Monitoring Method, System, Device and Medium for Usage of Sensitive Data

Abstract

The present invention provides a method, system, device and storage medium for monitoring the usage of sensitive data, including: reading sensitive data; matching the sensitive data in the heap memory space to obtain the corresponding first memory location address range; obtaining and determining, according to the executed bytecode, the second memory location address range that the bytecode needs to read in the heap memory space; comparing the first memory location address range with the second memory location address range, and determining the usage of the sensitive data according to the comparison result. By reading the sensitive data, this method can know the memory location address range of the sensitive data in the heap memory space. By obtaining the executed bytecode, it can determine the memory location address range corresponding to the data read in the heap memory space. By comparing the two memory location address ranges, it can quickly and accurately know the specific usage / call situation of the sensitive data, and solves the limitation problem in the prior art that the data usage situation during the program application process cannot be monitored in real time.

Description

Technical Field

[0001] The present invention relates to the field of data monitoring, and more specifically, to a monitoring method, system, device and medium for the usage situation of sensitive data. Background Art

[0002] With the continuous development of big data technology and its business forms, there are business scenarios for processing and analyzing massive data in current life, and the accompanying challenge is data security. Whether the use of data is compliant and secure during the process of data processing and analysis has become one of the key elements of data security monitoring.

[0003] Currently, the security monitoring during the process of data processing and analysis mainly includes three types of monitoring methods:

[0004] (1) Analyzing whether the business administrator has abnormal operations on data processing and analysis behaviors based on the audit of personnel operation behaviors. This type of monitoring method is limited to personnel operation behaviors in terms of the monitored behavior object, and cannot monitor the program applications of data processing and analysis. Moreover, this monitoring method belongs to the ex-post audit of completed operations and does not have the ability to avoid in advance or block during the process.

[0005] (2) Monitoring abnormal situations of data interface method calls based on an interface monitoring method. The monitored behavior object of this type of monitoring method is the call behavior of data processing and analysis applications, and the monitoring indicators mainly include the legality of the call object, the rationality of the call frequency, etc., without delving into the monitoring of the data usage situation during the process of data processing and analysis.

[0006] (3) Monitoring the data flow path based on the data flow path comprehensively formed by database traffic and data asset feature scan results. This type of monitoring method mainly monitors the flow direction and storage location of data to depict the flow route of data in the internal network information system, and also does not have the ability to perceive the data usage situation inside data processing and analysis applications.

[0007] There is a lack of a data monitoring method in the prior art that can monitor the specific usage situation of data during the process of data processing and analysis. Summary of the Invention

[0008] The present invention aims to overcome at least one defect of the above prior art, and provides a monitoring method, system, device and medium for the usage situation of sensitive data, which is used to solve the problem that the specific usage situation of data cannot be monitored in the prior art.

[0009] The technical solutions adopted by the present invention include:

[0010] In a first aspect, the present invention provides a method for monitoring the usage of sensitive data in a data processing task, including: reading sensitive data; the sensitive data is data already stored in the heap memory space; matching the sensitive data in the heap memory space to obtain the first memory location address range of the sensitive data in the heap memory space; obtaining and determining, according to the executed bytecode, the address range of the data to be read by the bytecode, and matching the second memory location address range read by the bytecode in the heap memory space according to the address range of the data to be read; comparing the first memory location address range and the second memory location address range, and determining the usage of the sensitive data according to the comparison result.

[0011] The method for monitoring the usage of sensitive data in a data processing task provided by the present invention utilizes the stack-heap data processing principle of data analysis application development languages such as Java and Python. The sensitive data is already stored in the heap memory space. After reading the sensitive data, its memory location address range in the heap memory space can be obtained, which serves as the basis for subsequent monitoring of the usage of sensitive data. Obtain the executed bytecode, and determine the address range of the data to be read by the bytecode according to the content of the bytecode, match the memory location address range in the heap memory space, and compare the memory location address range of the sensitive data and the memory location address range read by the bytecode, then the specific usage / call situation of the sensitive data can be quickly and accurately known, solving the limitation problem in the prior art that the data usage situation during the program application process cannot be monitored in real time. Moreover, the method provided by the present invention knows the usage situation of sensitive data in the early stage of bytecode execution, can timely detect potential data security hazards, has the ability to avoid in advance and block during the process, and improves the security during the usage of sensitive data.

[0012] Further, obtaining and determining, according to the executed bytecode, the address range of the data to be read by the bytecode, and matching the second memory location address range read by the bytecode in the heap memory space according to the address range of the data to be read specifically includes: obtaining the executed bytecode, extracting the push operation instruction in the bytecode, determining the address range of the pushed data in the push operation instruction, and matching the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data.

[0013] Based on the principle of stack - heap data processing, the bytecode contains the function methods called during program execution. Before the function method is executed, the local parameter variables referenced by the function are stored on the stack, which is reflected as the push - stack operation instruction in the bytecode. By extracting the push - stack operation instruction of the bytecode, the address range of the pushed - stack data in the push - stack operation instruction can be obtained. The address range of the pushed - stack data is matched with the address range in the heap memory space to determine the corresponding memory location address range of the referenced local parameter variables in the heap memory space, which is used as the subsequent comparison with the memory location address range of sensitive data. Using the push - stack operation instruction of the bytecode function method, it is possible to pre - know the data and its address range that the bytecode will read, so as to quickly determine the usage of sensitive data and timely detect requests for illegal access to sensitive data.

[0014] Further, obtain the executed bytecode, extract the push - stack operation instruction in the bytecode, determine the address range of the pushed - stack data in the push - stack operation instruction, and match according to the address range of the pushed - stack data to obtain the second memory location address range read by the bytecode in the heap memory space. It also includes: when the obtained bytecode performs the push - stack operation through a register, by matching the register assignment operation instruction adjacent to the register above, determine the address range of the pushed - stack data in the push - stack operation, and match according to the address range of the pushed - stack data to obtain the second memory location address range read by the bytecode in the heap memory space.

[0015] A part of the bytecode performs the push - stack operation through a register. By matching the register assignment operation adjacent to the register above, the address range of the data pushed onto the stack by the function method can also be obtained, thereby determining the second memory location address range.

[0016] Further, comparing the first memory location address range and the second memory location address range specifically includes: comparing the first memory location address range and the second memory location address range, and determining the overlapping memory location address range of the first memory location address range and the second memory location address range as the comparison result; determining the usage of the sensitive data according to the comparison result specifically includes: when the overlapping memory location address range is a non - empty range, determining the sensitive data corresponding to the overlapping memory location address range as the sensitive data being used.

[0017] If there is an overlapping memory location address range between the first memory location address range and the second memory location address range, it means that the bytecode calls some / all of the sensitive data. Therefore, when the overlapping memory location address range is a non - empty range, the specific sensitive data called can be determined according to the overlapping memory location address range as the sensitive data being used. Subsequently, the call permissions and other contents can be specifically adjusted for the sensitive data being used to ensure the security of sensitive data usage.

[0018] Further, the method further includes: generating a corresponding data permission convergence policy according to the sensitive data that has been used.

[0019] Since it has been determined according to the foregoing steps that there is sensitive data being used and the specific sensitive data that has been used has been determined, in order to ensure the security of the use of the sensitive data that has been used, a corresponding data permission convergence policy should be generated immediately, that is, especially converge the call permissions for the sensitive data that has been used to prevent it from being intentionally / mistakenly called again, making the use of sensitive data more compliant and secure.

[0020] In a second aspect, the present invention provides a monitoring system for the usage situation of sensitive data in a data processing task, including: a data reading module, a sandbox model, and an address comparison and situation determination module; the data reading module is used to read sensitive data; the sensitive data is data that has been stored in the heap memory space; the sandbox model includes: a first address range obtaining module, which is used to match sensitive data in the heap memory space to obtain the first memory location address range of the sensitive data in the heap memory space; a second address range obtaining module, which is used to obtain and determine the address range of the data to be read by the bytecode according to the executed bytecode, and match the second memory location address range read by the bytecode in the heap memory space according to the address range of the data to be read; the address comparison and situation determination module is used to compare the first memory location address range and the second memory location address range, and determine the usage situation of the sensitive data according to the comparison result.

[0021] Further, the second address range obtaining module includes: an instruction extraction unit, which is used to obtain the executed bytecode and extract the push operation instruction in the bytecode; an address range determination unit, which is used to determine the address range of the pushed data in the push operation instruction according to the push operation instruction extracted by the instruction extraction unit, and match the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data.

[0022] Further, the address comparison and situation determination module includes: an address comparison unit, which is used to compare the first memory location address range and the second memory location address range, and determine the overlapping memory location address range of the first memory location address range and the second memory location address range as the comparison result; a situation determination unit, which is used to determine the sensitive data corresponding to the overlapping memory location address range as the sensitive data that has been used when the address comparison unit determines that the overlapping memory location address range is a non-empty range.

[0023] In a third aspect, the present invention provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the monitoring method for the usage of sensitive data in the above data processing task is implemented.

[0024] In a fourth aspect, the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the monitoring method for the usage of sensitive data in the above data processing task is implemented.

[0025] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0026] The monitoring method for the usage of sensitive data in the data processing task provided by the present invention is based on the underlying operating principle of virtual machines for data analysis applications such as Java and Python. By reading the sensitive data stored in the heap memory space, the memory location address range of the sensitive data in the heap memory is determined. The bytecode for calling and processing data will call data from the heap memory. Before or during the call, the memory location address range corresponding to the data read by the bytecode in the heap memory space can be determined according to the executed bytecode. By comparing the memory location address range of the sensitive data and the memory location address range read by the bytecode, the specific usage / call situation of the sensitive data can be accurately known, thereby realizing the efficient monitoring of data security risks. This method has the monitoring ability to perceive the data usage situation inside the data processing and analysis application, and can monitor the usage situation of sensitive data in the early stage of data call, with a strong preventive effect, and can ensure the usage security of sensitive data to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic flowchart of method steps S110 - S140 in Embodiment 1 of the present invention.

[0028] Figure 2 It is a schematic flowchart of method steps S110 - S145 in Embodiment 1 of the present invention.

[0029] Figure 3 It is a schematic diagram of the system module composition in Embodiment 2 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0030] The drawings of the present invention are only for illustrative purposes and cannot be construed as a limitation to the present invention. To better illustrate the following embodiments, some components in the drawings will be omitted, enlarged, or reduced, which do not represent the dimensions of the actual product; for those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0031] Embodiment 1

[0032] This embodiment provides a method for monitoring the usage of sensitive data in a data processing task. This method is used to monitor whether sensitive data is used without permission or beyond specific permissions when a user executes a data processing task, that is, to monitor the usage of sensitive data in real time to ensure the compliance and security of data usage.

[0033] As Figure 1 shown, this method includes the following steps:

[0034] S110. Read sensitive data;

[0035] In this step, the sensitive data is data stored in the heap memory space. The heap memory space allows the program to dynamically allocate a memory space of a certain size during runtime. In this embodiment, the heap memory space is specifically a continuous heap memory space.

[0036] In a specific implementation, sensitive data is generally read through object methods. Sensitive data is data that requires permission or specific permissions to be read / called, such as personal privacy data like the user's ID number, bank card number, mobile phone number, etc.

[0037] S120. Match the sensitive data in the heap memory space to obtain the first memory location address range of the sensitive data in the heap memory space;

[0038] In this step, the method of matching sensitive data is specifically to scan the program's heap memory space through feature matching to obtain the memory location address range of the sensitive data in the heap memory space as the first memory location address range for monitoring the usage of sensitive data in subsequent steps.

[0039] S130. Obtain and determine the address range of the data to be read by the bytecode according to the executed bytecode, and match the second memory location address range read by the bytecode in the heap memory space according to the address range of the data to be read;

[0040] In this step, bytecode is a binary file containing an executable program and consisting of a sequence of code / data pairs. The user can execute the program therein through the bytecode and read the data in the heap memory space. When the executed bytecode is obtained in this step, the address range of the data to be read by the bytecode during execution is determined through the content of the bytecode, specifically referring to the executable program contained in the bytecode, and matched in the heap memory space, so as to obtain the memory location address range of the data that the bytecode will read in the heap memory space as the second memory location address range.

[0041] In a specific implementation, before the function method of the execution program included in the bytecode is executed, the local parameter variables referenced by the function method are stored on the stack. Based on this, as Figure 2 shown, step S130 specifically includes the following steps:

[0042] S131. Obtain the executed bytecode, and extract the push operation instruction in the bytecode;

[0043] The push operation instruction of the bytecode refers to the operation instruction in which the function method of its execution program stores the local parameter variables to be referenced on the stack.

[0044] S132. Determine the address range of the pushed data in the push operation instruction, and match the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data;

[0045] The address range of the parameter variables stored on the stack is included in the push operation instruction. After the address range of the pushed data is matched in the heap memory space, the memory location address range corresponding to the address range of the pushed data is obtained, that is, the second memory location address range of the data read from the heap memory space when the bytecode is executed, which can be quickly determined directly according to the push operation instruction.

[0046] In a specific implementation, some bytecodes execute the push operation instruction based on registers. Based on this, in the process of executing steps S131 to S132, when the obtained bytecode executes the push operation through a register, it is determined by matching the register assignment operation instruction adjacent to the register in the above text, the address range of the pushed data in the push operation is determined, and the second memory location address range read by the bytecode in the heap memory space is matched according to the address range of the pushed data.

[0047] Registers are used to temporarily store the data participating in the operation and the intermediate results of the operation. The above text of the register refers to the content of the executed process instructions and data in the relevant registers and the stack. The register assignment operation adjacent to the register obtained by matching is equivalent to obtaining the push operation instruction of the bytecode, so as to determine the address range of the pushed data in the push operation, and determine the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data.

[0048] S140. Compare the first memory location address range and the second memory location address range, and determine the usage situation of the sensitive data according to the comparison result.

[0049] In this step, comparing the first memory location address range and the second memory location address range is mainly to determine the similarity / coincidence degree between the two memory location address ranges, and this similarity / coincidence degree can indicate whether the data called by the bytecode contains sensitive data, or the amount of sensitive data contained, that is, it can be used to reflect the usage situation of sensitive data.

[0050] In a specific implementation manner, in step S140, the specific sensitive data being used is determined by comparing the two memory location address ranges, such as Figure 2 shown, step S140 specifically includes the following steps:

[0051] S141. Compare the first memory location address range and the second memory location address range, and determine the overlapping memory location address range between the first memory location address range and the second memory location address range as the comparison result;

[0052] S142. Determine whether the overlapping memory location address range is a non-empty range. If so, execute step S143; if not, execute step S145;

[0053] S143. Determine the sensitive data corresponding to the overlapping memory location address range as the sensitive data being used;

[0054] In this step, the usage situation of sensitive data is that there is sensitive data being used, and specifically the sensitive data corresponding to the overlapping memory location address range is being used. As the sensitive data being used, subsequent content such as adjusting the call permissions can be specifically targeted at the sensitive data being used to ensure the data usage security of sensitive data.

[0055] In a preferred implementation manner, as Figure 2 shown, after executing step S143, the following steps are further included:

[0056] S144. Generate a corresponding data permission convergence policy according to the determined sensitive data being used.

[0057] Since it has been determined according to the foregoing steps that there is sensitive data being used and the specific sensitive data being used has been determined, in order to ensure the usage security of the sensitive data being used, a corresponding data permission convergence policy should be immediately generated, that is, especially converge the call permissions for the sensitive data being used to avoid its intentional / accidental call again, making the usage of sensitive data more compliant and secure. In a specific implementation manner, the data permission convergence policy is formulated by data security modules such as the data preprocessing module, the data open platform, and the data desensitization module, and is used to control the unnecessary opening of sensitive data and improve the security of data usage.

[0058] S145. The usage situation of sensitive data is that there is no sensitive data being used.

[0059] In this step, when there is no sensitive data being used, it indicates that the current bytecode is within the scope of safe and compliant data usage. Generally, no further adjustment or measure is required, and only the next executed bytecode needs to be continuously monitored by executing steps S130 to S140.

[0060] The monitoring method for the usage of sensitive data in the data processing task provided by the present invention is based on the underlying operating principles of virtual machines for data analysis applications such as Java and Python. By reading the sensitive data stored in the heap memory space, the memory location address range of the sensitive data in the heap memory is determined. The function methods in the bytecode used to call and process data will pre-push the data to be referenced from the heap memory onto the stack, and the memory location address range corresponding to the data read by the bytecode in the heap memory space is determined according to the stack call instructions of the function methods. By comparing the memory location address range of the sensitive data and the memory location address range read by the bytecode, the specific usage / call situation of the sensitive data can be accurately known, and the safe usage of the sensitive data can be efficiently monitored before or during the early stage of the bytecode's formal call to the data. This method has the monitoring ability to sense the data usage situation inside the data processing and analysis application, and can monitor the usage situation of the sensitive data during the early stage of data call, with a strong preventive effect, and can ensure the usage security of the sensitive data to the greatest extent.

[0061] Embodiment 2

[0062] Based on the same concept as Embodiment 1, as Figure 3 shown, this embodiment provides a monitoring system for the usage of sensitive data in a data processing task, including:

[0063] A data reading module 210, configured to read sensitive data;

[0064] The sensitive data is data stored in the heap memory space.

[0065] A sandbox model 220, including:

[0066] A first address range obtaining module 221, configured to match the sensitive data in the heap memory space to obtain a first memory location address range of the sensitive data in the heap memory space.

[0067] A second address range obtaining module 222, configured to obtain and determine the address range of the data to be read by the bytecode according to the executed bytecode, and match to obtain a second memory location address range read by the bytecode in the heap memory space according to the address range of the data to be read;

[0068] The second address range obtaining module 222 includes:

[0069] An instruction extraction unit 2221, configured to obtain the executed bytecode and extract the push operation instruction in the bytecode.

[0070] An address range determination unit 2222, configured to determine the address range of the pushed data in the push operation instruction according to the push operation instruction extracted by the instruction extraction unit, and match the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data.

[0071] When the obtained bytecode performs a push operation through a register, the instruction extraction unit 231 obtains the register assignment operation instruction adjacent to the register above by matching.

[0072] The address range determination unit 2222 determines the address range of the pushed data in the push operation according to the register assignment operation instruction adjacent to the register above, and matches the second memory location address range read by the bytecode in the heap memory space according to the address range of the pushed data.

[0073] An address comparison and situation determination module 230, configured to compare the first memory location address range and the second memory location address range, and determine the usage situation of the sensitive data according to the comparison result.

[0074] The address comparison and situation determination module 230 includes:

[0075] An address comparison unit 231, configured to compare the first memory location address range and the second memory location address range, and determine the overlapping memory location address range of the first memory location address range and the second memory location address range as the comparison result.

[0076] A situation determination unit 232, configured to determine the sensitive data corresponding to the overlapping memory location address range as the used sensitive data when the address comparison unit determines that the overlapping memory location address range is a non-empty range.

[0077] The system further includes:

[0078] A policy determination module 240, configured to generate a corresponding data permission convergence policy according to the determined used sensitive data.

[0079] In the implementation manner of the monitoring system for the usage of sensitive data in the above data processing tasks, the logical division of each functional module is only for illustrative purposes. In actual applications, according to needs, for example, due to hardware configuration requirements or software implementation considerations, the above functions can be assigned to different functional modules to complete. That is, the internal structure of the monitoring system can be divided into functional modules different from the above content, but it can complete all the functions described above. Secondly, regarding the execution process and other contents of the modules of the monitoring system in the above example, since they are based on the same concept as the monitoring method for the usage of sensitive data in the data processing task described in the previous embodiment of this example, their principles and the technical effects brought are the same as those of the previous monitoring method. For specific content, please refer to the description of the method implementation manner, and details will not be elaborated here.

[0080] Obviously, the above embodiments of the present invention are only examples for clearly illustrating the technical solutions of the present invention, rather than limitations on the specific implementation manners of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A method for monitoring the usage of sensitive data in a data processing task, characterized in that, Including: Reading sensitive data; The sensitive data is data stored in the heap memory space; Matching the sensitive data in the heap memory space to obtain the first memory location address range of the sensitive data in the heap memory space; Obtaining and determining, according to the executed bytecode, the address range of the data that the bytecode needs to read, and matching according to the address range of the data to be read to obtain the second memory location address range read by the bytecode in the heap memory space; The reading of the second memory location address range specifically includes: obtaining the executed bytecode, extracting the push operation instruction in the bytecode, determining the address range of the pushed data in the push operation instruction, and matching according to the address range of the pushed data to obtain the second memory location address range read by the bytecode in the heap memory space; Comparing the first memory location address range and the second memory location address range, and determining the usage situation of the sensitive data according to the comparison result.

2. The monitoring method for the usage of sensitive data in the data processing task according to claim 1, wherein, Obtaining the executed bytecode, extracting the push operation instruction in the bytecode, determining the address range of the pushed data in the push operation instruction, and matching according to the address range of the pushed data to obtain the second memory location address range read by the bytecode in the heap memory space, further including: When the obtained bytecode performs a push operation through a register, determining the address range of the pushed data in the push operation by matching the register assignment operation instruction adjacent to the register above, and matching according to the address range of the pushed data to obtain the second memory location address range read by the bytecode in the heap memory space.

3. The monitoring method for the usage of sensitive data in the data processing task according to claim 1, characterized in that Comparing the first memory location address range and the second memory location address range specifically includes: Comparing the first memory location address range and the second memory location address range, and determining the overlapping memory location address range of the first memory location address range and the second memory location address range as the comparison result; Determining the usage situation of the sensitive data according to the comparison result specifically includes: When the overlapping memory location address range is a non-empty range, determining the sensitive data corresponding to the overlapping memory location address range as the sensitive data being used.

4. The monitoring method for the usage of sensitive data in the data processing task according to claim 3, wherein, Further including: Generating a corresponding data permission convergence policy according to the sensitive data being used.

5. A monitoring system for the usage of sensitive data in a data processing task, characterized in that, Including: A data reading module, a sandbox model, and an address comparison and situation determination module; The data reading module is used to read sensitive data; The sensitive data is data stored in the heap memory space; The sandbox model includes: A first address range obtaining module, which is used to match sensitive data in the heap memory space to obtain the first memory location address range of the sensitive data in the heap memory space; A second address range obtaining module, which is used to obtain and determine, according to the executed bytecode, the address range of the data that the bytecode needs to read, and match according to the address range of the data to be read to obtain the second memory location address range read by the bytecode in the heap memory space; Reading the address range of the second memory location specifically includes: obtaining the executed bytecode, extracting the push operation instruction in the bytecode, determining the address range of the pushed data in the push operation instruction, and matching the address range of the pushed data to obtain the address range of the second memory location read by the bytecode in the heap memory space; The address comparison and situation determination module is used to compare the first memory location address range and the second memory location address range, and determine the usage situation of the sensitive data according to the comparison result.

6. The monitoring system for the usage of sensitive data in the data processing task according to claim 5, wherein The second address range acquisition module includes: An instruction extraction unit for obtaining the executed bytecode and extracting the push operation instruction in the bytecode; An address range determination unit for determining the address range of the pushed data in the push operation instruction extracted by the instruction extraction unit, and matching the address range of the pushed data to obtain the address range of the second memory location read by the bytecode in the heap memory space.

7. The monitoring system for the usage of sensitive data in the data processing task according to claim 5, wherein The address comparison and situation determination module includes: An address comparison unit for comparing the first memory location address range and the second memory location address range, and determining the overlapping memory location address range of the first memory location address range and the second memory location address range as the comparison result; A situation determination unit for determining the sensitive data corresponding to the overlapping memory location address range as the sensitive data being used when the address comparison unit determines that the overlapping memory location address range is a non-empty range.

8. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the method for monitoring the usage situation of sensitive data in the data processing task according to any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for monitoring the usage situation of sensitive data in the data processing task according to any one of claims 1 to 4.

Images