Data encryption compliance detection method and device

Abstract

The present invention provides a data encryption compliance detection method and device, the method comprising: collecting a mirror image of data sharing traffic to obtain original traffic data packets, and parsing the original traffic data packets to determine the data transmission protocol; performing encryption compliance detection on the data according to the data transmission protocol and a preset encryption compliance rule base. The device is used to execute the above method. The data encryption compliance detection method and device provided by the present invention can accurately identify various data transmission protocols in the data sharing process in the enterprise network in real time, and accurately identify various data encryption algorithms in real time based on the identified data transmission protocols and the preset encryption compliance rule base. It is simple to implement and has low performance requirements. It can help enterprises discover related encryption compliance issues and effectively ensure the security of enterprise data sharing transmission.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a data encryption compliance detection method and device. Background Art

[0002] Existing technologies often use the following solutions to perform compliance checks on encrypted data:

[0003] Solution 1: Through security testing before the business goes online, manual inspection is carried out to check whether the business interface uses encryption protocols or whether important data such as usernames and passwords are encrypted.

[0004] Solution 2: Detect the encryption and encryption algorithms used in encrypted data streams based on classification algorithms such as random forest, SVM, and K-means.

[0005] The existing technical solutions have the following disadvantages:

[0006] It is impossible to achieve real-time detection during data transmission, problems are not discovered in a timely manner, and the degree of automation is not high; it can only identify the encryption algorithm used for data streams encrypted at the protocol layer, and cannot identify the encryption algorithm for partial encryption of data at the application layer; it can only effectively identify several specific encryption algorithms, and cannot fully cover various mainstream types of encryption algorithms; a large amount of data streams are required for statistical analysis, and the use of machine learning classification algorithms leads to high implementation complexity and high performance requirements, which is prone to performance bottlenecks and cannot effectively meet the needs of massive traffic scenarios within the enterprise. Summary of the Invention

[0007] The data encryption compliance detection method and device provided by the present invention are used to overcome the above-mentioned problems existing in the prior art. They can accurately identify various data transmission protocols in the data sharing process in the enterprise network in real time, and accurately identify various data encryption algorithms in real time based on the identified data transmission protocols and the preset encryption compliance rule library. The implementation is simple and the performance requirements are low. It can help enterprises discover related encryption compliance issues and effectively ensure the security of enterprise data sharing and transmission.

[0008] The present invention provides a data encryption compliance detection method, comprising:

[0009] Collecting mirror images of data sharing traffic to obtain original traffic data packets, and parsing the original traffic data packets to determine the data transmission protocol;

[0010] The data is encrypted and compliant according to the data transmission protocol and the preset encryption compliance rule base.

[0011] According to a data encryption compliance detection method provided by the present invention, the step of parsing the original traffic data packet to determine the data transmission protocol includes:

[0012] Parsing the original traffic data packet to obtain a character set and a port application layer protocol format in an authentication phase data packet in the original traffic data packet;

[0013] Matching the character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet with the character set and port application layer protocol format in the authentication phase data packet after data is encrypted using a preset data transmission protocol in the encryption protocol traffic feature library to determine the data transmission protocol;

[0014] The preset data transmission protocol includes a non-encrypted protocol and an encrypted protocol.

[0015] According to a data encryption compliance detection method provided by the present invention, the encryption compliance detection of data is performed according to the data transmission protocol and a preset encryption compliance rule library, including:

[0016] If the data transmission protocol is an encryption protocol, performing encryption compliance detection on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule library;

[0017] If the data transmission protocol is a non-encrypted transmission protocol, the data encryption algorithm is identified and encryption compliance detection is performed on the data encryption algorithm according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule library.

[0018] According to a data encryption compliance detection method provided by the present invention, the encryption compliance detection of the data transmission protocol is performed according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule library, including:

[0019] The protocol type and version information of the data transmission protocol are compared with the rule-agreed protocol type and rule-agreed version information of the data sharing transmission protocol compliance policy. If the protocol type and the version information correspond to the rule-agreed protocol type and the rule-agreed version information, the data transmission protocol is determined to be compliant.

[0020] According to a data encryption compliance detection method provided by the present invention, identifying the data encryption algorithm includes:

[0021] Extracting application layer data from the original traffic data packet by column, and performing sensitive data identification on each column of data in the application layer data one by one based on a preset sensitive field identification rule library to determine non-sensitive data columns and sensitive data columns in the application layer data;

[0022] Identifying the data encryption algorithm of the non-sensitive data column according to the character distribution characteristics and data length characteristics of the non-sensitive data column; and

[0023] Identifying the data encryption algorithm of the sensitive data column according to the sensitive data encryption transmission compliance policy in the preset encryption compliance rule library;

[0024] The non-sensitive data column is a column in which the total number of sensitive data types included in the application layer data is less than a preset threshold;

[0025] The sensitive data column is a column in which the total number of sensitive data types included in the application layer data is greater than a preset threshold.

[0026] According to a data encryption compliance detection method provided by the present invention, identifying the data encryption algorithm of the non-sensitive data column based on the character distribution characteristics and data length characteristics of the non-sensitive data column includes:

[0027] Obtaining a first character set contained in the non-sensitive data column and comparing it with a preset encoding algorithm character set; if the first character set belongs to a subset of the preset encoding algorithm character set, performing character distribution feature statistics on each data in the non-sensitive data column, and matching the character distribution features of the non-sensitive data column with the character distribution features of the preset encoding algorithm;

[0028] If the match is successful, the data length characteristics of the data in the non-sensitive data column are counted one by one, and the data length characteristics of the non-sensitive data column are matched with the data length characteristics of the preset encoding algorithm, the data length characteristics of the preset encryption algorithm, and the key length characteristics to identify the data encryption algorithm in the non-sensitive data column;

[0029] The character distribution features include the number of digits, letter types, the number of letters and the number of special characters.

[0030] According to a data encryption compliance detection method provided by the present invention, the encryption compliance detection of the data encryption algorithm is performed according to the data sharing and transmission encryption algorithm compliance policy in the preset encryption compliance rule library, including:

[0031] Compare the data encryption algorithm with the encryption algorithm and key length stipulated in the data sharing and transmission encryption algorithm compliance policy. If the encryption algorithm and key length are consistent with the encryption algorithm and key length stipulated in the rules, then determine that the data encryption algorithm is compliant.

[0032] The data encryption algorithm includes the encryption algorithm and key length of the data.

[0033] The present invention also provides a data encryption compliance detection device, a transmission protocol determination module and a data encryption detection module;

[0034] The transmission protocol determination module is used to obtain original traffic data packets from the data sharing traffic collection mirror, and parse the original traffic data packets to determine the data transmission protocol;

[0035] The data encryption detection module is used to perform encryption compliance detection on the data according to the data transmission protocol and the preset encryption compliance rule library.

[0036] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described data encryption compliance detection methods are implemented.

[0037] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-mentioned data encryption compliance detection methods.

[0038] The data encryption compliance detection method and device provided by the present invention can accurately identify various data transmission protocols in the data sharing process in the enterprise network in real time, and accurately identify various data encryption algorithms in real time based on the identified data transmission protocols and the preset encryption compliance rule library. It is simple to implement and has low performance requirements. It can help enterprises discover related encryption compliance issues and effectively ensure the security of enterprise data sharing and transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 It is a flowchart of the data encryption compliance detection method provided by the present invention;

[0041] Figure 2 Schematic diagram of the structure of a data encryption compliance detection system using the data encryption compliance detection method provided by the present invention;

[0042] Figure 3 It is a structural diagram of the data encryption compliance detection device provided by the present invention;

[0043] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0045] The solution proposed in this invention can be used in scenarios where there is a need for large-scale data sharing and transmission between various businesses of an enterprise or with the outside world. Sensitive data needs to be encrypted for transmission to ensure security, but the encryption mechanism is controlled and implemented by each business party, and the security of the encryption cannot be guaranteed. Technical means are needed to perform real-time detection of the encryption security during data transmission.

[0046] The data encryption compliance testing involved in this invention mainly includes the following three types of compliance issues:

[0047] 1. The data that needs to be transmitted using an encryption protocol does not use the encryption protocol or the encryption protocol version does not meet the requirements.

[0048] 2. No encryption protocol is used, but the transmission of sensitive data is included, and no encryption algorithm is used to encrypt the sensitive data.

[0049] 3. The data is encrypted, but the encryption algorithm type and the selected key length (encryption strength) are inconsistent with the requirements.

[0050] Figure 1 It is a flow chart of the data encryption compliance detection method provided by the present invention, such as Figure 1 As shown, the method includes:

[0051] S1. Collecting mirror images of data sharing traffic to obtain original traffic data packets, and parsing the original traffic data packets to determine the data transmission protocol;

[0052] S2. Perform encryption compliance checks on data based on the data transmission protocol and the preset encryption compliance rule base.

[0053] It should be noted that the execution subject of the above method may be a computer device.

[0054] The following is the deployment of computer equipment Figure 2 The data encryption compliance detection system shown in FIG. 1 is used as an example to implement the data encryption compliance detection method provided by the present invention. Figure 2 As shown, the computer device is deployed with: a traffic collection module 210, a traffic analysis module 211, an encryption protocol identification module 212, a sensitive data identification module 213, an encryption algorithm identification module 214, an encryption compliance analysis module 215 and a rule policy management module 216.

[0055] Optionally, the traffic collection module 210 is used to collect and mirror the data sharing traffic to obtain the original traffic data packet. Specifically, the data sharing traffic of key network switch nodes can be mirrored through traffic probes to achieve real-time collection of original traffic data packets. For example, the data sharing traffic of multiple key network switch nodes can be mirrored and collected through distributed deployment of traffic probes, and the obtained original traffic data packet is parsed by the traffic parsing module 211 to determine the data transmission protocol.

[0056] It should be noted that the data encryption compliance detection method provided by the present invention bypasses the switch traffic on the key network link during data flow and performs in-depth analysis of the mirrored message to obtain the original traffic data packet. The business party is unaware of it and it has no impact on the existing network business.

[0057] According to the data transmission protocol and the encryption compliance rule base preset in the encryption compliance analysis module 215, encryption compliance detection is performed on the data.

[0058] The data encryption compliance detection method provided by the present invention can also obtain original traffic data packets by collecting data sharing traffic through a splitter. Specifically, the splitter is connected in series between network devices, and the splitting technology is used to copy the traffic on the key network switch node line to obtain the original traffic data packet.

[0059] By collecting and analyzing the mirror image of data sharing traffic, information such as encryption protocol characteristics, encrypted data character distribution, and encrypted data length characteristics are extracted from the data stream, and encryption elements such as encryption protocols and encryption algorithms are identified. By comparing and analyzing the identification results with the preset encryption compliance rule base, the encryption status of data flowing in the network and the encryption compliance status are detected, so that enterprises can grasp the encryption security risks of sensitive data when sharing internally and externally in real time, discover risk points in time, prevent sensitive data from being leaked illegally, and ensure the confidentiality and integrity of data. At the same time, the bypass mirror deployment method is adopted, which does not require any business transformation and is easy to implement. It can be quickly deployed and used in the enterprise, helping enterprises to quickly establish encryption compliance detection technical means.

[0060] The preset encryption compliance rule library provided by the present invention can identify mainstream encryption protocols such as https, ssh / sftp and mainstream encryption algorithms, including symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, and streaming encryption algorithms. It can identify specific encryption algorithms such as DES, AES, RSA, SHA-1 and other algorithms, and can further identify the key length used by the encryption algorithm, thereby realizing a comprehensive encryption security assessment.

[0061] The data encryption compliance detection method provided by the present invention can accurately identify various data transmission protocols in the data sharing process in the enterprise network in real time, and accurately identify various data encryption algorithms in real time based on the identified data transmission protocols and the preset encryption compliance rule library. It is simple to implement and has low performance requirements. It can help enterprises discover related encryption compliance issues and effectively ensure the security of enterprise data sharing and transmission.

[0062] Furthermore, in one embodiment, parsing the original traffic data packet to determine the data transmission protocol in step S1 may specifically include:

[0063] S11, parsing the original traffic data packet to obtain the character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet;

[0064] S12. Matching the character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet with the character set and port application layer protocol format in the authentication phase data packet after data is encrypted using a preset data transmission protocol in the encryption protocol traffic feature library to determine the data transmission protocol;

[0065] The preset data transmission protocol includes a non-encrypted protocol and an encrypted protocol.

[0066] Optionally, the original traffic data packet is parsed using the traffic parsing module to obtain the key character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet, and the character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet are matched with the character set and port application layer protocol format in the authentication phase data packet after the data is encrypted using the preset data transmission protocol in the encryption protocol traffic feature library through the encryption protocol identification module 212 and in accordance with the encryption protocol identification rules in the rule management module to identify the type and version of the data transmission protocol.

[0067] The data transmission protocols preset in the encryption protocol traffic feature library in the encryption protocol identification module 212 of the present invention include non-encrypted protocols and encrypted protocols, among which non-encrypted protocols include FTP, MYSQL, ORACLE, HTTP and other protocols, and encrypted protocols include HTTPS, SSH, SFTP and other protocols.

[0068] The data encryption compliance detection method provided by the present invention extracts encryption protocol features from the data stream, and matches the encryption protocol features after the data is encrypted using the preset data transmission protocol in the encryption protocol traffic feature library, thereby realizing the detection of data encryption protocol compliance during the data transmission process, and being able to timely discover risk points and prevent data from being illegally leaked, thereby ensuring the confidentiality and integrity of data transmission.

[0069] Furthermore, in one embodiment, step S2 may specifically include:

[0070] S21. If the data transmission protocol is an encryption protocol, perform encryption compliance detection on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule library;

[0071] S22. If the data transmission protocol is a non-encrypted transmission protocol, the data encryption algorithm is identified and encryption compliance detection is performed on the data encryption algorithm according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule library.

[0072] Optionally, based on the protocol type (encryption protocol identification) and version information (protocol version identification) of the data transmission protocol identified by the encryption protocol identification module 212, if it is determined that the data transmission protocol is one of the encryption protocols included in the preset encryption protocol traffic feature library, it will enter the encryption compliance analysis module 215 and perform encryption compliance detection on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule library in the encryption compliance analysis module 215.

[0073] If it is determined that the data transmission protocol is one of the non-encrypted protocols included in the preset encryption protocol traffic feature library, the application layer data extraction and parsing module is entered to identify the encryption algorithm used by the application layer data in the data sharing traffic, and the data encryption algorithm is encrypted according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule library in the encryption compliance analysis module 215. The compliance detection is performed on the data encryption algorithm.

[0074] The data encryption compliance detection method provided by the present invention can identify mainstream encryption protocols such as HTTPS, SSH, SFTP and encryption algorithms, and by comparing and analyzing the identification results with a preset encryption compliance rule library, it can detect the encryption status and encryption compliance of data flowing in the network, so that enterprises can grasp the encryption security risks that exist in data when sharing internally and externally in real time, discover risk points in time, prevent data from being leaked illegally, and ensure the confidentiality and integrity of data.

[0075] Furthermore, in one embodiment, performing encryption compliance detection on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule library in step S22 may specifically include:

[0076] S221. Compare the protocol type and version information of the data transmission protocol with the rule-specified protocol type and rule-specified version information of the data sharing transmission protocol compliance policy. If the protocol type and version information correspond to the rule-specified protocol type and rule-specified version information, the data transmission protocol is determined to be compliant.

[0077] Optionally, the protocol type and version information of the data transmission protocol are compared with the rule-agreed protocol type and rule-agreed version information of the data sharing transmission protocol compliance policy in the encryption compliance analysis module 215. If the protocol type and version information correspond to the rule-agreed protocol type and rule-agreed version information, the data transmission protocol is determined to be compliant.

[0078] Specifically, in the present invention, the encryption compliance analysis module 215 includes a preset encryption compliance rule base, which includes two types of rules. The first type of rule stipulates encryption compliance rules based on network transmission channels. For example, a transmission channel can be stipulated to use SSLv3, or data must be encrypted using AES, and the key length must be greater than or equal to 192. The second type of rule stipulates the encryption measures that should be taken for various types of sensitive data, such as user passwords should be encrypted using the MD5 algorithm. By matching the protocol type and protocol version information of the data transmission protocol identified in the above steps with the data sharing transmission protocol compliance policy, various encryption compliance issues in the data transmission process in the enterprise can be effectively discovered:

[0079] Data sharing transmission protocol compliance strategy: The protocol type and version information of the identified data transmission protocol are compared with the rules on the corresponding channel of the preset encryption compliance rule base. If the protocol type and version information are consistent with the rule agreement or there is no agreement, the data transmission protocol is determined to be compliant. Otherwise, the data transmission protocol is determined to be non-compliant.

[0080] The data encryption compliance detection method provided by the present invention can realize real-time and accurate identification of various data sharing transmission protocols and protocol versions in the enterprise network, and can help enterprises discover related encryption compliance issues, effectively ensuring the security of enterprise data sharing and transmission.

[0081] Furthermore, in one embodiment, identifying the data encryption algorithm in step S22 may specifically include:

[0082] S222. Extract application layer data from the original traffic data packet by column, and perform sensitive data identification on each column of data in the application layer data one by one based on a preset sensitive field identification rule library to determine non-sensitive data columns and sensitive data columns in the application layer data;

[0083] S223. Identify the data encryption algorithm of the non-sensitive data column based on the character distribution characteristics and data length characteristics of the non-sensitive data column; and

[0084] S224. Identify the data encryption algorithm for the sensitive data column according to the sensitive data encryption transmission compliance policy in the preset encryption compliance rule library;

[0085] The non-sensitive data column is a column in which the total number of sensitive data types included in the application layer data is less than a preset threshold;

[0086] The sensitive data column is a column in which the total number of sensitive data types included in the application layer data is greater than a preset threshold.

[0087] Optionally, after determining that the data transmission protocol is a non-encrypted protocol type, the application layer data extraction and parsing module will be entered to identify the encryption algorithm used for the application layer data in the data sharing traffic. Specifically: the application layer data in the original traffic data packet is extracted by column, and sensitive data identification is performed on each column of data in the application layer data one by one based on the preset sensitive field identification rule library in the sensitive data identification rules in the sensitive data identification module 213, so as to divide the application layer data into non-sensitive data columns and sensitive data columns.

[0088] Application layer data extraction and parsing module: The application layer data of the non-encrypted protocol is extracted from the data packet according to the application layer data format. When the traffic volume is large, the data packet and the content contained in the data packet can be sampled and extracted by configuring the sampling ratio. It should be noted that the present invention mainly detects structured data, such as CSV format files, MySQL table records, Hive big data component table records, etc. These structured data are widely present in enterprises and are also the data content mainly involved in sharing needs. The present invention uses the characteristics of structured data to carry out targeted optimization of the identification of structured data and data encryption algorithms, effectively improving the accuracy of detection.

[0089] The data extracted by the application layer data parsing and extraction module is formatted as structured data, and sensitive data is identified for each column one by one to obtain the sensitive data type of each column (of course, it may also be non-sensitive data or encrypted data that cannot be determined).

[0090] Structured data generally consists of multiple columns, while a single column of data consists of multiple records of the same type. These columns may contain sensitive data, such as names and phone numbers, or non-sensitive data. Enterprises generally only need to focus on sensitive data and encrypt sensitive data columns to ensure data security. Prioritizing the identification of sensitive data fields can effectively improve the efficiency and accuracy of encryption algorithms (columns identified as sensitive data do not require encryption).

[0091] The application layer data parsing and extraction module can also be used to cache the extracted data records (the data of each network session will be cached independently and subsequently identified independently). When the amount of session data cached on a certain network session reaches a threshold (this threshold can be adjusted based on the actual data recognition accuracy. If the data recognition accuracy can be guaranteed, the threshold can be lowered, otherwise it needs to be increased. For example, if 100 records are selected), a data recognition action will be performed. The specific data recognition includes several key sub-modules such as the field segmentation identification library and the sensitive field recognition rule library, which correspondingly include key recognition processes such as field segmentation and sensitive field recognition. The specific recognition process is as follows:

[0092] Field splitting: For data in formats such as CSV, the data is split into columns according to a specific delimiter (such as a comma), and a two-dimensional array is obtained after splitting.

[0093] Sensitive field identification: The two-dimensional array obtained in the previous step is subjected to column-by-column field type identification. Taking the first column as an example, each data in the column is matched with the preset sensitive field identification rule base to obtain the field type (possibly one or more) matched by each data in the column. Then, the number of each field type appearing in the column is counted to obtain the total number of occurrences of each type. If the total number of occurrences reaches the preset threshold, the column is considered to contain such sensitive data, that is, the column is a sensitive data column. Finally, the sensitive data type contained in each column in the two-dimensional array is obtained. Otherwise (the total number of occurrences is less than the preset threshold), the column is considered to be a non-sensitive data column.

[0094] The preset sensitive field identification rule library used in the present invention includes multiple identification rules such as regular expressions, keywords, dictionaries, etc., or a combination of the above rules.

[0095] Based on the encryption algorithm identification module 214 and in accordance with the encryption algorithm identification rules in the rule policy management module 216, the data encryption algorithm used in the non-sensitive data column is identified according to the character distribution characteristics and data length characteristics of the non-sensitive data column. Specifically:

[0096] (1) In terms of character distribution characteristics, in order to facilitate storage and transmission, the data will be further encoded into a specific binary ciphertext after encryption, typically using BASE64 encoding and HEX encoding (or variants of these two encodings and enterprise-defined encoding). Regardless of the encoding used, the encoded data consists of a set of agreed characters. For example, HEX-encoded data consists of the 16 characters 0-F (possibly lowercase 0-f), and BASE64-encoded data consists of the 64 characters "AZ", "az", "0-9", "+", " / ", and "=". By performing statistical analysis on the characters contained in the encrypted data, the characteristics of the encrypted data in terms of character distribution can be effectively discovered, and the encryption algorithm used for the data can be determined.

[0097] (2) In terms of data length characteristics, the encryption algorithm encrypts data in units of packets / blocks (blocks that do not meet the packet length will be padded using a padding algorithm), and an encryption algorithm may provide multiple optional packet lengths.

[0098] For example, the block length of 3DES is 64 bits, the block length of AES can be 128, 192, or 256 bits, and the block length of SHA-160 (SHA-1) is 512 bits. Generally, longer key lengths enhance encryption strength, making it more difficult to crack and, consequently, providing higher security. After plaintext data is encrypted in blocks, the overall length of the data will be a multiple of the block length. (The lengths of ciphertext and plaintext blocks may be the same, as in symmetric and asymmetric encryption algorithms, or they may differ. For example, in the hash algorithm SHA-160 (SHA-1), plaintext blocks are 512 bits, while ciphertext is fixed at 160 bits.) Furthermore, after encryption, data is further encoded, and the encoding algorithm also operates on a block-by-block basis, involving padding. Therefore, the final ciphertext output length is calculated based on the encryption algorithm block length and the encoding block length, resulting in distinct ciphertext length characteristics.

[0099] Taking the 3DES algorithm as an example, the maximum approximate length of the block after HBASE64 encoding is 32 bits and the total length is greater than or equal to 96 bits (the corresponding maximum approximate number of characters is 4 and the total length is greater than or equal to 12). The maximum approximate length of the block after HEX encoding is 128 bits (the corresponding maximum approximate number of characters is 16). The encryption algorithm used can be determined by the length characteristics of the data after encryption.

[0100] Identify the data encryption algorithm for sensitive data columns based on the sensitive data encryption transmission compliance policy in the preset encryption compliance rule library. Specifically:

[0101] Sensitive data encryption transmission compliance policy: If sensitive data is identified in the network channel (the identification as sensitive data means that no encryption measures are adopted), and there are no compliance rules for this network channel in the preset encryption compliance rule library, it will be matched with the second rule of the preset encryption compliance rule library mentioned above to obtain the data encryption algorithm used for the sensitive data column, and it is stipulated that if there is no encryption compliance rule for such sensitive data, the data encryption algorithm is determined to be compliant; otherwise, the data encryption algorithm is determined to be non-compliant.

[0102] The data encryption compliance detection method provided by the present invention is adapted to a variety of encryption scenarios through the identification of encryption protocols and the extraction of encryption algorithms for application layer data content. It also supports the identification of various encryption algorithms through identification in multiple dimensions, and can more comprehensively discover encryption security issues. It combines the two measures of sensitive data identification and encryption algorithm identification, and can more comprehensively discover sensitive data encryption compliance security risks while improving detection accuracy.

[0103] Furthermore, in one embodiment, step S223 may specifically include:

[0104] S2231. Obtain a first character set contained in a non-sensitive data column and compare it with a preset encoding algorithm character set. If the first character set is a subset of the preset encoding algorithm character set, perform character distribution feature statistics on each data in the non-sensitive data column, and match the character distribution features of the non-sensitive data column with the character distribution features of the preset encoding algorithm.

[0105] If the match is successful, the data length characteristics of the data in the non-sensitive data column are counted one by one, and the data length characteristics of the non-sensitive data column are matched with the data length characteristics of the preset encoding algorithm, the data length characteristics of the preset encryption algorithm, and the key length characteristics to identify the data encryption algorithm in the non-sensitive data column;

[0106] Among them, the character distribution features include the number of digits, letter types, the number of letters and the number of special characters.

[0107] Optionally, count the characters contained in the entire column of data in the non-sensitive data column, and compare the character set S that appears with the preset character set T of each encoding algorithm. If S is a subset of T, the encoding corresponding to T is listed as a candidate encoding. If S is not a subset of any T, the recognition process ends and this column is non-encrypted data.

[0108] Count each character in the entire column, obtaining statistics such as the number of digits, letter type (lowercase and uppercase), number of letters (lowercase and uppercase), and number of special characters. These statistical results are then compared with the character set distribution characteristics of the candidate encoding algorithms. The matching rate between the entire column data and each candidate encoding algorithm is calculated, and encoding algorithms with matching rates below a set threshold are filtered out. If the matching rate for any encoding algorithm is not met, the recognition process ends and the column is determined to be unencrypted data.

[0109] Specifically, the present invention mainly uses the following characteristics to identify the data encryption algorithm:

[0110] The characters contained in a single data are within the character set agreed upon by the preset encoding algorithm;

[0111] Individual data must meet character statistical characteristics (including the number of digits, lowercase letters, uppercase letters, special characters, etc.);

[0112] The length of a single data item meets the length agreement after the preset encryption algorithm and the preset encoding algorithm (including the length being greater than a threshold, the length being a multiple of a specific value, the length being a fixed value, etc.);

[0113] The entire column of data must conform to the preset encoding algorithm character set;

[0114] The proportion of data in the entire column that meets the character distribution characteristics must meet a certain threshold;

[0115] The entire column of data must meet the length agreement after the preset encryption algorithm and the preset encoding algorithm.

[0116] For example, the BASE64 encoding character distribution feature can be set to contain at least one lowercase letter, one uppercase letter, and one number, and all three conditions must be met. The HEX encoding character statistical feature is all lowercase letters or all uppercase letters, and one of the two conditions must be met.

[0117] Perform data length statistics on the entire column of data one by one to obtain the data length characteristics of the non-sensitive data column, and compare the data length characteristics of the non-sensitive data column with the data length characteristics of the preset encryption algorithm, the secret key length characteristics, and the data length characteristics of the candidate encoding algorithm obtained in the previous step (each data length in the entire column must be matched successfully) to obtain the successfully matched candidate encryption algorithm, secret key length, and encoding algorithm.

[0118] The data encryption compliance detection method provided by the present invention has made recognition optimization for structured data, and uses the characteristics of single data and entire column data in multiple dimensions such as character set, character statistics, and data length to achieve effective detection of encryption algorithms for structured data, effectively improving the efficiency and accuracy of encryption algorithm detection, and uses characteristics such as character distribution and data length for identification. The algorithm has low complexity and can effectively solve the performance bottleneck problem in massive scenarios.

[0119] Furthermore, in one embodiment, the encryption compliance check of the data encryption algorithm according to the data sharing and transmission encryption algorithm compliance policy in the preset encryption compliance rule library in step S22 may specifically include:

[0120] S225. Compare the data encryption algorithm with the encryption algorithm and key length specified in the data sharing and transmission encryption algorithm compliance policy. If the encryption algorithm and key length are consistent with the encryption algorithm and key length specified in the rules, then determine that the data encryption algorithm is compliant.

[0121] Among them, the data encryption algorithm includes the data encryption algorithm and the key length.

[0122] Optionally, the identified data encryption algorithm and key length are compared with the rules on the corresponding transmission channel in the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule base. If the encryption algorithm and key length agreed upon in the rules are consistent with those agreed upon in the rules, or there is no encryption algorithm and key length agreed upon, the data encryption algorithm is determined to be compliant; otherwise, the data encryption algorithm is determined to be non-compliant.

[0123] The data encryption compliance detection method provided by the present invention detects data encryption compliance by using the encryption algorithm and key length (encryption strength) required to be adopted on each data transmission channel as agreed upon in a preset encryption compliance rule library. By comparing the detection results with the preset encryption compliance rule library, encryption compliance problems can be effectively discovered and located.

[0124] The data encryption compliance detection device provided by the present invention is described below. The data encryption compliance detection device described below and the data encryption compliance detection method described above can refer to each other.

[0125] Figure 3 Schematic diagram of the structure of the data encryption compliance detection device provided by the present invention, such as Figure 3 As shown, it includes: a transmission protocol determination module 310 and a data encryption detection module 311;

[0126] The transmission protocol determination module 310 is used to obtain the original traffic data packets from the data sharing traffic collection mirror, and parse the original traffic data packets to determine the data transmission protocol;

[0127] The data encryption detection module 311 is used to perform encryption compliance detection on data according to the data transmission protocol and the preset encryption compliance rule library.

[0128] The data encryption compliance detection device provided by the present invention can accurately identify various data transmission protocols in the data sharing process in the enterprise network in real time, and accurately identify various data encryption algorithms in real time based on the identified data transmission protocols and the preset encryption compliance rule library. It is simple to implement and has low performance requirements. It can help enterprises discover related encryption compliance issues and effectively ensure the security of enterprise data sharing and transmission.

[0129] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 411, a memory 412, and a bus 413, wherein the processor 410, the communication interface 411, and the memory 412 communicate with each other via the bus 413. The processor 410 may call the logic instructions in the memory 412 to execute the following method:

[0130] Collect mirror images of data sharing traffic to obtain original traffic data packets, and parse the original traffic data packets to determine the data transmission protocol;

[0131] Perform encryption compliance checks on data based on data transmission protocols and preset encryption compliance rule base.

[0132] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer power screen (which can be a personal computer, server, or network power screen, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0133] Furthermore, the present invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can perform the data encryption compliance detection method provided by the above-mentioned method embodiments, for example, including:

[0134] Collect mirror images of data sharing traffic to obtain original traffic data packets, and parse the original traffic data packets to determine the data transmission protocol;

[0135] Perform encryption compliance checks on data based on data transmission protocols and preset encryption compliance rule base.

[0136] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the data encryption compliance detection method provided in each of the above embodiments is implemented, for example, including:

[0137] Collect mirror images of data sharing traffic to obtain original traffic data packets, and parse the original traffic data packets to determine the data transmission protocol;

[0138] Perform encryption compliance checks on data based on data transmission protocols and preset encryption compliance rule base.

[0139] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0140] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer power screen (which can be a personal computer, a server, or a network power screen, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A data encryption compliance detection method, characterized in that: include: Collecting mirror images of data sharing traffic to obtain original traffic data packets, and parsing the original traffic data packets to determine the data transmission protocol; Perform encryption compliance testing on the data according to the data transmission protocol and the preset encryption compliance rule base, including: if the data transmission protocol is an encryption protocol, performing encryption compliance testing on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule base; if the data transmission protocol is a non-encryption transmission protocol, identifying the data encryption algorithm and performing encryption compliance testing on the data encryption algorithm according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule base; If the data transmission protocol is a non-encrypted transmission protocol, the data encryption algorithm is identified, including: if it is determined that the data transmission protocol is one of the non-encrypted protocols included in the preset encryption protocol traffic feature library, the encryption algorithm used for the application layer data in the data sharing traffic is identified, and the data encryption algorithm is encrypted according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule library. Compliance detection is performed on the data encryption algorithm.

2. The data encryption compliance detection method according to claim 1, characterized in that: The parsing of the original traffic data packet to determine the data transmission protocol includes: Parsing the original traffic data packet to obtain a character set and a port application layer protocol format in an authentication phase data packet in the original traffic data packet; Matching the character set and port application layer protocol format in the authentication phase data packet in the original traffic data packet with the character set and port application layer protocol format in the authentication phase data packet after data is encrypted using a preset data transmission protocol in the encryption protocol traffic feature library to determine the data transmission protocol; The preset data transmission protocol includes a non-encrypted protocol and an encrypted protocol.

3. The data encryption compliance detection method according to claim 1, characterized in that: The performing encryption compliance detection on the data transmission protocol according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule base includes: The protocol type and version information of the data transmission protocol are compared with the rule-agreed protocol type and rule-agreed version information of the data sharing transmission protocol compliance policy. If the protocol type and the version information correspond to the rule-agreed protocol type and the rule-agreed version information, the data transmission protocol is determined to be compliant.

4. The data encryption compliance detection method according to claim 1, characterized in that: The identifying of the data encryption algorithm includes: Extracting application layer data from the original traffic data packet by column, and performing sensitive data identification on each column of data in the application layer data one by one based on a preset sensitive field identification rule library to determine non-sensitive data columns and sensitive data columns in the application layer data; Identifying the data encryption algorithm of the non-sensitive data column according to the character distribution characteristics and data length characteristics of the non-sensitive data column; and Identifying the data encryption algorithm of the sensitive data column according to the sensitive data encryption transmission compliance policy in the preset encryption compliance rule library; The non-sensitive data column is a column in which the total number of sensitive data types included in the application layer data is less than a preset threshold; The sensitive data column is a column in which the total number of sensitive data types included in the application layer data is greater than a preset threshold.

5. The data encryption compliance detection method according to claim 4, characterized in that: The identifying the data encryption algorithm of the non-sensitive data column according to the character distribution characteristics and data length characteristics of the non-sensitive data column includes: Obtaining a first character set contained in the non-sensitive data column and comparing it with a preset encoding algorithm character set; if the first character set belongs to a subset of the preset encoding algorithm character set, performing character distribution feature statistics on each data in the non-sensitive data column, and matching the character distribution features of the non-sensitive data column with the character distribution features of the preset encoding algorithm; If the match is successful, the data length characteristics of the data in the non-sensitive data column are counted one by one, and the data length characteristics of the non-sensitive data column are matched with the data length characteristics of the preset encoding algorithm, the data length characteristics of the preset encryption algorithm, and the key length characteristics to identify the data encryption algorithm in the non-sensitive data column; The character distribution features include the number of digits, letter types, the number of letters and the number of special characters.

6. The data encryption compliance detection method according to claim 1, characterized in that: The encryption compliance detection of the data encryption algorithm according to the data sharing and transmission encryption algorithm compliance policy in the preset encryption compliance rule library includes: Compare the data encryption algorithm with the encryption algorithm and key length stipulated in the data sharing and transmission encryption algorithm compliance policy. If the encryption algorithm and key length are consistent with the encryption algorithm and key length stipulated in the rules, then determine that the data encryption algorithm is compliant. The data encryption algorithm includes the encryption algorithm and key length of the data.

7. A data encryption compliance detection device, characterized in that: include: Transmission protocol determination module and data encryption detection module; The transmission protocol determination module is used to obtain original traffic data packets from the data sharing traffic collection mirror, and parse the original traffic data packets to determine the data transmission protocol; The data encryption detection module is used to perform encryption compliance detection on the data according to the data transmission protocol and the preset encryption compliance rule base, including: if the data transmission protocol is an encryption protocol, then the encryption compliance detection of the data transmission protocol is performed according to the data sharing transmission protocol compliance policy in the preset encryption compliance rule base; if the data transmission protocol is a non-encryption transmission protocol, then the data encryption algorithm is identified and encryption compliance detection of the data encryption algorithm is performed according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule base; If the data transmission protocol is a non-encrypted transmission protocol, the data encryption algorithm is identified, including: if it is determined that the data transmission protocol is one of the non-encrypted protocols included in the preset encryption protocol traffic feature library, the encryption algorithm used for the application layer data in the data sharing traffic is identified, and the data encryption algorithm is encrypted according to the data sharing transmission encryption algorithm compliance policy in the preset encryption compliance rule library. Compliance detection is performed on the data encryption algorithm.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the data encryption compliance detection method according to any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the data encryption compliance detection method according to any one of claims 1 to 6 are implemented.

Images