Data security protection method, data security management platform, system and storage medium

Abstract

The embodiments of the present application relate to the field of data management technology, and disclose a data security protection method, a data security management platform, a system, and a storage medium. The method comprises: calling a probe to collect first data, wherein the first data is a ciphertext of the business data of a data supplier encrypted with a first quantum key negotiated by a data security management platform; decrypting the first data transmitted via a first IPsec according to a shared first quantum key to obtain business data; encrypting the business data with a second quantum key to generate second data and storing it in a quantum trusted cloud; if a request for use of the business data is received from a data regulator and / or a data demander, decrypting the second data with a shared second quantum key to obtain the business data, encrypting the business data during the calculation process using an integrated key application system, and sharing the calculation result with the data regulator and / or the data demander via a second IPsec, thereby providing security protection for the data throughout its life cycle.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data management technology, and in particular to a data security protection method, a data security management platform, a system and a storage medium. Background Art

[0002] With the rapid development of communication technology and Internet technology, government, banks, factories, schools, research institutes and other institutions and organizations have achieved networking, informatization and data upgrades. All data related to industry, commerce, telecommunications, transportation, finance, natural resources, health, education and technology need to be transmitted and shared on the network. The implementation of the "Data Security Law of the People's Republic of China" requires all regions and departments to be responsible for the data and data security collected and generated in the work of their regions and departments, and to carry out strict data security management for data related to industry, commerce, telecommunications, transportation, finance, natural resources, health, education and technology.

[0003] However, the inventors of this application have discovered that the data security management systems commonly used in the industry simply encrypt the data that needs to be securely managed according to a preset key, and then store, transmit, and share it. Users who need to view and use this data can view and use this data after identity verification. The security management level is relatively low and the protection is relatively weak. The data still faces the risk of being stolen and leaked. Summary of the invention

[0004] The purpose of the embodiments of the present application is to at least provide a data security protection method, a data security management platform, a system and a storage medium, at least to solve the problems of low data security management level and weak data security protection, and at least to provide security protection for data throughout its life cycle, greatly reducing the risk of data theft and leakage.

[0005] At least one embodiment of the present application provides a data security protection method, which is applicable to a data security management platform, wherein the data security management platform is connected to a data supplier, a data supervisor, and a data demander, respectively, and the method includes the following steps: calling a probe to collect first data from the data supplier, wherein the first data is the ciphertext of the business data of the data supplier encrypted by the first quantum key negotiated by the data security management platform; decrypting the first data securely transmitted via the first IPsec according to the shared first quantum key to obtain the business data; encrypting the business data using the second quantum key to generate second data, and storing it in a quantum trusted cloud; if a request for use of the business data is received from the data supervisor and / or the data demander, decrypting the second data using the shared second quantum key to obtain the business data, encrypting the business data during the calculation process using an integrated key application system, and sharing the calculation result to the data supervisor and / or the data demander via the second IPsec.

[0006] At least one embodiment of the present application also provides a data security management platform, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned data security protection method.

[0007] At least one embodiment of the present application further provides a data security management system, including the above-mentioned data security management platform.

[0008] At least one embodiment of the present application further provides a computer-readable storage medium storing a computer program, wherein the computer program implements the above-mentioned data security protection method when executed by a processor.

[0009] At least one embodiment of the present application proposes a data security protection method, a data security management platform, a system and a storage medium. The data security management platform calls a probe to collect the first data of the data supplier. The first data is the ciphertext of the business data of the data supplier encrypted by the first quantum key negotiated by the data security management platform. The first data is securely transmitted to the data security management platform via the first IPsec. The data security management platform decrypts the first data according to the shared first quantum key to obtain the business data, and then uses the second quantum key to encrypt the business data to generate second data, and stores the generated second data in the quantum trusted cloud. If a request for the use of the business data is received from the data regulator and / or the data demander, the data security management platform uses the shared second quantum key to decrypt the second data to obtain the business data, and uses the integrated key application system provided by the quantum trusted cloud to encrypt the business data during the calculation process, and shares the calculation result to the data regulator and / or the data demander via the second IPsec. Considering that the industry only uses preset keys to simply encrypt data before transmission, the security management level is relatively low and the protection is relatively weak. In the embodiments of the present application, the data security management platform can provide security protection for data collection, transmission, storage, use, and sharing throughout the entire life cycle. Quantum encryption technology with a higher security level and stronger protection is used for encryption throughout the process, which greatly reduces the risk of data being stolen and leaked, and ensures that the data is reliable, trustworthy, and traceable.

[0010] In some optional embodiments, the data supplier is provided with a first quantum security gateway encapsulating a first security agent, and the data security management platform is provided with a probe deployed on the data supplier side, and the calling of the probe to collect the first data of the data supplier includes: initiating a return data collection request to the data supplier, wherein the data supplier obtains the return data of the business data by means of traffic replication or splitting, and the first security agent encrypts the return data with the first quantum key provided by the first quantum all-in-one machine to form the first data; calling the probe to collect the first data of the data supplier at a preset position of the data supplier's network, wherein the preset position includes a network exit, a security center, a core switching area, a business access area, a database server, and / or a government cloud.

[0011] In some optional embodiments, the data security management platform is also provided with a second quantum security gateway encapsulating a second security agent, and the decryption of the first data securely transmitted via the first IPsec based on the shared first quantum key includes: the second security agent obtains the shared first quantum key from the quantum all-in-one machine, wherein the second security agent and the first security agent share the first quantum key under negotiation with the data security management platform; the first data securely transmitted via the first IPsec is decrypted using the first quantum key to obtain the business data of the data supplier, wherein the data supplier is connected to the data security management platform via the first quantum security gateway and the second quantum security gateway, and the first quantum security gateway and the second quantum security gateway establish a bidirectional SA in the physical link between the data supplier and the data security management platform to provide an encrypted transmission channel first IPsec.

[0012] In some optional embodiments, the encrypting the business data using the second quantum key to generate the second data includes: the second security agent encrypts the business data using the second quantum key to generate the second data, and stores the second data in the first space of the data warehouse ODS layer, wherein the data warehouse of the data security management platform is built on the quantum trusted cloud, the data warehouse includes an ODS layer for storing original data, and the ODS layer includes a first space and several second spaces; the second security agent encrypts the business data using the fifth quantum key to generate disaster recovery data, and stores the disaster recovery data in any one of the second spaces, wherein the disaster recovery data is data disaster recovery of the second data.

[0013] In some optional embodiments, the data security management platform is further provided with a third security agent. After storing the second data in the ODS layer, the method further includes: if the second quantum key meets the preset update condition, decrypting the second data using the second quantum key shared by the third security agent to obtain the business data, wherein the third security agent and the second security agent share the second quantum key under negotiation with the data security management platform, and the update condition includes that the second quantum key has not been updated for a period exceeding a preset security period, and that the second quantum key has a security risk; encrypting the business data using the updated third quantum key to generate third data and storing it in the ODS layer.

[0014] In some optional embodiments, the encryption of the business data calculated using an integrated key application system includes: obtaining a quantum root key based on a request for use of the business data by the data regulator and / or the data demander, wherein the quantum root key is obtained by the third security agent from a quantum all-in-one machine; executing a virtual machine participating in the calculation of the business data, the third security agent using a quantum derivative key derived from the quantum root key to perform encryption calculations, wherein the quantum derivative key is derived by integrating the quantum root key and the ID of the virtual machine using a KDF function.

[0015] In some optional embodiments, a fourth security agent is deployed on the side of the data supervisor and / or the data demander, and the sharing of the calculation result to the data supervisor and / or the data demander via the second IPsec includes: if the data supervisor and / or the data demander requests to view the calculation result, the data supervisor and / or the data demander is authenticated, wherein the data security management platform pre-stores the first authentication data of the data supervisor and / or the data demander, and the first authentication data is the ciphertext of the account and password of the data supervisor and / or the data demander encrypted with the fourth quantum key negotiated by the data security management platform, and the third security agent provides the fourth quantum key; the identity authentication includes: using the fourth quantum key provided by the fourth security agent to encrypt the account and password in the authentication application of the data supervisor and / or the data demander to generate the second authentication data, wherein the The fourth security agent and the third security agent share the fourth quantum key under negotiation with the data security management platform; check the second authentication data and the first authentication data, if the second authentication data is consistent with the first authentication data, the identity authentication of the data supervisor and / or the data demander is passed; when the identity authentication of the data supervisor and / or the data demander is passed, the calculation result securely transmitted via the second IPsec is decrypted using the quantum derived key to obtain business analysis, wherein an encrypted transmission channel second IPsec is established on the physical link between the data security management platform and the data supervisor and / or the data demander, the fourth security agent and the third security agent share the quantum root key under negotiation with the data security management platform, and the data supervisor and / or the data demander integrates the quantum root key and the ID of the virtual machine using the KDF function to derive the quantum derived key. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0017] Figure 1 It is an application schematic diagram of a data security management system proposed in this application;

[0018] Figure 2 It is a hardware environment diagram of a data security management system proposed in this application;

[0019] Figure 3 It is a schematic diagram of the method of data supplier accessing the network structure proposed in this application;

[0020] Figure 4 is a flow chart of a data security protection method provided by some embodiments of the present application;

[0021] Figure 5 is a flow chart of a data security management platform calling a probe to collect first data from a data supplier in some embodiments of the present application;

[0022] Figure 6 is a schematic diagram of a process for constructing a quantum key tree provided in some embodiments of the present application;

[0023] Figure 7 is a schematic diagram of the architecture of a quantum trusted cloud provided in some embodiments of the present application;

[0024] Figure 8 It is a schematic diagram of a storage process of an ODS layer of a data warehouse provided in some embodiments of the present application;

[0025] Fig. 9 It is a schematic diagram of a business data calculation process provided in some embodiments of the present application. DETAILED DESCRIPTION

[0026] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the present application, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is for the convenience of description, and the specific implementation of the present application should not be construed as any limitation, and the various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0028] The purpose of this application is to provide users with a data security management system that is knowable, visible, and controllable. The system is centered on "data" and uses quantum-derived keys to achieve trusted circulation of data collection, transmission, storage, use, sharing, and disaster recovery. Users can monitor and analyze the data flow process and trace data leakage, thereby providing knowable, visible, and controllable support services. Figure 1 As shown, the data security management platform is connected to the data supplier, data regulator, and data demander respectively. The data security management platform, data supplier, data demander, and data regulator are all connected to the QKD network (Quantum Key Distribution) through the middleware. The middleware provides applications with quantum security capabilities to the user side through the cryptographic service interface based on the quantum key obtained from the QKD network. The quantum security capabilities include quantum keys, encryption algorithms, and cryptographic protocols. The middleware includes: a middleware platform and a security agent. The middleware platform is connected to the security agent for centralized management and control of the security agent; the security agent is used to obtain quantum keys provided for ICT (information and communications technology) applications from the QKD network, and to provide key factors or key vectors to the key engine through the cryptographic service interface.

[0029] The overall network architecture of the data security management system is divided into a core layer and a convergence layer. The hardware environment of the data security management system is as follows: Figure 2As shown in the figure, the core layer corresponds to the centralized control station of the quantum network, including the quantum key management service system server and the quantum network element management system. The quantum key management service system server is used to realize the management of all quantum devices in the quantum network, quantum key generation control and quantum key routing control. The quantum network element management system is used to accept the management of the quantum network element management system through the EMS northbound interface to realize the management function of quantum devices at all sites in the quantum network. The centralized control station can use dual-fiber links to complete the export connection between the metropolitan area network and the backbone network equipment, and the downstream connection is connected to the user node through the external network switch. The centralized control station is mainly responsible for connecting the backbone network, the convergence of the business control layer equipment within the metropolitan area network, and the large-capacity and high-speed forwarding of messages between the nodes of the network. The aggregation layer corresponds to the aggregation station and user station of the quantum network. The aggregation station can be divided into the classical network external network area (used for interconnection between Ethernet service data points) and the quantum device network area (used to realize quantum key transmission between stations, as well as the exchange of keys and command information between the quantum gateway and the key management machine within the station). The data supplier in the user station deploys quantum key generation and management terminals (such as quantum all-in-one machines) and realizes quantum key distribution with quantum key distribution devices (such as quantum all-in-one machines, single-receive quantum key distribution devices QKD-B) through optical quantum switches, and realizes functions such as quantum key management and relay.

[0030] The data provider in the user station adopts a dual-fiber mode, which is used for quantum optical channels ( Figure 2 The dashed line in the middle) and the quantum classical channel ( Figure 2 The data provider accesses the quantum network via a quantum secure encryption router, the quantum all-in-one machine (or a single-shot quantum key generation and management terminal) is connected to the centralized control station via a quantum optical channel, and the user access switch is connected to the centralized control station via a quantum classical channel. The quantum encryption router can encapsulate a first middleware, which includes a middleware platform and a first security agent. The first security agent (such as Figure 2 The first quantum security gateway of the user station in the middle) is used to encapsulate quantum keys into standard security capabilities, including keys, algorithms, cryptographic protocols, etc., and provide user nodes with identity authentication, key negotiation, cryptographic operations, key management and other functions in the form of standard APIs. The middleware platform can be encapsulated in the data security management platform to centrally manage and control the first security agent, introduce the traffic that needs to be securely transmitted into the quantum encryption router through static routing or policy routing, complete traffic encryption and introduce the ciphertext traffic into the quantum security transmission channel, and the ciphertext traffic is sent to the target node according to the external network route. Figure 3 A way for a data supplier to access a network structure is shown.

[0031] In the above-mentioned software and hardware environment, at least one embodiment of the present application proposes a data security protection method, which is applicable to a data security management platform. The data security management platform is respectively connected to a data supplier, a data supervisor, and a data demander. The implementation details of the data security protection method of this embodiment are described in detail below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this solution.

[0032] The specific process of the data security protection method of this embodiment can be as follows: Figure 4 It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here, including:

[0033] Step 101, call the probe to collect the first data of the data supplier. The first data is the ciphertext of the business data of the data supplier encrypted with the first quantum key negotiated by the data security management platform. Here, the data security management platform is provided with a probe deployed on the data supplier side. When the collection conditions are met, the data security management platform can call the probe to collect the first data of the data supplier. The first data collected by the probe is the ciphertext of the business data of the data supplier encrypted with the first quantum key negotiated by the data security management platform. Assuming that a third party maliciously invades the probe and steals the first data, but the third party cannot steal the first quantum key, it is impossible to decrypt the first data, so the business data of the data supplier will not be stolen, and the data collection process is strongly protected. Among them, calling the probe to collect the first data of the data supplier is performed periodically, and the collection condition can be reaching a preset collection time.

[0034] In some embodiments, the data supplier is provided with a first quantum security gateway encapsulating a first security agent, and the data security management platform can encapsulate a middleware platform. The data security management platform is provided with a probe deployed on the data supplier side. The data security management platform calls the probe to collect the first data of the data supplier, which can be done as follows: Figure 5 The implementation of each sub-step shown includes:

[0035] Sub-step 1011, initiating a return data collection request to the data supplier.

[0036] For example, when the data security management platform needs to obtain the business data of the data supplier, it can initiate a return data collection request to the data supplier. The data supplier obtains the return data of the business data through traffic replication or splitting, and uses the first security agent to obtain the first quantum key from the first quantum all-in-one machine to encrypt the return data to form the first data.

[0037] In some embodiments, the return data belongs to layer 2 Ethernet frame data traffic.

[0038] In some embodiments, the data supplier uses a first quantum key to encrypt the returned data through a first security agent to form the first data. For example, the quantum root key KQ corresponding to the returned data can be obtained from the first security agent. Then, the first security agent uses a KDF function (Key derivation function) based on the quantum root key KQ, combined with a user ID (data supplier ID), a business ID, a level or process ID, and the IDs of each node in the flow process, to derive an integrity key KQU enc and an encryption key KQU int. The first security agent encrypts the returned data based on KQU enc and KQU int to generate the first data. Figure 6 The construction process of the quantum key tree is output.

[0039] In some embodiments, the returned data may be ICT business data such as the Internet of Things and the Internet of Vehicles, or cloud application data, or security log information of systems and security devices.

[0040] Sub-step 1012: calling a probe to collect first data of the data supplier at a preset location of the data supplier network.

[0041] For example, the data security management platform can use probes to collect the first data of the data supplier at a preset location of the data supplier's network. The preset location may include a network exit, a security center, a core switching area, a business access area, a database server, and / or a government cloud, etc.

[0042] In some embodiments, the probe is a programmable matrix device unit, and all ports support traffic access and traffic control output. It accepts unified management of the wavelength division convergence unit based on the Openflow interface or the NETCONF interface, and can realize traffic input, classification identification output, and load balancing output. The probe also supports VxLAN stripping processing, label stripping, timestamps, and tunnel protocol identification. The probe can also introduce advanced SDN architecture for bypass traffic data management, and can form a complete traffic scheduling data delivery network by self-organizing. The probe also has a wealth of selection conditions for pre-processing operations such as extraction, classification, and priority allocation of traffic, and has the ability to call the first security agent for encryption.

[0043] In some embodiments, the probe involved in the embodiments of the present application may be any device or component with a probe function, and is not limited to ordinary probes in a narrow sense. The probe involved in the embodiments of the present application may also be a sandbox, database audit, intrusion detection system, cloud analysis component, cloud control center, etc.

[0044] Step 102: Decrypt first data securely transmitted via the first IPsec according to the shared first quantum key to obtain business data.

[0045] For example, after the data security management platform calls the probe to collect the first data of the data supplier, the first data can be securely transmitted to the data security management platform through the first IPsec (Internet Protocol Security), and the data security management platform decrypts the first data according to the shared first quantum key to obtain the business data. The data security protection method proposed in this application not only provides protection in the data collection stage, but also provides strong protection through IPsec in the data transmission stage, further reducing the risk of data theft and leakage.

[0046] In some embodiments, the data security management platform is also provided with a second quantum security gateway, and the second quantum security gateway can encapsulate a second security agent inside, so that the second quantum security gateway (second security agent) and the first quantum security gateway (first security agent) of the data supplier can share the first quantum key under the negotiation of the data security management platform (with a middleware platform encapsulated inside), that is, the middleware platform can centrally manage and control the first security agent and the second security agent. The data supplier is connected to the data security management platform via the first quantum security gateway and the second quantum security gateway. The first quantum security gateway corresponds to the data supplier, and the second quantum security gateway corresponds to the data security management platform. The first quantum security gateway and the second quantum security gateway establish a bidirectional SA (Security Association) in the physical link between the data supplier and the data security management platform to provide an encrypted transmission channel first IPsec. The data security management platform obtains the shared first quantum key from the second quantum security gateway, and uses the first quantum key to decrypt the first data securely transmitted via the first IPsec, thereby obtaining the business data of the data supplier.

[0047] In some embodiments, IPsec is an open standard security framework structure that can be used to ensure the confidentiality, integrity and anti-replay of data transmitted on the network. It uses two security protocols, AH protocol (Authentication Header protocol) and ESP protocol (Encapsulating Security Payload protocol) to achieve secure data transmission. IPsec also uses IKE protocol (Internet key exchange protocol) to negotiate keys and establish and maintain SA.

[0048] In some embodiments, the IPsec configuration process includes sequentially configuring network reachability, configuring ACLs (Access Control Lists) to identify interest flows, creating security proposals, creating security policies, and applying security policies.

[0049] In some embodiments, the code implementation of IPsec configuration is as follows:

[0050] "[RTA]ip route-static 10.1.2.0 24 20.1.1.2 static route to RTB

[0051] [RTA] acl number 3001 creates an access control list

[0052] [RTA-acl-dev-3001]rule 5permit ip source 10.1.1.0 0.0.0.255

[0053] Destination 10.1.2.0 0.0.0.255 allows the 1.0 network segment to go to the destination 2.0 network segment

[0054] [RTA]ipsec proposal tran 1 creates a security protocol named tran 1

[0055] [RTA-ipsec-proposal-tran1]esp authentication-algorithm sha1

[0056] Using sha1 encryption algorithm

[0057] [RTA]ipsec policy P1 10manual configures the ipsec policy named P1 10 in manual mode

[0058] [RTA-ipsec-policy-manual-P1-10] security acl 3001 encryption for security acl 3001

[0059] [RTA-ipsec-policy-manual-P1-10]proposal tran1 uses the full proposal of tran1

[0060] [RTA-ipsec-policy-manual-P1-10]tunnel remote 20.1.1.2 The remote address of the tunnel is 20.1.1.2

[0061] [RTA-ipsec-policy-manual-P1-10]tunnel local 20.1.1.1 The local address of the tunnel is 20.1.1.1

[0062] [RTA-ipsec-policy-manual-P1-10] sa spi outbound esp 54321 The security index outbound direction is 54321

[0063] [RTA-ipsec-policy-manual-P1-10] sa spiinbound esp 12345 security index inbound direction is 12345

[0064] [RTA-ipsec-policy-manual-P1-10]sa string-key outbound esp simple Hua Configure the outbound key of ike to Hua

[0065] [RTA-ipsec-policy-manual-P1-10]sa string-key inbound esp simple Hua configures the key for the inbound direction of ike to be Hua

[0066] [RTA-ipsec-policy-manual-P1-10]quit interface GigabitEthernet 0 / 0 / 1 to enter 0 / 0 / 1 interface view

[0067] [RTA-gigabitEthernet0 / 0 / 1]ipsec policy P1 applies the ipsec policy to the interface

[0068] [RTA-gigabitEthernet0 / 0 / 1]quit".

[0069] Step 103: Use the second quantum key to encrypt the business data to generate second data, and store it in the quantum trusted cloud.

[0070] Here, after the data security management platform obtains the business data, it can store the business data. The data security management platform uses the second quantum key to encrypt the business data to generate the second data, and stores it in the quantum trusted cloud. That is, in the data storage stage, the quantum trusted cloud that supports quantum key encrypted storage encrypts and stores the business data, which effectively protects the business data stored in the data security management platform and prevents data leakage. In some embodiments, the quantum trusted cloud is the same as the traditional cloud platform in terms of architectural composition. Its differentiation is that the middleware security agent is connected to the security management module of the cloud platform, and an integrated key application management and control system is used to provide corresponding security infrastructure guarantees for computing encryption, storage encryption, and network encryption. In other words, the quantum trusted cloud can provide an encrypted storage solution based on quantum keys, support encryption of various types of storage resources such as volume storage, object storage, and file storage, realize the security and controllability of the data storage process, prevent data leakage, and the encrypted data only interacts within a specified range. The architecture of the quantum trusted cloud can be as follows Figure 7 shown.

[0071] In some embodiments, the data security management platform is provided with a second quantum security gateway, and the second security agent encapsulated in the second quantum security gateway is connected to the security management module of the cloud platform, and an integrated key application management and control system is used for computing encryption, storage encryption, and network encryption, providing corresponding security infrastructure guarantees. The data security management platform encrypts the business data with the second quantum key obtained by the second security agent to generate second data, and stores the second data in the first space of the data warehouse ODS layer (Operational Data Store, original data layer). The data warehouse of the data security management platform is built on the quantum trusted cloud, and the data warehouse includes an ODS layer for storing original data, and the ODS layer includes a first space and several second spaces. In addition to the ODS layer, the data warehouse also includes a DWD layer (Data Warehouse Detail, detailed single data layer), a DWS layer (Data Warehouse Summary, aggregated data layer), a CDS layer (Common Data Model, common dimension layer), etc. In addition to storing the second data in the first space of the data warehouse ODS layer, the data security management platform can also encrypt the business data through the fifth quantum key obtained by the second security agent to generate disaster recovery data, and store the disaster recovery data in any second space of the data warehouse ODS layer. The disaster recovery data is data disaster recovery for the second data, which not only realizes data disaster recovery, but also provides strong protection for the data disaster recovery process.

[0072] In some embodiments, the ODS layer of the data warehouse is a distributed architecture, and a Hadoop+MPP hybrid architecture solution can be used. Different storage strategies are used according to different data types to provide structured, semi-structured, and unstructured data storage capabilities. The storage process of the ODS layer of the data warehouse can be as follows: Figure 8 shown.

[0073] In some embodiments, in addition to the second security agent, the data security management platform is also provided with a third security agent. The third security agent and the second security agent can share the second quantum key under the negotiation of the data security management platform (with a middleware platform encapsulated inside), that is, the data security management platform can centrally manage and control the first security agent, the second security agent, and the third security agent. After storing the second data in the ODS layer of the data warehouse, the data security management platform can determine whether the second quantum key meets the preset update conditions. The preset update conditions include that the time when the second quantum key has not been updated exceeds the preset security time, and the second quantum key has security risks (such as being attacked). If the second quantum key meets the preset update conditions, the data security management platform uses the second quantum key shared by the third security agent to decrypt the second data to obtain business data, and then uses the updated third quantum key to encrypt the business data to generate third data and store it in the ODS layer of the data warehouse, thereby further ensuring the security of data storage.

[0074] Step 104: If a request for the use of business data is received from a data regulator and / or data demander, the second data is decrypted using a shared second quantum key to obtain the business data, and the business data is encrypted during the calculation process using an integrated key application system, and the calculation result is shared with the data regulator and / or data demander via the second IPsec.

[0075] Here, the data security management platform can monitor in real time whether it has received a request for the use of business data from the data supervisor and / or data demander. After receiving the request for the use of business data from the data supervisor and / or data demander, the data security management platform can use the shared second quantum key to decrypt the second data stored in the quantum trusted cloud to obtain business data, and then use the integrated key application system to encrypt the business data during the calculation process, and share the calculation results to the data supervisor and / or data demander via the second IPsec. The data use (calculation) process is protected by the integrated key application system, and the data sharing process is protected by the second IPsec. In other words, the data security management platform completes the protection of the entire life cycle of data collection, transmission, storage, use, and sharing, and uses quantum encryption technology with a higher security level and stronger protection for encryption throughout the process, which greatly reduces the risk of data being stolen and leaked, and realizes data reliability, trustworthiness, and traceability.

[0076] In some embodiments, the data security management platform is provided with a third security agent. When the data security management platform uses an integrated key application system to encrypt the business data during the calculation process, the quantum root key is first obtained according to the data supervisor and / or data demander's request for the use of the business data. The quantum root key is obtained by the third security agent from the quantum all-in-one machine, and then the virtual machine participating in the calculation of the business data is executed. The third security agent uses the quantum derivative key derived from the quantum root key to perform encryption calculations, wherein the quantum derivative key is derived by integrating the quantum root key and the ID of the virtual machine using the KDF function. The calculation process of the business data can be as follows: Fig. 9 shown.

[0077] In some embodiments, in addition to the third security agent, the data security management platform also deploys a fourth security agent on the side of the data supervisor and / or data demander. The data security management platform pre-stores the first authentication data of the data supervisor and / or data demander. The first authentication data is the ciphertext of the account and password of the data supervisor and / or data demander encrypted by the fourth quantum key negotiated by the data security management platform. The third security agent and the fourth security agent share the fourth quantum key under the negotiation of the data security management platform. When performing identity authentication, the data security management platform uses the fourth quantum key deployed on the side of the data supervisor and / or data demander to encrypt the account and password in the authentication application of the data supervisor and / or data demander to generate the second authentication data, and checks the second authentication data and the first authentication data. If the second authentication data is consistent with the first authentication data, it is determined that the identity authentication of the data supervisor and / or data demander is passed. When the data supervisor and / or data demander passes the identity authentication, the data security management platform uses the quantum derived key to decrypt the calculation result transmitted securely via the second IPsec to obtain business analysis, wherein the physical link between the data security management platform and the data supervisor and / or data demander establishes an encrypted transmission channel second IPsec, and the data supervisor and / or the data demander uses the KDF function to integrate the quantum root key and the ID of the virtual machine to derive the quantum derived key. The second IPsec is similar to the first IPsec, and will not be repeated here.

[0078] In some embodiments, depending on the above environment, the data warehouse can process the business data as follows:

[0079] The DWD layer uses ETL tools (Extract-Transform-Load) to regularly filter data, standardize data types, aggregate and unify data, deduplicate data, migrate data, synchronize data, enhance extraction, perform database searches, and check data quality.

[0080] For example, the industrial data of industrial enterprises are classified into: R&D data domain (R&D design data, development and testing data, etc.), production data domain (control information, operating status, process parameters, system logs, etc.), operation and maintenance data domain (logistics data, product after-sales service data, etc.), management data domain (system equipment asset information, customer and product information, product supply chain data, business statistical data, etc.), and external data domain (with other data).

[0081] For example, the industrial data of platform enterprises can be classified into: platform operation data (IoT collection data, knowledge base model library data, R&D data, etc.) and enterprise management data domain (customer data, business cooperation data, financial data, etc.).

[0082] The DWS layer can use ETL tools to perform light aggregation on the data processed by the DWD layer in combination with the data model of the CDS layer.

[0083] The DMS layer performs highly aggregated analysis and obtains analysis results.

[0084] The above-mentioned summary analysis method can be Kylin model analysis. The analysis model can apply layer-by-layer algorithm (LayerCubing), fast Cube algorithm (Fast Cubing), etc. The analysis includes: mirror traffic analysis (log analysis, network traffic analysis, malicious code intelligence analysis, network threat perception analysis, network event intelligence analysis, special scenario traffic analysis), asset and threat monitoring (asset detection, website security scanning, asset vulnerability intelligence analysis, malicious code threat discovery), security compliance analysis (firewall, database audit system, vulnerability scanning system, backup dedicated equipment, bastion host, web dedicated firewall, log audit system, antivirus system), other equipment analysis (server, switch, router, cloud platform), etc. After obtaining the analysis results, they are transmitted to the data security management platform, data regulator, and data demander.

[0085] In some embodiments, in addition to security protection, the data security management platform can also be used for resource management, data classification management, data processing, data quality management, etc. throughout the data life cycle, further realizing the visualization of data management, data collection, transmission, storage, disaster recovery, use, and sharing process security, and making data reliable, trustworthy, and traceable. The functions and services supported by the data security management platform are as follows:

[0086] Metadata management, including metadata basic data management and metadata application, is composed of at least functions such as metadata automatic acquisition, metadata retrieval, data model management, and blood relationship.

[0087] Metadata analysis, including displaying the kinship of objects in a network pattern and displaying the directed kinship of objects in the form of parent-child dependencies.

[0088] Data processing, including stream data processing, data integration management, data architecture management, data anomaly management, data development management, unified scheduling management, data operation and maintenance management, etc.

[0089] Data quality management, including quality model configuration, quality planning management, solution configuration scheduling, quality inspection result review, quality inspection analysis report, etc.

[0090] The data security protection method proposed in this application has at least the following advantages:

[0091] First, full-cycle data management, that is, full-cycle data management from the aspects of data discovery and classification, data collection and cleaning, data management, data center construction, and data modeling.

[0092] Second, it has a wide range of applicable scenarios. Each product module in the solution can independently solve problems in different data management scenarios (such as data discovery and classification scenarios, data collection and cleaning scenarios, data security scenarios, data standard construction scenarios, etc.), and can also be combined arbitrarily to quickly adapt to different data management scenarios of government and enterprises.

[0093] Third, it is highly flexible. Each product provides a wealth of external interfaces, with high flexibility, scalability and integration capabilities. It uses all-round and strict security coding to enhance product security, strictly verifies unsafe data, and the program has self-testing, fault diagnosis and other functions.

[0094] Fourth, expand government and enterprise data assets, intelligently discover and sort out enterprise data assets, establish a unified data specification system, and improve data quality.

[0095] Fifth, reduce the data security risks of government and enterprises, do a good job in data classification and categorization, identify sensitive data, desensitize sensitive data, and reduce the data security risks of enterprises.

[0096] Some embodiments of the present application propose a data security management platform, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data security protection method in the above-mentioned embodiments.

[0097] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0098] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0099] Some embodiments of the present application propose a data security management system, which at least includes the data security management platform in the above embodiments.

[0100] Some embodiments of the present application provide a computer-readable storage medium storing a computer program, which implements the above method embodiments when executed by a processor.

[0101] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as: ROM), random access memory (Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

[0102] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A data security protection method, applicable to a data security management platform, wherein the data security management platform is connected to a data supplier, a data supervisor, and a data demander, respectively, and is characterized in that: The method comprises: Calling a probe to collect first data of the data supplier, wherein the first data is ciphertext of the business data of the data supplier encrypted with a first quantum key negotiated by the data security management platform; decrypting the first data securely transmitted via the first IPsec according to the shared first quantum key to obtain the service data; Encrypting the business data using a second quantum key to generate second data, and storing the data in a quantum trusted cloud; If a request for use of the business data is received from the data regulator and / or the data demander, the second data is decrypted using the shared second quantum key to obtain the business data, and the business data is encrypted during the calculation process in the virtual machine using a quantum derived key, and the calculation result is shared with the data regulator and / or the data demander via the second IPsec.

2. The data security protection method according to claim 1, characterized in that: The data supplier is provided with a first quantum security gateway encapsulating a first security agent, the data security management platform is provided with a probe deployed on the data supplier side, and the calling probe collects the first data of the data supplier, including: Initiate a return data collection request to the data supplier, wherein the data supplier obtains the return data of the business data by means of traffic replication or splitting, and the first security agent encrypts the return data by using the first quantum key provided by the quantum all-in-one machine to form first data; The probe is called to collect the first data of the data supplier at a preset location of the data supplier's network, wherein the preset location includes a network exit, a security center, a core switching area, a business access area, a database server, and / or a government cloud.

3. The data security protection method according to claim 2, characterized in that: The data security management platform is further provided with a second quantum security gateway encapsulating a second security agent, and the decryption of the first data securely transmitted via the first IPsec according to the shared first quantum key includes: The second security agent obtains the first shared quantum key from the quantum integrated machine, wherein the second security agent and the first security agent share the first quantum key under negotiation with the data security management platform; The first data securely transmitted via the first IPsec is decrypted using the first quantum key to obtain the business data of the data supplier, wherein the data supplier is connected to the data security management platform via a first quantum security gateway and a second quantum security gateway, and the first quantum security gateway and the second quantum security gateway establish a bidirectional SA in a physical link between the data supplier and the data security management platform to provide an encrypted transmission channel first IPsec.

4. The data security protection method according to claim 3, characterized in that: The step of encrypting the service data with the second quantum key to generate the second data includes: The second security agent encrypts the business data using a second quantum key to generate second data, and stores the second data in a first space of an ODS layer of a data warehouse, wherein the data warehouse of the data security management platform is built on the quantum trusted cloud, the data warehouse includes an ODS layer for storing original data, and the ODS layer includes a first space and a plurality of second spaces; The second security agent uses the fifth quantum key to encrypt the business data to generate disaster recovery data, and stores the disaster recovery data in any one of the second spaces, wherein the disaster recovery data is data disaster recovery of the second data.

5. The data security protection method according to claim 4, characterized in that: The data security management platform is further provided with a third security agent. After storing the second data in the ODS layer, the method further comprises: If the second quantum key meets the preset update condition, the second data is decrypted using the second quantum key shared by the third security agent to obtain the business data, wherein the third security agent and the second security agent share the second quantum key under the negotiation of the data security management platform, and the update condition includes that the second quantum key has not been updated for a period exceeding a preset security time period, and there are security risks in the second quantum key; The service data is encrypted using the updated third quantum key to generate third data and store the third data in the ODS layer.

6. The data security protection method according to claim 5, characterized in that: The encryption of the business data in the virtual machine computing process using a quantum derived key includes: Obtaining a quantum root key according to a request by the data supervisor and / or the data demander for use of the business data, wherein the quantum root key is obtained by the third security agent from the quantum all-in-one machine; The third security agent performs encryption of the calculation using a quantum derivative key derived from the quantum root key for executing a virtual machine participating in the calculation of the business data, wherein the quantum derivative key is derived by integrating the quantum root key and the ID of the virtual machine using a KDF function.

7. The data security protection method according to claim 6, characterized in that: The data supervisor and / or the data demander is / are deployed with a fourth security agent, and the calculation result is shared with the data supervisor and / or the data demander via the second IPsec, including: If the data supervisor and / or the data demander requests to view the calculation result, the data supervisor and / or the data demander is authenticated, wherein the data security management platform pre-stores the first authentication data of the data supervisor and / or the data demander, and the first authentication data is the ciphertext of the account and password of the data supervisor and / or the data demander encrypted by the fourth quantum key negotiated by the data security management platform, and the third security agent provides the fourth quantum key; the identity authentication includes: using the fourth quantum key provided by the fourth security agent to encrypt the account and password in the authentication application of the data supervisor and / or the data demander to generate second authentication data, wherein the fourth security agent and the third security agent share the fourth quantum key under negotiation with the data security management platform; checking the second authentication data and the first authentication data, if the second authentication data is consistent with the first authentication data, the identity authentication of the data supervisor and / or the data demander is passed; When the identity authentication of the data supervisor and / or the data demander is passed, the quantum derived key is used to decrypt the calculation result securely transmitted via the second IPsec to obtain business analysis, wherein an encrypted transmission channel second IPsec is established in the physical link between the data security management platform and the data supervisor, and / or the data demander, and the fourth security agent and the third security agent share the quantum root key under negotiation with the data security management platform, and the data supervisor and / or the data demander integrates the quantum root key and the ID of the virtual machine using a KDF function to derive the quantum derived key.

8. A data security management platform, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data security protection method as described in any one of claims 1 to 7.

9. A data security management system, characterized in that: Comprising the data security management platform as described in claim 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data security protection method according to any one of claims 1 to 7 is implemented.

Images