A method, device, equipment and medium for access control of sensitive data

Abstract

The present application discloses a method, device, equipment and medium for access control of sensitive data, which relates to the field of computer information security, including: intercepting sensitive data access requests, and calling the extended attributes of sensitive data corresponding to the sensitive data access requests; verifying the integrity signature of the extended attributes through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request; if the access control result is to allow access, access to the sensitive data is performed according to the permissions defined by the extended attributes; if the access control result is not to allow access, access to the sensitive data is denied and the corresponding log is recorded. By introducing the SM2 collaborative signature technology, the access control of sensitive data is made more sophisticated and more secure. System administrators can implement access control to files by attaching special encryption attributes to files and writing custom control logic.

Description

Technical Field

[0001] The present invention relates to the field of computer information security, and in particular to a method, device, equipment and medium for controlling access to sensitive data. Background Art

[0002] With the rapid development of information technology, data security issues have become increasingly prominent. Traditional operating system access control mechanisms usually rely on three basic permission modes: users, groups, and other users for permission management. This traditional permission control method has certain limitations. Its control granularity is coarse and cannot meet the needs of refined permission management in modern complex application scenarios. In order to protect key sensitive data, the usual practice is to encrypt the data. However, although directly encrypting sensitive data can improve security, it is often cumbersome in actual use. Users need to manually perform encryption and decryption operations every time they access data, which undoubtedly increases the complexity of use and may lead to reduced efficiency. In addition, the encryption operation itself does not achieve fine-grained control of data access rights, but only protects the data content.

[0003] Based on the Linux Security Modules (LSM) hook mechanism, you can implement custom security policy extensions at the operating system kernel layer. By extending the LSM hook mechanism, you can add additional extended attributes when accessing resources, thereby achieving more fine-grained control over key sensitive data. In this way, administrators can set complex access control policies for sensitive data without affecting normal user use, and this control is completely transparent to users and does not require additional user operations.

[0004] However, as information security issues intensify, the operating system kernel itself or commonly used software may have security vulnerabilities, which attackers can exploit to maliciously escalate privileges and bypass existing access control mechanisms. Attackers may even illegally access or modify key sensitive data by tampering with the extended attributes set by LSM. Therefore, relying solely on traditional access control mechanisms is difficult to cope with increasingly complex security threats. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for access control of sensitive data, which can implement dynamic access control on sensitive data during access process and reduce security threats. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a method for access control of sensitive data, comprising:

[0007] Intercepting a sensitive data access request, and calling an extended attribute of the sensitive data corresponding to the sensitive data access request; wherein the extended attribute includes a signed encryption attribute;

[0008] Performing integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain an access control result of the sensitive data access request;

[0009] If the access control result is that access is allowed, accessing the sensitive data according to the permission defined by the extended attribute;

[0010] If the access control result is that access is not allowed, access to the sensitive data is denied and a corresponding log is recorded.

[0011] Optionally, before intercepting the sensitive data access request, the method includes:

[0012] Through encrypted communication between the system administrator and the trusted key module, an encrypted attribute for double signing the attribute information of the sensitive data is obtained; wherein the attribute information includes the access rights of the sensitive data and the encryption strength or encryption method of the sensitive data;

[0013] The encryption attribute and signature information are stored in the extended attribute.

[0014] Optionally, the step of obtaining the encryption attribute of performing double signing on the attribute information of the sensitive data through encrypted communication between the system administrator and the trusted key module includes:

[0015] Through encrypted communication between the system administrator and the trusted key module, the attribute information of the sensitive data is double-signed using the first random number private key and the second random number private key in the signature information to obtain the encryption attribute of the double signature.

[0016] Optionally, before using the first random number private key and the second random number private key in the signature information to double-sign the attribute information of the sensitive data, the method further includes:

[0017] A first random number private key is generated in advance by a system administrator, and the first public key information of the system administrator's side is calculated by using the first random number private key and SM2 algorithm parameters, and then the first public key information is sent to the trusted key module through an encrypted transmission channel connected to the trusted key module;

[0018] Pre-generate a second random number private key through the trusted key module, and use the second random number private key and SM2 algorithm parameters to calculate the second public key information on the side where the trusted key module is located, and then send the second public key information to the system administrator through the encrypted transmission channel;

[0019] The system administrator calculates common key information according to the first random number private key, the second public key information and the SM2 algorithm parameters, and sends the common key information to the trusted key module through the encrypted transmission channel, so that the trusted key module stores the common key information, the second random number private key and the first public key information;

[0020] The common key information, the first random number private key and the second public key information are stored by the system administrator.

[0021] Optionally, the performing integrity signature verification on the extended attribute by using an SM2 collaborative signature system to obtain an access control result of the sensitive data access request includes:

[0022] The signature information is extracted from the extended attribute through the SM2 collaborative signature system, and the signature information is verified using the first public key information and the second public key information to obtain the integrity signature verification of the encrypted attribute, obtain the corresponding verification result, and use the verification result as the access control result of the sensitive data access request.

[0023] Optionally, if the access control result is that access is allowed, accessing the sensitive data according to the permission defined by the extended attribute includes:

[0024] If the access control result is that access is allowed, the sensitive data is accessed according to the authority corresponding to the encryption attribute of the sensitive data in the dynamic response security policy.

[0025] Optionally, if the access control result is that access is allowed, before accessing the sensitive data according to the permission corresponding to the encryption attribute of the sensitive data in the dynamic response security policy, the method further includes:

[0026] According to the real-time access frequency of sensitive data and the security requirements of the sensitive data, any one or more of the access rights, encryption strength and encryption method of the sensitive data are formulated and dynamically adjusted to obtain a corresponding dynamic response security strategy.

[0027] In a second aspect, the present application discloses a sensitive data access control device, comprising:

[0028] A request interception module, used to intercept sensitive data access requests and call extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes;

[0029] A result acquisition module, used to perform integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request;

[0030] A first access control module, configured to access the sensitive data according to the permission defined by the extended attribute if the access control result is that access is allowed;

[0031] The second access control module is used to deny access to the sensitive data and record corresponding logs if the access control result is that access is not allowed.

[0032] In a third aspect, the present application discloses an electronic device, comprising:

[0033] Memory, used to store computer programs;

[0034] A processor is used to execute the computer program to implement the steps of the aforementioned disclosed method for controlling access to sensitive data.

[0035] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed method for controlling access to sensitive data are implemented.

[0036] It can be seen that the present application discloses a method for access control of sensitive data, including: intercepting sensitive data access requests, and calling the extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes; performing integrity signature verification on the extended attributes through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request; if the access control result is to allow access, then access to the sensitive data is performed according to the permissions defined by the extended attributes; if the access control result is not to allow access, then access to the sensitive data is denied and the corresponding log is recorded. It can be seen that by introducing the SM2 collaborative signature technology, the access control of sensitive data is more refined and more secure. System administrators can implement access control to files by attaching special encryption attributes to files and writing custom control logic. The SM2 collaborative signature algorithm ensures that the signatures of key data extended attributes are jointly signed by multiple trusted parties. Even if one of the parties is attacked and the authority is elevated, the attacker cannot obtain the complete key and cannot tamper with the signature, thereby effectively ensuring the security of key sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A flow chart of a sensitive data access control method disclosed in this application;

[0039] Figure 2 A flowchart of a specific sensitive data access control method disclosed in this application;

[0040] Figure 3 A schematic diagram of the structure of a sensitive data access control device disclosed in this application;

[0041] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0043] With the rapid development of information technology, data security issues have become increasingly prominent. Traditional operating system access control mechanisms usually rely on three basic permission modes: users, groups, and other users for permission management. This traditional permission control method has certain limitations. Its control granularity is coarse and cannot meet the needs of refined permission management in modern complex application scenarios. In order to protect key sensitive data, the usual practice is to encrypt the data. However, although directly encrypting sensitive data can improve security, it is often cumbersome in actual use. Users need to manually perform encryption and decryption operations every time they access data, which undoubtedly increases the complexity of use and may lead to reduced efficiency. In addition, the encryption operation itself does not achieve fine-grained control of data access rights, but only protects the data content.

[0044] Based on the Linux Security Modules (LSM) hook mechanism, you can implement custom security policy extensions at the operating system kernel layer. By extending the LSM hook mechanism, you can add additional extended attributes when accessing resources, thereby achieving more fine-grained control over key sensitive data. In this way, administrators can set complex access control policies for sensitive data without affecting normal user use, and this control is completely transparent to users and does not require additional user operations.

[0045] However, as information security issues intensify, the operating system kernel itself or commonly used software may have security vulnerabilities, which attackers can exploit to maliciously escalate privileges and bypass existing access control mechanisms. Attackers may even illegally access or modify key sensitive data by tampering with the extended attributes set by LSM. Therefore, relying solely on traditional access control mechanisms is difficult to cope with increasingly complex security threats.

[0046] To this end, the present invention provides an access control scheme for sensitive data, which can implement dynamic access control on sensitive data during its access process and reduce security threats.

[0047] Reference Figure 1 As shown, an embodiment of the present invention discloses a method for access control of sensitive data, including:

[0048] Step S11: intercepting a sensitive data access request, and calling an extended attribute of the sensitive data corresponding to the sensitive data access request; wherein the extended attribute includes a signed encryption attribute.

[0049] In this embodiment, before intercepting the sensitive data access request, the method includes: obtaining an encrypted attribute for double-signing the attribute information of the sensitive data through encrypted communication between the system administrator and the trusted key module; wherein the attribute information includes the sensitive data access rights and the encryption strength or encryption method of the sensitive data; and storing the encrypted attribute and signature information in the extended attribute. It can be understood that in order to implement access control on sensitive data, before intercepting the sensitive data access request, the attribute information of the sensitive data is double-encrypted through encrypted communication between the system administrator and the trusted key module, thereby ensuring that the attribute information of the sensitive data is in an encrypted transmission state. It should be noted that the attribute information specifically includes but is not limited to the encryption label of the sensitive data, the access control list (ACL), signature information, etc. In this way, the double signature of the attribute information can ensure that the attribute information is not modified without authorization, and even if a malicious attacker attempts to modify the attribute, the tampering will be detected during verification. However, if the attribute information itself is not encrypted, it may be easier for the attacker to obtain and tamper with the attribute content, thereby bypassing the security mechanism to access the sensitive data. In addition, the encrypted attribute contains important content such as the access control list (ACL) and signature information, which are directly related to the access control and security of the data. Encrypting it can prevent these sensitive information from being illegally obtained and used, ensuring that these attribute information can only be obtained and used through a legal verification process. In the security design of the entire system, data is protected by strong encryption algorithms during storage and transmission. Attribute information, as important information related to sensitive data, also needs to be encrypted to ensure that the system maintains a high level of security during dynamic access control and ensure the confidentiality, integrity and availability of data. Sensitive data itself is encrypted, and attribute information is closely related to sensitive data. Encrypting attribute information can keep it consistent with encrypted data in security protection, and better realize the system's comprehensive protection of sensitive data.

[0050] It should be noted that the encryption attribute management of sensitive data is implemented through extended attributes based on the LSM mechanism. These encryption attributes not only control the access rights of the data, but also integrate the SM2 (SM2 Elliptic Curve Public Key Cryptography Algorithm) collaborative signature system to ensure the integrity and security of the data. The following is the specific design and implementation plan of encryption attribute management:

[0051] 1. Definition and configuration of encryption attributes:

[0052] Attribute definition: Encryption attributes include access rights, data integrity requirements, encryption levels, etc. These attributes are attached to sensitive data through the extended attribute mechanism to dynamically control data access.

[0053] Attribute configuration: The system administrator is responsible for configuring these encryption attributes. By calling special tools or system commands, the administrator can set different encryption attributes for different data files or directories. For example, a file can be set to be accessible only to specific users within a specific time period.

[0054] 2. Storage and management of encrypted attributes:

[0055] Extended attribute storage: Encrypted attributes are stored in the file system's extended attributes. The file system maintains a set of extended attributes for each file or directory. These attributes are stored separately from the file data and loaded when the system calls.

[0056] Attribute update and revocation: Administrators can dynamically update or revoke encrypted attributes in response to permission adjustments or security policy changes. The updated attributes will be re-signed through the SM2 collaborative signature system to ensure that the attributes cannot be tampered with.

[0057] In this embodiment, through encrypted communication between the system administrator and the trusted key module, the attribute information of the sensitive data is double-signed using the first random number private key and the second random number private key in the signature information to obtain the encryption attribute of the double signature. It can be understood that the system administrator first initiates the initial signature: the system administrator first uses its private key (the first random number private key) to perform an initial signature on the attribute information of the data to generate a partial signature result. Then the system administrator sends the partial signature result: the system administrator sends the partial signature result to the trusted key module through a secure channel. Then the trusted key module performs a partial signature: after receiving the partial signature result, the trusted key module uses its private key (the second random number private key) to sign the result, generates a new partial signature, and returns it to the system administrator. The system administrator completes the final signature: after receiving the partial signature returned by the trusted key module, the system administrator generates a complete final signature. The signature contains the dual signatures of the system administrator and the key module to ensure the integrity and security of the signature.

[0058] The signature generation is described in detail as follows:

[0059] The system administrator (abbreviated as A) first generates a random number. ,in, The value range is an integer range, so, , perform an initial signature on the attribute information based on the first random number to obtain a partial signature result and , some of the signature results The calculation formula is as follows: , where G represents the SM2 algorithm parameters, and calculates the partial signature result , where some of the signature results The calculation formula is as follows: ,in, Represents the public key component (second public key information) of the trusted key module B, and then and Send to the trusted key module (abbreviated as B);

[0060] The trusted key module verifies whether ,in, Indicates the second random number private key. If they are not equal, the authentication fails and the collaborative signature is terminated. If they are equal, a random number is generated. (Second random number) , calculate the new partial signature and ,in, The calculation formula is as follows: , Indicates the first public key information on the system administrator's side. The calculation formula is as follows: , then and Send to system administrator A;

[0061] System Administrator A verifies whether If they are not equal, the authentication fails and the collaborative signature is terminated. If they are equal, the final signature is completed. The steps to complete the final signature are as follows: First, the total signature result is calculated based on the partial signature result and the new partial signature result, that is, the point ,remember , hash the specific data and message and perform a modulo operation on the result. Specifically, calculate and ,in, Indicates specific data, M indicates the message to be transmitted, Express Hash operation is performed with M, Indicates that a modulo operation is performed on the result. In this way, after the hash operation, the hash operation result plus the abscissa value of the total signature result is modulo processed to obtain a first correlation value that represents the correlation between the message, specific data, and signature result. , at the same time, based on the first correlation value , random number And the first random number private key Calculate and perform a modulus operation on the result to obtain a second correlation value n, and send n to the trusted key module B; wherein the trusted key module B calculates the first re-signature t based on the second correlation value, the second random number, and the second random number private key, , and sends t to system administrator A; system administrator A finally performs a second signature, through Calculate the final digital signature information and output the final digital signature , to obtain the encryption properties after double signing.

[0062] In this embodiment, before using the first random number private key and the second random number private key in the signature information to double-sign the attribute information of the sensitive data, it also includes: pre-generating a first random number private key by a system administrator, and using the first random number private key and SM2 algorithm parameters to calculate the first public key information on the side where the system administrator is located, and then sending the first public key information to the trusted key module through an encrypted transmission channel connected to the trusted key module; pre-generating a second random number private key by the trusted key module, and using the second random number private key and SM2 algorithm parameters to calculate the second public key information on the side where the trusted key module is located, and then sending the second public key information to the system administrator through the encrypted transmission channel; calculating common key information by the system administrator and based on the first random number private key, the second public key information and the SM2 algorithm parameters, and sending the common key information to the trusted key module through the encrypted transmission channel, so that the trusted key module stores the common key information, the second random number private key and the first public key information; storing the common key information, the first random number private key and the second public key information by the system administrator. It can be understood that the SM2 collaborative signature system completes the signing and verification of the attribute information of sensitive data through the joint participation of the system administrator and the trusted key module (such as a hardware encryption card, etc.). The following is a specific design and implementation scheme. The steps for generating a common key are as follows: Initial key exchange: Before the signature is generated, the system administrator and the trusted key module first perform an initial key exchange. The two parties generate their own SM2 key pairs and exchange public keys. Save the other party's public key: After the initial key exchange, the system administrator and the trusted key module securely save the other party's public key for subsequent signature generation and verification processes. This step ensures that both parties can verify each other's identity during the signing process to prevent man-in-the-middle attacks.

[0063] The common key is described in detail as follows:

[0064] The system administrator (abbreviated as A) first generates the first random number private key , , then calculate the public key component of A , , that is, the first public key information, G is a parameter in the SM2 elliptic curve public key cryptography algorithm, which is a base point on the elliptic curve, and Send to the trusted key module (abbreviated as B);

[0065] B generates a second random number private key , , calculate B's public key component , , which is the second public key information, and then generate Send to A;

[0066] A calculates the common key information , Finally, A and B store the common key information, their own random number private key, and the other party's public key information respectively, that is, A stores , B storage .

[0067] In this embodiment, when accessing sensitive data (receiving a sensitive data access request), the system intercepts the sensitive data access request through the LSM hook mechanism, and extracts the extended attributes of the sensitive data corresponding to the access request, so as to call the SM2 collaborative signature system to verify the encryption attributes.

[0068] Step S12: Perform integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request.

[0069] In this embodiment, the integrity signature verification process is as follows: Extract the signature: extract the complete signature information of the system administrator and the trusted key module from the extended attributes of the file where the sensitive data is located. Verify the public key: use the initially exchanged public key to ensure that the signature comes from the expected system administrator and trusted key module to prevent signature forgery. Verify the signature integrity: verify the integrity of the signature to ensure that the data has not been tampered with.

[0070] The signature verification is described in detail as follows: According to the national standard SM2 algorithm digital signature verification steps, collaborative signature extension is performed. , then we only need to calculate the elliptic curve point ,calculate , and verify Whether it is established or not, the specific steps are:

[0071] ;

[0072] Depend on , , Know , it indicates that the signature verification is successful and the corresponding access control result is obtained.

[0073] Step S13: If the access control result is that access is allowed, access to the sensitive data is performed according to the authority defined by the extended attribute.

[0074] In this embodiment, first, relevant encryption attributes are extracted from the extended attributes of the file system. These encryption attributes include permission information such as access control lists (ACLs). The access control list lists in detail the users, groups or other entities with access rights and the corresponding permission settings, and may also include relevant information such as the encryption level of the data and encryption tags. Then, access operations are performed according to different permission types, for example: read operation. If the extended attribute stipulates that a user or group has read permission to sensitive data, the system will allow the user or group to read the data in a prescribed manner. For example, the number of reads, time period or part of the read content may be restricted. The read operation may involve a decryption process because the sensitive data may be stored in encrypted form. The system will use the corresponding key to perform a decryption operation according to the pre-set encryption and decryption rules to obtain readable data content. Write operation: When the extended attribute allows an entity to perform a write operation, the entity can modify the sensitive data. Before writing, the system may verify the entity's permissions and related signature information again to ensure the legitimacy of the write operation. The write operation may also require encryption of the newly written data to ensure the security and integrity of the data. Create operation: If the permission allows the creation of new sensitive data, the system will operate according to the rules defined in the extended attributes. This may include setting the encryption attributes of the new data, such as encryption level, access control rules, etc. The newly created data will automatically be associated with the corresponding encryption attributes and signature information to ensure that it can be effectively controlled during subsequent access. Delete operation: For entities with delete permissions, the system will delete sensitive data in accordance with the prescribed procedures after verifying their permissions. At the same time, the relevant encryption attributes and signature information may be processed accordingly, such as recording the log of the deletion operation, updating the relevant index or directory structure, etc., to ensure the consistency and integrity of the system data. Execute operation: If the sensitive data is an executable file and the extended attributes allow an entity to execute it, then the entity can run the file. Before execution, the system will also verify the relevant permissions and signature information to ensure the legality and security of the execution operation.

[0075] Step S14: If the access control result is that access is not allowed, access to the sensitive data is denied and a corresponding log is recorded.

[0076] In this embodiment, if the access control result is that access is not allowed, the system will directly block the access request to ensure that sensitive data will not be illegally accessed. Regardless of whether it is a request for reading, writing, creating, deleting or executing sensitive data, as long as the access control result is that access is not allowed, the corresponding operation cannot be performed. For example, if it is a read request, the system will prevent data from being transferred from the storage medium to the requester; if it is a write request, the system will prohibit new data from being written to the location where the sensitive data is located; for a create request, new sensitive data will not be allowed to be created in the relevant location; a delete request will also be rejected to prevent sensitive data from being accidentally deleted; and an execution request for an executable file will also not be executed. In addition, while blocking the access request, the following content is recorded through the log: Request source information: record which user, process or IP address the access request was initiated from. This helps to track possible malicious behavior sources and understand which entity is trying to access sensitive data. Request type: clearly record the type of request, whether it is a read, write, create, delete or execute operation. By clarifying the request type, the reasons for the rejection of different types of operations and the possible security risk patterns can be better analyzed. Encryption attribute verification results: record the detailed results of encryption attribute verification. This includes whether the signature information is verified (whether it is because of signature mismatch, verification process error or other reasons that lead to verification failure), as well as the verification of related content such as the access control list (ACL) in the encryption attribute. This is crucial for analyzing the specific reasons for access denial and evaluating the security of the system. Final access decision: Clearly record the final access decision as "access is not allowed". This record can serve as an important basis for subsequent audits to ensure that the system's access control decision process is clear and traceable.

[0077] It should be noted that the above log records can be used for subsequent audit analysis and compliance checks. Specifically, audit and security analysis: These detailed log records will be used to regularly audit access logs to check for abnormal behavior or potential security issues. By analyzing the logs, it can be found whether there are malicious attackers who continue to try to access sensitive data, or whether there are loopholes in the system's access control rules. The audit results can be used to improve security policies and optimize access control processes to further improve the security of the system. Compliance checks: In some environments with high requirements for data security and compliance, such as finance, medical care, government, etc., these log records are also an important part of meeting compliance requirements. They can prove that the system's access control to sensitive data is strictly enforced, and can provide detailed access history for inspection and verification when necessary.

[0078] In this way, during the entire access process, the system will continuously monitor whether the access operation complies with the permissions defined by the extended attributes and the relevant security rules. For example, it may check in real time whether there are abnormal access behaviors, such as exceeding the specified number of accesses, accessing during prohibited time periods, etc. If abnormal behavior is found, the system may take corresponding measures, such as interrupting access, recording abnormal logs, and triggering alarms, etc., to ensure the security of sensitive data.

[0079] It can be seen that the present application discloses a method for access control of sensitive data, including: intercepting sensitive data access requests, and calling the extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes; performing integrity signature verification on the extended attributes through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request; if the access control result is to allow access, then access to the sensitive data is performed according to the permissions defined by the extended attributes; if the access control result is not to allow access, then access to the sensitive data is denied and the corresponding log is recorded. It can be seen that by introducing the SM2 collaborative signature technology, the access control of sensitive data is more refined and more secure. System administrators can implement access control to files by attaching special encryption attributes to files and writing custom control logic. The SM2 collaborative signature algorithm ensures that the signatures of key data extended attributes are jointly signed by multiple trusted parties. Even if one of the parties is attacked and the authority is elevated, the attacker cannot obtain the complete key and cannot tamper with the signature, thereby effectively ensuring the security of key sensitive data.

[0080] Reference Figure 2 As shown, the embodiment of the present invention discloses a specific method for controlling access to sensitive data. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically:

[0081] Step S21: intercepting a sensitive data access request, and calling an extended attribute of the sensitive data corresponding to the sensitive data access request; wherein the extended attribute includes a signed encryption attribute.

[0082] For a more detailed processing procedure in step S21, please refer to the aforementioned disclosed embodiment content, which will not be described again here.

[0083] Step S22: Extract signature information from the extended attribute through the SM2 collaborative signature system, and use the first public key information and the second public key information to verify the signature information to obtain the integrity signature verification of the encrypted attribute, obtain the corresponding verification result, and use the verification result as the access control result of the sensitive data access request.

[0084] In this embodiment, extended attribute acquisition: encryption attributes related to sensitive data are extracted from the extended attributes of the file system. These attributes define the access rights, encryption level, etc. of the data. Attribute format: encryption attributes usually include the encryption tag, access control list (ACL), signature information, etc. of the data. Then call the SM2 collaborative signature system for signature verification: pass the extracted encryption attributes to the SM2 collaborative signature system for verification. The system will check whether the attributes have been validly signed to ensure the integrity and authenticity of the attributes. Key verification: During the verification process, the system will use the pre-exchanged public and private keys for verification to ensure that the signature comes from a legitimate system administrator and a trusted key module.

[0085] Step S23: If the access control result is that access is allowed, the sensitive data is accessed according to the authority corresponding to the encryption attribute of the sensitive data in the dynamic response security policy.

[0086] In this embodiment, if the access control result is to allow access, before accessing the sensitive data according to the permission corresponding to the encryption attribute of the sensitive data in the dynamic response security policy, it also includes: formulating and dynamically adjusting any one or more of the access rights, encryption strength, and encryption method of the sensitive data according to the real-time access frequency of the sensitive data and the security requirements of the sensitive data to obtain the corresponding dynamic response security policy. It can be understood that in order to achieve dynamic management of encryption attributes, dynamic management is performed through the following dynamic response security policy, specifically including: Automated management: The configuration and verification of encryption attributes can be automatically performed through preset policies, reducing the manual operation of administrators. For example, some encryption attributes can be automatically adjusted based on system status or user behavior. Policy-driven attribute management: The administrator can predefine encryption policies, and the system will dynamically set encryption attributes according to the policies. For example, when the access frequency of a file increases, the system can automatically increase the encryption level, or automatically update the signature after sensitive operations. In this way, through encryption attributes, administrators can implement fine-grained access control on sensitive data to ensure that only authenticated users or processes can access specific data under specific conditions. The signature of the encrypted attribute ensures that it has not been modified without authorization. Even if a malicious attacker attempts to modify the attribute, the tampering will be detected during verification, ensuring data security.

[0087] As can be seen, LSM Hook extracts and verifies the extended attributes of the file at each access request to ensure the integrity of the encryption attributes and signature information. Access control rules are adjusted according to real-time security policies and dynamic configurations to ensure that the system can respond in various attack scenarios. In this way, the system performs integrity checks before each operation to ensure that the data has not been tampered with. Any modification of the data will trigger the attribute update and signature regeneration process to ensure data integrity.

[0088] Reference Figure 3 As shown, the present invention also discloses a sensitive data access control device, including:

[0089] A request interception module 11, used to intercept sensitive data access requests and call extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes;

[0090] A result acquisition module 12, used to perform integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request;

[0091] A first access control module 13, configured to access the sensitive data according to the permission defined by the extended attribute if the access control result is that access is allowed;

[0092] The second access control module 14 is configured to deny access to the sensitive data and record a corresponding log if the access control result is that access is not allowed.

[0093] It can be seen that the present application discloses intercepting sensitive data access requests and calling the extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes; the integrity signature verification of the extended attributes is performed through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request; if the access control result is to allow access, the sensitive data is accessed according to the permissions defined by the extended attributes; if the access control result is not allowed, access to the sensitive data is denied and the corresponding log is recorded. It can be seen that by introducing the SM2 collaborative signature technology, the access control of sensitive data is more refined and more secure. System administrators can implement access control to files by attaching special encryption attributes to files and writing custom control logic. The SM2 collaborative signature algorithm ensures that the signatures of key data extended attributes are jointly signed by multiple trusted parties. Even if one of the parties is attacked and the authority is elevated, the attacker cannot obtain the complete key and cannot tamper with the signature, thereby effectively ensuring the security of key sensitive data.

[0094] Furthermore, the present application also discloses an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0095] Figure 4A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the access control method for sensitive data disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0096] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0097] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0098] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0099] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the access control method for sensitive data executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data received by the electronic device and transmitted from an external device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0100] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed sensitive data access control method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0101] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0102] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory RAM (Random Access Memory), memory, read-only memory ROM (Read Only Memory), electrically programmable EPROM (Electrically Programmable Read Only Memory), electrically erasable programmable EEPROM (ElectricErasable Programmable Read Only Memory), register, hard disk, removable disk, CD-ROM (CompactDisc-Read Only Memory), or any other form of storage medium known in the technical field.

[0103] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0104] The scheme provided by the present invention is introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for controlling access to sensitive data, characterized in that: include: Intercepting a sensitive data access request, and calling an extended attribute of the sensitive data corresponding to the sensitive data access request; wherein the extended attribute includes a signed encryption attribute; Performing integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain an access control result of the sensitive data access request; If the access control result is that access is allowed, accessing the sensitive data according to the permission defined by the extended attribute; If the access control result is that access is not allowed, access to the sensitive data is denied and a corresponding log is recorded; Before intercepting the sensitive data access request, the following steps are included: Through encrypted communication between the system administrator and the trusted key module, an encrypted attribute for double signing the attribute information of the sensitive data is obtained; wherein the attribute information includes the access rights of the sensitive data and the encryption strength or encryption method of the sensitive data; Storing the encryption attribute and signature information in extended attributes; The method of obtaining the encryption attribute of double signing the attribute information of sensitive data through encrypted communication between the system administrator and the trusted key module includes: Through encrypted communication between the system administrator and the trusted key module, the attribute information of the sensitive data is double-signed using the first random number private key and the second random number private key in the signature information to obtain the encryption attribute of the double signature; Before the double signing of the attribute information of the sensitive data by using the first random number private key and the second random number private key in the signature information, the method further includes: A first random number private key is generated in advance by a system administrator, and the first public key information of the system administrator's side is calculated by using the first random number private key and SM2 algorithm parameters, and then the first public key information is sent to the trusted key module through an encrypted transmission channel connected to the trusted key module; Pre-generate a second random number private key through the trusted key module, and use the second random number private key and SM2 algorithm parameters to calculate the second public key information on the side where the trusted key module is located, and then send the second public key information to the system administrator through the encrypted transmission channel; The system administrator calculates common key information according to the first random number private key, the second public key information and the SM2 algorithm parameters, and sends the common key information to the trusted key module through the encrypted transmission channel, so that the trusted key module stores the common key information, the second random number private key and the first public key information; The common key information, the first random number private key and the second public key information are stored by the system administrator.

2. The method for controlling access to sensitive data according to claim 1, characterized in that: The performing integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request includes: The signature information is extracted from the extended attribute through the SM2 collaborative signature system, and the signature information is verified using the first public key information and the second public key information to obtain the integrity signature verification of the encrypted attribute, obtain the corresponding verification result, and use the verification result as the access control result of the sensitive data access request.

3. The method for controlling access to sensitive data according to claim 1 or 2, characterized in that: If the access control result is that access is allowed, accessing the sensitive data according to the permission defined by the extended attribute includes: If the access control result is that access is allowed, the sensitive data is accessed according to the authority corresponding to the encryption attribute of the sensitive data in the dynamic response security policy.

4. The method for controlling access to sensitive data according to claim 3, characterized in that: If the access control result is that access is allowed, before accessing the sensitive data according to the permission corresponding to the encryption attribute of the sensitive data in the dynamic response security policy, the method further includes: According to the real-time access frequency of sensitive data and the security requirements of the sensitive data, any one or more of the access rights, encryption strength and encryption method of the sensitive data are formulated and dynamically adjusted to obtain a corresponding dynamic response security strategy.

5. A sensitive data access control device, characterized in that: include: A request interception module, used to intercept sensitive data access requests and call extended attributes of sensitive data corresponding to the sensitive data access requests; wherein the extended attributes include signed encryption attributes; A result acquisition module, used to perform integrity signature verification on the extended attribute through the SM2 collaborative signature system to obtain the access control result of the sensitive data access request; A first access control module, configured to access the sensitive data according to the permission defined by the extended attribute if the access control result is that access is allowed; A second access control module, configured to deny access to the sensitive data and record a corresponding log if the access control result is that access is not allowed; The access control device is used to obtain the encryption attribute of double signing the attribute information of sensitive data through encrypted communication between the system administrator and the trusted key module; wherein the attribute information includes the access right of sensitive data and the encryption strength or encryption mode of sensitive data; and store the encryption attribute and signature information in the extended attribute; The access control device is specifically used to perform a double signature on the attribute information of the sensitive data by using the first random number private key and the second random number private key in the signature information through encrypted communication between the system administrator and the trusted key module, so as to obtain the encryption attribute of the double signature; The access control device is also used to pre-generate a first random number private key through a system administrator, and use the first random number private key and SM2 algorithm parameters to calculate the first public key information on the side where the system administrator is located, and then send the first public key information to the trusted key module through an encrypted transmission channel connected to the trusted key module; pre-generate a second random number private key through the trusted key module, and use the second random number private key and SM2 algorithm parameters to calculate the second public key information on the side where the trusted key module is located, and then send the second public key information to the system administrator through the encrypted transmission channel; calculate common key information through the system administrator and based on the first random number private key, the second public key information and the SM2 algorithm parameters, and send the common key information to the trusted key module through the encrypted transmission channel, so that the trusted key module stores the common key information, the second random number private key and the first public key information; store the common key information, the first random number private key and the second public key information through the system administrator.

6. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the sensitive data access control method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the method for access control of sensitive data as described in any one of claims 1 to 4 are implemented.

Images