A method for real-time dynamic processing of structured data security identification

Abstract

The present invention provides a method for real-time dynamic processing of security identification of structured data, which relates to the field of data processing technology. The method includes: a data connection security component calls a sensitive data identification engine to scan the contents of each acquired data, the sensitive data identification engine extracts natural semantics from the data content, and compares the semantic similarity with the secret points provided by the policy management service, and returns the security level and related security attributes of the corresponding secret points when the similarity reaches a specified threshold, and completes the automatic determination of the confidentiality level of the data; the database connection security component calls a sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to abstract syntax tags to generate a data security identification; the sensitive data processing component binds the generated data security identification to the corresponding data item. The present invention can improve data security, realize automatic identification and protection of sensitive data, and refined data security management.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method for real-time dynamic processing of security identification of structured data. Background Art

[0002] In database systems, the storage and management of structured data are crucial. However, due to the different sensitivity of data, it is necessary to identify the sensitivity level and the corresponding security identification according to the content of the data. These security identifications provide a key basis for subsequent data access control and sharing exchange; currently, the mainstream data security identification method mainly relies on the database administrator (DBA) to add security attributes to the table fields of the database through the database management system (DBMS), or to add a special security identification column to the table. The generation of this identification is usually preset by the DBA during the database design phase, or specified by the business user during the operation of the business system.

[0003] However, this method exposes several problems in practical applications.

[0004] First, the control granularity is relatively coarse, and it can only identify the entire column or record, but cannot perform fine-grained control over specific data items in the row record. This is particularly insufficient when dealing with complex records containing multiple sensitive data.

[0005] Secondly, the management effectiveness of this method is also questioned. Since the data in the database changes dynamically, it is difficult to timely reflect the real-time sensitivity level of the data by relying on the security identification manually set by the DBA. If it is relied on business users to set it in the business system, not only does it require large-scale transformation of the system, but it also requires users to have a high level of sensitive data identification ability, which is often difficult to achieve in practice.

[0006] Furthermore, the existing security identification method also has its own security issues. Since the security identification and the data itself are stored separately, this increases the risk of the security identification being tampered with, which may lead to the failure of the entire control mechanism.

[0007] Finally, in certain specific scenarios, such as building multi-table data views or exporting and exchanging batch data, existing methods make it difficult to quickly determine the security level of the data, and are unable to effectively manage the mixing of data involving multiple sensitive fields. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a method for real-time dynamic processing of security identification of structured data, improve data security, realize automatic identification and protection of sensitive data, refined data security management, security management in multiple scenarios, user identity and access control, and automated data processing.

[0009] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0010] In a first aspect, a method for real-time dynamic processing of security identification of structured data is provided, the method comprising:

[0011] Business users initiate data write requests to the database through the application system;

[0012] The application system connects to the security component through the database and initiates SQL write instructions to the database;

[0013] The database connection security component filters SQL instructions according to the security policy issued by the sensitive data policy management service to obtain the data content to be written into the database;

[0014] The data connection security component calls the sensitive data identification engine to scan the acquired data content. The sensitive data identification engine extracts the natural semantics of the data content and compares the semantic similarity with the secret points provided by the policy management service. If the similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data.

[0015] The database connection security component calls the sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier;

[0016] The sensitive data processing component binds the generated data security identifier to the corresponding data item;

[0017] The database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction.

[0018] Furthermore, the sensitive data processing component binds the generated data security identifier to the corresponding data item, including:

[0019] The data security identifier M generated by ASN.1 encoding is calculated by SM3 algorithm to obtain the summary value H;

[0020] The digest value H of the data security identifier is used as the initial vector, and the identifier binding key K is used to encrypt and bind the data content through the SM4-CBC algorithm to obtain the ciphertext data C;

[0021] Construct a data security identification header, which consists of a fixed quick detection mark, the current confidentiality level value, the summary value of the data security identification, and the authentication code;

[0022] The data security identifier header HEAD, the data security identifier M and the ciphertext data C are concatenated to obtain the final data bound to the security identifier.

[0023] Furthermore, the identification binding key K is obtained from a policy management service.

[0024] Furthermore, the authentication code is obtained by performing an SM3-HMAC operation on the identification header information using the identification binding key K.

[0025] In a second aspect, a method for real-time dynamic processing of security identification of structured data is provided, the method comprising:

[0026] Business users initiate data read requests to the database through the application system;

[0027] The database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy for sensitive data from the policy management service based on the current user identity;

[0028] The database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database;

[0029] The database connection security component uses the data security identification to quickly detect the read data and obtain sensitive data with data security identification;

[0030] The database connection security component calls the sensitive data processing component to perform integrity verification on sensitive data with data security identifiers;

[0031] The database connection security component returns the desensitized data or decrypted data verified by the sensitive data processing component and returned according to the policy to the application system for display.

[0032] Furthermore, integrity checks are performed on sensitive data with data security identifiers, including:

[0033] Parse the data security identification header, obtain the authentication code HMAC1 recorded therein, use the identification binding key K to perform SM3-HMAC operation on the data security identification header information to obtain the authentication code HMAC2, and compare it with HMAC1. If they are inconsistent, it means that the data security identification has been tampered with, terminate access and issue an alarm; if they are consistent, continue;

[0034] Parse the summary value H1 of the data security identifier recorded in the data security identifier header; parse the data to obtain the ASN.1-encoded data security identifier M, calculate its summary value H2 through the SM3 algorithm, and compare it with H1. If they are inconsistent, it means that the data security identifier has been tampered with, terminate access and issue an alarm; if they are consistent, continue;

[0035] The ciphertext data C is obtained by parsing. According to the access control policy of the current user, if the policy is desensitization, the ciphertext data is replaced and returned while keeping other non-sensitive data in plain text;

[0036] If the policy allows decryption, the digest value H1 of the data security identifier is used as the initial vector, and the identifier binding key K is used to decrypt the ciphertext data C using the SM4-CBC algorithm. If decryption fails correctly, it means that the binding relationship between the data security identifier and the ciphertext data has been tampered with;

[0037] If all the above integrity checks pass, the decrypted plaintext data is obtained and returned.

[0038] In a third aspect, a device for real-time dynamic processing of security identification of structured data includes:

[0039] The acquisition module is used for business users to initiate data write requests to the database through the application system; the application system initiates SQL write instructions to the database through the database connection security component; the database connection security component filters the SQL instructions according to the security policy issued by the sensitive data policy management service, and obtains the data content to be written into the database; the data connection security component calls the sensitive data recognition engine to scan the acquired data content, and the sensitive data recognition engine extracts the natural semantics of the data content and compares the semantic similarity with the secret points provided by the policy management service. For those whose similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data;

[0040] The processing module is used for the database connection security component to call the sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier; the sensitive data processing component binds the generated data security identifier to the corresponding data item; the database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction.

[0041] In a fourth aspect, a device for real-time dynamic processing of security identification of structured data includes:

[0042] The read module is used by business users to initiate data read requests to the database through the application system; the database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy for sensitive data from the policy management service based on the current user identity; the database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database;

[0043] The verification module is used for the database connection security component to quickly detect the read data through the data security identification fast detection mark, and obtain the sensitive data with the data security identification; the database connection security component calls the sensitive data processing component to perform integrity verification on the sensitive data with the data security identification; the database connection security component returns the desensitized data or decrypted data that has been verified by the sensitive data processing component and returned according to the policy to the application system for display.

[0044] According to a fifth aspect, a computing device includes:

[0045] one or more processors;

[0046] The storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method described.

[0047] In a sixth aspect, a computer-readable storage medium stores a program, and when the program is executed by a processor, the method described is implemented.

[0048] The above solution of the present invention includes at least the following beneficial effects:

[0049] The present invention realizes real-time dynamic detection and identification of sensitive data and security identification binding when the application system accesses the database, and simultaneously performs real-time access control on sensitive data reading and security identification integrity verification.

[0050] Compared with traditional technical methods such as adding security identification columns to database tables, the above-mentioned technical method adopted by the present invention realizes the binding and integrity protection of data security identification with data, avoids illegal tampering of data security identification by database administrators, operation and maintenance personnel, and external attackers, and greatly improves the security and effectiveness of data identification.

[0051] Compared with traditional database data security identification that requires manual setting by database administrators or business users, the sensitive data identification engine adopted by the present invention and technical means such as semantic extraction and semantic similarity comparison of secret points realize automatic scanning of data, automatic identification of sensitive data, confidentiality level determination, and security identification generation and binding when the application system accesses the database, greatly improving the processing efficiency and effectiveness of sensitive data security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a schematic diagram of a specific application of a device for real-time dynamic processing of security identification of structured data provided by an embodiment of the present invention.

[0053] Figure 2 It is a schematic diagram of a device for real-time dynamic processing of security identification of structured data provided by an embodiment of the present invention.

[0054] Figure 3 This is another schematic diagram of a device for real-time dynamic processing of security identification of structured data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0056] like Figure 1 As shown, an embodiment of the present invention provides a method for real-time dynamic processing of security identification of structured data, the method comprising the following steps:

[0057] Business users initiate data write requests to the database through the application system;

[0058] The application system connects to the security component through the database and initiates SQL write instructions to the database;

[0059] The database connection security component filters SQL instructions according to the security policy issued by the sensitive data policy management service to obtain the data content to be written into the database;

[0060] The data connection security component calls the sensitive data identification engine to scan the acquired data content. The sensitive data identification engine extracts the natural semantics of the data content and compares the semantic similarity with the secret points provided by the policy management service. If the similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data.

[0061] The database connection security component calls the sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier;

[0062] The sensitive data processing component binds the generated data security identifier to the corresponding data item;

[0063] The database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction.

[0064] In an embodiment of the present invention, by automatically determining the data confidentiality level and generating a data security identifier, the method can ensure that sensitive data is clearly marked and protected when it is written to the database, greatly reducing the risk of sensitive data leakage or misuse, thereby significantly improving the overall security of the data. The method dynamically manages the access and processing policies of sensitive data through a policy management service, which means that the security policy can be flexibly adjusted according to actual needs to adapt to different security requirements and business scenarios, thereby improving the adaptability and flexibility of the system. Through the semantic extraction and similarity comparison of the sensitive data recognition engine, as well as the subsequent automatic generation and binding process of the data security identifier, the method achieves a high degree of automation. This not only reduces the burden of manual operation, but also reduces the possibility of human error, and improves the accuracy and efficiency of data processing. The method can perform fine confidentiality determination and security identifier binding for each data item, thereby achieving fine-grained control of the data. This helps to ensure the confidentiality and integrity of the data while meeting the data access needs of different users. Since the data security identifier is closely bound to the data item, once the data is leaked or abused, the source and destination of the data can be traced back. The application system can be, for example:

[0065] Office systems, such as the OA (office automation) system within an enterprise, are used to handle daily office documents, process approval and other tasks.

[0066] Information management systems, such as archive management systems, are used for information such as borrowing and returning archives.

[0067] Business processing systems, such as project application management system, about the project theme, objectives, content, project construction cycle, and project goals.

[0068] For example, enterprises or individuals can fill out a project application form online, including key information such as the project's theme, objectives, content, and project construction cycle. The system supports uploading attachments, such as project plans and budgets, and staff can review and approve projects online. The approval process is clear and transparent, ensuring fairness and justice. The system supports multi-level approval to meet the management needs of different levels. The system provides comprehensive project management functions, including project progress tracking and fund usage monitoring, which helps to keep abreast of project progress and ensure that projects proceed as planned. The system has built-in data analysis tools that can conduct in-depth mining and analysis of project data. Through visual charts, you can intuitively understand the distribution of projects, funding directions, implementation effects, and other situations.

[0069] In the process of filling in the application and approval of the project, the system not only realizes the automated management of the business process, but also makes great efforts in information security and authority control. According to the identities and responsibilities of different personnel, the system can intelligently adjust the sensitivity of the project information they can view, ensuring that users at all levels can only access data that meets their authority level.

[0070] The cleverness of this design lies in that it combines the actual needs of business processes with the strict requirements of data security. When users fill in project application information, the system will use secret point matching technology to automatically identify and process fields involving sensitive information. Whether it is the subject, goal, or specific content description of the project, as long as it contains sensitive data, the system will perform precise identification binding and immediately apply encryption measures to ensure the absolute security of this data during storage and transmission.

[0071] When project data enters the approval process, the system's permission management mechanism will play a vital role. According to the identity, role and responsibilities of different approvers, the system will accurately match the corresponding confidentiality level identification, thereby opening up appropriate access and viewing permissions for them. This flexible and sophisticated permission setting not only ensures the smooth progress of the approval process, but also protects sensitive information from being leaked or abused to the greatest extent.

[0072] In addition, this function of the system has greatly improved work efficiency and data accuracy. Through automated key point matching and encryption processing, the complexity and error rate of manual operations are reduced, making the project application and approval process more efficient and reliable. At the same time, refined authority management also avoids various risks and disputes that may be caused by information leakage, providing a strong guarantee for the stable operation of the enterprise.

[0073] In general, the system not only optimizes the business process of project application and approval through intelligent key point matching, automated data encryption and sophisticated permission control, but also achieves an unprecedented level of data security protection.

[0074] In a preferred embodiment of the present invention, the sensitive data processing component binds the generated data security identifier to the corresponding data item, including:

[0075] The data security identifier M generated by ASN.1 encoding is calculated by SM3 algorithm to obtain the summary value H;

[0076] The digest value H of the data security identifier is used as the initial vector, and the identifier binding key K is used to encrypt and bind the data content through the SM4-CBC algorithm to obtain the ciphertext data C;

[0077] Construct a data security identification header, which consists of a fixed quick detection mark, the current confidentiality level value, the summary value of the data security identification, and the authentication code;

[0078] The data security identification header HEAD, data security identification M and ciphertext data C are concatenated to obtain the final binding security identification data; the identification binding key K is obtained from the policy management service; the authentication code is obtained by performing SM3-HMAC operation on the identification header information using the identification binding key K.

[0079] In an embodiment of the present invention, the summary value H of the data security identifier M is calculated by the SM3 algorithm, and this summary value is used as the initial vector, and the data content is encrypted using the SM4-CBC algorithm. This method not only ensures the confidentiality of the data, but also protects the data from tampering through integrity verification during the encryption process, thereby maintaining the integrity of the data. The data security identifier header contains a fixed fast detection mark, which allows the system to perform a fast detection before processing the data to determine whether the data contains a security identifier. This design can greatly improve the efficiency of data processing and reduce unnecessary decryption or verification operations. The use of the authentication code further enhances the ability to identify data. The authentication code obtained by performing an SM3-HMAC operation on the identifier header information using the identifier binding key K can effectively detect whether the data has been tampered with, providing double protection for the authenticity and integrity of the data.

[0080] The identity binding key K is obtained from the policy management service, which means that the key can be dynamically replaced according to different security requirements, thereby achieving more flexible security policy management. In addition, the policy management service can also adjust the security level and other security attributes of the data as needed to meet the changing security environment. The SM4-CBC algorithm is used for data encryption, which is a domestically produced symmetric encryption algorithm with high security and encryption strength. Combined with the use of the initial vector, the result of each encryption is unique. Even if the same plaintext data is encrypted multiple times, different ciphertexts will be obtained, thereby enhancing the security of the data. The modular design of this binding method makes the system easier to expand and maintain. The loose coupling between the various components facilitates the addition or modification of functions according to actual needs, and is also conducive to the long-term stable operation of the system.

[0081] For example, when applied specifically, the following steps are included:

[0082] First, the sensitive data processing component uses ASN.1 encoding to generate a data security identifier M based on the sensitivity level and security attributes of the data. This identifier contains information such as the confidentiality level, source, and usage permissions of the data. Next, the generated data security identifier M is calculated using the SM3 algorithm to obtain a summary value H. This summary value will be used in subsequent encryption processes and data integrity verification. Using the summary value H of the data security identifier as the initial vector, the identifier binding key K obtained from the policy management service is used to encrypt and bind the data content using the SM4-CBC algorithm to obtain the ciphertext data C. This step ensures that even if the data is leaked, the original data cannot be decrypted and read without the correct key.

[0083] Then, construct the data security identification header HEAD, which consists of a fixed fast detection mark (used to quickly identify whether the data contains a security identification), the current confidentiality level value (indicating the sensitivity level of the data), the summary value H of the data security identification, and the authentication code. The authentication code is obtained by performing SM3-HMAC operation on the identification header information using the identification binding key K, and is used to verify the integrity and authenticity of the data.

[0084] Finally, the data security identifier HEAD, data security identifier M and ciphertext data C are concatenated to obtain the final data bound to the security identifier. This data now not only contains the original sensitive information, but also has additional security elements for verifying and protecting this information. The data processed in this way effectively protects the confidentiality and integrity of the data. At the same time, since each data item is bound to a unique security identifier, it is easier to track the source and use of the data, thereby strengthening the ability to control sensitive data.

[0085] A method for real-time dynamic processing of security identification of structured data, the method comprising:

[0086] Business users initiate data read requests to the database through the application system;

[0087] The database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy for sensitive data from the policy management service based on the current user identity;

[0088] The database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database;

[0089] The database connection security component uses the data security identification to quickly detect the read data and obtain sensitive data with data security identification;

[0090] The database connection security component calls the sensitive data processing component to perform integrity verification on sensitive data with data security identifiers;

[0091] The database connection security component returns the desensitized data or decrypted data verified by the sensitive data processing component and returned according to the policy to the application system for display.

[0092] In an embodiment of the present invention, through this method, all sensitive data will be quickly detected by security identification when reading, and integrity check will be performed. This ensures the integrity and authenticity of the data, effectively prevents the data from being tampered with during transmission or storage, and thus significantly improves the security of the data. The method can obtain the corresponding sensitive data access control policy from the policy management service according to the identity and confidentiality level information of the business user. This refined access control mechanism can ensure that different users can only access data within their authority, effectively preventing data leakage and illegal access. Since the method can process data according to the identity and policy of the user in real time, it can dynamically respond to different security requirements and business scenarios. This dynamic processing capability makes the system more flexible and efficient. Through the sensitive data processing component, the sensitive data is integrity checked, and the desensitized data or decrypted data is returned according to the policy. The method can maximize the availability and use efficiency of the data while ensuring data security. Users can quickly obtain the required data without waiting for a long data decryption or desensitization process. The method can be seamlessly integrated with existing application systems and databases, without large-scale transformation of existing systems. At the same time, through the policy management service, administrators can easily manage and update data access policies, reducing management complexity and costs.

[0093] In a preferred embodiment of the present invention, integrity check is performed on sensitive data with data security identification, including:

[0094] Parse the data security identification header, obtain the authentication code HMAC1 recorded therein, use the identification binding key K to perform SM3-HMAC operation on the data security identification header information to obtain the authentication code HMAC2, and compare it with HMAC1. If they are inconsistent, it means that the data security identification has been tampered with, terminate access and issue an alarm; if they are consistent, continue;

[0095] Parse the summary value H1 of the data security identifier recorded in the data security identifier header; parse the data to obtain the ASN.1-encoded data security identifier M, calculate its summary value H2 through the SM3 algorithm, and compare it with H1. If they are inconsistent, it means that the data security identifier has been tampered with, terminate access and issue an alarm; if they are consistent, continue;

[0096] The ciphertext data C is obtained by parsing. According to the access control policy of the current user, if the policy is desensitization, the ciphertext data is replaced and returned while keeping other non-sensitive data in plain text;

[0097] If the policy allows decryption, the digest value H1 of the data security identifier is used as the initial vector, and the identifier binding key K is used to decrypt the ciphertext data C using the SM4-CBC algorithm. If decryption fails correctly, it means that the binding relationship between the data security identifier and the ciphertext data has been tampered with;

[0098] If all the above integrity checks pass, the decrypted plaintext data is obtained and returned.

[0099] In an embodiment of the present invention, the method ensures the integrity of data through multiple levels of verification. First, the authenticity of the data security identification header is verified by comparing the authentication codes HMAC1 and HMAC2. Secondly, the integrity of the data is further verified by comparing the summary values ​​H1 and H2 of the data security identification. This multiple verification mechanism greatly increases the probability of data being tampered with and discovered, thereby enhancing the security of the data. According to the access control policy of the current user, the method can flexibly perform desensitization or decryption operations. If the policy is desensitization, only sensitive data is replaced, and the plaintext state of other non-sensitive data is maintained, which not only protects sensitive information, but also facilitates the normal use of data. If the policy is to allow decryption, the ciphertext data is decrypted using the identification binding key K and the initial vector H1 to ensure that only authorized users can access the plaintext content of the sensitive data. During the integrity verification process, once it is found that the data security identification or ciphertext data has been tampered with, the system will immediately terminate the access and issue an alarm. This timely tampering detection and alarm mechanism helps to quickly discover and respond to potential security threats and protect the integrity and confidentiality of data. During the decryption process, if the ciphertext data cannot be correctly decrypted, it means that the binding relationship between the data security identifier and the ciphertext data may have been tampered with. This decryption correctness verification further ensures the authenticity and reliability of the data. While achieving data security, this method also fully considers the availability of data. Through flexible access control strategies and integrity verification mechanisms, sensitive data is protected from illegal access and tampering, and authorized users are ensured to use and process data normally.

[0100] like Figure 2 As shown, an embodiment of the present invention further provides a device 20 for real-time dynamic processing of security identification of structured data, comprising:

[0101] Acquisition module 21 is used for business users to initiate data write requests to the database through the application system; the application system initiates SQL write instructions to the database through the database connection security component; the database connection security component filters the SQL instructions according to the security policy issued by the sensitive data policy management service, and obtains the data content to be written into the database; the data connection security component calls the sensitive data recognition engine to scan the acquired data content, and the sensitive data recognition engine extracts natural semantics from the data content and compares the semantic similarity with the secret points provided by the policy management service. For those whose similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data;

[0102] Processing module 22 is used for the database connection security component to call the sensitive data processing component, and according to the result of the confidentiality level determination, encode the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier; the sensitive data processing component binds the generated data security identifier to the corresponding data item; the database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction.

[0103] A device 30 for real-time dynamic processing of security identification of structured data, comprising:

[0104] The reading module 31 is used for the business user to initiate a data reading request to the database through the application system; the database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy of sensitive data from the policy management service according to the current user identity; the database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database;

[0105] The verification module 32 is used for the database connection security component to quickly detect the read data through the rapid detection mark of the data security identifier, and obtain the sensitive data with the data security identifier; the database connection security component calls the sensitive data processing component to perform integrity verification on the sensitive data with the data security identifier; the database connection security component returns the desensitized data or decrypted data that has been verified by the sensitive data processing component and returned according to the policy to the application system for display.

[0106] It should be noted that the device is a device corresponding to the above method, and all implementation methods in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0107] The embodiment of the present invention further provides a computing device, comprising: a processor, a memory storing a computer program, wherein when the computer program is executed by the processor, the method described above is executed. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0108] The embodiment of the present invention also provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute the method described above. All implementations in the above method embodiment are applicable to this embodiment and can achieve the same technical effect.

[0109] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0110] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0111] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0113] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0114] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0115] In addition, it should be noted that in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it is understood that all or any steps or components of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or a network of computing devices in hardware, firmware, software or a combination thereof, which can be achieved by those of ordinary skill in the art using basic programming skills after reading the description of the present invention.

[0116] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general device. Therefore, the purpose of the present invention can also be achieved by simply providing a program product containing a program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order. Some steps can be performed in parallel or independently of each other.

[0117] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for real-time dynamic processing of security identification of structured data, characterized in that: The method comprises: Business users initiate data write requests to the database through the application system; The application system connects to the security component through the database and initiates SQL write instructions to the database; The database connection security component filters SQL instructions according to the security policy issued by the sensitive data policy management service to obtain the data content to be written into the database; The data connection security component calls the sensitive data identification engine to scan the acquired data content. The sensitive data identification engine extracts the natural semantics of the data content and compares the semantic similarity with the secret points provided by the policy management service. If the similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data. The database connection security component calls the sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier; The sensitive data processing component binds the generated data security identifier to the corresponding data item; The database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction; The sensitive data processing component binds the generated data security identifier to the corresponding data item, including: The data security identifier M generated by ASN.1 encoding is calculated by SM3 algorithm to obtain the summary value H; The digest value H of the data security identifier is used as the initial vector, and the identifier binding key K is used to encrypt and bind the data content through the SM4-CBC algorithm to obtain the ciphertext data C; Construct a data security identification header, which consists of a fixed quick detection mark, the current confidentiality level value, the summary value of the data security identification, and the authentication code; The data security identification header HEAD, the data security identification M and the ciphertext data C are concatenated to obtain the final binding security identification data; the identification binding key K is obtained from the policy management service.

2. A method for real-time dynamic processing of security identification of structured data according to claim 1, characterized in that: The authentication code is obtained by performing an SM3-HMAC operation on the identification header information using the identification binding key K.

3. A method for real-time dynamic processing of security identification of structured data, characterized in that: The method comprises: Business users initiate data read requests to the database through the application system; The database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy for sensitive data from the policy management service based on the current user identity; The database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database; The database connection security component uses the data security identification to quickly detect the read data and obtain sensitive data with data security identification; The database connection security component calls the sensitive data processing component to perform integrity verification on sensitive data with data security identifiers; The database connection security component returns the desensitized data or decrypted data that has been verified by the sensitive data processing component and returned according to the policy to the application system for display; Integrity check of sensitive data with data security identification, including: Parse the data security identification header, obtain the authentication code HMAC1 recorded therein, use the identification binding key K to perform SM3-HMAC operation on the data security identification header information to obtain the authentication code HMAC2, and compare it with HMAC1. If they are inconsistent, it means that the data security identification has been tampered with, terminate access and issue an alarm; if they are consistent, continue; Parse the summary value H1 of the data security identifier recorded in the data security identifier header; parse the data to obtain the ASN.1-encoded data security identifier M, calculate its summary value H2 through the SM3 algorithm, and compare it with H1. If they are inconsistent, it means that the data security identifier has been tampered with, terminate access and issue an alarm; if they are consistent, continue; The ciphertext data C is obtained by parsing. According to the access control policy of the current user, if the policy is desensitization, the ciphertext data is replaced and returned while keeping other non-sensitive data in plain text; If the policy allows decryption, the digest value H1 of the data security identifier is used as the initial vector, and the identifier binding key K is used to decrypt the ciphertext data C using the SM4-CBC algorithm. If decryption fails correctly, it means that the binding relationship between the data security identifier and the ciphertext data has been tampered with; If all the above integrity checks pass, the decrypted plaintext data is obtained and returned.

4. A device for real-time dynamic processing of security identification of structured data, characterized in that: include: The acquisition module is used by business users to initiate data writing requests to the database through the application system; The application system connects to the security component through the database and initiates SQL write instructions to the database; The database connection security component filters SQL instructions according to the security policy issued by the sensitive data policy management service to obtain the data content to be written into the database; The data connection security component calls the sensitive data identification engine to scan the acquired data content. The sensitive data identification engine extracts the natural semantics of the data content and compares the semantic similarity with the secret points provided by the policy management service. If the similarity reaches the specified threshold, the security level and related security attributes of the corresponding secret point are returned to complete the automatic determination of the confidentiality level of the data. A processing module is used for the database connection security component to call the sensitive data processing component, and according to the result of the confidentiality level determination, encodes the confidentiality level and its related security attributes according to the abstract syntax mark to generate a data security identifier; the sensitive data processing component binds the generated data security identifier to the corresponding data item; The database connection security component replaces the corresponding original data in the SQL instruction with the data of the bound security identifier returned by the sensitive data processing component, and writes the data of the bound security identifier into the data item of the corresponding row record of the database by executing the SQL instruction; The sensitive data processing component binds the generated data security identifier to the corresponding data item, including: The data security identifier M generated by ASN.1 encoding is calculated by SM3 algorithm to obtain the summary value H; The digest value H of the data security identifier is used as the initial vector, and the identifier binding key K is used to encrypt and bind the data content through the SM4-CBC algorithm to obtain the ciphertext data C; Construct a data security identification header, which consists of a fixed quick detection mark, the current confidentiality level value, the summary value of the data security identification, and the authentication code; The data security identification header HEAD, the data security identification M and the ciphertext data C are concatenated to obtain the final binding security identification data; the identification binding key K is obtained from the policy management service.

5. A device for real-time dynamic processing of security identification of structured data, characterized in that: include: The read module is used by business users to initiate data read requests to the database through the application system; The database connection security component obtains the current business user identity and user confidentiality level information from the application system through the session interface, and obtains the access control policy for sensitive data from the policy management service based on the current user identity; The database connection security component initiates an SQL read instruction to the database and obtains the corresponding row record data in the database; Verification module, used for database connection security components to quickly detect the data read through the data security identification mark, and obtain sensitive data with data security identification; The database connection security component calls the sensitive data processing component to perform integrity verification on the sensitive data with data security identification; the database connection security component returns the desensitized data or decrypted data that has been verified by the sensitive data processing component and returned according to the policy to the application system for display; Integrity check of sensitive data with data security identification, including: Parse the data security identification header, obtain the authentication code HMAC1 recorded therein, use the identification binding key K to perform SM3-HMAC operation on the data security identification header information to obtain the authentication code HMAC2, and compare it with HMAC1. If they are inconsistent, it means that the data security identification has been tampered with, terminate access and issue an alarm; if they are consistent, continue; Parse the summary value H1 of the data security identifier recorded in the data security identifier header; parse the data to obtain the ASN.1-encoded data security identifier M, calculate its summary value H2 through the SM3 algorithm, and compare it with H1. If they are inconsistent, it means that the data security identifier has been tampered with, terminate access and issue an alarm; if they are consistent, continue; The ciphertext data C is obtained by parsing. According to the access control policy of the current user, if the policy is desensitization, the ciphertext data is replaced and returned while keeping other non-sensitive data in plain text; If the policy allows decryption, the digest value H1 of the data security identifier is used as the initial vector, and the identifier binding key K is used to decrypt the ciphertext data C using the SM4-CBC algorithm. If decryption fails correctly, it means that the binding relationship between the data security identifier and the ciphertext data has been tampered with; If all the above integrity checks pass, the decrypted plaintext data is obtained and returned.

6. A computing device, characterized in that include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1 to 2.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, which implements the method according to any one of claims 1 to 2 when executed by a processor.

Images