field information of the to-be-returned data. The standard security policy is a security policy corresponding to the enterprise according to the national regulations, industry regulations and enterprise rules, and the access standard security policy corresponding to the same access label of the same enterprise is the same.

[0063] In a specific implementation, the accessed database is queried according to the data access request to determine the to-be-returned data, and the field information of the to-be-returned data is obtained. The safe category level corresponding to the field information of the to-be-returned data is determined according to the classification and grading rules of the enterprise, and the access label of the to-be-returned data is determined. The label identifier of the to-be-returned data is determined according to the access label of the to-be-returned data, and the access security policy corresponding to the access label is determined based on the label identifier.

[0064] Step 130, determining whether the first security policy is consistent with the access standard security policy;

[0065] In a specific implementation, the access label corresponding to the field information of the to-be-returned data is determined based on the field information of the to-be-returned data and the classification and grading rules of the enterprise, and the access standard security policy corresponding to the access label is determined according to the label identifier of the to-be-returned data, so as to compare the first security policy of the to-be-returned data determined by querying the accessed database in real time with the access standard security policy, and determine whether the security policy implemented by the to-be-returned data is complete, which cannot guarantee the security of the data in the data access request process. If the first security policy is consistent with the access standard security policy, the security policy implemented by the to-be-returned data is complete, and the to-be-returned data is taken as the target data corresponding to the data access request for data access. If the first security policy is inconsistent with the access standard security policy, it indicates that the real-time security policy of the to-be-returned data is incomplete, and the to-be-returned data cannot be taken as the target data corresponding to the data access request for data access.

[0066] Step 140, when the first security policy is inconsistent with the access standard security policy, the current data access is blocked, and the current abnormal access is recorded.

[0067] In a specific implementation, it is determined whether the first security policy is consistent with the access standard security policy, and data access is performed under the premise of ensuring the safety of data access to data in the database. When the first security policy is inconsistent with the access standard security policy, it is indicated that the security of the to-be-returned data corresponding to the data access request cannot be ensured, and the current data access needs to be blocked to ensure that data is not leaked. The data access is monitored in real time, and abnormal access records of the enterprise are provided for internal auditing and adjustment of the data security policy of the enterprise, so that the data of the enterprise is subjected to clear data security control according to the classification and grading rules, and the risk of data leakage is reduced.

[0068] In the embodiment of the application, a data access request sent by a user terminal is received, and a first security policy implemented by to-be-returned data corresponding to the access request is determined from a database. A label of the to-be-returned data and a first standard security policy corresponding to the label are determined from a first label library according to field information of the to-be-returned data. It is determined whether the first security policy is consistent with the first standard security policy. When the first security policy is inconsistent with the first standard security policy, the current data access is blocked, and the current abnormal access is recorded. The problem that security cannot be ensured during liquidity data access is solved. The access standard security policy that needs to be implemented by the to-be-returned data is determined according to the access label corresponding to the field information of the to-be-returned data, and the first security policy implemented by the to-be-returned data is determined. The consistency of the first security policy and the access standard security policy is compared to determine the implementation of the security policy corresponding to the to-be-returned data, so as to ensure the safety of the current data access. While the integrity of the access database is retained, the safety of the dynamic data flow is ensured.

[0069] The data management method provided by the embodiment of the application is further described below. As shown in Figure 2 The method can specifically include the following steps:

[0070] In step 210, a data access request sent by a user terminal is received, and to-be-returned data is determined by querying an access database based on the data access request, and a first security policy implemented by the to-be-returned data is determined.

[0071] In step 220, an access label corresponding to the to-be-returned data is determined by querying a classification and grading rule based on field information of the to-be-returned data. The classification and grading rule includes a rule for judging the category level corresponding to the field information.

[0072] For example, the classification and grading rules can be understood as the industry to which the enterprise belongs, the laws used in the industry of the country, and the enterprise rules set by the enterprise according to its actual needs. The classification and grading rules of the enterprise can generally be from three levels of national level, industry level and enterprise regulation. According to the rules of each level, the field information of the data in the access database is determined to belong to a category level. In essence, the classification and grading rules are used to determine or identify the rules of the category level corresponding to different field information.

[0073] In a specific implementation, the field information of the data to be returned is obtained by querying the access database according to the data access request to determine the data to be returned. The classification and grading rules are queried according to the field information of the data to be returned, and the category level corresponding to the field information of the data to be returned is determined. According to the category level corresponding to the field information of the data to be returned, that is, the access tag corresponding to the data to be returned, the tag identifier corresponding to the access tag is determined in the access identifier library.

[0074] Step 230, query the access identifier library based on the access tag to determine the tag identifier corresponding to the access tag. The access identifier library includes the tag identifiers of all access category levels identified according to the classification and grading rules;

[0075] For example, the access identifier library can be understood as a database that stores the tag identifiers of all access category levels identified by the classification and grading rules. The access identifier library corresponds to the classification and grading rules. The access tags identified by the classification and grading rules of the same enterprise can find the corresponding tag identifiers in the access identifier library. The identifier corresponding to the access tag can be understood as an identifier for indicating the category level of the data to be returned. The category level can be directly determined according to the identifier.

[0076] In a specific implementation, the field information of the data to be returned is obtained by querying the access database according to the data access request to determine the data to be returned. The classification and grading rules are queried according to the field information of the data to be returned, and the category level corresponding to the field information of the data to be returned is determined. According to the category level corresponding to the field information of the data to be returned, that is, the access tag corresponding to the data to be returned, the tag identifier corresponding to the access tag is determined in the access identifier library.

[0077] Step 240, query the access identifier strategy library based on the tag identifier to determine the access standard security policy corresponding to the access tag. The access identifier strategy library includes the security policies corresponding to all tag identifiers in the access identifier library;

[0078] In a specific implementation, the access identification policy library can be understood as a database storing security policies to be implemented according to all label identifiers corresponding to all category levels in the access identification library, wherein the label identifiers in the access identification policy library correspond to the access standard security policies. The access label is queried from the access identification library according to the field information of the data to be returned, the label identifier corresponding to the access label is determined, and the access standard security policy stored corresponding to the label identifier corresponding to the access label is determined as the access standard security policy corresponding to the access label according to the label identifier corresponding to the access label.

[0079] Step 250, determining whether the first security policy is consistent with the access standard security policy;

[0080] Step 260, when the first security policy is inconsistent with the access standard security policy, blocking this data access, and recording this abnormal access.

[0081] Further, the access identification library is established as follows:

[0082] According to the industry rules and enterprise data specifications to which the access database belongs, the classification and grading rules of the enterprise are determined;

[0083] Based on the labels of all access categories and levels identified according to the classification and grading rules, the access identification library corresponding to the classification and grading rules is created, and the access identification library is used to distinguish different categories and levels of data.

[0084] For example, the access database is a database storing all data in the enterprise. According to the industry rules of the operation industry of the enterprise, the data specifications of the enterprise can also be determined according to the actual needs in the actual production and operation process of the enterprise. The industry rules need to be executed under the premise of being legal. In essence, the industry rules here actually contain the rules of the potential operation mode of the national level. For example: the data related to the secret level file needs to be encrypted and set with permissions, and only the people related to the project are allowed to open, only the user equipment allowed to view is set for the data system, and the related data can be viewed using the key. If the related data is obtained using hacking technology, it will violate the regulations at the national level.

[0085] In a specific implementation, according to the industry rules and enterprise data specifications to which the access database belongs, the classification and grading rules of the enterprise are determined, and the access labels of the data stored in the access database can be determined according to the classification and grading rules. According to the classification and grading rules, the access identification library storing the identifiers of all category levels of access labels is created. For example: the access label corresponding to the data to be returned can be determined according to the field information of the data to be returned corresponding to the data access request, and the label identifier is found from the access identification library according to the access label, so as to determine the corresponding access standard security policy according to the label identifier.

[0086] Further, the access identification policy library is obtained in the following manner:

[0087] According to the classification grading rule and the industry security rule, a corresponding access security rule library of the classification grading rule is determined;

[0088] The access identification library and the access security rule library corresponding to the same classification grading rule are stored in association according to the category level, so as to obtain an access identification policy library corresponding to the access identification library.

[0089] In a specific implementation, the industry security rule can be understood as all security policies implemented by the industry and the corresponding rule of the category level, and the standard security policy corresponding to all category levels of the classification grading rule can be determined according to the classification grading rule. The access security rule library can be understood as a database storing the standard security policy corresponding to all category levels of the classification grading rule, and the corresponding standard security policy of the access tag can be determined according to the classification grading rule. For the same classification grading rule, the corresponding tag identification and standard security policy of the access identification library and the access security rule library are stored in association according to the category level tag, so as to obtain the access identification policy library.

[0090] In the embodiment of the application, the data access request sent by the user end is received, and the first security policy implemented by the to-be-returned data corresponding to the access request is determined from the database; the tag of the to-be-returned data and the first standard security policy corresponding to the tag are determined from the first tag library according to the field information of the to-be-returned data; it is determined whether the first security policy is consistent with the first standard security policy; when the first security policy is inconsistent with the first standard security policy, the current data access is blocked, and the current abnormal access is recorded, thereby solving the problem that security guarantee cannot be provided when liquidity data is accessed. The access standard security policy required by the to-be-returned data is determined through the access tag corresponding to the field information of the to-be-returned data, and the first security policy implemented by the to-be-returned data is determined, and the consistency of the first security policy and the access standard security policy is compared to determine the implementation of the security policy corresponding to the to-be-returned data, so as to ensure the security of the current data access; while the integrity of the access database is preserved, the dynamic data flow security is ensured.

[0091] Figure 3 Another flowchart of the data management method provided by the embodiment of the application is provided, which can be executed by the data management device provided by the embodiment of the application. The device can be realized in the form of software and / or hardware. In a specific embodiment, the device can be integrated in an electronic device, such as a server. The following embodiments will be described by taking the device integrated in the electronic device as an example. For details, refer to the description of the device. Figure 3The method can specifically include the following steps:

[0092] Step 310, obtaining transmission information and a second security policy corresponding to the transmission information;

[0093] For example, the transmission information can be understood as data information currently transmitted through an application program interface API of an enterprise data platform. The enterprise data platform can query all access databases of the enterprise, or transmit data between multiple data platforms through the application program interface API according to actual needs. The application program interface API can transmit data on the data platform outwards, or transmit data on other data platforms inwards, and mainly provide data sharing for various different platforms. The second security policy corresponding to the transmission information can be understood as a security policy implemented for the transmission data in the current transmission information. The security policy can be encryption, desensitization, identity authentication, authentication, recording, early warning, and the like, and the encryption algorithm, desensitization algorithm, identity authentication mode difficulty, authentication, recording granularity, and early warning threshold set according to different category levels are also different. The higher the category level, the more difficult the algorithm, the stronger the authentication mode, the finer the recording granularity, and the more sensitive the early warning threshold.

[0094] In a specific implementation, the application program interface API has a gateway, which is used to obtain transmission information before transmission of the application program interface API, and determine transmission data and a first security policy implemented for the transmission data according to the transmission information. Only the field information of the transmission information is determined, so as to determine a category level corresponding to the transmission information according to the field information of the transmission data.

[0095] Step 320, determining a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to the field information of the transmission information;

[0096] For example, the field information of the transmission information can be understood as each field name in each data table in the transmission data of the transmission information. The transmission data of the transmission information is corresponding data information in the field name in the data table, and each field name corresponds to different transmission data. The transmission data can also be a string or a text sequence. The field name of the string can be a character with a preset fixed number of bits according to actual needs, or can be a main theme according to the actual meaning represented by the string or the semantic meaning corresponding to the string. The field name of the text sequence can be a subject word of the text sequence. The transmission label corresponding to the transmission information can be understood as classification and grading rules corresponding to industry rules and enterprise data specifications based on the application program interface API of the enterprise data platform, which determines the category level of the field information of the transmission data corresponding to the security. The transmission standard security policy can be understood as a security policy required to be implemented according to the category level of the transmission information corresponding to the security, which is a standard security policy formulated based on multiple levels such as the state, the industry, and the enterprise.

[0097] It should be noted that, although the application program interface API of the access database and the enterprise data platform is one as an access process and one as a transmission process of data security, the same enterprise is in the same industry, the same legal and the same enterprise data specification content. Therefore, the same enterprise classification grading rules are the same, and whether the access process or the transmission process is a comparison of the security policy according to the data field information in the standard and implementation of two aspects, to ensure the completeness of the security policy implemented in the data access or transmission process, and to protect the data security in the data access and transmission process.

[0098] In a specific implementation, the transmission data is determined according to the transmission information, and the first security policy implemented by the transmission data is determined. The field information of the transmission data is determined according to the transmission data, the security class level corresponding to the field information of the transmission data, i.e. the transmission label of the transmission data, is determined according to the classification grading rules of the enterprise, and the label identification of the transmission data is determined according to the transmission label of the transmission data. The transmission security policy corresponding to the transmission label is determined based on the label identification.

[0099] Step 330, determine whether the second security policy is consistent with the transmission standard security policy;

[0100] In a specific implementation, the transmission label corresponding to the field information of the transmission data is determined based on the field information of the transmission data and the classification grading rules of the enterprise, and the transmission standard security policy corresponding to the transmission label is determined according to the label identification of the transmission data, so as to compare with the second security policy implemented by the query transmission data, determine that the security policy implemented by the transmission data is not implemented according to the completeness of the transmission standard security policy, and cannot guarantee the security of the data in the data transmission process. If the second security policy is consistent with the transmission standard security policy, the security policy implemented by the data is implemented according to the completeness of the transmission standard security policy, and the transmission data is transmitted through the application program interface API. If the second security policy is inconsistent with the access standard security policy, it indicates that the security policy implemented by the transmission data is not complete, and cannot be transmitted through the application program interface API.

[0101] Step 340, when the second security policy is inconsistent with the transmission standard security policy, the data transmission is blocked this time, and the abnormal transmission this time is recorded.

[0102] In the specific implementation, it is determined whether the second security policy is consistent with the transmission standard security policy, so as to ensure that the application program interface (API) calls or transmits data under the premise of data security during data transmission. When the second security policy is inconsistent with the transmission standard security policy, it indicates that the transmission data cannot be guaranteed to be secure, and the current data transmission needs to be blocked to ensure that the data is not leaked. The data transmission process is monitored in real time, and the abnormal transmission record of the enterprise is provided for internal auditing and adjustment of the data security policy of the enterprise, so as to ensure that the enterprise data is subjected to clear data security control according to the classification and grading rules, and the risk of data leakage is reduced.

[0103] Further, the transmission information corresponding to the transmission label and the transmission standard security policy corresponding to the transmission label are determined according to the field information of the transmission information, and the transmission information corresponding to the transmission label and the transmission standard security policy corresponding to the transmission label are determined according to the field information of the transmission information.

[0104] The classification and grading rules are queried based on the field information of the transmission information to determine the transmission label corresponding to the transmission data, and the classification and grading rules include rules for judging the category level corresponding to the field information.

[0105] The transmission label identification library is queried based on the transmission label to determine the label identification corresponding to the transmission label, and the transmission label identification library includes label identifications of all transmission category levels identified according to the classification and grading rules.

[0106] The transmission label identification strategy library is queried based on the label identification to determine the transmission standard security policy corresponding to the transmission label, and the transmission label identification strategy library includes the security policy corresponding to all label identifications in the transmission label identification library.

[0107] For example, the classification and grading rules can be understood as the industry to which the enterprise belongs, the laws used in the industry of the country, and the enterprise rules set by the enterprise according to its actual needs. The classification and grading rules of the enterprise can generally be from the national level, the industry level and the enterprise regulations. According to the rules of each level, the field information of the data transmitted through the application program interface API is determined to be in the category level. In essence, the classification and grading rules are used to determine or identify the category level corresponding to different field information. The transmission identification library can be understood as a database that stores the label identification of all transmission data categories identified by the classification and grading rules. The transmission identification library corresponds to the classification and grading rules. The transmission label identified by the classification and grading rules of the same enterprise can find the corresponding label identification in the transmission identification library. The label identification corresponding to the transmission label can be understood as an identifier indicating the category level of the transmission data, which can be directly determined according to the identification. The transmission identification strategy library can be understood as a database that stores all security strategies that need to be implemented according to all category levels corresponding to all label identifications in the transmission identification library. Among them, the label identification in the transmission identification strategy library corresponds to the transmission standard security policy. The transmission standard security policy can be understood as a standard security policy corresponding to the label identification found in the transmission identification strategy library according to the label identification.

[0108] In a specific implementation, the transmission data is determined according to the transmission information, the classification and grading rules are queried according to the field information of the transmission data to determine the label corresponding to the transmission data, and the label identification corresponding to the transmission label is determined based on the transmission label. The transmission standard security policy corresponding to the transmission label is determined by querying the transmission identification strategy library based on the label identification corresponding to the transmission label. By calling the classification and grading rules, the transmission identification library and the transmission identification strategy library, the corresponding standard security policy is implemented only by determining whether the transmission data is complete through the gateway to obtain the field information of the transmission data without affecting the original data of the transmission, so as to ensure that the transmission data is transmitted under safe conditions.

[0109] Further, the transmission identification library creation method is as follows:

[0110] According to the industry rules and enterprise data specifications corresponding to the application program interface API of the enterprise data platform, the classification and grading rules of the enterprise are determined;

[0111] Based on the label of all transmission categories identified by the classification and grading rules, the transmission identification library corresponding to the classification and grading rules is created. The transmission identification library is used to distinguish the category level of different information.

[0112] For example, the enterprise data platform is a data sharing platform for accessing data on a database and an external data platform through an application program interface (API) call. The corresponding industry rules of the enterprise data platform can be formulated according to the operation industry of the enterprise, and the rules followed by the industry can also be determined by the enterprise according to the actual production and operation process. The industry rules need to be executed under the premise of legality. In essence, the industry rules actually contain the rules of the potential operation mode of the industry and the rules stipulated at the national level.

[0113] In a specific implementation, the application program interface (API) of the enterprise data platform corresponds to the industry rules and enterprise data specifications of the enterprise classification and grading rules. The transmission label of the transmission data through the application program interface (API) can be determined according to the classification and grading rules. The transmission label of all categories and levels is created to store the transmission label of all categories and levels. For example, the transmission label corresponding to the transmission data can be determined according to the field information of the transmission data corresponding to the transmission information, and the label identifier can be searched from the transmission label library according to the transmission label, so as to determine the corresponding transmission standard security policy according to the label identifier.

[0114] Further, the transmission identification strategy library is obtained in the following manner:

[0115] According to the classification and grading rules and the industry safety rules, the transmission safety rule library corresponding to the classification and grading rules is determined;

[0116] The transmission identification library and the transmission safety rule library corresponding to the same classification and grading rules are stored according to the category level, and the transmission identification strategy library corresponding to the transmission identification library is obtained.

[0117] In a specific implementation, the industry safety rule can be understood as all safety policies and category level corresponding rules implemented by the industry to which the user belongs, and the standard safety policy corresponding to all category levels of the classification and grading rule can be determined according to the classification and grading rule. The transmission safety rule library can be understood as a database storing the standard safety policy corresponding to all category levels of the classification and grading rule, and the corresponding standard safety policy of the transmission label determined according to the classification and grading rule. The classification and grading rules of the same enterprise are the same, and for the transmission label corresponding to the same classification and grading rule, the corresponding label identifier and the standard safety policy of the transmission identifier library and the transmission safety rule library are associated and stored according to the category level label to obtain the transmission identifier policy library. The information transmitted by the application program interface (API) is dynamically verified by the gateway, so that the data in the transmission can also be verified by the data security policy, and the safety of data transmission is ensured. Here, the gateway can also be a security engine in the security system of the enterprise, which has the same function. In addition, by calling the database, rather than directly adding a label to the data, the access to the data and the transmission data security policy can be secretly detected without being misled by false information while ensuring that the original data is not damaged.

[0118] In the embodiment of the application, the transmission information and the second safety policy corresponding to the transmission information are obtained, the transmission label corresponding to the transmission information and the transmission standard safety policy corresponding to the transmission label are determined according to the field information of the transmission information, and it is determined whether the second safety policy is consistent with the transmission standard safety policy. When the second safety policy is inconsistent with the transmission standard safety policy, the current data transmission is blocked, and the current abnormal transmission is recorded, thereby solving the problem that the industry and enterprise data cannot provide safety protection in the liquidity data access. The transmission standard safety policy that needs to be implemented for the transmission data is determined through the transmission label corresponding to the field information of the transmission data, and the second safety policy implemented by the transmission data is determined. The implementation of the safety rule corresponding to the transmission data is determined by comparing the consistency of the second safety policy and the transmission standard safety policy, so as to ensure the safety of the current data transmission. Under the condition of not damaging the storage form of the original database, the dynamic data flow safety is ensured.

[0119] Figure 4 A structural schematic diagram of a data management device provided by the embodiment of the application is shown in FIG. 1. Figure 4 As shown in FIG. 1, the data management device includes a gateway.

[0120] The data policy determination module 410 is configured to receive a data access request sent by a user end, query an access database based on the data access request to determine to-be-returned data and determine a first safety policy implemented on the to-be-returned data.

[0121] The standard policy determination module 420 is configured to determine an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data.

[0122] The policy consistency determination module 430 is configured to determine whether the first security policy is consistent with the access standard security policy.

[0123] The access blocking module 440 is configured to block the current data access and record the current abnormal access when the first security policy is inconsistent with the access standard security policy.

[0124] In an embodiment, the standard policy determination module 420 determines the access label of the to-be-returned data and the access standard security policy corresponding to the access label according to the field information of the to-be-returned data, and the method comprises the following steps.

[0125] The classification and grading rules are queried based on the field information of the to-be-returned data to determine the access label corresponding to the to-be-returned data, and the classification and grading rules comprise rules for judging the classification level corresponding to the field information.

[0126] The access label identification library is queried based on the access label to determine the label identification corresponding to the access label, and the access label identification library comprises label identifications of all access classification levels identified according to the classification and grading rules.

[0127] The access label identification policy library is queried based on the label identification to determine the access standard security policy corresponding to the access label, and the access label identification policy library comprises security policies corresponding to all label identifications in the access label identification library.

[0128] In an embodiment, the access label identification library is established in the following manner.

[0129] The classification and grading rules of the enterprise are determined according to the industry rules and enterprise data specifications to which the access database belongs.

[0130] The access label identification library corresponding to the classification and grading rules is created based on all access classification levels identified according to the classification and grading rules, and the access label identification library is used to distinguish the classification level of different data.

[0131] In an embodiment, the access label identification policy library is obtained in the following manner.

[0132] The access security rule library corresponding to the classification and grading rules is determined according to the classification and grading rules and the industry security rules.

[0133] The access label identification library and the access security rule library corresponding to the same classification and grading rules are stored in association according to the classification level to obtain the access label identification policy library corresponding to the access label identification library.

[0134] In the device, a data access request sent by a user terminal is received, a first security policy implemented on data to be returned corresponding to the access request is determined from a database, a label of the data to be returned and a first standard security policy corresponding to the label are determined from a first label library according to field information of the data to be returned, whether the first security policy is consistent with the first standard security policy is determined, and when the first security policy is inconsistent with the first standard security policy, the current data access is blocked, and the current abnormal access is recorded, thereby solving the problem that industry and enterprise data cannot provide security guarantee in liquidity data access. The access standard security policy required to be implemented on the data to be returned is determined through the access label corresponding to the field information of the data to be returned, the first security policy implemented on the data to be returned is determined, the consistency of the first security policy and the access standard security policy is determined, the implementation of the security rule corresponding to the data to be returned is determined, and the security of the current data access is ensured. Under the condition that the storage form of the original database is not damaged, the security of dynamic data flow is ensured.

[0135] Figure 5 Another structural schematic diagram of the data management device provided by the embodiment is shown in FIG. 6. Figure 5 As shown in FIG. 6, the device is applied to a gateway, and the device comprises:

[0136] The policy acquisition module 510 is configured to acquire transmission information and a second security policy corresponding to the transmission information.

[0137] The policy determination module 520 is configured to determine a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information.

[0138] The consistency judgment module 530 is configured to determine whether the second security policy is consistent with the transmission standard security policy.

[0139] The transmission blocking module 540 is configured to block the current data transmission when the second security policy is inconsistent with the transmission standard security policy, and record the current abnormal transmission.

[0140] In an embodiment, the policy determination module 520 determines the transmission label corresponding to the transmission information and the transmission standard security policy corresponding to the transmission label according to the field information of the transmission information, and the method comprises:

[0141] The classification and grading rule is queried based on the field information of the transmission information to determine the transmission label corresponding to the transmission data, and the classification and grading rule comprises a rule for judging the category and level corresponding to the field information.

[0142] query a transmission identification library based on the transmission label to determine the label identification corresponding to the transmission label, the transmission identification library including label identifications of all transmission categories identified according to the classification and grading rules;

[0143] query a transmission identification strategy library based on the label identification to determine the transmission standard security policy corresponding to the transmission label, the transmission identification strategy library including security policies corresponding to all label identifications in the transmission identification library.

[0144] In an embodiment, the transmission identification library creation method is as follows:

[0145] determine the classification and grading rules of the enterprise according to the industry rules and enterprise data specifications corresponding to the application program interface (API) of the enterprise data platform;

[0146] create a transmission identification library corresponding to the classification and grading rules based on the label of all transmission category levels identified according to the classification and grading rules, the transmission identification library being used to distinguish different information category levels.

[0147] In an embodiment, the transmission identification strategy library is obtained in the following manner:

[0148] determine the transmission security rule library corresponding to the classification and grading rules according to the classification and grading rules and the industry security rules;

[0149] store the transmission identification library and the transmission security rule library corresponding to the same classification and grading rules according to the category level to obtain the transmission identification strategy library corresponding to the transmission identification library.

[0150] The embodiment of the application obtains transmission information and a second security policy corresponding to the transmission information, determines a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information, determines whether the second security policy is consistent with the transmission standard security policy, and blocks the current data transmission and records the current abnormal transmission when the second security policy is inconsistent with the transmission standard security policy, thereby solving the problem that industry and enterprise data cannot provide security protection in liquidity data access. The transmission standard security policy that needs to be implemented for transmission data is determined through the transmission label corresponding to the field information of the transmission data, and the second security policy implemented for the transmission data is determined, the consistency of the second security policy and the transmission standard security policy is compared, the implementation of the security rule corresponding to the transmission data is determined, and the safety of the current data transmission is ensured. The dynamic data flow safety is ensured without destroying the storage form of the original database.

[0151] Figure 6 A structural schematic diagram of an electronic device is provided for the embodiment of the application. Figure 6A block diagram is shown of an exemplary electronic device 12 suitable for implementing embodiments of the present invention. Figure 6 The electronic device 12 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0152] like Figure 6 As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0153] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0154] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0155] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (64 not shown, commonly referred to as a "hard disk drive"). Although Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. System memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0156] Program / utility 40 having a set of program modules 42 can be stored in system memory 28 by way of example, such program modules 42 include an operating system, one or more application programs, other program modules, and program data, each or some combination thereof, which may

[0157] Electronic device 12 can also communicate with one or more external devices 14 such as a keyboard or pointing device, a display 24, etc. ; other devices such as a storage device or a printer; and / or a network interface 20 which can be any means of connecting the electronic device 12 to one or more other electronic devices or networks, such as a modem, a network adapter, etc. which can be used to communicate with one or more other electronic devices or networks. Figure 6 Network adapter 20 can communicate to the Internet or one or more other networks by way of a communication connection to enable device 12 to communicate with other devices and to enable the receipt of various media content over the network. It should be appreciated that the network adapter 20 can also be utilized to communicate with other electronic devices or systems using other communication techniques, such as a wireless communication protocol, a cellular protocol, etc.

[0158] Processing unit 16 can execute various functions and / or methods provided by embodiments of the present application by running programs stored in system memory 28. Such programs can include, for example:

[0159] receiving a data access request sent by a user end, querying an access database based on the data access request to determine data to be returned and to determine a first security policy implemented on the data to be returned;

[0160] determining an access label of the data to be returned and an access standard security policy corresponding to the access label according to field information of the data to be returned;

[0161] determining whether the first security policy is consistent with the access standard security policy;

[0162] when the first security policy is not consistent with the access standard security policy, blocking the data access and recording the current abnormal access;

[0163] or, obtaining transmission information and a second security policy corresponding to the transmission information;

[0164] determine a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information;

[0165] determine whether the second security policy is consistent with the transmission standard security policy;

[0166] when the second security policy is inconsistent with the transmission standard security policy, block the current data transmission and record the current abnormal transmission.

[0167] The embodiment of the application further provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the data management method, and the method comprises the following steps:

[0168] receive a data access request sent by a user end, query an access database based on the data access request to determine to-be-returned data and determine a first security policy implemented on the to-be-returned data;

[0169] determine an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data;

[0170] determine whether the first security policy is consistent with the access standard security policy;

[0171] when the first security policy is inconsistent with the access standard security policy, block the current data access and record the current abnormal access;

[0172] or, obtain transmission information and a second security policy corresponding to the transmission information;

[0173] determine a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information;

[0174] determine whether the second security policy is consistent with the transmission standard security policy;

[0175] when the second security policy is inconsistent with the transmission standard security policy, block the current data transmission and record the current abnormal transmission.

[0176] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0177] The computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave, in which the computer-readable program code is contained. Such propagated data signal can take a variety of forms, including but not limited to electro-magnetic, optical or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium that is not a storage medium and that can be used to carry or propagate program code that is used by or in connection with an instruction execution system, apparatus, or device.

[0178] The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wire line, optical fiber, RF, etc., or any suitable combination of the above.

[0179] The computer program code for carrying out operations of the present application can be written in one or more programming languages or combinations of languages including object oriented programming languages such as Java, Smalltalk, C++ or conventional procedural programming languages such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0180] Note that the above merely describes preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A data management method characterized by, The application is applied to a gateway, and comprises the following steps: receiving a data access request sent by a user terminal, querying an access database based on the data access request to determine to-be-returned data and a first security policy implemented on the to-be-returned data; determining an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data, wherein the access label is determined according to a classification and grading rule corresponding to an enterprise to which the access database belongs, and the field information of the to-be-returned data corresponds to a safe class level; determining whether the first security policy is consistent with the access standard security policy; when the first security policy is inconsistent with the access standard security policy, blocking this data access and recording this abnormal access.

2. The method of claim 1, wherein, The method comprises the following steps: querying a classification and grading rule based on the field information of the to-be-returned data to determine an access label corresponding to the to-be-returned data, wherein the classification and grading rule comprises a rule for judging a class level corresponding to the field information; querying an access identification library based on the access label to determine a label identification corresponding to the access label, wherein the access identification library comprises label identifications of all access class levels identified according to the classification and grading rule; querying an access identification strategy library based on the label identification to determine an access standard security policy corresponding to the access label, wherein the access identification strategy library comprises a security policy corresponding to all label identifications in the access identification library.

3. The method of claim 2, wherein, The access identification library is established in the following manner: determining a classification and grading rule of an enterprise according to an industry rule and an enterprise data specification to which an access database belongs; correspondingly creating an access identification library corresponding to the classification and grading rule based on labels of all access class levels identified according to the classification and grading rule, wherein the access identification library is used to distinguish class levels of different data.

4. The method of claim 2, wherein, The access identification strategy library is obtained in the following manner: determining an access security rule library corresponding to the classification and grading rule according to the classification and grading rule and an industry security rule; storing the access identification library and the access security rule library corresponding to the same classification and grading rule according to class levels to obtain an access identification strategy library corresponding to the access identification library.

5. A data management method characterized by, The application is applied to a gateway, and comprises the following steps: obtaining transmission information and a second security policy corresponding to the transmission information; determining a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information, wherein the transmission label is determined according to a classification and grading rule corresponding to an application program interface API industry rule and an enterprise data specification of an enterprise data platform, and the field information of the transmission data corresponds to a safe class level; determining whether the second security policy is consistent with the transmission standard security policy; when the second security policy is inconsistent with the transmission standard security policy, blocking this data transmission and recording this abnormal transmission.

6. The method of claim 5, wherein, The field information of the transmission information is used to determine the transmission label corresponding to the transmission information and the transmission standard security policy corresponding to the transmission label, including: Based on the field information of the transmission information, the classification grading rule is queried to determine the transmission label corresponding to the transmission data, and the classification grading rule includes the rule for judging the classification level corresponding to the field information; Based on the transmission label, the transmission identification library is queried to determine the label identification corresponding to the transmission label, and the transmission identification library includes the label identification of all transmission classification levels identified according to the classification grading rule; Based on the label identification, the transmission identification policy library is queried to determine the transmission standard security policy corresponding to the transmission label, and the transmission identification policy library includes the security policy corresponding to all label identifications in the transmission identification library.

7. The method of claim 6, wherein, The transmission identification library creation method is as follows: According to the industry rules and enterprise data specifications corresponding to the application program interface API of the enterprise data platform, the classification grading rule of the enterprise is determined; Based on the classification grading rule, the label of all transmission classification levels identified is used to create the transmission identification library corresponding to the classification grading rule, and the transmission identification library is used to distinguish the classification level of different information.

8. The method of claim 6, wherein, The transmission identification policy library is obtained in the following way: According to the classification grading rule and the industry safety rule, the transmission safety rule library corresponding to the classification grading rule is determined; The transmission identification library and the transmission safety rule library corresponding to the same classification grading rule are stored according to the classification level to obtain the transmission identification policy library corresponding to the transmission identification library.

9. A data management apparatus characterized by comprising: Including: A data policy determination module is configured to receive a data access request sent by a user end, query an access database based on the data access request to determine to-be-returned data and determine a first security policy implemented on the to-be-returned data; A standard policy determination module is configured to determine an access label of the to-be-returned data and an access standard security policy corresponding to the access label according to field information of the to-be-returned data; wherein the access label is determined according to a classification grading rule corresponding to an enterprise to which an access database belongs, and a classification level corresponding to the field information of the to-be-returned data is determined to be safe; A policy consistency determination module is configured to determine whether the first security policy is consistent with the access standard security policy; An access blocking module is configured to block the current data access when the first security policy is not consistent with the access standard security policy, and record the current abnormal access.

10. A data management apparatus characterized by comprising: Including: A policy acquisition module is configured to acquire transmission information and a second security policy corresponding to the transmission information; A policy determination module is configured to determine a transmission label corresponding to the transmission information and a transmission standard security policy corresponding to the transmission label according to field information of the transmission information; wherein the transmission label is determined according to a classification grading rule corresponding to an industry rule and an enterprise data specification of an application program interface API of an enterprise data platform, and a classification level corresponding to the field information of the transmission data is determined to be safe; A consistency determination module is configured to determine whether the second security policy is consistent with the transmission standard security policy. A transmission blocking module is configured to block the current data transmission and record the current abnormal transmission when the second security policy is inconsistent with the transmission standard security policy.

11. An electronic device, comprising: The electronic device includes: one or more processors; a memory device storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the data management method according to any one of claims 1-4 or 5-8.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the data management method according to any one of claims 1-4 or 5-8.

Images