User data security protection method and system for multi-tenant platform

Abstract

The present application relates to a method and system for protecting user data security on a multi-tenant platform, the method comprising: determining a complete key based on the unified key and the encryption vector; authenticating the user, determining the user's level, and controlling the frequency based on the user's level; verifying the user's authority to determine whether the current user has access rights to the data; after both the identity authentication and authority verification are passed, using the complete key to encrypt and transmit the data requested by the user. The present application proposes an overall data security strategy that can effectively improve data security in complex scenarios such as enterprise-level multi-tenants. At the same time, because the strategy is unified as a whole and is simplified as much as possible, it takes into account both ease of use and different access scenarios.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method and system for protecting user data security on a multi-tenant platform. Background Art

[0002] With the rise of the enterprise service (To B) market, various SaaS (Software as a Service) service platforms are in the ascendant. In order to better serve their own platform customers (which can be understood as merchants on the platform, for the convenience of distinction, collectively referred to as "first-level customers"), and to facilitate platform customers to serve their own enterprises (which can be understood as enterprises served by each merchant, for the convenience of distinction, collectively referred to as "second-level customers"), various enterprise service platforms have launched multi-tenant solutions.

[0003] Since there are many user and data layers on a multi-tenant platform, each tenant (first-level customer) has subordinate enterprise data, and each enterprise (second-level customer) has its own user data. At the same time, each tenant (first-level customer), each enterprise (second-level customer), and each user (third-level customer) has their own data access scenario, which makes data isolation and data security protection more complex.

[0004] In addition, in addition to providing web access services, current SaaS platforms also need to provide API interface-level access services for tenants and enterprises; these pose considerable challenges to user identity security authentication, interface access security, and data security protection.

[0005] In the related technologies, the existing multi-tenant data security strategy is relatively simple, and the data usually adopts a unified data encryption strategy and key. Once the data is breached from one point, the entire data is at risk of leakage. The data security protection level is too low.

[0006] At the same time, the existing data access security control levels are all based on functional level control. Once a bug occurs and the functional control is bypassed, or an identity switching attack occurs, all data may face the risk of leakage. Summary of the invention

[0007] In order to overcome the problems existing in the related art at least to a certain extent, the present application provides a user data security protection method and system for a multi-tenant platform.

[0008] According to a first aspect of an embodiment of the present application, a method for protecting user data security of a multi-tenant platform is provided, comprising:

[0009] Upon receiving a data access request initiated by a user, obtaining the user's unified key and encryption vector;

[0010] determining a complete key based on the unified key and the encryption vector;

[0011] Authenticate the user, determine the user's level, and perform frequency control based on the user's level;

[0012] Verify the user's permissions to determine whether the current user has access rights to the data;

[0013] After both identity authentication and permission verification are passed, the complete key is used to encrypt and transmit the data requested by the user.

[0014] Furthermore, the method further comprises:

[0015] When creating a first-level customer, specify the private key and encryption vector of the first-level customer, where the private key is used as the unified key;

[0016] When creating a secondary customer under a primary customer, a different offset is specified for each secondary customer as the encryption vector of each secondary customer.

[0017] Furthermore, the users include primary customers and secondary customers; each primary customer corresponds to one or more secondary customers;

[0018] Each of the first-level customers corresponds to a unified key, which is used as a unified secret key for encrypting the second-level customers under it;

[0019] Each of the first-level customers corresponds to an encryption vector, which is used to encrypt and decrypt the first-level customer's own data in conjunction with the unified secret key;

[0020] Each of the secondary customers corresponds to an encryption vector, which is used to encrypt and decrypt the data of the secondary customer in conjunction with the unified secret key.

[0021] Furthermore, the step of obtaining the user's unified key and encryption vector includes:

[0022] When the user is a first-level customer, obtain the user's unified key and encryption vector;

[0023] When the user is a secondary customer, the unified key of the primary customer corresponding to the user and the encryption vector of the user are obtained.

[0024] Furthermore, the method further comprises:

[0025] Before encrypting any piece of data, the business field is signed and hashed;

[0026] Decoding the original data before data modification and / or after data loading;

[0027] After the data is correctly decoded, the signature is calculated for the data and compared with the stored signature;

[0028] If the signature hash values ​​do not match, the user's access request is denied.

[0029] Furthermore, the identity verification step includes:

[0030] Obtain user credentials each time a user accesses a website or interface;

[0031] User credentials are authenticated through the user authentication system, and user identities and levels are distinguished.

[0032] Furthermore, the step of verifying the authority includes:

[0033] Before data modification and / or after data loading, verify whether the current user has access rights to the data;

[0034] If there is no permission, the user's access request is denied;

[0035] When each piece of data is created, the user who has permission to access the data will be marked.

[0036] Furthermore, the method further comprises:

[0037] According to the verified user information, the decoding key corresponding to the user is loaded to decode the access data;

[0038] After the data is correctly decoded, the signature is calculated on the data and compared with the stored signature.

[0039] Further, using the complete key to encrypt and transmit the data requested by the user includes:

[0040] An https secure channel is used, the complete key is used as the transmission key, and the transmission data is signed and verified.

[0041] According to a second aspect of an embodiment of the present application, a user data security protection system for a multi-tenant platform is provided, comprising:

[0042] An acquisition module, used to acquire a user's unified key and encryption vector upon receiving a data access request initiated by the user;

[0043] A determination module, configured to determine a complete key based on the unified key and the encryption vector;

[0044] The authentication module is used to authenticate the user and determine the user's level;

[0045] A frequency control module, used for performing frequency control according to the user's level;

[0046] The permission verification module is used to verify the user's permission and determine whether the current user has the access rights to the data;

[0047] The encryption transmission module is used to encrypt and transmit the data requested by the user using the complete key after verification.

[0048] The technical solution provided by the embodiments of the present application has the following beneficial effects:

[0049] This application proposes an overall data security strategy that can effectively improve data security in complex scenarios such as enterprise-level multi-tenancy. At the same time, due to the overall unity of the strategy, it also ensures simplification as much as possible, taking into account the convenience of use and different access scenarios.

[0050] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0052] Figure 1 The figure is a schematic diagram of a user system under multi-tenancy according to an exemplary embodiment.

[0053] Figure 2 The present invention is a flowchart of a method for protecting user data security of a multi-tenant platform according to an exemplary embodiment.

[0054] Figure 3 It is a schematic diagram of a user data security protection system of a multi-tenant platform according to an exemplary embodiment.

[0055] Figure 4 The diagram is a schematic diagram of a data encryption strategy according to an exemplary embodiment. DETAILED DESCRIPTION

[0056] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of methods and systems consistent with some aspects of the present application as detailed in the appended claims.

[0057] The user system under multi-tenancy is as follows Figure 1As shown. The present invention aims to solve the user data security protection system in complex scenarios such as enterprise-level multi-tenant platforms, which can effectively improve the security level of the overall data. Different data encryption is performed on different platform customers (merchants) and different enterprises (enterprises under tenants) from the bottom layer, and data isolation is performed from the bottom layer. In addition, data permission control is performed from the bottom layer, which fundamentally avoids illegal data access.

[0058] The present invention cooperates with multi-level data signature protection, multi-level interface access control, and a complete user identity authentication system to effectively improve the data security level of the overall platform. It can also achieve compatibility with different scenarios of web page access and interface access, achieving an effective balance between data security and ease of use.

[0059] Figure 2 The following is a flowchart of a method for protecting user data security on a multi-tenant platform according to an exemplary embodiment. The method may include the following steps:

[0060] Step S1: upon receiving a data access request initiated by a user, obtaining the user's unified key and encryption vector;

[0061] Step S2, determining a complete key according to the unified key and the encryption vector;

[0062] Step S3: authenticate the user, determine the user's level, and perform frequency control according to the user's level;

[0063] Step S4: Verify the user's authority to determine whether the current user has access rights to the data;

[0064] Step S5: After both identity verification and authority verification are passed, the complete key is used to encrypt and transmit the data requested by the user.

[0065] This application proposes an overall data security strategy that can effectively improve data security in complex scenarios such as enterprise-level multi-tenancy. At the same time, due to the overall unity of the strategy, it also ensures simplification as much as possible, taking into account the convenience of use and different access scenarios.

[0066] It should be understood that although Figure 2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0067] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

[0068] In some embodiments, the method further includes: when creating a first-level customer, specifying the private key and encryption vector of the first-level customer, wherein the private key serves as a unified key; when creating a second-level customer under the first-level customer, specifying a different offset for each second-level customer as the encryption vector of each second-level customer.

[0069] In some embodiments, the users include primary customers and secondary customers; each primary customer corresponds to one or more secondary customers. Each primary customer corresponds to a unified key, which is used as a unified secret key for encrypting secondary customers under it. Each primary customer corresponds to an encryption vector, which is used to encrypt and decrypt the primary customer's own data in conjunction with the unified secret key. Each secondary customer corresponds to an encryption vector, which is used to encrypt and decrypt the secondary customer's data in conjunction with the unified secret key.

[0070] In some embodiments, the step of obtaining the user's unified key and encryption vector in step S1 includes: when the user is a first-level customer, obtaining the user's unified key and encryption vector; when the user is a second-level customer, obtaining the unified key of the first-level customer corresponding to the user and its own encryption vector.

[0071] In some embodiments, the method also includes: signing and hashing the business field before encrypting any piece of data; decoding the original data before modifying the data and / or after loading the data; after the data is correctly decoded, calculating the signature of the data and comparing it with the stored signature; if the signature hash value does not match, denying the user's access request.

[0072] In some embodiments, the identity authentication step in step S3 includes: obtaining user credentials each time the user accesses through the web page and interface; authenticating the user credentials through a user identity authentication system, and distinguishing the user identity and level.

[0073] In some embodiments, the permission verification step in step S4 includes: before data modification and / or after data loading, verifying whether the current user has access rights to the data; if no permission is given, denying the user's access request; wherein, when each piece of data is created, the user with permission to access the data will be marked.

[0074] In some embodiments, the method further includes: based on the verified user information, loading the decoding key corresponding to the user to decode the access data; after the data is correctly decoded, calculating the signature of the data and comparing it with the stored signature.

[0075] In some embodiments, the step S5 uses the complete key to encrypt and transmit the data requested by the user, including: using https secure channel, using the complete key as the transmission key, and signing and verifying the transmission data.

[0076] Reference Figure 3 ,The data security protection of this system mainly consists of five parts: transmission encryption, hierarchical interface frequency ,control, data authority verification, encryption and decryption under secret key collaboration, and data signature.

[0077] Data access is initiated through a web page or interface. In a secure channel, each merchant / enterprise's independent secret key / signature verification strategy is used to encrypt and transmit data. After the request reaches the system, it will first pass through the hierarchical interface frequency control, where the identity authentication system will be used to ensure the user's legal access. The system will verify the data permissions of the operation and the returned data. After ensuring that it is a legitimate user access, the company's respective complete secret key is used to encrypt and decrypt the data, and the data signature will be verified to ensure that the data has not been illegally tampered with.

[0078] First, when creating a merchant customer (also known as a tenant), specify the merchant's private key. When creating an enterprise customer under the merchant, specify different offsets for the enterprise customer. The two parts together are the complete data key. This is used to encrypt and decrypt data.

[0079] Secondly, every time a user accesses a website or interface, the user's credentials are authenticated by the user authentication system, and the user's identity and level are distinguished to avoid identity switching attacks.

[0080] Then, through the hierarchical interface frequency control mechanism, the frequency of user access is controlled to prevent brute force attacks such as traffic overload.

[0081] Next, data permissions for user access to data are verified to confirm that the user has the authority to read and operate the data to avoid illegal access attacks.

[0082] Next, based on the verified user information, the corresponding decoding key of the user is loaded to decode the access data. Since the keys of different user data are different, unauthorized access attacks on data can be avoided.

[0083] After the data is correctly decoded, a signature is calculated for the data and compared with the stored signature to prevent attacks that could lead to illegal data tampering.

[0084] Next, when communicating with customers, we use the https secure channel, set an independent transmission key for each customer, and sign and verify the transmitted data to avoid attacks such as communication access hijacking.

[0085] In order to achieve systematic protection of user data security, the technical solution of this application specifically includes the following mechanisms:

[0086] 1. Collaboration of secret keys between platform tenant customers (merchants) and enterprises (enterprises under tenants)

[0087] The platform does not use a unified encryption key for data encryption, but instead realizes the key coordination between tenant customers (merchants) and enterprises (enterprises under tenants). Data isolation can be achieved from the bottom up.

[0088] Specific strategies such as Figure 4 As shown. Each merchant has its own independent secret key, and each enterprise under the merchant has its own encryption vector. In addition, the merchant also has its own encryption vector for the data it uses independently. Only by combining the merchant's secret key and the encryption vectors of each enterprise can the complete secret key of each enterprise be formed to access and encrypt data. The combination of encryption vectors specifically combines the two parts (unified key and encryption vector) into a complete key. Specifically, two parameters need to be passed in for decryption when the code is implemented, which is guaranteed by the AES algorithm mechanism.

[0089] This mechanism ensures the encryption and isolation of data under each merchant and the encryption and decryption of data under each enterprise, fundamentally preventing enterprise A from accessing the data of enterprise B. Even if data is illegally loaded through layers of restrictions, it is impossible to decode B's data because the complete secret key of enterprise B is unknown.

[0090] Merchants only need to protect their own unique root key, which reduces the complexity of use and ensures convenience.

[0091] 2. Underlying data signature mechanism

[0092] Data signature is a hash operation on the data content, which converts the complete data content into a numerical string of a certain length, which can be understood as extracting the feature value of the data. The numerical values ​​after the hash of the same data signature are the same, while the numerical values ​​after the hash of different data content signatures are almost always different (the probability of difference is low enough).

[0093] Before encrypting each piece of data at the data bottom layer, the data content will be signed and hashed. Before modifying the data and after loading the data, the original data will be decoded and the signature hash will be recalculated and checked. If the hash value does not match, it means that the data has been illegally tampered with or is being illegally accessed.

[0094] Data validity and privacy are protected from the bottom up.

[0095] 3. Data underlying permission control mechanism

[0096] When each piece of data is created, the user who has the right to access the data will be marked. Before data modification and after data loading, it will verify whether the current user has the right to access the data. If the user does not have the right, the access can be rejected from the bottom layer, thus avoiding data leakage.

[0097] In conjunction with a complete user identity authentication system, various data leakage attacks such as unauthorized access and identity switching attacks can be effectively prevented.

[0098] 4. Hierarchical data interface access frequency control mechanism

[0099] The system sets frequency control for the interface under merchant and enterprise access in advance, and can set different frequencies for different access scenarios (interface scenario access or SaaS webpage scenario access). When the user logs in to verify the identity, the system will perform hierarchical data interface access control on merchants and enterprises based on the current customer's identity and previous settings, and can achieve access frequency control for different merchants, different enterprises, different interfaces, and different scenarios. It can prevent data from being cracked by brute force attacks and effectively protect customer data from being maliciously copied by internal personnel.

[0100] 5. Independent transmission encryption key for each merchant / enterprise

[0101] In addition, https secure data channels are used in all front-end and back-end access processes, and AES data encryption is combined with data signatures as transmission security control. The data of each merchant and enterprise is encrypted whether accessed through web pages or interfaces. Each merchant and enterprise can also change its own transmission key by itself (the specific operation method is to log in with the original key first, verify the identity, and then submit the modified key to the system), ensuring the security of data transmission.

[0102] In some embodiments, the following alternatives may also be adopted: for each enterprise and each merchant, the webpage and the interface are encrypted and decrypted separately, and data loading is controlled by functions. However, these embodiments are much more complex and less secure.

[0103] The scheme of the present application adopts the above-mentioned embodiment, which has the following beneficial effects: 1. Through the key coordination mechanism, different data keys of different enterprises are realized. Key isolation is realized from the bottom layer, and then data isolation is realized to prevent illegal access to data. Even illegal access cannot be correctly decoded. 2. Data signature mechanism effectively prevents data from being tampered with. 3. Data permission verification is performed from the bottom layer of the data to prevent data from being unauthorized and illegally accessed. 4. Hierarchical data interface frequency control can effectively control the frequency for different scenarios. Prevent data from being cracked by force and data leakage within the enterprise. 5. The transmission process uses a secure channel, and each enterprise independently controls the transmission key to ensure the data security of the transmission process.

[0104] An embodiment of the present application also provides a user data security protection system for a multi-tenant platform, including: an acquisition module, a determination module, a frequency control module, a verification module and an encryption transmission module.

[0105] The acquisition module is used to obtain the user's unified key and encryption vector when receiving a data access request initiated by the user. The determination module is used to determine the complete key based on the unified key and the encryption vector. The identity authentication module is used to authenticate the user and determine the user's level. The frequency control module is used to control the frequency according to the user's level. The authority verification module is used to verify the user's authority and determine whether the current user has access rights to the data. The encryption transmission module is used to encrypt and transmit the data requested by the user using the complete key after the verification is passed.

[0106] Regarding the system in the above embodiment, the specific steps for each module to perform operations have been described in detail in the embodiment of the method, and will not be elaborated in detail here. Each module in the above data security protection system can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0107] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0108] It should be noted that, in the description of this application, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0109] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0110] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0111] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0112] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0113] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0114] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0115] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A user data security protection method for a multi-tenant platform, characterized in that: include: Upon receiving a data access request initiated by a user, obtaining the user's unified key and encryption vector; determining a complete key based on the unified key and the encryption vector; Authenticate users, determine their levels, and control the frequency of user access based on their levels; Verify the user's permissions to determine whether the current user has access rights to the data; After both identity verification and permission verification are passed, the complete key is used to encrypt and transmit the data requested by the user; The method further includes: specifying the private key and encryption vector of the first-level customer when creating the first-level customer, wherein the private key is used as a unified key; When creating a secondary customer under a primary customer, a different offset is specified for each secondary customer as the encryption vector of each secondary customer.

2. The method according to claim 1, characterized in that The users include primary customers and secondary customers; each primary customer corresponds to one or more secondary customers; Each of the first-level customers corresponds to a unified key, which is used as the unified key for encrypting the second-level customers under it; Each of the first-level customers corresponds to an encryption vector, which is used to encrypt and decrypt the first-level customer's own data in conjunction with the unified key; Each of the secondary customers corresponds to an encryption vector, which is used to encrypt and decrypt the data of the secondary customer in conjunction with the unified key.

3. The method according to claim 1, characterized in that: The step of obtaining the user's unified key and encryption vector comprises: When the user is a first-level customer, obtain the user's unified key and encryption vector; When the user is a secondary customer, the unified key of the primary customer corresponding to the user and the encryption vector of the user are obtained.

4. The method according to any one of claims 1 to 3, characterized in that: The method further includes: Before encrypting any piece of data, the business field is signed and hashed; Decoding the original data before data modification and / or after data loading; After the data is correctly decoded, the signature is calculated for the data and compared with the stored signature; If the signature hash values ​​do not match, the user's access request is denied.

5. The method according to any one of claims 1 to 3, characterized in that: The steps of identity verification include: Obtain user credentials each time a user accesses a website or interface; User credentials are authenticated through the user authentication system, and user identities and levels are distinguished.

6. The method according to any one of claims 1 to 3, characterized in that: The steps of the permission verification include: Before data modification and / or after data loading, verify whether the current user has access rights to the data; If there is no permission, the user's access request is denied; When each piece of data is created, the user who has permission to access the data will be marked.

7. The method according to any one of claims 1 to 3, characterized in that: The method further includes: According to the verified user information, the decoding key corresponding to the user is loaded to decode the access data; After the data is correctly decoded, the signature is calculated on the data and compared with the stored signature.

8. The method according to any one of claims 1 to 3, characterized in that: The complete key is used to encrypt and transmit the data requested by the user, including: An https secure channel is used, the complete key is used as the transmission key, and the transmission data is signed and verified.

9. A user data security protection system for a multi-tenant platform, characterized in that: include: An acquisition module, used to acquire a user's unified key and encryption vector upon receiving a data access request initiated by the user; It is also used to specify the private key and encryption vector of the primary customer when creating a primary customer, where the private key is used as a unified key; when creating a secondary customer under the primary customer, a different offset is specified for each secondary customer as the encryption vector of each secondary customer; A determination module, configured to determine a complete key based on the unified key and the encryption vector; The authentication module is used to authenticate the user and determine the user's level; A frequency control module, used for performing frequency control on user access according to the user's level; The permission verification module is used to verify the user's permission and determine whether the current user has the access rights to the data; The encryption transmission module is used to encrypt and transmit the data requested by the user using the complete key after verification.

Images