A data space construction method and device

Abstract

The application discloses a data space construction method and device, wherein the method comprises the following steps: distributing a data security engine, a data management terminal and a data space user terminal at the bottom layer of a data space system; performing data service analysis on the protection of the bottom layer data based on the data security engine, the data management terminal and the data space user terminal; wherein the data security engine comprises an access control model, a data desensitization algorithm, a data structure model, a data control flow model and an identity recognition model; accessing a plurality of data sources by using a data access module; accessing the data sources corresponding to the data management terminal, the data user terminal and the data security engine into the data space of the data space system to obtain the data sources of the data space; and constructing a security protection layer based on the data security engine according to the data sources of the data space to form a secure data space. The application is used for providing security guarantee for data with high confidentiality and security requirements.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a data space construction method and device. BACKGROUND

[0002] With the vigorous development of information technology and the continuous advancement of the national big data strategy, big data has become an important strategic resource for improving enterprise competitiveness, and the use and security of data resources have also been increasingly valued by enterprises.

[0003] When an enterprise develops to a certain scale, the data island problem seriously affects the use efficiency of data resources. The data island problem refers to that when an enterprise develops to a certain stage, multiple business departments appear, each business department has its own data, and the data between business departments are often stored and defined by each department, so that the data of each business department is like an island and cannot (or is extremely difficult) to connect and interact with other data in the enterprise. Simply speaking, there is a lack of correlation between data, and databases cannot be compatible with each other.

[0004] The data island is divided into two types: physical and logical. The physical data island refers to that the department data is only stored and maintained independently in the department itself, and is physically isolated from other departments; the logical data island refers to that for some same data, different departments lack interactive communication based on data analysis results, and only stand in their own perspective to analyze, understand and define the data, which seriously affects the data cooperation efficiency across departments.

[0005] Since the strategic position of big data in the current enterprise competition is rising, the data security problem cannot be ignored. In the process of data use, data with no requirement or low requirement for confidentiality rarely consider security problems, but data with high requirement for confidentiality must strictly consider security problems. Generally, data with high requirement for confidentiality has high commercial value, and even relates to the survival of the enterprise. How to provide security protection for confidential data in the process of data use is an urgent need of enterprises.

[0006] In addition, in the big data scenario, data is gathered from multiple channels, data types, user roles and application requirements are more diversified, and access control faces many new problems. First, the large amount of multi-source data increases the difficulty of access control policy formulation and authorization management, and the phenomena of excessive authorization and insufficient authorization are serious. Second, the diversity of data, user roles and requirements increases the difficulty of object description. In the traditional access control scheme, data attributes are often used to describe the object in the access control policy. Unstructured and semi-structured data cannot be described in the same way, which makes it difficult to accurately specify the data range that the user can access and meet the minimum authorization principle. Finally, for data with high confidentiality and security requirements, traditional methods alone cannot handle or cannot handle encryption mechanisms. SUMMARY

[0007] The present application aims to at least partially solve one of the technical problems in the related art.

[0008] To this end, the purpose of the present application is to construct a data space and propose a data space construction method to solve the data security and data island problems faced by data use in the process of big data governance and data mining.

[0009] Another purpose of the present application is to propose a data space construction device.

[0010] To achieve the above purpose, the present application proposes a data space construction method, which includes the following steps:

[0011] A data security engine is distributed at the bottom layer of the data space system, and a data management end and a data space user end are distributed at the upper layer. The data space management end and the data space user end perform data business analysis based on the protection of the bottom layer data by the data security engine. The data security engine includes an access control model, a data desensitization algorithm, a data structure model, a data control process model and an identity recognition model.

[0012] A data access module is used to access multiple data sources, and the data sources corresponding to the data management end, the data user end and the data security engine are accessed into the data space of the data space system to obtain the data sources of the data space.

[0013] According to the data sources of the data space, a security protection layer based on the data security engine is constructed to form a secure data space.

[0014] The data space construction method according to the embodiment of the present application provides security guarantee for the access and use of data based on the data space of the data security engine. The data management is more refined, and the data with high confidentiality and security can be accessed or used by the data user under the premise of security protection, effectively solving the data security and data island problems existing in the data use process.

[0015] In addition, the data space construction method according to the above-mentioned embodiments of the present application can further have the following additional technical features:

[0016] Further, the data access module is used to access a plurality of data sources, including: a data manager selects a data source type to be accessed on a data space management end, fills in corresponding connection information, tests whether the connection is successful, and if successful, submits and saves the data source information to a database.

[0017] Further, the data source is accessed to a data space of a data space system, including: after the data source is accessed to the data space, data security rules are set to open the data for use.

[0018] Further, the access control model includes: the access control model is a DBAC access control model, the DBAC access control model adds an ACL authorization access control list mode and an algorithm to the RBA access control model to authorize and control fine-grained data; based on a data relationship model, a model expansion is performed on an access object; based on a DSM data security model and an ABAC access control model, fine-grained security control strategies are added to the data relationship model to perform deep data access control; session control is expanded, an ACM control matrix is added to the DBAC access control model, a Token security identifier token is bound to the ACM control matrix to uniquely match the ACM control matrix.

[0019] Further, the data user accesses the data source, including: after the data user selects a data source to be accessed, a corresponding sql is input to a data space user end, a server of the data space user end receives and analyzes the sql, a data security engine loads data security rules from a database, after the loading is passed, the data space user end rewrites the sql according to the data security rules, and the rewritten sql is sent to a database for execution.

[0020] Further, the data user applies data desensitization within the permission range to the data laboratory of the data user, including: the data user applies data desensitization within the permission range to the data laboratory of the data user on the data space user end, the data space automatically loads the data permission of the user, and performs data desensitization transfer according to the data permission and the corresponding data security rules to transfer the data to the data laboratory of the user.

[0021] Further, the security protection operation for the data source includes: the data entering the data space is an external data source or imported data, and the data space performs security protection on the data in different levels and layers according to different data security level requirements.

[0022] Optionally, the operation log is formed by recording the operations of the data user and the data administrator on the data and the calling of the API interface to form a log to provide traceability evidence for data security accountability.

[0023] Further, the data desensitization algorithm includes multiple algorithms selected from the group consisting of numerical simulation, data masking, matching transformation, random change, fixed replacement, Hash transformation, numerical correlation and dictionary mapping.

[0024] To achieve the above-mentioned purposes, another aspect of the present application provides a data space construction device, comprising:

[0025] A data distribution module is configured to distribute a data security engine at a bottom layer, a data management terminal and a data space user terminal of a data space system; the data management terminal and the data space user terminal are configured to analyze data services based on protection of the data security engine on the bottom layer data; and the data security engine includes an access control model, a data desensitization algorithm, a data structure model, a data control flow model and an identity recognition model.

[0026] A data access module is configured to access multiple data sources by using the data access module, access the data sources corresponding to the data management terminal, the data user terminal and the data security engine to the data space of the data space system, so as to obtain the data sources of the data space.

[0027] A protection construction module is configured to construct a security protection layer based on the data security engine according to the data sources of the data space, so as to form a secure data space.

[0028] The data space construction device according to the embodiment of the present application provides security guarantee for the access and use of data based on the data space of the data security engine, and the data management is more refined, and the data with high confidentiality and security can be accessed or used by the data user under the premise of security protection, thereby effectively solving the data security and data island problems existing in the data use process.

[0029] The present application has the following advantages:

[0030] Under the background of big data, the present application can effectively solve the data island and data security problems existing in the data use process, and provide security guarantee for the data with high confidentiality and security requirements.

[0031] Additional aspects and advantages of the present application will be made apparent by the following description and the appended claims. BRIEF DESCRIPTION OF DRAWINGS

[0032] The above-mentioned and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0033] Figure 1 Overall technical scheme diagram for data space construction according to an embodiment of the present application;

[0034] Figure 2 Flowchart for a data space construction method according to an embodiment of the present application;

[0035] Figure 3 Flowchart for a data administrator adding a data source according to an embodiment of the present application;

[0036] Figure 4 Flowchart for a data administrator configuring a security policy according to an embodiment of the present application;

[0037] Figure 5 Schematic diagram of a DBAC access control model according to an embodiment of the present application;

[0038] Figure 6 Timing diagram for data personnel security according to an embodiment of the present application;

[0039] Figure 7 Schematic diagram for data desensitization landing use according to an embodiment of the present application;

[0040] Figure 8 Schematic diagram of a data space data architecture according to an embodiment of the present application;

[0041] Figure 9 Schematic diagram of a data space API and development SDK according to an embodiment of the present application;

[0042] Figure 10 Schematic diagram of data security audit according to an embodiment of the present application;

[0043] Figure 11 Structural schematic diagram of a data space construction device according to an embodiment of the present application. DETAILED DESCRIPTION

[0044] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0045] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0046] Figure 1 is a schematic diagram of the overall technical solution of the data space construction of one embodiment of the present application.

[0047] As shown in Figure 1 , the system as a whole is divided into two system modules of a management end and a user end, and a data security engine provides underlying security support. The data security engine includes five sub-modules of an access control model, a data desensitization algorithm, a data structure model, a data control process model, and an identity recognition. The data security engine composed of these modules protects the security of underlying data, and allows the upper application to perform data business analysis activities under the condition of security rules. A data access module is a key module of the data space construction technology, which supports access of multiple data sources such as hive, hadoop, oracle, mysql, mongoDb, and redis.

[0048] The data sources corresponding to the various subsystems of an enterprise can be accessed into the data space, and after the access, they become data sources of the data space. The data security engine builds a security protection layer on them, so that the data sources and the data space technology module form a huge secure data space.

[0049] Figure 2 is a flowchart of the data space construction method of one embodiment of the present application.

[0050] As shown in Figure 2 , the data space construction method includes the following steps:

[0051] Step S1, distributing a data security engine at the bottom layer of a data space system, and distributing a data management end and a data space user end at the upper layer; the data management end and the data space user end perform data business analysis based on the protection of underlying data by the data security engine; wherein the data security engine includes an access control model, a data desensitization algorithm, a data structure model, a data control process model, and an identity recognition model.

[0052] Specifically, the data desensitization algorithm in the data security engine includes multiple ones of numerical simulation, data masking, matching transformation, random change, fixed replacement, Hash transformation, numerical correlation, and dictionary mapping.

[0053] It should be understood that those skilled in the art should have a complete understanding of the above data desensitization algorithm. The data desensitization algorithm is briefly introduced as follows:

[0054] Numerical simulation: performing simulation processing on numerical data, and maintaining the relative properties of the original data through linear transformation;

[0055] Data masking: using special characters (such as *) to replace the keywords of data content, and destroying the readability of data;

[0056] Matching conversion: conversion by pattern matching through regular expression;

[0057] Random change: random change to data, so that data does not retain the original semantics and format;

[0058] Fixed replacement: all replacement of a specific field to a fixed field string or value;

[0059] Hash conversion: Hash calculation with data, such as MD5, and Hash value instead of original value;

[0060] Numerical association: transformation or simulation of numerical values, but the associated field relationship remains unchanged, such as ensuring that the third column is the sum of the first two columns;

[0061] Dictionary mapping: according to the dictionary, the key in the data is replaced by the specified value.

[0062] Step S2, using a data access module to access a plurality of data sources, and connecting the data management end, the data user end and the data security engine to the data space of the data space system to obtain the data source of the data space.

[0063] Specifically, in step S2, the data access module is used to access a plurality of data sources, including: the data management personnel selects the type of data source to be accessed on the data space management end, fills in the corresponding connection information, and tests whether the connection is successful, if successful, the data source information is submitted and saved to the database.

[0064] Figure 3 Flow chart for adding data sources for a data administrator of an embodiment of the present application.

[0065] As Figure 3 shown, if a data space is to be constructed, a data source must first be provided. In the management end of the data space, the data management personnel selects the type of data source to be accessed, fills in the corresponding connection information, and tests the connection after filling in the connection information. After the connection test is successful, the data source information is saved to the database.

[0066] Step S3, constructing a security protection layer based on the data security engine according to the data source of the data space to form a secure data space.

[0067] Specifically, the security protection layer is constructed, including: after the data source is accessed into the data space, setting data security rules to open the use of data.

[0068] The embodiments of the present application will be further described below with reference to the accompanying drawings.

[0069] As an example, Figure 4 Flow chart for configuring a security policy for a data administrator of an embodiment of the present application.

[0070] As shown in Figure 4 shown, after data source access, to open to the outside use, must first set data security rules, and then can open the use of data.

[0071] Specifically, the access control model in the data security engine is a DBAC access control model, which comprises: the DBAC access control model is based on the RBA access control model, and an ACL authorization access control list mode and an algorithm are added to authorize control of fine-grained data; based on a data relationship model, a model expansion is performed on an access object; based on a DSM data security model and an ABAC access control model, fine-grained security control strategies are added to the data relationship model to perform deep data access control; session control is expanded, an ACM control matrix is added to the DBAC access control model, and a Token security identifier token is bound to the ACM control matrix to uniquely match the ACM control matrix.

[0072] As an example, Figure 5 a schematic diagram of the DBAC access control model of one embodiment of the application.

[0073] As shown in Figure 5 shown, DBAC is based on the capability of the RBAC role-based access control model, and an ACL authorization access control list mode and an algorithm are added to ensure that users can authorize control of fine-grained data; based on a mature data relationship model, a model expansion is performed on an access object; based on a DSM (Data Secruity Model) data security model and an ABAC access control model, fine-grained security control strategies are added to the data model to ensure the depth of data access control; session control is expanded, an ACM (Access Control Matric) is added to the context, and a Token is bound to the ACM to ensure that the user of the access can uniquely match the ACM.

[0074] Specifically, the use of data in the data space comprises:

[0075] After the data user selects the data source to be accessed, the corresponding sql is input to the data space user end, the server of the data space user end receives and parses the sql, and then calls the data security engine for analysis; the data security engine loads the data security rules from the database, and after the loading is passed, the data space user end rewrites the sql according to the data security rules, and sends the rewritten sql to the database for execution.

[0076] As an example, Figure 6 a timing diagram of the data user security use of one embodiment of the application.

[0077] As shown in Figure 6 , after the data user selects the data source to be accessed, the corresponding sql is input to the data space user end, the server of the user end receives it, parses the sql, and then calls the security engine for security check, the security engine first loads the security rules from the data database, performs security check according to the corresponding security rules, and after loading, the data space user end will rewrite the sql according to the rules, and then send the rewritten sql to the database for execution.

[0078] Specifically, the data desensitization landing includes: the data user applies to land the data within the permission range to the data experiment library of the data user end, the data space automatically loads the data permission of the user, and performs data desensitization transfer according to the data permission and the corresponding data security rules, so as to transfer the data to the data experiment library of the user.

[0079] As an example, Figure 7 the data desensitization landing of an embodiment of the application is shown in the use schematic diagram.

[0080] As shown in Figure 7 , the data user applies to land the data within the permission range to the data experiment library of the data user end, the data space automatically loads the data permission of the user, and performs data desensitization transfer according to the data permission and the corresponding data security rules, so as to transfer the data to the data experiment library of the user.

[0081] Specifically, for the security protection of data, the data entering the data space is an external data source or data written and imported by the user, and the data space performs security protection at different levels and levels according to different data security level requirements.

[0082] As an example, Figure 8 the data space data architecture schematic diagram of an embodiment of the application is shown.

[0083] As shown in Figure 8 , the data entering the data space can be an external production data source or data written and imported by the user. The data space performs security protection at different levels and levels according to different data security level requirements, and is divided into security compliant data and desensitized data.

[0084] Specifically, the data space provides traceability evidence function, including:

[0085] The operations of the data user and the data management personnel on the data and the calling of the API interface are recorded to form a log, and the traceability evidence is provided for data security accountability.

[0086] As an example,Figure 9 is a schematic diagram of a data space API and development SDK of one embodiment of the present application.

[0087] As shown in Figure 9 , the data space is configured with an SDK, and the application for data research uses the SDK to call the restAPI exposed by the data space. Through such API, the data source type contained in the data space and the table type contained in the data source can be obtained, and the select statement and other operations can be executed.

[0088] As an example, Figure 10 is a schematic diagram of data security audit of one embodiment of the present application.

[0089] As shown in Figure 10 , the operation of the data space, the operation recorder records the operation of the data user and the data administrator on the data and the call of the API interface, and forms a log, which is convenient for providing traceability evidence for future data security accountability.

[0090] Through the above steps, the data space is constructed, and the problems of data security and data island in the data use process are solved. The data space based on the data security engine provides security guarantee for the access and use of data, and the data management is more refined. The data with high confidentiality and security can be accessed or used by the data user under the premise of security protection.

[0091] It should be noted that the construction method of the data space still has room for improvement, but no matter how it is improved, as long as the data space solves the problems of data security and data island in the data use process, it can make up for the shortcomings of the prior art and achieve the corresponding technical effects.

[0092] In order to realize the above embodiment, as shown in Figure 11 , the present embodiment further provides a data space construction device 10, which comprises:

[0093] The data distribution module 100 is used for distributing the data security engine at the bottom layer of the data space system, and distributing the data management end and the data space user end at the upper layer. The data space management end and the data space user end perform data business analysis based on the protection of the data security engine on the bottom layer data. The data security engine comprises an access control model, a data desensitization algorithm, a data structure model, a data control process model and an identity recognition model.

[0094] The data access module 200 is used for accessing a plurality of data sources by using the data access module, accessing the data sources corresponding to the data management end, the data user end and the data security engine to the data space of the data space system, so as to obtain the data sources of the data space.

[0095] The protection module 300 is constructed, and a security protection layer based on the data security engine is constructed according to the data source of the data space, so as to form a secure data space.

[0096] The data space construction device according to the embodiment of the present application provides security guarantee for the access and use of data based on the data space of the data security engine, and the data management is more refined, and the data with high confidentiality and security can be accessed or used by the data user under the premise of security protection, effectively solving the problems of data security and data island in the data use process.

[0097] It should be noted that the foregoing explanation and description of the data space construction method embodiment are also applicable to the data space construction device of the embodiment, which will not be described here again.

[0098] In addition, the terms "first", "second" are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0099] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the present application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the skilled in the art can combine and combine the different embodiments or features of the embodiments or examples described in the present application without contradiction.

[0100] Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

Claims

1. A method for constructing a data space, characterized in that, Includes the following steps: A data security engine is distributed at the bottom layer of the data space system, while a data management terminal and a data space user terminal are distributed at the top layer. The data space management terminal and the data space user terminal perform data business analysis based on the protection of the underlying data by the data security engine. The data security engine includes an access control model, a data desensitization algorithm, a data structure model, a data control process model, and an identity recognition model. The data access module is used to access multiple data sources, and the data sources corresponding to the data management terminal, data user terminal and data security engine are connected to the data space of the data space system to obtain the data source of the data space; Based on the data source of the data space, a security protection layer based on the data security engine is constructed to form a secure data space; Data management personnel select the type of data source to be connected on the data space management terminal, fill in the corresponding connection information, and test whether the connection is successful. If successful, the data source information is submitted and saved to the database. After the data source is connected to the data space, data security rules are set to allow the data to be used openly; The access control model is the DBAC access control model. Based on the RBA access control model, the DBAC access control model adds an ACL (Access Control List) pattern and algorithm to perform fine-grained data authorization control; it extends the access object model based on a data relationship model; it adds fine-grained security control policies to the data relationship model based on the DSM (Data Security Model) and ABAC (Abstract Access Control Model) for deep data access control; and it extends session control by adding an ACM (Active Management Matrix) control matrix to the DBAC access control model, binding a Token security identifier to the ACM control matrix for unique matching. After selecting the data source to access, the data user enters the corresponding SQL and sends it to the data space user terminal. The server of the data space user terminal receives and parses the SQL, and then calls the data security engine for analysis. The data security engine loads the data security rules from the database. After loading is successful, the data space user terminal rewrites the SQL according to the data security rules and sends the rewritten SQL to the database for execution. When a data user applies to the data space user terminal to de-identify and store data within their authorized scope in their own data experiment library, the data space automatically loads the user's data permissions and performs data de-identification and transfer according to the data permissions and corresponding data security rules to transfer the data to the user's data experiment library.

2. The data space construction method according to claim 1, characterized in that, The data entering the data space is either from external data sources or imported data. The data space provides tiered and layered security protection for the data based on different data security level requirements.

3. The data space construction method according to claim 2, characterized in that, The method further includes: Logs are created by recording the data operations and API calls made by data users and data managers, providing traceability evidence for assigning responsibility for data security.

4. The data space construction method according to claim 1, characterized in that, The data anonymization algorithm includes: Numerical simulation, data masking, matching transformation, random variation, fixed replacement, hash transformation, numerical association, and dictionary mapping are among the many techniques used.

5. A data space construction apparatus using the method as described in claim 1, characterized in that, include: The data distribution module is used to distribute the data security engine at the bottom layer of the data space system, and the data management terminal and data space user terminal at the upper layer. The data space management terminal and the data space user terminal perform data business analysis based on the data security engine's protection of the underlying data; wherein, the data security engine includes an access control model, a data desensitization algorithm, a data structure model, a data control process model, and an identity recognition model; The data access module is used to access multiple data sources, connecting the data management terminal, data user terminal, and data security engine corresponding data sources into the data space of the data space system to obtain the data source of the data space; A protection module is constructed, which builds a security protection layer based on the data security engine according to the data source of the data space, so as to form a secure data space.

Images