A method, device and electronic device for dynamically adjusting data authority control

Abstract

The embodiments of the present invention disclose a method, device and electronic device for dynamically adjusting data permission management and control. The method includes: forming a static storage data map within the entire domain; presetting a data security protection strategy; obtaining the flow of sensitive data and sending the flow situation; scanning according to the flow situation to see if there is sensitive data on the disk; synchronizing the security protection strategy to the security product of the node; scanning local data, and revoking the security protection strategy if the sensitive data no longer exists on the node; when the security protection strategy is updated, updating the node security protection strategy. Through the above-mentioned method, the embodiments of the present invention can dynamically adjust the data protection strategy of the corresponding server, terminal or application node according to the data classification and grading and the data flow situation, and the relevant data security protection strategy tracks and protects the data in real time, which greatly reduces the difficulty of managing the database user data permissions and improves the security of data use.

Description

Technical Field

[0001] The embodiments of the present invention relate to field data authority control, and in particular, to a method, device and electronic device for dynamically adjusting data authority control. Background Art

[0002] In the existing data security protection strategy system, data security permission control measures are usually implemented through preset strategies. However, in actual application, this approach seems to be stretched and difficult to achieve a good protection effect, which is related to the characteristics of the data assets themselves. Since data is naturally fluid and derivative, in order to make data play its value, it is inevitable to open and share data. The current data security defense technology adopts a static defense approach, and performs security control through preset users, data, and permission strategies. Once the strategy is triggered, an alarm will be triggered, and the corresponding administrator will handle it. However, this method is too rigid, and the data permission management of access users can only grant fixed permissions in advance. In the process of data analysis, after multiple data are aggregated, their value is often higher than the original value, so it is necessary to constantly adjust the corresponding protection measures for the corresponding data to achieve the best protection status. Summary of the invention

[0003] The main technical problem solved by the embodiments of the present invention is to provide a method, device and electronic device for dynamically adjusting data permission management, which can dynamically adjust the data protection strategies of corresponding nodes such as servers, terminals or applications according to data classification and grading and data flow, and the relevant data security protection strategies can track and protect data in real time.

[0004] To solve the above technical problems, the first aspect of an embodiment of the present invention provides a method for dynamically adjusting data permission management, including: forming a static storage data map within the entire domain; presetting a security protection policy for data in the database in a unified dynamic permission management platform; the unified dynamic permission management platform obtains the flow of sensitive data and sends the flow to a sensitive data identification system and a DLP system; the sensitive data identification system and the DLP system scan according to the flow to see whether the sensitive data is stored on the disk at the node where the sensitive data identification system and the DLP system are located; if data is stored on the disk at the node, the unified dynamic permission management platform synchronizes the relevant security protection policy to the security product of the node; scans local data, and if the scan finds that the sensitive data no longer exists on the node, reports to the unified dynamic permission management platform, and the unified dynamic permission management platform revokes the relevant security protection policy.

[0005] In an embodiment of the present invention, the method as described above also includes that when the security protection policy of the unified dynamic permission management and control platform is updated, the unified dynamic permission management and control platform will resynchronize the security protection policy of the node where the sensitive data corresponding to the relevant security protection policy is located.

[0006] In one embodiment of the present invention, the formation of a static storage data map over the entire domain includes: based on a data security management and control platform product, it is able to connect with various data security technical tools to obtain information, thereby forming a static storage data map over the entire domain.

[0007] In one embodiment of the present invention, the security protection strategy for data in the database is preset in the unified dynamic permission management and control platform, including: based on the classification and grading information of the data, the user's access rights and data flow control measures, the security protection strategy for data in the database is preset in the unified dynamic permission management and control platform.

[0008] In one embodiment of the present invention, the unified dynamic permission management and control platform obtains the flow of sensitive data, including: deploying a database audit product at the node; detecting the flow of real-time data by the database audit product; and uploading the flow status to the unified dynamic permission management and control platform.

[0009] In one embodiment of the present invention, the unified dynamic permission management and control platform is used to issue security protection policies and unified management of data classification and grading policies.

[0010] In one embodiment of the present invention, the relevant security protection strategy includes: prohibiting the sensitive data from being sent to users who are not in the local area network where the node is located; controlling the communication interface of the node; controlling data access; and directly sending alarm information.

[0011] A second aspect of an embodiment of the present invention provides a device for dynamically adjusting data authority control, the electronic device comprising:

[0012] A data map forming module, the data map forming module is used to obtain information to form a static storage data map of the entire domain; a policy preset module, the policy preset module is used to preset the security protection policy of the data in the database according to the classification and grading information of the data, the user's access rights and data flow control measures; a monitoring and issuing module, the monitoring and issuing module is used to deploy database audit products at the node, the database audit products detect the flow of real-time data, and then the database audit products upload the flow situation to the unified dynamic permission management and control platform, and the unified dynamic permission management and control platform sends the flow situation to the sensitive data identification system and the DLP system; a data scanning module, the data scanning module is used to scan according to the flow situation to scan whether the sensitive data is stored on the disk at the node; a policy synchronization module, the policy synchronization module is used to synchronize the relevant security protection policies to the security products of the node; a policy revocation module, the policy revocation module is used to revoke the relevant security protection policies on the security products of the node.

[0013] A third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned method of dynamically adjusting data permission management.

[0014] A fourth aspect of an embodiment of the present invention provides a non-volatile computer storage medium, which stores computer-executable instructions. The computer-executable instructions are executed by one or more processors, allowing the one or more processors to execute the above-mentioned method for dynamically adjusting data permission management.

[0015] The beneficial effects of the embodiments of the present invention are: different from the prior art, the embodiments of the present invention can dynamically adjust the data protection strategies of corresponding servers, terminals or application nodes according to the data classification and grading and data flow, and the relevant data security protection strategies track and protect data in real time, greatly reducing the difficulty of managing database user data permissions and improving the security of data use. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a method for dynamically adjusting data authority control provided by an embodiment of the present invention;

[0017] Figure 2 It is a structural diagram of a device for dynamically adjusting data authority control provided by an embodiment of the present invention;

[0018] Figure 3It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention.

[0019] The following are the marking instructions:

[0020] 10; Dynamically adjust the data authority control device;

[0021] 100: data map forming module; strategy preset module: monitoring and issuing module; 300: request acquisition module; 400: data scanning module; 500: strategy synchronization module; 600: strategy revocation module; 700: strategy update module;

[0022] 800: electronic device; 801: processor; 802: memory. DETAILED DESCRIPTION

[0023] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several variations and improvements may be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0024] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0025] It should be noted that, if there is no conflict, the various features in the embodiments of the present invention can be combined with each other, all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the flow chart. In addition, the words "first", "second", "third", etc. used herein do not limit the data and execution order, but only distinguish the same items or similar items with basically the same functions and effects.

[0026] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in this specification and in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0027] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0028] See also Figure 1 , Figure 1 The following is a flowchart of a method for dynamically adjusting data permission control, wherein the method comprises:

[0029] Step S100: forming a static storage data map within the entire domain;

[0030] In one embodiment of the present invention, it is based on a data security management and control platform product, which can connect various data security technical tools to obtain data, such as product log collection, policy issuance, etc., so as to form a static storage data map in the entire domain. Logs are a very critical component, including system logs, database logs and security logs, which can record information about hardware, software and system problems in the system. A policy is a set of rules. Taking security policy as an example, a security policy refers to a set of rules for all security-related activities within a certain security area (a security area usually refers to a series of processing and communication resources belonging to an organization). The action strategy formulated by the network administrator or CIO based on the risks and security goals of the organization is the security policy. Security policies are usually based on authorization. Information cannot be given, accessed, referenced, or used by entities without proper authorization.

[0031] Step S200: Preset the security protection strategy for data in the database;

[0032] In one embodiment of the present invention, a security protection strategy for data in a database is preset in the unified dynamic permission management and control platform through data classification and grading information, preset data flow control measures and preset user permission table obtained by the unified dynamic permission management and control platform.

[0033] In one embodiment of the present invention, the classification and grading information of data includes: data type, data security level and data availability status information. Data security protection strategies include security management strategies, storage control strategies, database encryption, database overall encryption, hardware encryption and other methods. Specifically, it prohibits the sending of sensitive data to users who are not in the local area network where the node is located, prohibits screenshots and screen recording, manages the communication interface of the node, manages data access, and directly sends alarm information.

[0034] Step S300: Obtain the flow of sensitive data and send the flow;

[0035] In one embodiment of the present invention, a database audit product is first deployed in the node where the sensitive data identification system and the DLP system are located. When a node accesses the data of the static data storage map, the data flows, and the database audit product detects the flow of real-time data in the node, and then the database audit product uploads the flow to the unified dynamic permission control platform. The unified dynamic permission control platform receives the flow and sends the flow to the sensitive data identification system and the DLP system.

[0036] Database auditing is centered on security events, based on comprehensive and precise auditing, and records database activities on the network in real time, performs fine-grained auditing of database operations for compliance management, and issues real-time alerts for risky behaviors encountered by the database. It helps users generate compliance reports and trace the source of accidents after the fact by recording, analyzing, and reporting on user access to the database. At the same time, it provides efficient query audit reports through big data search technology, locates the cause of the incident, and facilitates future query, analysis, and filtering, thereby strengthening the monitoring and auditing of internal and external database network behaviors and improving data asset security.

[0037] Database auditing is one of the database security technologies, which mainly include: database vulnerability scanning, database encryption, database firewall, data desensitization, and database security auditing system.

[0038] Data leakage prevention (DLP), also known as "data loss prevention" (DLP), is sometimes called "information leakage prevention" (ILP). Data leakage prevention (DLP) is a strategy that uses certain technical means to prevent the designated data or information assets of an enterprise from flowing out of the enterprise in a form that violates security policies.

[0039] In one embodiment of the present invention, the node may be a terminal, a server, an application program, etc.

[0040] Step S400: Scan according to the flow situation to determine whether there is sensitive data stored on the disk;

[0041] In one embodiment of the present invention, the sensitive data identification system and the DLP system scan all data in the node according to the received flow situation, determine whether the node accesses sensitive data, causing sensitive data to flow to the node, whether sensitive data is stored on the node, and upload the scan result to the unified dynamic permission management and control platform. If the scan result is no, no sensitive data is stored on the node, then no operation is performed on the node.

[0042] Step S500: Synchronize the relevant security protection policy to the security product of the node;

[0043] In one embodiment of the present invention, while a database audit product is deployed in the node where the sensitive data identification system and the DLP system are located, a security product such as an anti-leakage product is deployed in the node.

[0044] In one embodiment of the present invention, if the scanning results show that the node has accessed sensitive data and sensitive data is stored on the node, the unified dynamic permission management platform will send the security protection policy related to the sensitive data to the security product of the node, such as an anti-leakage product.

[0045] Step S600: Scan local data, and if the sensitive data no longer exists on the node, revoke the relevant security protection policy;

[0046] In one embodiment of the present invention, the sensitive data identification system and the DLP system scan local data. If the scan finds that the sensitive data no longer exists on the node, the scan result is reported to the unified dynamic permission management and control platform, and the unified dynamic permission management and control platform revokes the relevant security protection policies of the security products on the node.

[0047] The situation where sensitive data does not exist in the node can be divided into artificially deleting the sensitive data to overcome the restrictions of the security protection policy on the node, or deleting the sensitive data by the relevant security protection policy to reduce the risk of data leakage again.

[0048] Step S700: When the security protection policy is updated, the node where the sensitive data is located is scanned and the relevant security protection policy is updated.

[0049] When the security protection policy of the unified dynamic permission management and control platform is updated, the sensitive data identification system and the DLP system will scan the node again, and the unified dynamic permission management and control platform will resynchronize the relevant security protection policy for the node.

[0050] Different from the prior art, the embodiment of the present invention discloses a method for dynamically adjusting data permission management and control. The method includes: forming a static storage data map within the entire domain; presetting a data security protection strategy; obtaining the flow of sensitive data and issuing the flow situation; scanning according to the flow situation to see if there is sensitive data on the disk; synchronizing the security protection strategy to the security product of the node; scanning local data, and revoking the security protection strategy if the sensitive data no longer exists on the node; when the security protection strategy is updated, updating the node security protection strategy. Through the above method, the embodiment of the present invention can dynamically adjust the data protection strategy of the corresponding server, terminal or application node according to the data classification and grading and the data flow situation, and the relevant data security protection strategy tracks and protects the data in real time, which greatly reduces the difficulty of managing the database user data permissions and improves the security of data use.

[0051] See also Figure 2 , Figure 2 It is a structural diagram of a device 10 for dynamically adjusting data authority control, which includes a data map forming module 100, a policy preset module 200, a detection and delivery module 300, a data scanning module 400, a policy synchronization module 500, a policy revocation module 600 and a policy update module 700.

[0052] The data map forming module 100 is used to form a static storage data map in the entire domain. Based on the data security management and control platform product, it can connect various data security technical tools to obtain data, such as product log collection, policy issuance, etc., so as to form a static storage data map in the entire domain.

[0053] The policy preset module 200 is used to preset the security protection policy of the data in the database. The security protection policy of the data in the database is preset in the unified dynamic authority control platform through the data classification and grading information, preset data flow control measures and preset user authority table obtained by the unified dynamic authority control platform.

[0054] In one embodiment of the present invention, the data security protection strategy includes security management strategy, storage control strategy, database encryption, database encryption, hardware encryption and other methods. Specifically, it prohibits the sensitive data from being sent to users who are not in the local area network where the node is located, prohibits screenshots and screen recording, manages the communication interface of the node, manages data access, and directly sends alarm information.

[0055] The detection and sending module 300 is used to obtain the flow of sensitive data and send the flow. A database audit product is deployed in the node where the sensitive data identification system and the DLP system are located. The database audit product detects the flow of real-time data in the node, and then the database audit product uploads the flow to the unified dynamic permission control platform. The unified dynamic permission control platform receives the flow and sends the flow to the sensitive data identification system and the DLP system.

[0056] In one embodiment of the present invention, the node may be a terminal, a server, an application program, etc.

[0057] The data scanning module 400 is used to scan according to the flow situation and determine whether there is sensitive data stored on the disk. The sensitive data identification system and the DLP system scan all the data in the node according to the received flow situation to determine whether there is sensitive data stored on the node, and upload the scan result to the unified dynamic permission management and control platform. If the scan result is no, and no sensitive data is stored on the node, no operation is performed on the node.

[0058] The policy synchronization module 500 is used to synchronize the relevant security protection policies to the security products of the node. When the database audit product is deployed in the node where the sensitive data identification system and the DLP system are located, security products such as anti-leakage products are deployed in the node. If the data scanning module 400 scans and finds that sensitive data is stored on the disk on the node, the unified dynamic permission management and control platform will send the security protection policies related to the sensitive data to the security products of the node, such as anti-leakage products.

[0059] The policy revocation module 600 is used to scan local data, and if the sensitive data no longer exists on the node, revoke the relevant security protection policy. The sensitive data identification system and the DLP system scan local data, and if the scan finds that the sensitive data no longer exists on the node, the scanning result is reported to the unified dynamic permission management and control platform, and the unified dynamic permission management and control platform will revoke the relevant security protection policy of the security product on the node.

[0060] The policy update module 700 is used to scan the node where the sensitive data is located and update the relevant security protection policy when the security protection policy is updated. When the security protection policy of the unified dynamic permission control platform is updated, the sensitive data identification system and the DLP system will scan the node again, and the unified dynamic permission control platform will resynchronize the relevant security protection policy for the node.

[0061] Different from the prior art, the embodiment of the present invention discloses a device 10 for dynamically adjusting data permission control. The device 10 includes: a data map forming module 100, a policy preset module 200, a detection and delivery module 300, a data scanning module 400, a policy synchronization module 500, a policy revocation module 600 and a policy update module 700. Through the above-mentioned device, the embodiment of the present invention can dynamically adjust the data protection strategy of the corresponding server, terminal or application node according to the data classification and grading situation and the data flow situation. The relevant data security protection strategy tracks and protects the data in real time, which greatly reduces the difficulty of managing the database user data permissions and improves the security of data use.

[0062] Figure 3 is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention, such as Figure 3 As shown, the electronic device 800 includes:

[0063] One or more processors 801 and memory 802, Figure 3 A processor 801 is taken as an example.

[0064] The processor 801 and the memory 802 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0065] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. The processor 801 executes various functional applications and data processing of the electronic device by running the non-volatile software programs, instructions, and units stored in the memory 802, that is, the method for dynamically adjusting data authority control of the above method embodiment is implemented.

[0066] The memory 802 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 802 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 802 may optionally include a memory remotely arranged relative to the processor 801, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0067] The one or more units are stored in the memory 802, and when executed by the one or more processors 801, the method for dynamically adjusting data permission control in any of the above method embodiments is executed, for example, the method described above is executed. Figure 1 Steps S100 to S700 of the method are implemented Figure 2 The functions of modules 100-700.

[0068] The above electronic device can execute the method for dynamically adjusting data permission control provided by the embodiment of the present invention, and has the program module and beneficial effects corresponding to the execution method. For technical details not fully described in the electronic device embodiment, please refer to the method for dynamically adjusting data permission control provided by the embodiment of the present invention.

[0069] The embodiment of the present invention further provides a non-volatile computer-readable storage medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above non-volatile computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method of the embodiment of the present disclosure is implemented.

[0070] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:

[0071] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhones), multimedia phones, functional phones, and low-end phones.

[0072] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. These terminals include: PDA, M ID and UMPC devices, such as iPad.

[0073] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0074] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc.

[0075] (5) Other electronic devices.

[0076] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0077] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course, can also be implemented by hardware. Those skilled in the art can understand that all or part of the processes in the above embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other changes in different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity. Although the present invention has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for dynamically adjusting data authority control, characterized in that: include: Form a static storage data map across the entire domain; Preset security protection strategies for data in the database in the unified dynamic permission management and control platform; The unified dynamic permission management and control platform obtains the flow of sensitive data and sends the flow to the sensitive data identification system and the DLP system; The sensitive data identification system and the DLP system scan according to the flow situation to check whether the sensitive data is stored in the node where the sensitive data identification system and the DLP system are located; If data is stored on the node, the unified dynamic permission management and control platform will synchronize the relevant security protection policies to the security products of the node; Scan local data. If the scan finds that the sensitive data no longer exists on the node, the data is reported to the unified dynamic permission management and control platform, and the unified dynamic permission management and control platform revokes the relevant security protection policy. The security protection strategy for data in the database is preset in the unified dynamic permission management and control platform, including: According to the classification and grading information of the data, the user's access rights and the data flow control measures, the security protection strategy of the data in the database is preset in the unified dynamic rights control platform; The unified dynamic permission management and control platform obtains the flow of sensitive data, including: Deploy a database audit product on the node; The database audit product detects the flow of real-time data; The database audit product uploads the flow status to the unified dynamic authority management and control platform.

2. The method according to claim 1, characterized in that Also includes: When the security protection policy of the unified dynamic permission management and control platform is updated, the unified dynamic permission management and control platform will resynchronize the security protection policy for the node where the sensitive data corresponding to the relevant security protection policy is located.

3. The method according to claim 1, characterized in that The forming of a static storage data map in the whole domain includes: Based on the data security management and control platform product, it can connect with various data security technical tools to obtain information, thereby forming a static storage data map covering the entire domain.

4. The method according to claim 1 or 2, characterized in that: The unified dynamic permission management and control platform is used for issuing security protection strategies and unified management of data classification and grading strategies.

5. The method according to claim 1, characterized in that The relevant security protection strategies include: It is prohibited to send the sensitive data to users who are not in the local area network where the node is located; Managing and controlling the communication interface of the node; Control access to data; Send alarm information directly.

6. A device for dynamically adjusting data authority control, characterized in that: include: A data map forming module, the data map forming module is used to obtain information to form a static storage data map of the entire domain; A policy preset module, which is used to preset a security protection policy for data in the database based on the classification and grading information of the data, the user's access rights and data flow control measures; A monitoring and issuing module, which is used to deploy a database audit product on a node, and the database audit product detects the flow of real-time data, and then the database audit product uploads the flow status to a unified dynamic permission control platform, and the unified dynamic permission control platform sends the flow status to a sensitive data identification system and a DLP system; A data scanning module, the data scanning module is used to scan according to the flow situation to check whether the sensitive data is stored in the node; A policy synchronization module, which is used to synchronize relevant security protection policies to the security product of the node when data is stored on the node; A policy revocation module, wherein the policy revocation module is used to revoke the relevant security protection policy on the security product of the node when the sensitive data does not exist on the node.

7. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

8. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, which are executed by one or more processors, enabling the one or more processors to execute the method for dynamically adjusting data permission management as described in any one of claims 1 to 5.

Images