A label-based sensitive data tracking method

Abstract

The present invention discloses a sensitive data tracking and tracing method based on tags. When a user applies to access the corresponding tag content and the audit fails, the present invention triggers an abnormal retrieval signaling, integrates and analyzes the historical access data of the tag in the past week, and obtains the abnormal state evaluation index of the tag at the current triggering time point. The obtained abnormal state evaluation index intuitively reflects the abnormal risk of the tag in the past week, and can judge whether there are risks and anomalies in the storage process of the sensitive data corresponding to the current tag, and promptly notifies the management personnel to pay attention to possible tag risks and abnormal users, thereby ensuring the security of sensitive data during user access and storage.

Description

Technical Field

[0001] The present invention relates to the technical field of sensitive data tracking and tracing, and in particular to a tag-based sensitive data tracking and tracing method. Background Art

[0002] In a large-scale sensitive data environment, it is necessary to establish and maintain labels for each sensitive data to facilitate subsequent tracking, tracing, and auditing.

[0003] By classifying and labeling sensitive data, it is easy to track the flow and operation history of data during data transmission, storage and processing. However, the sensitive data tracking and tracing methods based on labels in the existing technology still have the following problems in ensuring the security of sensitive data:

[0004] The labels of each sensitive data are classified into corresponding constructed databases according to the source of sensitive data for storage. When the user fails to review the corresponding sensitive data through the assigned labels, relevant processing can only be performed according to the current review failure situation. The historical relevant data within the set time period of the label cannot be comprehensively analyzed, thereby reflecting the abnormal behavior of the current label within the set time period, and security cannot be fully guaranteed;

[0005] When the server to which the corresponding database belongs is attacked by a network attack, it is generally intercepted by the set automatic interception system. When the interception fails, the network attack suffered by the server cannot be solved in a timely and effective manner, and the security level of the server is optimized, the intelligence level is low and the security is low;

[0006] To this end, a label-based sensitive data tracking and tracing method is introduced. Summary of the invention

[0007] In view of this, the present invention provides a tag-based sensitive data tracking and tracing method to solve the problems raised by the above background technology.

[0008] The purpose of the present invention can be achieved through the following technical solutions:

[0009] S1: First, mark and classify the sensitive data involved. The specific steps are as follows:

[0010] S1-101: Establish multiple databases corresponding to sensitive data classifications, and send the sensitive data involved to the corresponding databases according to different data sources according to the sources of the sensitive data;

[0011] S1-102: After the classification of the sensitive data involved is completed, collect the operations and events related to each sensitive data; record this information and associate it with the corresponding sensitive data as an integrated data package of the sensitive data, and assign a unique label to each integrated data package of sensitive data; the label is a code composed of letters and numbers;

[0012] S1-104: Establish a label corresponding to each sensitive data based on steps S1-101 to S1-103;

[0013] S2: When a user accesses the corresponding sensitive data through each assigned label, the audit signaling is automatically triggered. The specific steps are:

[0014] S2-201: When the audit signaling is triggered, the user's identity information is verified and the required access rights are checked. If the current user identity has the corresponding permissions, it is considered to have passed the audit;

[0015] S2-202: When the audit fails or the processing method does not match the authority, the abnormal retrieval signaling is triggered, and the historical related data is extracted from the integrated data packet of the tag and analyzed to obtain the abnormal state evaluation index YCP of the tag;

[0016] S2-203: The manager receives and analyzes the risk data packet generated at the current trigger time point;

[0017] S3: The servers corresponding to each established database are placed in independent subnets, and only necessary network connections are allowed; IDS and IPS are used to discover and prevent intrusions suffered by each established database, and corresponding processing is performed. The specific steps are as follows:

[0018] S3-301: Block the current network attack through IDS and IPS. When the blocking fails, first cut off the connection between each database and the network, analyze the specific characteristics and patterns of the current network attack process, and establish an identification information template of the current network attack based on the analysis results;

[0019] S3-302: Obtain global cyber attack information and data at the current time point from the participating security community threat intelligence sharing platform, and match the established identification information template. If the match fails, trigger maintenance signaling and proceed to the next step;

[0020] S3-303: After the maintenance signal is triggered, the technician with the largest emergency effectiveness value GP within the scope is selected as the solution provider;

[0021] S3-304: After the current server is attacked by a network and resolved, the improvement signaling is automatically triggered, and the historical attack data of the server within a set time period is analyzed to obtain the optimization evaluation index MHP of the corresponding server corresponding to the current trigger time point;

[0022] S3-305: The technicians patch and optimize the security vulnerabilities of the current server based on the generated server security optimization signaling;

[0023] S4: Set fixed time intervals for tracing and auditing sensitive data, and continuously optimize and improve the problems and weaknesses found during the tracking and tracing process of each tag.

[0024] In some embodiments, historical access data of the past week is obtained from the integrated data packet of the tag, and the number of accesses that failed the review is extracted from the historical access data and recorded as the number of failed accesses; a normal access time period is set for each tag, and the time point of each failed access number of the corresponding tag is matched with the set normal access time period. If the match fails, the number of failures is counted as the number of abnormal time period accesses YS1 for the tag at the current trigger time point; the number of failed accesses is matched with the dates of each day in the past week to obtain the number of failed accesses for each day in the past week; if the number of failed accesses on one day is greater than the set number of allowed failures for a single day, the day is marked as an abnormal access date; the number of days of abnormal access dates is counted as the number of abnormal access days YS2 for the tag at the current trigger time point.

[0025] In some embodiments, the number of failed processing permission matches for the tag in the past week is obtained at the same time, and is classified based on transmission failure, modification failure, and deletion failure to obtain the number of failures for each category of the tag at the current trigger time point;

[0026] The number of failures in each category is marked as f1, f2 and f3 respectively; where f1, f2 and f3 correspond to the number of transmission failures, the number of modification failures and the number of deletion failures respectively;

[0027] The processing anomaly evaluation index YS3 and the abnormal state evaluation index YCP of the tag at the current trigger time point are calculated by formulas (1) and (2) respectively; specifically:

[0028] in accordance with Calculate; calculate the processing anomaly evaluation index YS3 of the tag at the current trigger time point by formula (1); where aq1, aq2 and aq3 are the influence weight factors of the number of transmission failures f1, the number of modification failures f2 and the number of deletion failures f3, and the values ​​of aq1, aq2 and aq3 are 1.034, 1.058 and 1.069 respectively;

[0029] The abnormal state evaluation index YCP of the tag at the current trigger time point is calculated by formula (2); where YS1 允许 、YS2 允许 and YS3 允许 They respectively represent the number of access times allowed during the abnormal period, the number of days for abnormal access and the abnormal handling permission index corresponding to the established database to which the tag belongs; bw1, bw2 and bw3 are the influencing weight factors of the number of access times during the abnormal period YS1, the number of days for abnormal access YS2 and the abnormal handling evaluation index YS3 of the tag, and the values ​​of bw1, bw2 and bw3 are 1.125, 1.137 and 1.158 respectively.

[0030] In some embodiments, an abnormal state evaluation threshold index of each established database is set; and the threshold indexes corresponding to the source system database, the user submission database, and the external provider database are marked as YT1, YT2, and YT3, respectively;

[0031] Compare the abnormal state evaluation index YCP calculated by the tag at the current trigger time point with the corresponding threshold index YTi; where i=1, 2 or 3; if YCP>YTi, calculate the difference between the two, and match the obtained difference with the multiple difference value ranges set in the corresponding database to obtain the abnormal risk level of the tag at the current trigger time point; each difference value range corresponds to an abnormal risk level;

[0032] At the same time, a tree diagram of the number of failed accesses, failed processing permission matches, and corresponding users for the tag in the past week is constructed; the corresponding users are all users who have had access failures and failed processing permission matches for the tag in the past week, and the cumulative number of failed accesses and failed processing permission matches for each user is calculated, and the number of arrows corresponding to the user in the tree diagram is counted; if the number of arrows is 2 and the cumulative number is less than or equal to 3, the user is marked as a first-level abnormal user; if the number of arrows is 1 and the cumulative number is greater than 3, it is also marked as a first-level abnormal user; if the number of arrows is 2 and the cumulative number is greater than 3, the user is marked as a second-level abnormal user;

[0033] The abnormal level generated for each user, the abnormal risk level generated at the current trigger time point and the label code are integrated into a risk data packet and sent to the mobile terminal or email address of the manager who is currently in working state.

[0034] In some embodiments, a circle is drawn with the server currently under attack as the center and the distance as the radius, and available technicians within the circle are screened, and a position feedback instruction is sent to the mobile terminal of the technicians within the circle. After confirming the position feedback instruction, each technician obtains the current actual location of each technician, and calculates the route distance based on the current actual location of each technician and the location of the server to obtain the required walking distance of each technician; the distance unit is meter;

[0035] The required walking distance of each technician is converted into a score, and multiple value ranges matching the required walking distance are set, and each value range corresponds to a score; the score range is 1-10; after matching the required walking distance of each technician with the set multiple value ranges, the distance estimation score h1 of each technician is obtained;

[0036] At the same time, the working years and the total number of processing times are extracted from the identity information of each technician; the number of successful times in the total number of processing times of each technician is extracted, and the ratio between the number of successful times and the total number of processing times is calculated, which is recorded as the success rate;

[0037] Based on the above steps, the working years, total number of processing times and success rate of each technician are converted into scores in the same way; and the estimated years of service, total processing times and success rate of each technician are marked as h2, h3 and h4 respectively;

[0038] The emergency effectiveness value GP of each technician at the current time point = h1+h2+h3+h4;

[0039] The technician with the largest emergency effectiveness value GP is selected as the problem solver, and the location of the corresponding server and the identification information template of the current network attack are sent to the mobile terminal of the technician; at the same time, the total number of processing times of the technician is increased by one.

[0040] In some embodiments, the number of attacks on the server to which the current database is to be established within a set time period is extracted, the number of times the maintenance signaling is triggered is extracted based on the number of attacks, the difference between the number of attacks and the number of times the maintenance signaling is triggered is calculated to obtain the number of successful automatic interceptions; the ratio between the number of successful automatic interceptions and the number of attacks is calculated to obtain the interception ratio and record it as LJ1; the number of attacks is recorded as LJ2;

[0041] Different risk additional values ​​are set based on the servers to which each established database belongs, and the server risk additional values ​​corresponding to the source system database, user submitted database, and external provider database are marked as X1, X2, and X3, respectively; X1, X2, and X3 are 1.078, 1.113, and 1.146, respectively;

[0042] According to the formula , calculate the optimization evaluation index MHP of the current server; and They represent the minimum interception ratio and the number of attacks allowed for the corresponding server within the set time period; yt1 and yt2 are the impact weight factors of the interception ratio LJ1 and the number of attacks LJ2, and their values ​​are 1.278 and 1.354 respectively; E is a preset constant, ranging from 2.038 to 2.076, and the specific value depends on the source of sensitive data of the current server; Xc represents the risk additional value of each corresponding server, where c=1, 2 or 3;

[0043] The optimization evaluation index MHP of the current server is compared with the reference optimization evaluation index set for the corresponding server. If it is greater than the corresponding reference optimization evaluation index, a server security optimization signaling is generated and sent to the mobile terminal of the technician with the largest emergency effectiveness value GP within the current server range.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] When a user applies to access the corresponding tag content and the audit fails, the present invention triggers an abnormal search signaling, integrates and analyzes the historical access data of the tag in the past week, and obtains the abnormal state evaluation index of the tag at the current trigger time point. Based on the obtained abnormal state evaluation index, the abnormal risk of the tag in the past week can be reflected, and it can be judged whether there are risks and abnormalities in the storage process of the sensitive data corresponding to the current tag, and the management personnel are notified in time to pay attention to the possible tag risks and abnormal users, thereby ensuring the security of sensitive data during access and storage.

[0046] The present invention establishes a maintenance signaling when the server to which the database belongs is attacked and the matching fails, and sets a range based on the corresponding server currently under attack, obtains the relevant parameters of the technicians in the range for analysis, and obtains the emergency effectiveness value of each technician in the current optional range. According to the emergency effectiveness value of each technician, the best technician is selected to go to the location of the server to solve the problem, thereby ensuring the timely security of sensitive data when it is stored or attacked, and avoiding data leakage and loss;

[0047] The present invention automatically triggers improved signaling after the network attack on the current server is resolved, and analyzes the historical attack data of the server within a set time period to obtain an optimized evaluation index of the corresponding server corresponding to the current trigger time point. The security level of the current server is reflected based on the comparison result of the obtained optimized evaluation index, and the technical personnel with the highest emergency effectiveness value are notified to upgrade and resolve the security and existing vulnerabilities of the current server, thereby further improving the security of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0049] Figure 1 It is a principle block diagram of the present invention;

[0050] Figure 2 This is the tree model diagram in the present invention. DETAILED DESCRIPTION

[0051] Several embodiments of the present application will be described in more detail below with reference to the accompanying drawings so that those skilled in the art can implement the present application. The present application can be embodied in many different forms and purposes and should not be limited to the embodiments described herein. These embodiments are provided to make the present application comprehensive and complete, and to fully convey the scope of the present application to those skilled in the art. The embodiments do not limit the present application.

[0052] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the relevant art and / or the context of this specification, and will not be interpreted in an idealized or overly formal sense unless explicitly defined as such herein.

[0053] See also Figure 1-Figure 2 A label-based sensitive data tracking and tracing method is shown, comprising:

[0054] S1: First, mark and classify the sensitive data involved. The specific steps are as follows:

[0055] S1-101: Establish multiple databases corresponding to sensitive data classifications, and send the sensitive data involved to the corresponding databases according to the sources of the sensitive data, such as the data source system, user submissions, and external data providers; set the names of the multiple databases to be the source system database, user submission database, and external provider database;

[0056] S1-102: After the classification of the sensitive data involved is completed, collect the operations and events related to each sensitive data; including activities such as access, modification, transmission and deletion of sensitive data; record this information and associate it with the corresponding sensitive data as the integrated data package of the sensitive data, and give a unique label to each integrated data package of sensitive data; the label is coded with letters and numbers; such as Q1-101; Q1 is the corresponding classification number of the sensitive data in the integrated data package; it can be set to Q1, Q2 and Q3, corresponding to the source system database, user submission database and external provider database respectively; 101 is the corresponding number of the integrated data package, and so on 102, 103...;

[0057] S1-104: Based on steps S1-101 to S1-103, a label corresponding to each sensitive data is established; the user tracks and traces each sensitive data through the unique label assigned to each sensitive data;

[0058] S2: When a user accesses the corresponding sensitive data through each assigned label, the audit signaling is automatically triggered. The specific steps are:

[0059] S2-201: When the audit signaling is triggered, the user's identity information is verified and the required access rights are checked. If the current user identity has the corresponding permissions, it is considered to have passed the audit;

[0060] If the permissions of the current user identity do not match the currently required access permissions, the query statement corresponding to the user is executed in the application list, and according to the authorized access request, the qualified access request data is extracted to match with the user; the user names, the specific databases accessed, the time interval between the two, and the access IP address are matched;

[0061] When the access IP address does not match, relevant content is extracted from the user's access request. If there is a "remote application" description, the IP address is considered to be matched successfully;

[0062] After the match is successful, it is considered to have passed the review, and the user can enter the location of the corresponding sensitive data through the tag and perform corresponding processing; the sensitive data is processed based on the processing permissions obtained by the user's current access request;

[0063] When the user performs a transfer process, a transfer subtag is generated based on the before and after of the transfer; when the user performs a modification process, a modification subtag is generated based on the before and after of the modification; when the user performs a deletion process, a deletion subtag is generated based on the before and after of the deletion;

[0064] The generated transmission sub-tag, modification sub-tag and deletion sub-tag are sent to the corresponding integrated data package of the sensitive data for updating; the management personnel can track the transmission and processing of the sensitive data through the generated corresponding sub-tag;

[0065] S2-202: When the audit fails or the processing method does not match the authority, the processing methods include transmission, modification and deletion; triggering abnormal retrieval signaling, extracting historical related data from the integrated data packet of the tag and analyzing it to obtain the abnormal state evaluation index YCP of the tag;

[0066] The specific steps to obtain the corresponding label abnormal state evaluation index YCP are:

[0067] Obtain the historical access data of the past week from the integrated data package of the tag, and extract the number of visits that failed the review from the historical access data, which is recorded as the number of failed accesses; set the normal access time period for each tag, and match the time point of each failed access number of the corresponding tag with the set normal access time period. If the match fails, the number of failures is counted as the number of abnormal time period visits YS1 for the tag at the current trigger time point;

[0068] Match the number of failed accesses with the dates of the past week to obtain the number of failed accesses on each day of the past week; if the number of failed accesses on one day is greater than the set number of allowed failed accesses per day, mark that day as an abnormal access date; count the number of abnormal access dates as the number of abnormal access days YS2 for this tag at the current trigger time point;

[0069] At the same time, the number of failed processing permission matches for the tag in the past week is obtained, and the number of failures in each category of the tag at the current trigger time point is obtained by classifying them based on transmission failure, modification failure, and deletion failure.

[0070] The number of failures in each category is marked as f1, f2 and f3 respectively; where f1, f2 and f3 correspond to the number of transmission failures, the number of modification failures and the number of deletion failures respectively;

[0071] The processing anomaly evaluation index YS3 and the abnormal state evaluation index YCP of the tag at the current trigger time point are calculated by formulas (1) and (2) respectively; specifically:

[0072] in accordance with , and calculate; the processing anomaly evaluation index YS3 of the tag at the current trigger time point is calculated by formula (1); where aq1, aq2 and aq3 are the influence weight factors of the number of transmission failures f1, the number of modification failures f2 and the number of deletion failures f3, and the values ​​of aq1, aq2 and aq3 are 1.034, 1.058 and 1.069 respectively;

[0073] The abnormal state evaluation index YCP of the tag at the current trigger time point is calculated by formula (2); , as well as They respectively represent the number of access times allowed during the abnormal period, the number of days allowed for abnormal access, and the abnormal handling permission index corresponding to the database established by the tag; bw1, bw2, and bw3 are the influencing weight factors of the number of access times during the abnormal period YS1, the number of days allowed for abnormal access YS2, and the abnormal handling evaluation index YS3 of the tag, and the values ​​of bw1, bw2, and bw3 are 1.125, 1.137, and 1.158, respectively;

[0074] Set the abnormal status assessment threshold index of each established database; and mark the threshold indexes corresponding to the source system database, the user submission database, and the external provider database as YT1, YT2, and YT3 respectively;

[0075] Compare the abnormal state evaluation index YCP calculated by the tag at the current trigger time point with the corresponding threshold index YTi; where i=1, 2 or 3; if YCP>YTi, calculate the difference between the two, and match the obtained difference with the multiple difference value ranges set in the corresponding database to obtain the abnormal risk level of the tag at the current trigger time point; each difference value range corresponds to an abnormal risk level;

[0076] At the same time, a tree diagram of the number of failed accesses, failed processing permission matches, and corresponding users for the tag in the past week is constructed; the corresponding users are all users who have had access failures and failed processing permission matches for the tag in the past week, and the cumulative number of failed accesses and failed processing permission matches for each user is calculated, and the number of arrows corresponding to the user in the tree diagram is counted; if the number of arrows is 2 and the cumulative number is less than or equal to 3, the user is marked as a first-level abnormal user; if the number of arrows is 1 and the cumulative number is greater than 3, it is also marked as a first-level abnormal user; if the number of arrows is 2 and the cumulative number is greater than 3, the user is marked as a second-level abnormal user;

[0077] The abnormal level generated by each user, the abnormal risk level generated at the current trigger time point and the label code are integrated into a risk data packet and sent to the mobile terminal or email of the manager who is currently in working state;

[0078] It should be noted that after the abnormal retrieval signal is triggered, by integrating and analyzing the historical access data of the tag in the past week, it is possible to determine whether there are risks and anomalies in the storage process of the sensitive data corresponding to the current tag, and promptly notify the management staff to pay attention to possible tag risks and abnormal users, thereby ensuring the security of sensitive data storage.

[0079] S2-203: The manager receives and analyzes the risk data packet generated at the current trigger time point, and performs risk avoidance and problem optimization in advance based on the analysis results;

[0080] S3: Place the servers corresponding to each established database in an independent subnet and set only necessary network connections; use IDS and IPS to discover and prevent intrusions suffered by each established database and take corresponding measures. The specific steps are as follows:

[0081] S3-301: Block the current network attack through IDS and IPS. When the blocking fails, first cut off the connection between the database and the network, analyze the specific characteristics and patterns of the current network attack process, and establish the identification information template of the current network attack based on the analysis results; such as the pattern of attack traffic, the characteristics of attack code and the tools used by the attacker;

[0082] It should be noted that establishing an identification information template for current network attacks can be used as reference historical data in the future to update the template database, providing a basis and reference for technical personnel to solve problems; thereby further improving the security of sensitive data storage and transmission.

[0083] S3-302: Obtain global cyber attack information and data at the current time point from the participating security community threat intelligence sharing platform, and match the established identification information template. If the match fails, trigger maintenance signaling and proceed to the next step;

[0084] It should be noted that by participating in the threat intelligence sharing platform of other organizations and security communities, we can obtain network attack information and data from around the world; by matching with this information, we can promptly identify the types of attacks facing the database.

[0085] S3-303: After the maintenance signaling is triggered, a circle is drawn with the currently attacked server as the center and the distance as the radius, and available technicians within the circle are screened, and a position feedback instruction is sent to the mobile terminals of the technicians within the circle. After confirming the position feedback instruction, each technician obtains the current actual location of each technician, and calculates the route distance based on the current actual location of each technician and the location of the server to obtain the required walking distance of each technician; the distance unit is meter;

[0086] The required walking distance of each technician is converted into a score, and multiple value ranges matching the required walking distance are set, and each value range corresponds to a score; the score range is 1-10; after matching the required walking distance of each technician with the set multiple value ranges, the distance estimation score h1 of each technician is obtained;

[0087] At the same time, the working years and the total number of processing times are extracted from the identity information of each technician; the number of successful times in the total number of processing times of each technician is extracted, and the ratio between the number of successful times and the total number of processing times is calculated, which is recorded as the success rate;

[0088] Based on the above steps, the working years, total number of processing times and success rate of each technician are converted into scores in the same way; and the estimated years of service, total processing times and success rate of each technician are marked as h2, h3 and h4 respectively;

[0089] The shorter the distance a technician needs to walk, the higher the conversion score; the longer the working experience, the higher the conversion score; the more total processing times, the higher the conversion score; the greater the success rate, the higher the conversion score;

[0090] The emergency effectiveness value GP of each technician at the current time point = h1+h2+h3+h4;

[0091] The technician with the largest emergency effectiveness value GP is selected as the problem solver, and the location of the corresponding server and the identification information template of the current network attack are sent to the mobile terminal of the technician; at the same time, the total number of processing times of the technician is increased by one;

[0092] If the problem is solved successfully by the problem solver, the number of successes of the problem solver will be increased by one; if the problem solver fails to solve the problem, the technician with the second highest emergency effectiveness value GP will be selected as the problem solver; and the same goes for the following cases;

[0093] It should be noted that a range is set based on the server currently under attack, and relevant parameters of technicians in the range are obtained for analysis. This allows the best technician to be selected based on the current situation to go to the server location to solve the problem, thereby ensuring the security of sensitive data and avoiding leakage and loss.

[0094] S3-304: After the current server is attacked by a network and resolved, the improvement signaling is automatically triggered, and the historical attack data of the server within the set time period is analyzed to obtain the optimization evaluation index MHP of the corresponding server corresponding to the current trigger time point, specifically:

[0095] Extract the number of attacks on the server to which the current database is built within the set time period, extract the number of maintenance signaling triggers based on the number of attacks, calculate the difference between the number of attacks and the number of maintenance signaling triggers, and obtain the number of successful automatic interceptions; calculate the ratio between the number of successful automatic interceptions and the number of attacks, obtain the interception ratio and record it as LJ1; record the number of attacks as LJ2;

[0096] Different risk additional values ​​are set based on the servers to which each established database belongs, and the server risk additional values ​​corresponding to the source system database, user submitted database, and external provider database are marked as X1, X2, and X3, respectively; X1, X2, and X3 are 1.078, 1.113, and 1.146, respectively;

[0097] It should be noted that setting different risk additional values ​​can reflect the different importance of the corresponding servers based on different sensitive data sources, thereby improving the accuracy of data analysis.

[0098] According to the formula , calculate the optimization evaluation index MHP of the current server; and They represent the minimum interception ratio and the number of attacks allowed for the corresponding server within the set time period; yt1 and yt2 are the impact weight factors of the interception ratio LJ1 and the number of attacks LJ2, and their values ​​are 1.278 and 1.354 respectively; E is a preset constant, ranging from 2.038 to 2.076, and the specific value depends on the source of sensitive data of the current server; Xc represents the risk additional value of each corresponding server, where c=1, 2 or 3;

[0099] The optimization evaluation index MHP of the current server is compared with the reference optimization evaluation index set by the corresponding server. If it is greater than the corresponding reference optimization evaluation index, a server security optimization signaling is generated and sent to the mobile terminal of the technician with the largest emergency effectiveness value GP within the current server range;

[0100] S3-305: The technicians patch and optimize the security vulnerabilities of the current server based on the generated server security optimization signaling;

[0101] S4: Set fixed time intervals for tracing and auditing sensitive data, and continuously optimize and improve the problems and weaknesses found during the tracking and tracing process of each tag.

[0102] The above formulas are obtained by collecting a large amount of data and performing software simulation, and a formula close to the actual value is selected. The influencing weight factor and specific coefficient value in the formula are set by technical personnel in this field according to actual conditions, and can be adjusted and modified later.

[0103] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A tag-based sensitive data tracing method, characterized in that: include: S1: First, mark and classify the sensitive data involved. The specific steps are as follows: S1-101: Establish multiple databases corresponding to sensitive data classifications, and send the sensitive data involved to the corresponding databases according to different data sources according to the sources of the sensitive data; S1-102: After the classification of the sensitive data involved is completed, collect the operations and events related to each sensitive data; Record this information and associate it with the corresponding sensitive data as an integrated data package of the sensitive data, and assign a unique label to each integrated data package of sensitive data; the label is coded in letters and numbers; S1-103: Establish a label corresponding to each sensitive data based on steps S1-101 to S1-102; S2: When a user accesses the corresponding sensitive data through each assigned label, the audit signaling is automatically triggered. The specific steps are: S2-201: When the audit signaling is triggered, the user's identity information is verified and the required access rights are checked. If the current user identity has the corresponding permissions, it is considered to have passed the audit; S2-202: When the audit fails or the processing method does not match the authority, the abnormal retrieval signaling is triggered, and the historical related data is extracted from the integrated data packet of the tag and analyzed to obtain the abnormal state evaluation index YCP of the tag; Extract historical data from the integrated data package of the corresponding tag and analyze it, specifically: Obtain the historical access data of the past week from the integrated data package of the tag, and extract the number of visits that failed the review from the historical access data, and record it as the number of failed accesses; set the normal access time period for each tag, and match the time point of each failed access number of the corresponding tag with the set normal access time period. If the match fails, count the number of failures as the number of abnormal time period visits YS1 for the tag at the current trigger time point; match the number of failed accesses with the dates of each day in the past week to obtain the number of failed accesses for each day in the past week; if the number of failed accesses on one day is greater than the set number of allowed failed accesses per day, mark that day as an abnormal access date; count the number of days of abnormal access dates as the number of abnormal access days YS2 for the tag at the current trigger time point; The abnormal state evaluation index YCP of the corresponding label is obtained, specifically: Get the number of failed processing permission matches for the tag in the past week, and classify them based on transmission failure, modification failure, and deletion failure, to get the number of failures for each category of the tag at the current trigger time point; The number of failures of each category is marked as f1, f2, and f3; Where f1, f2 and f3 correspond to the number of transmission failures, modification failures and deletion failures respectively; The processing anomaly evaluation index YS3 and the abnormal state evaluation index YCP of the tag at the current trigger time point are calculated by formulas (1) and (2) respectively; specifically: in accordance with , Calculate; calculate the processing anomaly evaluation index YS3 of the tag at the current trigger time point by formula (1); where aq1, aq2 and aq3 are the influence weight factors of the number of transmission failures f1, the number of modification failures f2 and the number of deletion failures f3, and the values ​​of aq1, aq2 and aq3 are 1.034, 1.058 and 1.069 respectively; The abnormal state evaluation index YCP of the tag at the current trigger time point is calculated by formula (2); , as well as They respectively represent the number of access times allowed during the abnormal period, the number of days allowed for abnormal access, and the abnormal handling permission index corresponding to the database established by the tag; bw1, bw2, and bw3 are the influencing weight factors of the number of access times during the abnormal period YS1, the number of days allowed for abnormal access YS2, and the abnormal handling evaluation index YS3 of the tag, and the values ​​of bw1, bw2, and bw3 are 1.125, 1.137, and 1.158, respectively; Based on the obtained abnormal state evaluation index YCP, further processing: Set the abnormal status assessment threshold index of each established database; and mark the threshold indexes corresponding to the source system database, the user submission database, and the external provider database as YT1, YT2, and YT3 respectively; Compare the abnormal state evaluation index YCP calculated by the tag at the current trigger time point with the corresponding threshold index YTi; where i=1, 2 or 3; if YCP>YTi, calculate the difference between the two, and match the obtained difference with the multiple difference value ranges set in the corresponding database to obtain the abnormal risk level of the tag at the current trigger time point; each difference value range corresponds to an abnormal risk level; At the same time, a tree diagram of the number of failed accesses, failed processing permission matches, and corresponding users for the tag in the past week is constructed; the corresponding users are all users who have had access failures and failed processing permission matches for the tag in the past week, and the cumulative number of failed accesses and failed processing permission matches for each user is calculated, and the number of arrows corresponding to the user in the tree diagram is counted; if the number of arrows is 2 and the cumulative number is less than or equal to 3, the user is marked as a first-level abnormal user; if the number of arrows is 1 and the cumulative number is greater than 3, it is also marked as a first-level abnormal user; if the number of arrows is 2 and the cumulative number is greater than 3, the user is marked as a second-level abnormal user; The abnormal level generated by each user, the abnormal risk level generated at the current trigger time point and the label code are integrated into a risk data packet and sent to the mobile terminal or email of the manager who is currently in working state; S2-203: The manager receives and analyzes the risk data packet generated at the current trigger time point; S3: The servers corresponding to each established database are placed in independent subnets, and only necessary network connections are allowed; IDS and IPS are used to discover and prevent intrusions suffered by each established database, and corresponding processing is performed. The specific steps are as follows: S3-301: Block the current network attack through IDS and IPS. When the blocking fails, first cut off the connection between each database and the network, analyze the specific characteristics and patterns of the current network attack process, and establish an identification information template of the current network attack based on the analysis results; S3-302: Obtain global cyber attack information and data at the current time point from the participating security community threat intelligence sharing platform, and match the established identification information template. If the match fails, trigger maintenance signaling and proceed to the next step; S3-303: After the maintenance signal is triggered, the technician with the largest emergency effectiveness value GP within the scope is selected as the solution provider; Specifically: Draw a circle with the server currently under attack as the center and the distance as the radius, select the available technicians within the circle, and send a position feedback command to the mobile terminals of the technicians within the range. After confirming the position feedback command, each technician obtains the current actual location of each technician, calculates the route distance based on the current actual location of each technician and the location of the server, and obtains the required walking distance of each technician; the distance unit is meter; The required walking distance of each technician is converted into a score, and multiple value ranges matching the required walking distance are set, and each value range corresponds to a score; the score range is 1-10; after matching the required walking distance of each technician with the set multiple value ranges, the distance estimation score h1 of each technician is obtained; At the same time, the working years and total number of processing times are extracted from the identity information of each technician; Extract the number of successful times from the total number of times each technician has processed, calculate the ratio between the number of successful times and the total number of times processed, and record it as the success rate; Based on the above steps, the working years, total number of processing times and success rate of each technician are converted into scores in the same way; and the estimated years of service, total processing times and success rate of each technician are marked as h2, h3 and h4 respectively; The emergency effectiveness value GP of each technician at the current time point = h1+h2+h3+h4; The technician with the largest emergency effectiveness value GP is selected as the problem solver, and the location of the corresponding server and the identification information template of the current network attack are sent to the mobile terminal of the technician; at the same time, the total number of processing times of the technician is increased by one; S3-304: After the current server is attacked by a network and resolved, the improvement signaling is automatically triggered, and the historical attack data of the server within a set time period is analyzed to obtain the optimization evaluation index MHP of the corresponding server corresponding to the current trigger time point; S3-305: The technicians patch and optimize the security vulnerabilities of the current server based on the generated server security optimization signaling; S4: Set fixed time intervals for tracing and auditing sensitive data, and continuously optimize and improve the problems and weaknesses found during the tracking and tracing process of each tag.

2. A tag-based sensitive data tracing method according to claim 1, characterized in that: The optimization evaluation index MHP of the corresponding server corresponding to the current trigger time point is obtained, specifically: Extract the number of attacks on the server to which the current database is built within the set time period, extract the number of times the maintenance signaling is triggered based on the number of attacks, calculate the difference between the number of attacks and the number of times the maintenance signaling is triggered, and obtain the number of successful automatic interceptions; Calculate the ratio between the number of successful automatic interceptions and the number of attacks to obtain the interception ratio and record it as LJ1; record the number of attacks as LJ2; Different risk additional values ​​are set based on the servers to which each established database belongs, and the server risk additional values ​​corresponding to the source system database, user submitted database, and external provider database are marked as X1, X2, and X3, respectively; X1, X2, and X3 are 1.078, 1.113, and 1.146, respectively; According to the formula , calculate the optimization evaluation index MHP of the current server; and They represent the minimum interception ratio and the number of attacks allowed for the corresponding server within the set time period; yt1 and yt2 are the impact weight factors of the interception ratio LJ1 and the number of attacks LJ2, and their values ​​are 1.278 and 1.354 respectively; E is a preset constant with a value range of 2.038-2.076, and the specific value depends on the source of sensitive data of the current server; Xc represents the risk additional value of each corresponding server, where c=1, 2 or 3; The optimization evaluation index MHP of the current server is compared with the reference optimization evaluation index set for the corresponding server. If it is greater than the corresponding reference optimization evaluation index, a server security optimization signaling is generated and sent to the mobile terminal of the technician with the largest emergency effectiveness value GP within the current server range.

Images