Sensitive rule configuration method, device, storage medium and computer program product

Abstract

The embodiment of the present application provides a configuration method, device, storage medium and computer program product of sensitive rules, wherein, for a database operation statement such as an SQL statement that indicates data flow between different data objects in the database system, the database system searches for an existing sensitive rule base for an existing sensitive rule of the first data object according to the object identifier of the first data object before the flow; if an existing sensitive rule of the first data object is found, a new sensitive rule configured for the second data object is generated according to the object identifier of the second data object after the flow and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule base. Thus, the database system effectively resists attacks on sensitive data by attackers and ensures the security of the database system.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a configuration method, device, storage medium and computer program product for sensitive rules. Background Art

[0002] To protect sensitive data in the database system, users often configure corresponding sensitive rules. Sensitive rules define the way to protect sensitive data in the database system. For example, sensitive rules define the desensitization algorithm or encryption algorithm for sensitive data. In the data access stage, the database system uses sensitive rules to perform data protection processing on sensitive data queried by users, and returns the sensitive data that has been processed with data protection to the user.

[0003] In actual applications, attackers often design some SQL (Structured Query Language) statements. After the attacker triggers the database system to execute the specially designed SQL statements, sensitive data will be transferred. For example, sensitive data is copied from one data object to another data object, such as a database, a data table, or a data column. However, the sensitive rules configured by the user for the specified data object are only valid for the specified data object. When the sensitive data in the specified data object is copied to other data objects, the sensitive rules are invalid for the other data objects. In this way, the attacker can request the database system to query the sensitive data in other data objects. The database system will provide the original sensitive data that has not been processed for data protection to the attacker, causing the sensitive data to be outside the sensitive rules. The database system cannot use the sensitive rules to protect the sensitive data and cannot resist the attacker's attack on the sensitive data, which reduces the security of the database system. Summary of the invention

[0004] Multiple aspects of the present application provide a method, device, storage medium and computer program product for configuring sensitive rules to ensure the security of a database system.

[0005] An embodiment of the present application provides a method for configuring sensitive rules, including: obtaining a target database operation statement, the target database operation statement indicating data flow between different data objects in the database system, the data flow being used to transfer data content of a first data object before the flow to a second data object after the flow within the database system; searching, based on the object identifier of the first data object before the flow, whether there is an existing sensitive rule for the first data object in an existing sensitive rule library; if the existing sensitive rule for the first data object is found, generating a new sensitive rule configured for the second data object based on the object identifier of the second data object after the flow and the data protection policy in the existing sensitive rule of the first data object, and adding the new sensitive rule to the existing sensitive rule library.

[0006] An embodiment of the present application provides an electronic device, comprising: a memory and a processor; the memory is used to store a computer program; the processor is coupled to the memory, and is used to execute the computer program to execute the steps in the configuration method of executing sensitive rules.

[0007] An embodiment of the present application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement the steps in the method for configuring sensitive rules.

[0008] An embodiment of the present application provides a computer program product, including a computer program / instruction. When the computer program / instruction is executed by a processor, the processor is enabled to implement the steps in the method for configuring sensitive rules.

[0009] In an embodiment of the present application, for a database operation statement such as an SQL statement that indicates data transfer between different data objects in the database system, the database system searches the existing sensitive rule base for an existing sensitive rule for the first data object based on the object identifier of the first data object before the transfer; if the existing sensitive rule for the first data object is found, a new sensitive rule configured for the second data object is generated based on the object identifier of the second data object after the transfer and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule base. Thus, even if an attacker designs a database operation statement such as an SQL statement that initiates a request for data transfer, as long as the data object before the transfer is configured with a sensitive rule, the database system can still configure a sensitive rule for the data object after the transfer, so that the sensitive data in the data object after the transfer cannot be separated from the sensitive rule, and the database system can effectively resist the attacker's attack on the sensitive data, thereby ensuring the security of the database system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0011] Figure 1 A schematic diagram of an application scenario provided in an embodiment of the present application;

[0012] Figure 2 A flowchart of a method for configuring sensitive rules provided in an embodiment of the present application;

[0013] Figure 3 A flowchart of another method for configuring sensitive rules provided in an embodiment of the present application;

[0014] Figure 4 A schematic diagram of the structure of a sensitive rule configuration device provided in an embodiment of the present application;

[0015] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0017] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the access relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B may be singular or plural. In the text description of the present application, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship. In addition, in the embodiments of the present application, "first", "second", "third", etc. are only used to distinguish the contents of different objects and have no other special meanings.

[0018] To protect sensitive data in the database system, users often configure corresponding sensitive rules. Sensitive rules define the way to protect sensitive data in the database system. For example, sensitive rules define the desensitization algorithm or encryption algorithm for sensitive data. In the data access stage, the database system uses sensitive rules to perform data protection processing on sensitive data queried by users, and returns the sensitive data that has been processed with data protection to the user.

[0019] In actual applications, attackers often design some SQL (Structured Query Language) statements. After the attacker triggers the database system to execute the specially designed SQL statements, sensitive data will be transferred. For example, sensitive data is copied from one data object to another data object, such as a database, a data table, or a data column. However, the sensitive rules configured by the user for the specified data object are only valid for the specified data object. When the sensitive data in the specified data object is copied to other data objects, the sensitive rules are invalid for the other data objects. In this way, the attacker can request the database system to query the sensitive data in other data objects. The database system will provide the original sensitive data that has not been processed for data protection to the attacker, causing the sensitive data to be outside the sensitive rules. The database system cannot use the sensitive rules to protect the sensitive data and cannot resist the attacker's attack on the sensitive data, which reduces the security of the database system.

[0020] To this end, the embodiment of the present application provides a configuration method, device, storage medium and computer program product for sensitive rules. In the embodiment of the present application, the database system receives a database operation statement such as an SQL statement indicating data flow between different data objects in the database system. The database system searches the existing sensitive rule library for the existence of an existing sensitive rule for the first data object according to the object identifier of the first data object before the flow; if the existing sensitive rule for the first data object is found, a new sensitive rule configured for the second data object is generated according to the object identifier of the second data object after the flow and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule library. Therefore, even if an attacker designs a database operation statement such as an SQL statement that initiates a request for data flow, as long as the data object before the flow is configured with a sensitive rule, the database system can still configure a sensitive rule for the data object after the flow, so that the sensitive data in the data object after the flow cannot be separated from the sensitive rule, and the database system can effectively resist the attacker's attack on the sensitive data, thereby ensuring the security of the database system.

[0021] Figure 1A schematic diagram of an application scenario provided for an embodiment of the present application. In actual applications, a database system may maintain several databases (Database), each of which usually includes multiple data tables (Table), and a data table (Table) is usually a two-dimensional data structure consisting of columns (Column) and rows (Row). Each row represents a record (Record), and each column represents a field (Field) of data. A field (Field) is a data unit that stores a specific type of data in a database table (Table). The data objects provided by the database system include, for example, databases, data tables, and columns. If the data object is a database, the object identifier of the data object is the database name (also referred to as the library name); if the data object is a data table, the object identifier of the data table can be defined by the database name of the database where the data table is located, and the table name of the data table in the database. If the data object is a column, the object identifier of the column is defined by the database name of the database where the data table is located, the table name of the data table in the database, and the column name in the data table. For example, the name of a database is Database1, the name of a data table in Database1 is Table1, and the names of multiple columns in Table1 are Column1, Column2, Column3, etc. If the data object is Database1, the object identifier of the data object is Database1; if the data object is Table1, the object identifier of the data object is Database1-Table1, which identifies the Table1 data table in Database1; if the data object is Column1, the object identifier of the data object is Database1-Table1-Column1, which identifies the Column1 column in Table1 data table in Database1.

[0022] In actual applications, there are often some sensitive fields in the fields provided by the database table. For example, in the employee information table, "name", "age", "gender", "date of employment", "salary income" and so on are all sensitive fields. In order to reduce the risk of sensitive data leakage, relevant rule configuration personnel such as database administrators can configure sensitive rules for sensitive fields. Sensitive rules can be rules that are flexibly configured on demand to protect sensitive data.

[0023] In practical applications, such as Figure 1 As shown in ① and ②, the rule configuration personnel performs the configuration operation of configuring sensitive rules for the data object on the configuration terminal, and triggers the configuration terminal to send the sensitive rules to the database system so that the database system can save the sensitive rules locally. At this point, the configuration process of the sensitive rules is completed.

[0024] In the data access phase, see Figure 1 As shown in ③ and ④, the attacker's access terminal sends a data transfer request to the database system. For example, the data transfer request requests to copy the field data of a sensitive field in a data table to another data table. For another example, the data transfer request changes the field name of a sensitive field in a data table (that is, changes the column name). In response to the data transfer request, the database system determines whether the data object before the transfer is configured with a sensitive rule. If the data object before the transfer is configured with a sensitive rule, it is necessary to configure a matching sensitive rule for the data object after the transfer, so that the sensitive data is still protected by the corresponding sensitive rule after it flows from the data object before the transfer to the data object after the transfer. After configuring a matching sensitive rule for the data object after the transfer, the database system performs a data transfer operation so that the sensitive data flows from the data object before the transfer to the data object after the transfer.

[0025] See also Figure 1 As shown in ⑤ and ⑥, the attacker's access terminal sends a query request to the database system for the transferred data object. The database system confirms that the transferred data object is configured with sensitive rules, and uses the sensitive rules to perform data protection processing on the data content of the transferred data object, and returns the data protected data to the access terminal as the query result. In this way, even if the attacker designs an SQL statement to initiate a request for data transfer, the database system can still configure sensitive rules for the transferred data object, so that the sensitive data in the transferred data object cannot be separated from the sensitive rules. The database system can effectively resist the attacker's attack on sensitive data and ensure the security of the database system.

[0026] In practical applications, database systems include, but are not limited to, relational databases, non-relational databases, cloud-native databases, or data warehouses. Which fields in the database tables provided by the database system are sensitive fields and which fields are not sensitive fields can be flexibly specified as needed without restriction.

[0027] In practical applications, the access terminal can be understood as the client of the database system. The client can be any device or application that can initiate a request and interact with the database system to access and operate data. The access terminal includes, but is not limited to, terminal devices such as desktop computers, personal computers, smart phones, tablets, vehicle-mounted devices, or IoT devices. Of course, the access terminal can also be an application installed on the terminal device, and there is no restriction on this.

[0028] In practical applications, the configuration terminal can be any device or application that can initiate a request and interact with the database system to access and operate data. Configuration terminals include, but are not limited to, terminal devices such as desktop computers, personal computers, smart phones, tablets, vehicle-mounted devices, or IoT devices. Of course, the configuration terminal can also be an application installed on the terminal device, and there is no limitation on this.

[0029] It should be noted that Figure 1 The application scenario shown is only an exemplary application scenario, and the present application embodiment does not limit the application scenario. Figure 1 does not limit the equipment included in Figure 1 The positional relationship between the devices is limited.

[0030] The following specific embodiments are used to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The following is a detailed description of the technical solutions provided by each embodiment of the present application in conjunction with the accompanying drawings.

[0031] Figure 2 A flowchart of a sensitive rule configuration method provided in an embodiment of the present application. The method can be executed by a database system, see Figure 2 , the method may include the following steps:

[0032] 201. Obtain a target database operation statement, where the target database operation statement indicates data flow between different data objects in the database system.

[0033] 202. According to the object identifier of the first data object before the transfer, search whether there is an existing sensitive rule for the first data object in the existing sensitive rule library.

[0034] 203. If an existing sensitive rule for the first data object is found, a new sensitive rule configured for the second data object is generated based on the object identifier of the transferred second data object and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule library.

[0035] In actual applications, database operation statements include, but are not limited to, SQL statements, ORM (Object-Relational Mapping) operation statements, and NoSQL (non-relational database) commands.

[0036] In actual applications, the access terminal can provide various database operation statements to the database system. The basic statement types of database operation statements include, but are not limited to: SELECT statements for retrieving data, INSERT INTO statements for inserting new data into a data table, UPDATE statements for updating data in a data table, DELETE statements for deleting data in a data table; ALTER statements for modifying database structure information, etc.

[0037] The database system analyzes the database operation statement submitted by the access terminal to determine whether the database operation statement submitted by the access terminal is a target database operation statement. The target database operation statement indicates data flow between different data objects in the database system. The data flow is used to transfer the data content of the first data object before the flow to the second data object after the flow within the database system. The target database operation statement includes, but is not limited to: a database operation statement indicating that the data content of one data object is copied to another data object, and a database operation statement indicating that a data object is to be renamed. The target database operation statement is a target SQL statement. For ease of understanding, several exemplary target SQL statements are given below:

[0038] 1. "INSERT INTO table_name2 (column1,column2) SELECT column1, column2FROM table_name1", the purpose of this target SQL statement is to select (SELECT) all the data in the two columns of column1 and column2 from the table_name1 data table, and then insert these data into the corresponding columns of the table_name2 data table. In other words, it copies two columns of data from one data table to another data table.

[0039] 2. "INSERT INTO table_name2FROM table_name1" The purpose of this target SQL statement is to select all the data in each column from the table_name1 data table, and then insert this data into the corresponding columns of the table_name2 data table, that is, to copy the data of all columns in one data table to another data table.

[0040] 3. "ALTER TABLE table_name1 RENAME COLUMN x TO y", the purpose of this target SQL statement is to rename the column named x in table_name1 to y, thereby changing the column name.

[0041] 4 “RENAME TABLE old_table_name TO new_table_name”, the purpose of this target SQL statement is to modify the old table name old_table_name to the new table name new_table_name, and then change the table name of the data table.

[0042] In actual applications, the access terminal may also send a relatively complex SQL statement to the database system. If such a complex SQL statement can be decomposed into multiple simple SQL statements involving data flow, the complex SQL statement is also considered as the target SQL statement. For example, the complex SQL statement is "CREATE TABLE AB as (SELECT(t1.x+t2.y)as zFROM AC as t1,AD as t2 WHEREt1.id=t2.id)". The complex SQL statement can be decomposed into "INSERT INTO AB (z) SELECT x FROM AC", "INSERT INTO AB (z) SELECT yFROM AD". Among them, t1 refers to the data table AC, t1.x refers to the column named x in the data table AC; t2 refers to the data table AD, and t2.y refers to the column named y in the data table AD. t1.id refers to the id column of the data table AC; t2.id refers to the id column of the data table AD.

[0043] Among them, "INSERT INTO AB (z) SELECT x FROM AC" means inserting the data of column x in table AC into column z in table AB. "INSERT INTO AB (z) SELECT y FROMA.D" means inserting the data of column y in table AD into column z in table AB.

[0044] In actual applications, after the database system obtains the target database operation statement submitted by the access terminal, it can start the task of configuring sensitive rules for the transferred data object before executing the target database operation statement, during executing the target database operation statement, or after executing the target database operation statement, without any restrictions.

[0045] In practical applications, the database system can maintain an existing sensitive rule base, which includes one or more existing sensitive rules. Existing sensitive rules can be understood as sensitive rules that have been configured for a certain data object. Existing sensitive rules include, but are not limited to: object identifiers of data objects, data protection policies, or user roles.

[0046] Through the object identifiers in the existing sensitive rules, you can determine which sensitive fields need to be processed for data protection. For example, if the object identifier in the existing sensitive rules is Database1, it means that all columns in all data tables in the Database1 database are sensitive fields. For another example, if the object identifier in the existing sensitive rules is Database1-Table1, it means that all columns in the Table1 data table in the Database1 database are sensitive fields. For another example, if the object identifier in the existing sensitive rules is Database1-Table1-Column1, it means that the Column1 column in the Table1 data table in the Database1 database is a sensitive field.

[0047] The data protection policy defines the data protection processing method required for sensitive fields. The data protection policy includes, for example, desensitizing algorithm or encryption algorithm. The desensitizing algorithm is used to desensitize the field data of sensitive fields. Desensitizing algorithms include, but are not limited to, replacement desensitizing algorithm, mask desensitizing algorithm, hash algorithm, encryption algorithm, etc. The encryption algorithm is used to encrypt the field data of sensitive fields before or after desensitization. Encryption processing enables ciphertext data to flow out of the database system instead of plaintext data, ensuring the security of data transmission from the database system to the access terminal.

[0048] Among them, the replacement desensitization algorithm can replace part or all of the content in the sensitive data with non-sensitive content, for example, replacing the real name with "anonymous user" or replacing the last four digits of the phone number with "****". The replacement desensitization algorithm can be customized by the access user, for example, including but not limited to: replacement mode, replacement digits, and reserved bit positions. The replacement mode defines which non-sensitive content is replaced, and non-sensitive content includes but is not limited to: asterisks (*), random characters, fixed characters, etc. The replacement digits are used to determine how many digits are replaced. For example, the mobile phone number only displays the first three digits and the last four digits, and the middle is replaced by asterisks. The reserved bit positions are used to determine which characters are not retained and which are replaced.

[0049] The mask desensitization algorithm can replace part or all of the content in sensitive data with specific characters (such as asterisks *, X) or other placeholders to hide some sensitive information in the data. The mask desensitization algorithm is suitable for data with a fixed format, such as phone numbers, credit card numbers, or ID numbers. The mask desensitization algorithm can be customized by the user to access the algorithm parameters, such as but not limited to: mask mode, mask digits, and reserved bit positions. The mask mode defines which non-sensitive content is used for masking. Non-sensitive content includes but is not limited to: asterisks (*), random characters, fixed characters, etc. The mask digits are used to determine how many digits are masked. For example, the mobile phone number only displays the first three digits and the last four digits, and the middle part is masked. The reserved bit positions are used to determine which characters are not retained and which are masked.

[0050] Hash algorithms can use hash functions to convert sensitive data into fixed-length, irreversible hash values ​​to protect data privacy. Hash algorithms can be customized by accessing user parameters such as, but not limited to, hash algorithm type, salt value, number of iterations, etc. Hash algorithm types include, but are not limited to, SHA-1 (SecureHash Algorithm 1), SHA-256 (Secure Hash Algorithm 256). Salt values ​​can add random strings to improve hash uniqueness; increasing the number of iterations can enhance security.

[0051] When an encryption algorithm is used as a desensitization algorithm, sensitive data is protected by encrypting it. The encryption algorithm can be customized by the user to access the algorithm parameters, such as but not limited to: key, key derivation function, encryption algorithm type, etc. Encryption algorithm types include but are not limited to: symmetric encryption algorithm, asymmetric encryption algorithm, etc.

[0052] In actual applications, user roles in existing sensitive rules can be flexibly set as needed. User roles include, but are not limited to: management users, ordinary users, temporary access users, data analysis users, developers, etc.

[0053] It is understandable that if an existing sensitive rule includes a user role, the existing sensitive rule is valid only when the user role of the data accessor is a user role in the existing sensitive rule. If a data accessor whose user role is a user role in an existing sensitive rule requests the database system to query a sensitive field, the database system needs to use the data protection policy in the existing sensitive rule to perform data protection processing on the sensitive field.

[0054] It is understandable that if the existing sensitive rules do not include user roles, the existing sensitive rules will be effective for any user role. If a data accessor of any user role requests to query the database system for sensitive fields, the database system needs to use the data protection policy in the existing sensitive rules to perform data protection processing on the sensitive fields.

[0055] In this embodiment, after the database system obtains the target database operation statement, it parses the target database operation statement to obtain the object identifier of the data object to be transferred. Here, the data object before the transfer is referred to as the first data object, and the data object after the transfer is referred to as the second data object. It can be understood that after the database system executes the target database operation statement, the data content of the first data object can be transferred to the second data object.

[0056] In this embodiment, after the database system obtains the object identifier of the first data object before the circulation, it searches the existing sensitive rule library for existing sensitive rules for the first data object based on the object identifier of the first data object before the circulation.

[0057] In actual applications, the database system can search for an existing sensitive rule in the existing sensitive rule library whose object identifier is exactly the same as the object identifier of the first data object, and use it as the existing sensitive rule of the first data object. For example, the existing sensitive rule library includes the existing sensitive rule of Database1-Table1-Column1, the existing sensitive rule of Database1, and the existing sensitive rule of Database1-Table1. If the object identifier of the first data object is Database1-Table1-Column1, then the existing sensitive rule of Database1-Table1-Column1 is the existing sensitive rule of the first data object.

[0058] Further optionally, the database system searches the existing sensitive rule base for existing sensitive rules for the first data object based on the object identifier of the first data object before the transfer in the following manner: searches the existing sensitive rule base for candidate existing sensitive rules based on the object identifier of the first data object before the transfer, the granularity of the object identifier in the candidate existing sensitive rules being greater than or equal to the granularity of the object identifier of the first data object; and determines the existing sensitive rules for the first data object from the candidate existing sensitive rules.

[0059] Specifically, the granularity of the object identification of the data object includes, for example, but is not limited to: library granularity, table granularity, and column granularity. Sorted from large to small in granularity, they are library granularity, table granularity, and column granularity. If the granularity of the object identification of the data object is library granularity, the object identification of the data object is the library name, that is, the data object is a database; if the granularity of the object identification of the data object is table granularity, the object identification of the data object consists of the library name and the table name, that is, the data object is a data table; if the granularity of the object identification of the data object is column granularity, the object identification of the data object consists of the library name, the table name, and the column name, that is, the data object is a column.

[0060] In actual applications, the database system searches for candidate existing sensitive rules in the existing sensitive rule base, and the granularity of the object identifier in the candidate existing sensitive rules is greater than or equal to the granularity of the object identifier of the first data object. For example, if the granularity of the object identifier of the first data object is column granularity, but the existing sensitive rule base has existing sensitive rules for the column where the first data object is located, then the existing sensitive rules for the column where the first data object is located can be used as the existing sensitive rules for the first data object. For example, if the granularity of the object identifier of the first data object is column granularity, but the existing sensitive rule base only consists of existing sensitive rules for the data table where the first data object is located, then the existing sensitive rules for the data table where the first data object is located can be used as the existing sensitive rules for the first data object. For another example, if the granularity of the object identifier of the first data object is table granularity, but the existing sensitive rule base only consists of existing sensitive rules for the database where the first data object is located, then the existing sensitive rules for the database where the first data object is located can be used as the existing sensitive rules for the first data object.

[0061] It is worth noting that, when there are multiple candidate existing sensitive rules, the candidate existing sensitive rule whose object identifier granularity is closest to the granularity of the object identifier of the first data object is used as the existing sensitive rule of the first data object.

[0062] It is worth noting that the object identifier in the candidate existing sensitive rule is associated with the object identifier of the first data object. The data object identified by the object identifier in the candidate existing sensitive rule may be a data table, database or column to which the first data object belongs.

[0063] It can be understood that searching the existing sensitive rules of the data table, database or column to which the first data object belongs in the existing sensitive rule library as the existing sensitive rules of the first data object can ensure the reliability of obtaining the existing sensitive rules of the first data object, thereby effectively protecting sensitive data.

[0064] In this embodiment, after the database system finds the existing sensitive rules for the first data object in the existing sensitive rule library, it can generate new sensitive rules configured for the second data object based on the object identifier of the transferred second data object and the data protection policy in the existing sensitive rules of the first data object, and add the new sensitive rules to the existing sensitive rule library.

[0065] In actual applications, there is no restriction on the method of generating a new sensitivity rule configured for the second data object based on the existing sensitivity rule of the first data object.

[0066] As an example, the data protection policy in the existing sensitive rules of the first data object can be extracted, and new sensitive rules configured for the second data object can be generated based on the object identifier of the transferred second data object and the data protection policy in the existing sensitive rules of the first data object.

[0067] As another example, the data protection policy and user role in the existing sensitive rules of the first data object can be extracted, and new sensitive rules configured for the second data object can be generated based on the object identifier of the transferred second data object and the data protection policy and user role in the existing sensitive rules of the first data object.

[0068] It is worth noting that the user role is added to the new sensitivity rule configured for the second data object, so that access control is better performed on the second data object based on the user role, thereby effectively protecting sensitive data.

[0069] As another example, when generating a new sensitive rule configured for a second data object, a copy of an existing sensitive rule for a first data object can be obtained by copying the existing sensitive rule; the object identifier in the existing sensitive rule copy can be modified to the object identifier of the second data object to obtain a new sensitive rule configured for the second data object.

[0070] It is worth noting that the new sensitive rules configured for the second data object through rule replication can better reuse the existing sensitive rules of the first data object, so that the second data object and the first data object remain consistent in data protection strategy and / or user role-based permission control, thereby effectively protecting sensitive data.

[0071] It can be understood that the new sensitive rules configured for the second data object are added to the existing sensitive rule library so that when the subsequent database system receives a query request for the data content of the second data object, the data content of the queried second data object is processed for data protection using the new sensitive rules of the second data object, thereby ensuring that the data content of the second data object that has been processed for data protection flows out of the database system, thereby ensuring the security of sensitive data.

[0072] The technical solution provided by the embodiment of the present application is that, for a database operation statement such as an SQL statement that indicates data flow between different data objects in the database system, the database system searches the existing sensitive rule base for an existing sensitive rule for the first data object based on the object identifier of the first data object before the flow; if the existing sensitive rule for the first data object is found, a new sensitive rule configured for the second data object is generated based on the object identifier of the second data object after the flow and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule base. Therefore, even if an attacker designs a database operation statement such as an SQL statement that initiates a request for data flow, as long as the data object before the flow is configured with a sensitive rule, the database system can still configure a sensitive rule for the data object after the flow, so that the sensitive data in the data object after the flow cannot be separated from the sensitive rule, and the database system can effectively resist the attacker's attack on the sensitive data, thereby ensuring the security of the database system.

[0073] Figure 3 A flowchart of another sensitive rule configuration method provided in an embodiment of the present application. The method can be executed by a database system, see Figure 3 , the method may include the following steps:

[0074] 301. Obtain a target database operation statement, where the target database operation statement indicates data flow between different data objects in the database system.

[0075] 302. According to the object identifier of the first data object before the transfer, search whether there is an existing sensitive rule for the first data object in the existing sensitive rule library; if the existing sensitive rule for the first data object is found, execute step 303; if the existing sensitive rule for the first data object is not found, end the process.

[0076] It is understandable that the database system does not find the existing sensitive rules for the first data object in the existing sensitive rule library, indicating that the data content of the first data object is not sensitive data. At this time, there is no need to configure sensitive rules for the first data object, and the process of "configuring sensitive rules for the first data object" ends. The database system finds the existing sensitive rules for the first data object in the existing sensitive rule library, indicating that the data content of the first data object is sensitive data, and it is necessary to configure sensitive rules for the second data object to ensure that after the data content of the first data object is transferred to the second data object, it is protected by the sensitive rules configured for the second data object.

[0077] 303. According to the object identifier of the second data object, search whether there is an existing sensitive rule for the second data object in the existing sensitive rule library; if no existing sensitive rule for the second data object is found, execute step 304; if an existing sensitive rule for the second data object is found, execute step 305.

[0078] In practical applications, there is no restriction on the execution order of step 302 and step 303, and they can be executed in parallel or in series.

[0079] Specifically, if the database system finds existing sensitivity rules for the first data object but fails to find existing sensitivity rules for the second data object, step 304 may be executed to reuse the existing sensitivity rules for the first data object as new sensitivity rules configured for the second data object.

[0080] If the database system finds the existing sensitive rules for the first data object and also finds the existing sensitive rules for the second data object, the database system can end the process of "configuring new sensitive rules for the second data object". Further, if the database system finds the existing sensitive rules for the first data object and also finds the existing sensitive rules for the second data object, step 305 is also performed to more effectively protect sensitive data.

[0081] 304. Generate a new sensitive rule configured for the second data object according to the object identifier of the transferred second data object and the data protection policy in the existing sensitive rule of the first data object, and add the new sensitive rule to the existing sensitive rule library.

[0082] 305. Determine whether the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object; if the security level of the existing sensitive rules of the second data object is lower than the security level of the existing sensitive rules of the first data object, execute step 306; if the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object, end the process.

[0083] 306 : Delete the existing sensitive rules of the second data object in the existing sensitive rule library, and return to execute step 304 .

[0084] In actual applications, if the database system finds existing sensitive rules for the first data object and also finds existing sensitive rules for the second data object, it can determine whether to replace the existing sensitive rules for the second data object in the existing sensitive rule library.

[0085] Specifically, if the security level of the existing sensitive rules of the second data object is lower than the security level of the existing sensitive rules of the first data object, in order to ensure that the data protection strength is not reduced after the data content of the first data object is transferred to the second data object, it is necessary to delete the existing sensitive rules of the second data object in the existing sensitive rule library, and generate new sensitive rules configured for the second data object based on the existing sensitive rules of the first data object, and add the new sensitive rules to the existing sensitive rule library.

[0086] If the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object, it means that the data protection strength will be further enhanced after the data content of the first data object is transferred to the second data object. At this time, the database system can end the process of "configuring new sensitive rules for the second data object".

[0087] In practical applications, there is no restriction on the method of judging whether the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object. For example, if the security level of the desensitization algorithm in the existing sensitive rules of the second data object is higher than the security level of the desensitization algorithm in the existing sensitive rules of the first data object, then the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object. For another example, if the security level of the encryption algorithm in the existing sensitive rules of the second data object is higher than the security level of the encryption algorithm in the existing sensitive rules of the first data object, then the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object. For another example, based on the security level of the desensitization algorithm and the security level of the encryption algorithm in the existing sensitive rules of the second data object, the security score of the existing sensitive rules of the second data object is calculated; based on the security level of the desensitization algorithm and the security level of the encryption algorithm in the existing sensitive rules of the first data object, the security score of the existing sensitive rules of the first data object is calculated; if the security score of the existing sensitive rules of the second data object is greater than the security score of the existing sensitive rules of the first data object, then the security level of the existing sensitive rules of the second data object is higher than the security level of the existing sensitive rules of the first data object. It can be understood that the higher the security level, the higher the security.

[0088] Further optionally, in order to more effectively protect sensitive data, if the database system finds existing sensitive rules for the first data object, and if the data protection strategy includes a desensitizing algorithm and an encryption algorithm, the above method also includes: when the existing sensitive rules for the second data object are found, determining whether only one algorithm in the existing sensitive rules for the second data object has a higher security level than the security level of the corresponding algorithm in the existing sensitive rules for the first data object; if the judgment result is yes, then generating a new sensitive rule configured for the second data object based on the object identifier of the second data object, a first algorithm with a higher security level in the existing sensitive rules of the second data object, and a second algorithm with a higher security level in the existing sensitive rules of the first data object, the first algorithm being one of the desensitizing algorithm and the encryption algorithm, and the second algorithm being the other of the desensitizing algorithm and the encryption algorithm.

[0089] It can be understood that, from the desensitization algorithms of the existing sensitive rules of the first data object and the desensitization algorithms of the existing sensitive rules of the second data object, a desensitization algorithm with a high security level is selected and configured in the new sensitive rules of the second data object. From the encryption algorithms of the existing sensitive rules of the first data object and the encryption algorithms of the existing sensitive rules of the second data object, an encryption algorithm with a high security level is selected and configured in the new sensitive rules of the second data object. The existing sensitive rules of the second data object in the existing sensitive rule library are deleted, and new sensitive rules of the second data object with a higher security level are added to the existing sensitive rule library.

[0090] In actual applications, there is no restriction on whether to add user roles to the new sensitive rules of the second data object. For example, the user roles in the existing sensitive rules of the first data object or the user roles in the existing sensitive rules of the second data object can be added to the new sensitive rules of the second data object.

[0091] Further optionally, in order to more effectively protect sensitive data, a new sensitive rule configured for the second data object is generated based on the object identifier of the second data object, a first algorithm with a high security level in the existing sensitive rules of the second data object, and a second algorithm with a high security level in the existing sensitive rules of the first data object. The implementation method is as follows: if the level of the user role in the existing sensitive rules of the second data object is lower than the level of the user role in the existing sensitive rules of the first data object, then a new sensitive rule configured for the second data object is generated based on the object identifier of the second data object, the first algorithm and the user role with a high security level in the existing sensitive rules of the second data object, and the second algorithm with a high security level in the existing sensitive rules of the first data object; if the level of the user role in the existing sensitive rules of the second data object is higher than the level of the user role in the existing sensitive rules of the first data object, then a new sensitive rule configured for the second data object is generated based on the object identifier of the second data object, the first algorithm with a high security level in the existing sensitive rules of the second data object, the second algorithm and the user role with a high security level in the existing sensitive rules of the first data object.

[0092] In actual applications, the user role of the data accessor can be identified through the account of the data accessor, but it is not limited to this. Generally, the higher the level of the user role, the better the credibility of the data accessor, and the lower the probability of the data accessor launching an attack. For example, the order from high to low is: management user, ordinary user, etc. If the user role in the existing sensitive rule of the second data object is management user, and the user role in the existing sensitive rule of the first data object is ordinary user, then the user role in the new sensitive rule of the second data object is ordinary user. If the user role in the existing sensitive rule of the second data object is ordinary user, and the user role in the existing sensitive rule of the first data object is management user, then the user role in the new sensitive rule of the second data object is management user. Since the data is transferred from the first data object to the second data object, the user role in the new sensitive rule of the second data object is controlled by the user role in the existing sensitive rule of the first data object, so that the data protection strength is not reduced after the flow from the first data object to the second data object.

[0093] The technical solution provided by the embodiment of the present application is that the database system receives a database operation statement such as an SQL statement indicating data flow between different data objects in the database system, and the database system searches for the existence of an existing sensitive rule of the first data object in the existing sensitive rule library according to the object identifier of the first data object before the flow; if the existing sensitive rule of the first data object is found, a new sensitive rule configured for the second data object is generated according to the object identifier of the second data object after the flow and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule library. Further, if the database system finds the existing sensitive rule of the first data object and also finds the existing sensitive rule of the second data object, at this time, it can be determined whether to replace the existing sensitive rule of the second data object in the existing sensitive rule library. Therefore, even if the attacker designs a database operation statement such as an SQL statement that initiates a request for data flow, as long as the data object before the flow is configured with a sensitive rule, the database system can still configure the sensitive rule for the data object after the flow, so that the sensitive data in the data object after the flow cannot be separated from the sensitive rule, and the database system can effectively resist the attacker's attack on the sensitive data, thereby ensuring the security of the database system.

[0094] Figure 4 A schematic diagram of a sensitive rule configuration device provided in an embodiment of the present application. The device may be composed of software and / or hardware and may generally be integrated into a database system. Figure 4 , the device may include:

[0095] An acquisition module 41 is used to acquire a target database operation statement, where the target database operation statement indicates data transfer between different data objects in the database system, where the data transfer is used to transfer data content of a first data object before the transfer to a second data object after the transfer within the database system;

[0096] A search module 42, configured to search, based on the object identifier of the first data object before the transfer, whether there is an existing sensitive rule for the first data object in the existing sensitive rule library;

[0097] Configuration module 43 is used to generate new sensitive rules configured for the second data object based on the object identifier of the second data object after circulation and the data protection policy in the existing sensitive rules of the first data object if the existing sensitive rules of the first data object are found, and add the new sensitive rules to the existing sensitive rule library.

[0098] Further optionally, when the configuration module 43 generates a new sensitive rule configured for the second data object, it is specifically used to: generate a new sensitive rule configured for the second data object based on the object identifier of the second data object after the transfer and the data protection policy and user role in the existing sensitive rules of the first data object.

[0099] Further optionally, when the configuration module 43 generates a new sensitive rule configured for the second data object, it is specifically used to: obtain a copy of the existing sensitive rule obtained by copying the existing sensitive rule for the first data object; modify the object identifier in the copy of the existing sensitive rule to the object identifier of the second data object, and obtain a new sensitive rule configured for the second data object.

[0100] Further optionally, before the configuration module 43 generates a new sensitive rule configured for the second data object, it is also used to: search, based on the object identifier of the second data object, whether there is an existing sensitive rule for the second data object in the existing sensitive rule library; if no existing sensitive rule for the second data object is found, execute the step of generating a new sensitive rule configured for the second data object.

[0101] Further optionally, the configuration module 43 is also used to: if an existing sensitive rule for the second data object is found, determine whether the security level of the existing sensitive rule for the second data object is higher than the security level of the existing sensitive rule for the first data object; if the security level of the existing sensitive rule for the second data object is lower than the security level of the existing sensitive rule for the first data object, delete the existing sensitive rule for the second data object in the existing sensitive rule library, and execute the step of generating new sensitive rules configured for the second data object.

[0102] Further optionally, the data protection strategy includes a desensitizing algorithm and an encryption algorithm, and the configuration module 43 is also used to: when an existing sensitive rule for the second data object is found, determine whether only one algorithm in the existing sensitive rules of the second data object has a higher security level than the security level of the corresponding algorithm in the existing sensitive rules of the first data object; if the judgment result is yes, then generate a new sensitive rule configured for the second data object based on the object identifier of the second data object, a first algorithm with a high security level in the existing sensitive rules of the second data object, and a second algorithm with a high security level in the existing sensitive rules of the first data object, the first algorithm being one of the desensitizing algorithm and the encryption algorithm, and the second algorithm being the other of the desensitizing algorithm and the encryption algorithm.

[0103] Further optionally, when the configuration module 43 generates a new sensitive rule configured for the second data object based on the object identifier of the second data object, the first algorithm with a high security level in the existing sensitive rules of the second data object, and the second algorithm with a high security level in the existing sensitive rules of the first data object, it is specifically used to: if the level of the user role in the existing sensitive rules of the second data object is lower than the level of the user role in the existing sensitive rules of the first data object, then generate a new sensitive rule configured for the second data object based on the object identifier of the second data object, the first algorithm and the user role with a high security level in the existing sensitive rules of the second data object, and the second algorithm with a high security level in the existing sensitive rules of the first data object; if the level of the user role in the existing sensitive rules of the second data object is higher than the level of the user role in the existing sensitive rules of the first data object, then generate a new sensitive rule configured for the second data object based on the object identifier of the second data object, the first algorithm with a high security level in the existing sensitive rules of the second data object, and the second algorithm and the user role with a high security level in the existing sensitive rules of the first data object.

[0104] Further optionally, the search module 42 is specifically used to: search whether there are candidate existing sensitive rules in the existing sensitive rule library based on the object identifier of the first data object before the flow, and the granularity of the object identifier in the candidate existing sensitive rules is greater than or equal to the granularity of the object identifier of the first data object; determine the existing sensitive rules for the first data object from the candidate existing sensitive rules.

[0105] Figure 4 The device shown can perform Figure 2 The method shown in the embodiment shown, its implementation principle and technical effect are not described in detail. Figure 4 The specific manner in which each module and unit of the device shown performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0106] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 201 to 203 can be device A; for another example, the execution subject of steps 201 and 202 can be device A, and the execution subject of step 203 can be device B; and so on.

[0107] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 201, 202, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0108] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0109] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the electronic device includes: a memory 51 and a processor 52;

[0110] The memory 51 is used to store computer programs and can be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc.

[0111] The memory 51 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0112] The processor 52 is coupled to the memory 51 and is used to execute the computer program in the memory 51 to perform the steps in the configuration method of the sensitive rules.

[0113] Further optional, such as Figure 5 As shown, the electronic device also includes: a communication component 53, a display 54, a power component 55, an audio component 56 and other components. Figure 5 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 5 In addition, Figure 5 The components in the dashed box are optional components, not mandatory components, and the specific components depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, or an IOT (Internet of Things) device, or a server device such as a conventional server, a cloud server, or a server array. If the electronic device of this embodiment is implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, etc., it can include Figure 5 If the electronic device of this embodiment is implemented as a server device such as a conventional server, a cloud server or a server array, it may not include Figure 5 Components within the dashed box.

[0114] For the detailed implementation process of the processor executing each action, please refer to the relevant description in the aforementioned method embodiment or device embodiment, which will not be repeated here.

[0115] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed, can implement each step that can be executed by an electronic device in the above method embodiment.

[0116] Accordingly, an embodiment of the present application also provides a computer program product, including a computer program / instruction. When the computer program / instruction is executed by a processor, the processor is enabled to implement each step in the above method embodiment that can be executed by an electronic device.

[0117] The communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi (Wireless Fidelity), 2G (2 Generation), 3G (3 Generation), 4G (4 Generation) / LTE (long Term Evolution), 5G (5 Generation), and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra wide band (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0118] The display includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0119] The power supply assembly provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply assembly is located.

[0120] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0121] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0125] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0126] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0127] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, Phase Change RAM (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. According to the definition in this article, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0129] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for configuring sensitive rules, characterized in that: include: Acquire a target database operation statement, wherein the target database operation statement indicates to perform data transfer between different data objects in the database system, wherein the data transfer is used to transfer data content of a first data object before the transfer to a second data object after the transfer within the database system; According to the object identifier of the first data object before the transfer, searching whether there is an existing sensitive rule for the first data object in the existing sensitive rule library; If an existing sensitive rule of the first data object is found, a new sensitive rule configured for the second data object is generated according to the object identifier of the transferred second data object and the data protection policy in the existing sensitive rule of the first data object, and the new sensitive rule is added to the existing sensitive rule library; Before generating a new sensitivity rule configured for the second data object, the method further includes: searching, according to the object identifier of the second data object, whether there is an existing sensitive rule for the second data object in the existing sensitive rule library; If no existing sensitivity rule for the second data object is found, executing the step of generating a new sensitivity rule configured for the second data object; If an existing sensitive rule for the second data object is found, determining whether the security level of the existing sensitive rule for the second data object is higher than the security level of the existing sensitive rule for the first data object; If the security level of the existing sensitive rule of the second data object is lower than the security level of the existing sensitive rule of the first data object, deleting the existing sensitive rule of the second data object in the existing sensitive rule library, and executing the step of generating a new sensitive rule configured for the second data object; If the security level of the existing sensitive rule of the second data object is higher than the security level of the existing sensitive rule of the first data object, the step of generating a new sensitive rule configured for the second data object is no longer performed; Wherein, the data protection strategy includes a desensitization algorithm and an encryption algorithm, and when an existing sensitive rule of the second data object is found, it is determined whether the security level of only one algorithm in the existing sensitive rule of the second data object is higher than the security level of the corresponding algorithm in the existing sensitive rule of the first data object; In the case where the judgment result is yes, if the level of the user role in the existing sensitive rule of the second data object is lower than the level of the user role in the existing sensitive rule of the first data object, a new sensitive rule configured for the second data object is generated according to the object identifier of the second data object, the first algorithm and user role with a high security level in the existing sensitive rule of the second data object, and the second algorithm with a high security level in the existing sensitive rule of the first data object; If the level of the user role in the existing sensitive rules of the second data object is higher than the level of the user role in the existing sensitive rules of the first data object, a new sensitive rule configured for the second data object is generated according to the object identifier of the second data object, the first algorithm with a high security level in the existing sensitive rules of the second data object, the second algorithm with a high security level in the existing sensitive rules of the first data object, and the user role; the first algorithm is one of the desensitizing algorithm and the encryption algorithm, and the second algorithm is the other of the desensitizing algorithm and the encryption algorithm.

2. The method according to claim 1, characterized in that: Generating a new sensitivity rule configured for the second data object, including: A new sensitive rule configured for the second data object is generated according to the object identifier of the transferred second data object and the data protection policy and user role in the existing sensitive rule of the first data object.

3. The method according to claim 1, characterized in that: Generating a new sensitivity rule configured for the second data object, including: Obtaining a copy of the existing sensitive rule obtained by copying the existing sensitive rule of the first data object; The object identifier in the existing sensitive rule copy is modified to the object identifier of the second data object, so as to obtain a new sensitive rule configured for the second data object.

4. The method according to claim 1, characterized in that: Searching, according to the object identifier of the first data object before the transfer, whether there is an existing sensitive rule for the first data object in the existing sensitive rule library includes: According to the object identifier of the first data object before the transfer, searching whether there is a candidate existing sensitive rule in the existing sensitive rule library, the granularity of the object identifier in the candidate existing sensitive rule being greater than or equal to the granularity of the object identifier of the first data object; An existing sensitivity rule for the first data object is determined from candidate existing sensitivity rules.

5. An electronic device, characterized in that: include: Memory and processor; The memory is used to store computer programs; The processor is coupled to the memory and configured to execute the computer program to perform the steps in the method according to any one of claims 1 to 4.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is enabled to implement the steps in the method according to any one of claims 1 to 4.

7. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, enables the processor to implement the steps of the method according to any one of claims 1 to 4.

Images