Data security access method, device and electronic equipment

Abstract

The present invention discloses a data security access method, device and electronic device. The method first responds to a user access request and collects data from the API used by the user; then converts the format of the collected data to obtain first data; then, according to a preset annotation model and user permissions, the first data is labeled by permission classification and grading; finally, based on the user access request and the permission classification and grading annotation, the requested data is returned to the user, which can greatly reduce the cost of data security protection and effectively improve the flexibility and accuracy of security protection.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a data security access method, device and electronic equipment. Background Art

[0002] When users access application servers to obtain data, they are usually comprehensively evaluated, so that their permissions can be dynamically developed or downgraded, providing more refined and rapid automated risk response capabilities for application scenarios.

[0003] At present, the security protection of data access is mainly achieved by uniformly controlling the access rights of APIs through application servers or API (application programming interface) gateways, returning different data contents through different APIs, and then authorizing different APIs to different users. However, since the data structure returned by the API is fixed and the content is hard-coded in the business server, when the classification and grading attributes of the data structure change, the business server needs to be re-encoded and adjusted or a very complex internal attribute control system needs to be designed to complete it, resulting in an increase in the development cost of non-core business content of the business server. In addition, whether the data structure returned by the API complies with the classification and grading specifications depends entirely on manual review and the compliance of program developers, which makes supervision difficult.

[0004] Therefore, how to reduce the security protection cost of data access and improve the flexibility and accuracy of security protection is a technical problem to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of the present invention is to solve the technical problems in the prior art of high security protection cost during data access and low flexibility and accuracy of security protection.

[0006] To achieve the above technical objectives, the present invention provides a data security access method, which includes:

[0007] In response to user access requests, collect data on the APIs used by users;

[0008] Converting the collected data into a first format;

[0009] Performing permission classification and grading annotation on the first data according to a preset annotation model and user permissions;

[0010] The requested data is returned to the user based on the user access request and the permission classification and grading annotation.

[0011] Preferably, the responding to the user access request specifically includes:

[0012] Determining whether the user access request is abnormal;

[0013] If so, the user's access request is denied;

[0014] If not, the user authority is determined, and after determining the user authority, the access request is authorized and released, and data collection is performed on the API used by the user.

[0015] Preferably, the preset labeling model is specifically a neural network model trained by a training data set, and the neural network model is established based on a classification and grading standard library and approximate attribute names.

[0016] Preferably, the step of labeling the first data by authority classification and grading according to a preset labeling model and user authority specifically includes:

[0017] Determining a permission classification and grading strategy based on the user permissions;

[0018] The first data is labeled with permission classification and grading according to the permission classification and grading strategy using the preset labeling model.

[0019] Preferably, the method further comprises sending the permission classification and grading annotation to an administrator so that the administrator can check the permission classification and grading annotation.

[0020] Preferably, the step of returning the requested data to the user based on the user access request and the permission classification and grading annotation is as follows:

[0021] Acquiring request data according to the user access request;

[0022] Converting the requested data into the format to obtain second data;

[0023] Desensitizing the data in the second data that exceeds the permission level according to the permission classification and hierarchical labeling;

[0024] The desensitized second data is sent to the user.

[0025] Preferably, the format conversion is specifically structured parsing into a preset format.

[0026] On the other hand, the present invention also provides a data security access device, the device comprising:

[0027] The response module is used to collect data on the API used by the user in response to the user's access request;

[0028] A conversion module, configured to convert the format of the collected data to obtain first data;

[0029] A labeling module, configured to label the first data by authority classification and grading according to a preset labeling model and user authority;

[0030] The return module is used to return the requested data to the user based on the user access request and the permission classification and grading annotation.

[0031] In another aspect, the present invention further provides an electronic device, comprising:

[0032] processor;

[0033] a memory for storing instructions executable by the processor;

[0034] The processor is configured to execute the method described above.

[0035] The present invention provides a data security access method, system and electronic device. Compared with the existing technology, the method first responds to the user access request and collects data from the API used by the user; then converts the format of the collected data to obtain first data; then classifies and labels the first data according to the preset labeling model and user permissions; finally, based on the user access request and the permission classification and classification, the requested data is returned to the user, which can greatly reduce the cost of data security protection and effectively improve the flexibility and accuracy of security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 The figure shows a flow chart of a data security access method provided by an embodiment of this specification;

[0038] Figure 2 FIG2 is a schematic diagram of the structure of a data security access device provided in an embodiment of this specification;

[0039] Figure 3 The figure shows a hardware structure block diagram of the data security access server provided in the embodiment of this specification. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0041] like Figure 1 The flowchart of the data security access method provided by the embodiment of this specification is shown. Although this specification provides the method operation steps or device structure shown in the following embodiments or drawings, based on routine or without creative labor, the method or device may include more or fewer operation steps or module units after partial merger. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied in actual devices, servers or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in a parallel processor or multi-threaded processing environment, or even in a distributed processing or server cluster implementation environment).

[0042] The data security access method provided in the embodiment of this description can be applied to terminal devices such as clients and servers. Figure 1 As shown, the method specifically includes the following steps:

[0043] Step S101: In response to a user access request, data is collected from the API used by the user.

[0044] Specifically, when a user obtains data from a server, they will send a user access request through the API gateway, which will then collect data from the API used by the user. The collected data includes the address of the target server, the service port of the target server, the requested path, the data type, and the effective data payload returned by the API. Specific examples in specific application scenarios are as follows:

[0045]

[0046]

[0047] When the API used by the user is HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol over Secure Socket Layer), the unencrypted content can be obtained in the API gateway through SSL (Secure Socket Layer) offloading and other methods. For custom microservice interaction protocols, the actual request content can be obtained through fixed encryption and decryption and other methods. This application does not impose any restrictions on this.

[0048] To improve the security of data access, in the embodiment of the present application, responding to the user access request specifically includes:

[0049] Determining whether the user access request is abnormal;

[0050] If so, deny access to the user.

[0051] If not, the user authority is determined, and after determining the user authority, the access request is authorized and released, and data collection is performed on the API used by the user.

[0052] Specifically, this solution will first determine whether the user access request is abnormal, and perform identity authentication, trust assessment, and risk assessment on the user. User access requests that fail any one of the three or more of the three are considered abnormal. For non-abnormal users, the corresponding user permissions are determined based on the user identity information, and the access request is authorized and released. This authorization includes business access authorization and API access authorization. In a specific application scenario, assuming that the user has two accounts, admin1 and admin2, the permission allocation examples for these two accounts are as follows:

[0053] admin1(g1_5), that is, account admin1 has access to data of level 5 and below in category g1;

[0054] admin2(g1_10,g2_10): Account admin2 has access to data at level 10 of category g1 and data at level 10 and below of category g2.

[0055] The authorization content examples of the two accounts are as follows:

[0056] admin1 authorization content is:

[0057]

[0058]

[0059] In a specific application scenario, all HTTP requests from users to access the server can be completed through the API gateway. The API gateway parses the business and API path that the user currently wants to access based on the HTTP header information, first checks the user's business access authorization and API access authorization, and releases the request after passing. However, it should be noted that the above-mentioned API gateway is only a specific implementation method in this application. Those skilled in the art can flexibly choose to set up different hardware to execute the above-mentioned solution, which does not affect the scope of protection of this application.

[0060] Step S102: convert the format of the collected data to obtain first data.

[0061] Specifically, in order to facilitate the classification and grading of permissions, the collected data needs to be formatted. This format conversion is essentially a structured parsing into a preset format. The preset format is flexibly set by those skilled in the art based on actual conditions to facilitate annotation. For example, when the return data type is "application / json", it can be restored to a json data structure. The example is as follows:

[0062] Before conversion:

[0063]

[0064]

[0065] After conversion:

[0066]

[0067] It should be noted that the above format is only an example in this specification. The preset format is set for the convenience of annotation. Those skilled in the art can flexibly set it according to the actual application scenario, which does not affect the scope of protection of this application.

[0068] Step S103: perform permission classification and grading annotation on the first data according to a preset annotation model and user permissions.

[0069] In an embodiment of the present application, the preset labeling model is specifically a neural network model trained by a training data set, and the neural network model is established based on a classification and grading standard library and approximate attribute names.

[0070] The performing permission classification and grading labeling on the first data according to the preset labeling model and user permissions specifically includes:

[0071] Determining a permission classification and grading strategy based on the user permissions;

[0072] The first data is labeled with permission classification and grading according to the permission classification and grading strategy using the preset labeling model.

[0073] Specifically, a neural network model can be established in advance based on a classification and grading standard library and approximate attribute names, and then the neural network model can be trained using a pre-collected training data set to make the output results of the neural network model more accurate. The corresponding hierarchical classification strategy is determined based on the user permissions determined above. After obtaining the classification and grading strategy, the preset labeling model performs permission classification and grading labeling on the first data according to the strategy.

[0074] In order to make the permission classification and grading annotation more accurate, in an embodiment of the present application, the method further includes sending the permission classification and grading annotation to an administrator so that the administrator can check the permission classification and grading annotation.

[0075] Specifically, the administrator can check and adjust the completed permission classification and grading annotations by logging into the account. At the same time, the preset annotation model can also learn based on the permission classification and grading annotations adjusted by the administrator to make its own annotation results more accurate.

[0076] Step S104: Return the requested data to the user based on the user access request and the permission classification and grading annotation.

[0077] Specifically, the corresponding request data is obtained in the corresponding server according to the user access request. At the same time, the request data is selectively returned to the user according to the permission classification and grading labeling. The processing of the request data can be achieved through the API gateway, but this application is not limited to specific execution hardware or software. Those skilled in the art can flexibly set it according to actual conditions, which does not affect the scope of protection of this application.

[0078] In order to return the requested data to the user more accurately and quickly, in an embodiment of the present application, the request data is returned to the user based on the user access request and the permission classification and grading annotation, specifically:

[0079] Acquiring request data according to the user access request;

[0080] Converting the requested data into the format to obtain second data;

[0081] Desensitizing the data in the second data that exceeds the permission level according to the permission classification and hierarchical labeling;

[0082] The desensitized second data is sent to the user.

[0083] Specifically, after obtaining the request data from the server according to the user access request, the request data will first be converted into the second data in the above-mentioned preset format, and then the second data exceeding the permission level will be desensitized according to the permission classification and classification labeling. In a specific application scenario, it is assumed that the specific example of the requested request data is as follows:

[0084]

[0085]

[0086] Then the second data example after desensitization is as follows:

[0087]

[0088] After the above processing, the security protection cost during data access can be reduced, and the flexibility and accuracy of security protection can be greatly improved.

[0089] Based on the above-mentioned data security access method, one or more embodiments of this specification also provide a platform and terminal for data security access. The platform or terminal may include devices, software, modules, plug-ins, servers, clients, etc. that use the methods described in the embodiments of this specification and are combined with necessary hardware implementation devices. Based on the same innovative concept, the system in one or more embodiments provided in the embodiments of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the system are similar, the implementation of the specific system in the embodiments of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. The terms "unit" or "module" used below can be a combination of software and / or hardware that implements the predetermined functions. Although the system described in the following embodiments is preferably implemented in software, hardware and a combination of software and hardware are also possible and conceived.

[0090] Specifically, Figure 2 This is a schematic diagram of the module structure of an embodiment of the data security access device provided in this specification. Figure 2 As shown, the data security access device provided in this manual includes:

[0091] The response module 201 is used to collect data on the API used by the user in response to the user's access request;

[0092] The conversion module 202 is used to convert the format of the collected data to obtain first data;

[0093] A labeling module 203 is configured to label the first data according to permission classification and grading based on a preset labeling model and user permissions;

[0094] The return module 204 is configured to return the requested data to the user based on the user access request and the permission classification and grading annotation.

[0095] It should be noted that the above-mentioned system may also include other implementation methods according to the description of the corresponding method embodiment. The specific implementation methods can refer to the description of the above-mentioned corresponding method embodiment, and will not be described one by one here.

[0096] An embodiment of the present application further provides an electronic device, including:

[0097] processor;

[0098] a memory for storing instructions executable by the processor;

[0099] The processor is configured to execute the method provided in the above embodiment.

[0100] The electronic device provided in the embodiment of the present application stores executable instructions of the processor in a memory. When the processor executes the executable instructions, it can collect data from the API used by the user; then convert the collected data into a first data format; then classify and grade the first data according to a preset labeling model and user permissions; finally, return the requested data to the user based on the user access request and the permission classification and grading labeling, which can greatly reduce the cost of data security protection and effectively improve the flexibility and accuracy of security protection.

[0101] The method embodiments provided in the embodiments of this specification can be executed in a mobile terminal, a computer terminal, a server or a similar computing device. Taking running on a server as an example, Figure 3 This is a hardware block diagram of a data security access server in one embodiment of this specification. The computer terminal may be the data security access server or data security access device in the aforementioned embodiments. It may include one or more (only one is shown) processors 100 (processor 100 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a non-volatile memory 200 for storing data, and a transmission module 300 for communication functions.

[0102] The non-volatile memory 200 can be used to store software programs and modules of application software, such as the program instructions / modules corresponding to the data security access method in the embodiments of this specification. The processor 100 executes various functional applications and resource data updates by running the software programs and modules stored in the non-volatile memory 200. The non-volatile memory 200 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the non-volatile memory 200 may further include a memory remotely located relative to the processor 100, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0103] The transmission module 300 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by a communications provider of a computer terminal. In one embodiment, the transmission module 300 includes a network interface controller (NIC) that can connect to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission module 300 may be a radio frequency (RF) module configured to communicate with the Internet wirelessly.

[0104] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] The methods or devices described in the above embodiments of this specification can implement business logic through computer programs and record them on storage media. The storage media can be read and executed by a computer to achieve the effects of the solutions described in the embodiments of this specification, such as:

[0106] In response to user access requests, collect data on the APIs used by users;

[0107] Converting the collected data into a first format;

[0108] Performing permission classification and grading annotation on the first data according to a preset annotation model and user permissions;

[0109] The requested data is returned to the user based on the user access request and the permission classification and grading annotation.

[0110] The storage medium may include a physical device for storing information, typically digitizing the information and then storing it in a medium utilizing electrical, magnetic, or optical means. Examples of such storage media include: devices that store information electrically, such as various types of memory devices like RAM and ROM; devices that store information magnetically, such as hard disks, floppy disks, magnetic tapes, magnetic core memories, bubble memories, and USB flash drives; and devices that store information optically, such as CDs and DVDs. Of course, other types of readable storage media exist, such as quantum memories and graphene memories.

[0111] The embodiments of this specification are not limited to those that must comply with industry communication standards, standard computer resource data update and data storage rules, or the situations described in one or more embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the embodiments using custom methods or embodiments can also achieve the same, equivalent, or similar implementation effects as the above embodiments, or the expected implementation effects after deformation. The embodiments obtained by applying these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of the embodiments of this specification.

[0112] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel ATMEL AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in pure computer-readable program code, the controller can also be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing various functions included therein can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0113] The device embodiments described above are merely illustrative. For example, the division of units described is merely a logical functional division. Actual implementations may employ alternative divisions, such as combining or integrating multiple units or plug-ins into another system, or omitting or disabling certain features. Furthermore, the coupling or direct coupling or communication connection shown or discussed between devices or units may be through interfaces, or indirect coupling or communication connection between devices or units may be electrical, mechanical, or otherwise.

[0114] These computer program instructions can also be loaded onto a computer or other programmable resource data updating device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0115] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referenced to the partial description of the method embodiment. In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in an appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0116] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.

Claims

1. A data security access method, characterized in that: The method comprises: In response to user access requests, collect data on the APIs used by users; Converting the collected data into a first format; Determine the permission classification and grading strategy based on user permissions; Performing permission classification and grading annotation on the first data according to the permission classification and grading strategy using a preset annotation model; Returning the requested data to the user based on the user access request and the permission classification and grading annotation; The preset annotation model is specifically a neural network model trained by a training data set, and the neural network model is established based on a classification and grading standard library and approximate attribute names; Also includes: The permission classification and grading annotations are sent to an administrator so that the administrator can check the permission classification and grading annotations.

2. The data security access method according to claim 1, wherein: The responding to the user access request specifically includes: Determining whether the user access request is abnormal; If so, the user's access request is denied; If not, the user authority is determined, and after determining the user authority, the access request is authorized and released, and data collection is performed on the API used by the user.

3. The data security access method according to claim 1, wherein: The method of returning the requested data to the user based on the user access request and the permission classification and grading annotation is specifically as follows: Acquiring request data according to the user access request; Converting the requested data into the format to obtain second data; Desensitizing the data in the second data that exceeds the permission level according to the permission classification and hierarchical labeling; The desensitized second data is sent to the user.

4. The data security access method according to claim 3, wherein: The format conversion is specifically structured parsing into a preset format.

5. A data security access device, characterized in that: The device comprises: The response module is used to collect data on the API used by the user in response to the user's access request; A conversion module, configured to convert the format of the collected data to obtain first data; A labeling module is used to determine a permission classification and grading strategy based on user permissions; and to label the first data according to the permission classification and grading strategy using a preset labeling model; A return module, configured to return the requested data to the user based on the user access request and the permission classification and grading annotation; The preset annotation model is specifically a neural network model trained by a training data set, and the neural network model is established based on a classification and grading standard library and approximate attribute names; Also includes: The permission classification and grading annotations are sent to an administrator so that the administrator can check the permission classification and grading annotations.

6. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the method according to any one of claims 1 to 4.

Images