Business travel sensitive authority control and data encryption system and method

Abstract

The invention provides a business travel sensitive authority control and data encryption system and method, and belongs to the technical field of business travel information encryption. A data encryption gateway receives business travel information access instructions of a user terminal and a business travel server; a public and private key pair is stored in the cipher machine; the data encryption gateway respectively obtains business travel information sent by the user terminal and the business travel server, encrypts the received business travel information based on a public key, and stores the encrypted business travel information in a business travel database; and the data encryption gateway obtains information calling instructions sent by the user terminal and the business travel server, calls corresponding business travel information from the business travel database based on the information calling instructions, decrypts the business travel information and sends the decrypted business travel information to the user terminal and the business travel server. According to the invention, sensitive authority control and data encryption are carried out by using the data encryption gateway, the USB key and the cipher machine, two-factor authentication is realized, and the security of data information is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of business travel information encryption, and in particular relates to a system and method for business travel sensitive authority control and data encryption. Background Art

[0002] Currently in the business travel sector, sensitive permission control and data encryption are key measures to ensure data security and privacy. These technologies are designed to prevent unauthorized access and data leakage, and protect sensitive information of enterprises and customers.

[0003] The user information of the business travel system is very sensitive. Whether in the storage layer, display layer or transmission layer, sensitive information must be packaged, and the access rights of each data must be strictly controlled to avoid horizontal and vertical unauthorized access. Especially for the core information of personnel (ID number, mobile phone number, itinerary information), it must be ensured that no unauthorized personnel (including operation and maintenance, developers) can view it, which requires no plain text transmission and decryption method from the storage layer to the display layer.

[0004] In business travel systems, sensitive permission control and data encryption are important means to ensure data security, but these methods also have some shortcomings. The first is the lack of sensitive permission control. As the scale of enterprises expands and the complexity of business increases, permission configuration may become very complicated. This requires administrators to have a high level of technical skills and expertise to correctly configure and maintain the permission system. However, in actual operations, due to personnel mobility, differences in skill levels, etc., permission configuration may be wrong or missed, leading to security risks.

[0005] In the prior art, business travel information is generally encrypted using a key, but the key is the main means of data encryption technology. However, there are also security risks in the storage, transmission and use of the key. If the key is leaked or stolen, the security of the encrypted data will be seriously threatened, which can easily affect the security of business travel information during storage and transmission, causing data leakage. Summary of the invention

[0006] The present invention provides a method for business travel sensitive authority control and data encryption, which can effectively control sensitive authority control and data encryption to ensure the security of business travel information.

[0007] The system includes: user terminal, data encryption gateway, business travel server, business travel database and cipher machine;

[0008] The user terminal and the business travel server are respectively connected to the business travel database through a data encryption gateway; the data encryption gateway receives business travel information access instructions from the user terminal and the business travel server respectively;

[0009] The data encryption gateway is connected to the cryptographic machine for communication; the cryptographic machine stores a public-private key pair;

[0010] The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database;

[0011] The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

[0012] It should be further explained that it also includes: U shield;

[0013] The U-Shield communicates with the user's terminal and provides the user with a certificate signed by a private key;

[0014] The certificate includes a signed public key used to encrypt business travel information and authenticate user identities;

[0015] The user terminal decrypts the business travel information encrypted by the public key based on the private key of the U shield;

[0016] Business travel information includes but is not limited to user name, password, ID number, mobile phone number, travel information and travel time.

[0017] It should be further explained that the data encryption gateway stores symmetric keys and asymmetric keys, which are used to encrypt the communication interface of the data encryption gateway and encrypt business travel information respectively;

[0018] The data encryption gateway distinguishes symmetric keys based on the interface dimension, and different communication interfaces of the data encryption gateway use different keys for encryption processing.

[0019] It is further necessary to explain that the data encryption gateway stores the public key based on the database table field dimension mapping cipher machine index;

[0020] The encrypted fields are individually assigned asymmetric public key indexes and there is no duplication between fields.

[0021] It should be further explained that the data encryption gateway uses regular expression matching and keyword matching methods to match sensitive information in business travel information.

[0022] According to another embodiment of the present application, a data encryption method with business travel sensitive authority control and data is provided, the method comprising:

[0023] The data encryption gateway receives business travel information access instructions from the user terminal and the business travel server respectively;

[0024] The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database;

[0025] The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

[0026] It should be further noted that the method also includes: the data encryption gateway monitors HTTP traffic generated by the system, identifies HTTP traffic belonging to the Web application, and excludes data traffic of non-HTTP protocols;

[0027] The data encryption gateway sets the packet capture conditions based on the source address, destination address, and destination port information, and collects traffic data that meets the preset requirements;

[0028] The data encryption gateway restores the key components of the HTTP protocol, including but not limited to the POST request instruction, the requested URL address, the request header information, and the data body of the POST request.

[0029] It should be further explained that the method also includes:

[0030] Generate a key pair based on the U-Shield, store the private key in the user terminal and the business travel server, and use the public key for subsequent certificate issuance;

[0031] Submit the public key and personal information to the data encryption gateway. After identity authentication is passed, a digital certificate is issued;

[0032] A digital certificate contains a public key, user information, and the CA’s digital signature;

[0033] Send the issued digital certificate to the user terminal and business travel server;

[0034] After the user logs in or successfully authenticates on the business travel server based on the user terminal, the business travel server generates authentication success identification information and returns it to the user terminal;

[0035] The user terminal saves the authentication success identification information, and carries the authentication success identification information in the request header or request body when making subsequent requests to sensitive interfaces.

[0036] It should be further explained that the method also includes:

[0037] Configure the corresponding public and private key pairs for the user terminal;

[0038] Based on the public key in the public-private key pair, the data encryption gateway encrypts the business travel information sent by the user terminal to generate a business travel data key;

[0039] configured to generate first business travel encrypted information based on the public key and the generated business travel data key;

[0040] Submit the first business travel encrypted information after signing it to the cipher machine to obtain the business travel encrypted information hash value of the first business travel encrypted information; the signature of the first business travel encrypted information is used to identify that the first business travel encrypted information is constructed by the data encryption gateway;

[0041] Return the business travel encrypted information hash value and the private key in the public-private key pair to the data encryption gateway, so that the data encryption gateway issues the business travel encrypted information hash value and the private key to the user terminal.

[0042] It should be further explained that the method also includes:

[0043] Receive a verification request; the verification request carries the content of the business travel information to be verified and the business travel encrypted information hash value used to verify the business travel encrypted information;

[0044] Verify whether the business travel encrypted information hash value in the request exists in the invalidation list on the cipher machine, and if not, query the cipher machine for the second business travel encrypted information corresponding to the business travel encrypted information hash value in the request;

[0045] Encrypt the content of the business travel information to be verified based on the public key in the second business travel encrypted information to obtain the business travel data key to be verified;

[0046] The verification result is determined according to a consistency comparison result between the business travel data key to be verified and the business travel data key in the second business travel encryption information.

[0047] It can be seen from the above technical solutions that the present invention has the following advantages:

[0048] The data encryption system with business travel sensitive permission control and data provided in this application realizes two-factor authentication and strict permission control of sensitive data, as well as secure key storage by integrating high-security cryptographic devices such as U-shield and cryptographic machine.

[0049] This application can use asymmetric encryption technology and public-private key pairs, especially the national secret algorithm supported by the cipher machine, to further enhance the complexity and security of encryption, making it much more difficult to crack. It improves the security of business travel information during storage and transmission, and effectively prevents data leakage and unauthorized access.

[0050] The data encryption system with business travel sensitive permission control and data provided by this application can automatically identify the sensitivity of the data and apply the corresponding encryption and decryption methods. It also protects sensitive data at the log level, ensuring that even maintenance and development personnel cannot view sensitive data without permission, effectively preventing risks such as log leakage and database attacks.

[0051] This application can monitor sensitive interfaces in real time, and combines the dual authentication methods of hardware certificate chain and application layer token, so that brute force attacks on sensitive interfaces cannot be carried out solely through software or physical methods, greatly reducing the risk of illegal access to the interface.

[0052] The dual verification mechanism in the data encryption system with sensitive permission control and data for business travel not only improves the security of the interface, but also enhances the overall defense capability of the system. It ensures the encryption of data throughout the storage and transmission process, effectively preventing the data from being stolen or tampered with during the transmission process. Combined with the use of U shield and password machine, a full range of security protection system from user identity authentication, data encryption, permission control to data transmission and storage is formed, providing security protection for the business travel system. It also improves the security and stability of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0054] Figure 1 A schematic diagram of a data encryption system with business travel sensitive authority control and data;

[0055] Figure 2 Data information stored in the U-Shield and encryption and decryption flow chart;

[0056] Figure 3 Data information stored in the cipher machine and encryption and decryption flow chart;

[0057] Figure 4 Process architecture diagram for sensitive permission control and data encryption;

[0058] Figure 5 This is a schematic diagram of the encryption gateway application;

[0059] Figure 6 The following is a flow chart for log traffic analysis. DETAILED DESCRIPTION

[0060] The following describes in detail the data encryption system with business travel sensitive permission control and data involved in the present application. For the purpose of illustration rather than limitation, specific details such as specific system structures and technologies are proposed to facilitate a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details.

[0061] When describing the data encryption system with business travel sensitive permission control and data of this application, when used in this application specification, the term "includes" indicates the existence of the described features, wholes, steps, operations, elements and / or components, but does not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections. The terms "include", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0062] The "one or more" mentioned in this application refers to one, two or more than two, and the "multiple" mentioned in this application refers to two or more. In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B. The "and / or" in this article is just a way to describe the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0063] The phrases such as "one embodiment" or "some embodiments" described in the present application mean that the specific features, structures or characteristics described in the embodiment are included in one or more embodiments of the present application. Therefore, the phrases such as "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments" etc. that appear in different places in the present application do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways.

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] See also Figure 1 The figure is a schematic diagram of a data encryption system with business travel sensitive authority control and data in a specific embodiment, the system includes: a user terminal, a data encryption gateway, a business travel server, a business travel database and a cipher machine.

[0066] The user terminal and the business travel server are respectively connected to the business travel database through a data encryption gateway; the data encryption gateway receives business travel information access instructions from the user terminal and the business travel server respectively.

[0067] The data encryption gateway is connected to the cryptographic machine for communication; the cryptographic machine stores a public-private key pair.

[0068] The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database.

[0069] The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

[0070] In some embodiments, a U-shield is configured in the system; the U-shield is connected to the user terminal for communication, and the U-shield provides the user with a certificate signed by a private key; the certificate includes a signed public key for encrypting business travel information and authenticating the user's identity; the user terminal decrypts the business travel information encrypted by the public key based on the U-shield's private key; the business travel information includes but is not limited to user name, password, ID number, mobile phone number, travel information and travel time.

[0071] In an exemplary embodiment, Figure 2 and Figure 3 As shown in the figure, the USB shield is also called USBKEY, and its working principle mainly involves encryption technology, identity authentication, digital signature, etc. The USB shield itself has a secure storage function and can store users' sensitive data, such as passwords, certificates, etc.

[0072] The cipher machine of this embodiment is a special device that uses a password to encrypt, decrypt and authenticate information, and is used in confidential scenarios. The encryption algorithm of the cipher machine is highly secure and can effectively protect information.

[0073] As an implementation step of an embodiment of the present application: both the U-shield and the cryptographic machine can store confidential information without leaking it. At the U-shield level, the certificate issued by a trusted certificate authority (CA) is stored in the secure storage area of ​​the U-shield, and is physically and logically protected together with the private key.

[0074] When the user needs to authenticate or encrypt communication, the U-Shield will provide the necessary certificate and private key information. The user terminal and business travel server can confirm the user's identity and the legitimacy of the transaction by verifying the certificate and private key in the U-Shield (authentication or decryption is performed in the U-Shield). The encryption process can be performed using the public key provided to the outside.

[0075] like Figure 2 The USB-Shield can provide users with a certificate signed by a private key. The certificate contains a signed public key and can be used for data encryption and user identity authentication. Data encrypted with a public key can only be used after being decrypted with a private key through the physical device, the USB-Shield.

[0076] The system U shield of this application can use asymmetric encryption, which is more secure and can achieve more comprehensive functions. The data encrypted by U shield generally includes user name, password, ID number, mobile phone number, etc. Only the account owner has the right to view such data at the business travel platform level, and the information is only allowed to be viewed by the user.

[0077] At the same time, the certificate of the U shield can be used to verify the certificate authority. This method is used to configure sensitive permissions. When controlling sensitive permissions, the operator must strictly have the corresponding U shield or CA certificate to achieve two-factor verification.

[0078] The cipher machine of this embodiment stores a large number of public and private key pairs. The public and private key pairs of the cipher machine support national secret algorithms such as SM2 and SM4. The stored public and private key pairs are divided into symmetric key segments and asymmetric key segments. Similar to the U shield, the private key is physically and logically protected and cannot be obtained by anyone (including operation and maintenance, development and even production personnel). Only the public key can be provided to the user end for use. The data information stored in the cipher machine and the encryption and decryption process are as follows: Figure 3 .

[0079] The cryptographic machine storage layer of the embodiment of the present application stores symmetric keys and asymmetric keys. The two keys are used for interface encryption and unified data encryption respectively. The encryption key depends on the index setting.

[0080] For interface encryption, the interface dimension is used to distinguish symmetric keys. Different interfaces use different keys, and the cipher machine only allows fixed IP access. Encryption is used before the interface user terminal and the server message are transmitted. After the message arrives, the corresponding key is used for decryption, thereby realizing the encryption and decryption of the user terminal and the server message.

[0081] For unified data encryption, the database table field dimension is used to map the cipher machine index and store the public key. The encrypted field is assigned an asymmetric public key index separately and there is no duplication between fields. The data is stored in the database after being encrypted with the public key. The data needs to be decrypted by the cipher machine private key when it is retrieved, and it is also combined with fixed IP access.

[0082] The cryptographic method of the embodiment of the present application combined with role-based access control (RBAC) is a supplement to the use of U-shield for user-level data encryption and sensitive permission control. It is suitable for data encryption and permission control with high sensitivity but information that needs to be viewed by multiple users. The process architecture of sensitive permission control and data encryption combined with the two is as follows: Figure 4 .

[0083] Specifically, if Figure 4 As shown in the figure, various encryption methods can be superimposed, with encryption priority from top to bottom and decryption priority from bottom to top. The requirements for permission control and data encryption are extremely high, and no valid data can be obtained by attacking the application layer or persistence layer. The cipher machine and U shield strictly protect data such as private keys at both the physical and logical levels. The technology is mature, and it is extremely difficult to obtain valid information, thus strictly protecting sensitive data in business travel.

[0084] It should be noted that the embodiment of the present application is an access control method that associates roles with permissions based on role-based access control. By assigning different roles to users and setting each role's access rights to resources, fine-grained permission control is achieved. In specific applications, in a business travel system, different roles can be assigned according to different positions and responsibilities (such as sales managers, financial personnel, customer service representatives, etc.), and corresponding data access rights can be set. In this way, it is easy to manage and maintain, and the permission settings can be flexibly adjusted to adapt to business changes.

[0085] This embodiment also involves attribute-based access control, which is a more fine-grained access control method that determines access rights based on user attributes (such as identity, position, department, etc.) and resource attributes (such as data type, sensitivity, etc.). In the business travel system, access rights can be dynamically adjusted according to user attributes and data sensitivity to achieve stricter protection of sensitive data. It can provide more flexible and dynamic permission control to adapt to complex business scenarios.

[0086] For the symmetric encryption of this application, the same key is used for encryption and decryption. In the business travel system, sensitive data (such as customer personal information, transaction records, etc.) can be symmetrically encrypted to ensure the confidentiality of the data during storage and transmission. The advantage is that the encryption speed is fast and suitable for processing large amounts of data. However, key management is complex and the security and availability of the key need to be ensured.

[0087] The asymmetric encryption of this embodiment can use a pair of keys (public key and private key) for encryption and decryption. The public key is used to encrypt data, and the private key is used to decrypt data. In business travel systems, asymmetric encryption is often used in scenarios such as digital signatures and key negotiation. For example, asymmetric encryption technology can be used to generate digital signatures for sensitive data to ensure the integrity and authenticity of the data. Key management is relatively simple, but the encryption speed is slow.

[0088] In some embodiments, the data encryption gateway acts as a transit station for data transmission, and can intercept and process all data flows in and out of the database. When data flows from the application server to the database server, the encryption gateway encrypts the data; and when data is returned from the database server to the application server, the encryption gateway decrypts the data. This "encryption in, decryption out" mechanism ensures the security of data during storage and transmission.

[0089] As an embodiment of the present application, when using U shield and cipher machine, information is already extremely difficult to leak, but operation and development personnel can inevitably physically contact authorized U shield, cipher machine and other equipment in a large number of development tasks and operation and maintenance processes, and are familiar with the intranet environment, can cross the intranet authentication, and have the need and ability to use. In order to prevent conscious or unconscious explicit acquisition of sensitive data during the development and operation process, it is necessary to use the encryption function of the data encryption gateway.

[0090] The data encryption gateway of this embodiment can transparently encrypt and decrypt data. Although the data encryption gateway encrypts the data, it is transparent and imperceptible to legitimate users and applications. In other words, legitimate users and applications do not need to perform additional decryption operations when accessing encrypted data. The gateway will automatically decrypt the data. This transparent encryption and decryption mechanism ensures the normal use of data while also improving the security and usability of the system. During the operation and maintenance process, the operation and maintenance developers are special users and debuggers, and the encryption gateway is opaque, thereby preventing the operation and maintenance and developers from unconsciously acquiring explicit data. The encryption gateway application diagram is shown in the figure below. Figure 5 .

[0091] For the embodiments of this application, it can be seen that outside the application, developers and operation and maintenance personnel cannot obtain explicit data during the debugging process. The encrypted flow of the data flow finally passes through the encryption gateway, and the first step of the decryption flow passes through the decryption gateway. The encryption gateway cannot be bypassed in the intranet environment when both the U shield and the cipher machine are authorized to use it, thus achieving complete information confidentiality.

[0092] In some embodiments, the system of the present application also relates to a method for marking and processing sensitive data.

[0093] Among them, sensitive data marking is mainly used for real-time monitoring of newly added data fields and newly added interfaces. During the operation of business travel projects, some fields or interfaces may not be marked as sensitive in any form but actually contain sensitive information. In order to prevent data leakage and security risks caused by such situations, the following methods are used for sensitive data marking, alarming and emergency preprocessing.

[0094] The embodiments of the present application use regular expression matching and keyword matching methods to match sensitive information in the data.

[0095] The specific implementation method is: Regular expression matching matches sensitive information in the data by defining a specific regular expression pattern. It is suitable for data with a clear format, such as ID card number, mobile phone number, email address, etc., which covers the vast majority of sensitive data.

[0096] Keyword matching is a specific strategy matching that matches sensitive information in data through a predefined keyword list. The sensitive keywords are determined by the operation and maintenance personnel. It is more flexible and suitable for data that does not have a clear format but contains specific keywords, such as names, addresses, etc.

[0097] For the above implementation, strict data encryption technology is implemented throughout the entire process, and high-security cryptographic devices (U-shield, cryptographic machine) are used to strictly control sensitive permissions and encrypt data. U-shield and cryptographic machine can achieve two-factor authentication and strict permission control, and secure key storage. The system of this application uses software (data encryption gateway) to achieve complete confidentiality of information without authorization by operation and maintenance and developers.

[0098] As for the sensitive data marking and identification method involved in this application, when applied at the application layer, it can automatically identify the sensitivity of the data and apply the corresponding encryption method and decryption method (strict two-factor access, dual-key encryption, gateway encryption only), and data confidentiality is refined to the log level, so that even operation and maintenance and development personnel cannot view the data without permission, effectively eliminating the risk of loss of valid data and sensitive data caused by log leakage, database attacks, application layer key leakage, etc.

[0099] The embodiments of the present application also implement real-time monitoring of sensitive interfaces. When the sensitive interface is executed, the dual authentication method of the hardware certificate chain and the application layer token can be monitored in real time, so that the sensitive interface blasting cannot be performed solely through software or physical methods. Both methods cannot be bypassed, and the risk of interface blasting is minimized.

[0100] For the user terminal of the present application, it can be a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), digital signal processors (DSP), embedded devices, etc. It can also be any electronic product that can interact with users, such as personal computers, tablet computers, smart phones, personal digital assistants (PDAs), interactive network televisions (IPTVs), smart wearable devices, etc.

[0101] Business server is intended to refer to various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers.

[0102] The following is an embodiment of a data encryption method with business travel sensitive permission control and data provided by the embodiments of the present disclosure. This method and the data encryption system with business travel sensitive permission control and data in the above-mentioned embodiments belong to the same inventive concept. For details not fully described in the embodiment of the data encryption method with business travel sensitive permission control and data, please refer to the embodiment of the data encryption system with business travel sensitive permission control and data.

[0103] The method includes: a data encryption gateway receives business travel information access instructions from a user terminal and a business travel server respectively;

[0104] The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database;

[0105] The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

[0106] In some specific embodiments, log traffic analysis technology is applied to enhance the comprehensiveness of sensitive data protection. This embodiment chooses to deploy intelligent sniffing devices in the data encryption gateway. These devices are like "data detectives" that specifically monitor and analyze the traffic generated by Web applications. This method is intended to be a complementary means of sensitive data monitoring for back-end databases. By actively capturing and analyzing Web traffic, it can gain in-depth insights into the interaction details at the HTTP protocol level. The data encryption gateway can rely on the sensitive data marking method based on whether the traffic message in the log contains unencrypted sensitive data.

[0107] As an implementation step of the embodiment of the present application: all HTTP traffic generated by the system is ensured to be included in the monitoring and collection scope without omission. Through a carefully designed collection management process, full-chain monitoring from traffic capture to data analysis is achieved.

[0108] Specifically, the system first carefully screens all network traffic, accurately identifies HTTP traffic belonging to Web applications, and excludes data traffic of non-HTTP protocols to improve analysis efficiency and accuracy.

[0109] In terms of collection strategy, the data encryption gateway adopts a flexible and sophisticated filtering mechanism, setting packet capture conditions based on key information such as source address, destination address, and destination port to ensure that only traffic data that meets specific security or business analysis needs is collected.

[0110] In this embodiment, the system can deeply restore the key components of the HTTP protocol, including but not limited to the specific request method (such as GET, POST), the URL address of the request, the key request header information (Cookie, Host, Referer, User-Agent, etc.), and the data body of the POST request. At the same time, the system also pays attention to the response status code, important response header information (such as Content-Type) and the actual response message body (i.e., the web page content).

[0111] Through the above methods, not only can the generation and access of sensitive data be effectively monitored and identified, but also detailed traffic analysis reports can be provided to the security team to help timely discover potential security threats or data leakage risks, thereby building a more solid data security protection network. For interfaces where sensitive information is detected, an alarm message is directly sent to the operation and maintenance personnel, and the symmetric key of the cipher machine is allocated in real time to encrypt the interface message transmission, thus ensuring data security in the first place. Figure 6 .

[0112] In some specific embodiments, the data encryption gateway also has real-time monitoring of sensitive interfaces. When sensitive interfaces are executed, the dual verification method of real-time monitoring of the hardware certificate chain and the application layer token can effectively enhance the security of the interface and reduce the risk of interface explosion.

[0113] Specifically, the hardware certificate chain is deployed and used: Use the U shield to generate a key pair, that is, a public key and a private key. The private key is securely stored in the hardware, and the public key is used for subsequent certificate issuance. Submit the public key and personal information to the certificate authority (CA), and after identity authentication, the CA issues a digital certificate. The digital certificate contains the public key, user information, and the CA's digital signature to ensure the authenticity and legitimacy of the certificate. Certificate deployment: Securely deploy the issued digital certificate to the user terminal and business travel server.

[0114] In some embodiments, application layer token management is configured: after the user logs in or authenticates successfully, the business travel server generates a unique token (such as JWT) and returns it to the user terminal. The token contains sufficient information (such as user ID, validity period, etc.) for subsequent verification. Token storage and transmission: The user terminal should store the token securely (such as using HTTP Secure Cookie or local secure storage). When requesting sensitive interfaces subsequently, the user terminal should carry the token in the request header or request body.

[0115] This embodiment also implements a double verification mechanism. First, a request interceptor is set at the sensitive interface to pre-process all requests.

[0116] Then read and verify whether the requester has provided a valid hardware certificate chain (whether the user has inserted the USB shield and whether it contains a valid authorization certificate). Use the CA's public key to verify the certificate chain to ensure the authenticity and validity of the certificate.

[0117] Then, the application layer token cache is used to verify whether the request carries a valid token. The token is decoded to verify whether the information it contains (such as user ID, validity period, etc.) meets the requirements.

[0118] The request is allowed to continue only when both the hardware certificate chain and the application layer token are verified; otherwise, the request is rejected and an error message is returned.

[0119] This embodiment of real-time monitoring and logging can monitor the access to sensitive interfaces in real time. Once abnormal access or blasting behavior is found, an alarm is triggered immediately, and all interface access log information is recorded in detail, including request time, requester IP, request content, verification results, etc., for subsequent auditing and tracking.

[0120] In some embodiments of the present application, the following specific implementations are also involved:

[0121] Step 201: configure a corresponding public-private key pair for a user terminal.

[0122] In this embodiment, the private key in the public-private key pair can decrypt the business travel information encrypted by the public key. A user terminal has a dedicated public-private key pair for encrypting and decrypting the business travel information content.

[0123] Specifically, the private key in the public-private key pair can be a complete private key that matches the public key. It should be noted that it can be determined according to the purpose and type of the user terminal. The public-private key pair can use a symmetric encryption algorithm or an asymmetric encryption algorithm.

[0124] In some embodiments, the business travel server may provide a business travel information processing port, and the data encryption gateway may input the business travel information content into the business travel information processing port to submit it to the business travel server for processing.

[0125] Step S202: Based on the public key in the public-private key pair, the data encryption gateway encrypts the business travel information sent by the user terminal to generate a business travel data key.

[0126] It should be noted that the purpose of generating a public-private key pair is to encrypt and store business travel information. The data encryption gateway can encrypt the business travel information based on the public key in the public-private key pair to generate a business travel data key.

[0127] The data encryption gateway can encrypt the business travel information based on the public key in the public-private key pair and the corresponding asymmetric encryption algorithm to obtain the business travel data key.

[0128] Step S203: generating first business travel encrypted information based on the public key and the generated business travel data key.

[0129] After the business travel information is encrypted, the business travel data key is stored on the cipher machine through the business travel encryption information. The data encryption gateway can be configured to generate the first business travel encryption information based on the public key and the generated business travel data key. Since there are some fixed fields in the business travel encryption information, including the public key, the business travel data key, the business travel encryption information type, the user signature, the user identity information, etc., the data encryption gateway configures the business travel encryption information to fill the public key and the business travel data key into the corresponding fields in the business travel encryption information.

[0130] Step S204, the first business travel encrypted information is signed and submitted to the cipher machine to obtain the business travel encrypted information hash value of the first business travel encrypted information; the signature of the first business travel encrypted information is used to identify that the first business travel encrypted information is constructed by the data encryption gateway.

[0131] Specifically, the data encryption gateway signs the first business travel encrypted information to identify that the first business travel encrypted information is constructed by the data encryption gateway. The data encryption gateway stores the signed first business travel encrypted information in the cipher machine. After storage, the cipher machine is configured with a business travel encrypted information hash value that uniquely identifies the first business travel encrypted information.

[0132] Step 205, returning the business travel encrypted information hash value and the private key in the public-private key pair to the data encryption gateway, so that the data encryption gateway issues the business travel encrypted information hash value and the private key to the user terminal.

[0133] The data encryption gateway can configure the business travel encryption information hash value of the first business travel encryption information and the private key in the public-private key pair. The business travel encryption information hash value and the private key are saved, and the business travel encryption information hash value of the first business travel encryption information and the private key in the public-private key pair are issued to the user terminal, so that the user terminal can easily search for the business travel encryption information in the cipher machine later.

[0134] In the embodiments of the present application, the full-text ciphertext of the public-private key pair is stored on a cryptographic machine to prevent tampering, effectively improve security, and avoid the problem of loss of the public-private key pair due to damage to the centralized storage device, thereby greatly improving the security and reliability of business travel information.

[0135] Moreover, in order to solve the risk of business travel information leakage and tampering, this application generates a pair of exclusive public-private key pairs for the preset business travel information, uses the public key in the exclusive public-private key pair to encrypt the business travel information and store it in the cipher machine, and the private key is only held by the business travel information grantor. This ensures that the public-private key pair will not leak data or be tampered with, and further improves security.

[0136] In some embodiments, the method comprises the following steps:

[0137] Step 301, receiving a verification request; the verification request carries the content of the business travel information to be verified and the business travel encrypted information hash value used to verify the business travel encrypted information.

[0138] Specifically, if the verifier wants to verify the content of the business travel information, he can enter the keywords of the business travel information to be verified and the business travel encrypted information hash value used for the business travel encrypted information, thereby triggering a verification request to be sent to the data encryption gateway.

[0139] Step 302, verify whether the business travel encryption information hash value in the request exists in the invalidation list on the cryptographic machine, if not, query the cryptographic machine for the second business travel encryption information corresponding to the business travel encryption information hash value in the request.

[0140] In this embodiment, if the business travel encrypted information hash value in the verification request exists in the invalidation list on the cipher machine, it means that the business travel encrypted information hash value has expired or been cancelled, and the verification result of verification failure can be directly returned to the verification party.

[0141] Step 303: Encrypt the content of the business travel information to be verified based on the public key in the second business travel encrypted information to obtain the business travel data key to be verified.

[0142] It can be understood that the data encryption gateway can extract the signature information from the fixed field in the second business travel encrypted information, and then extract the business travel data key, public key and other information from the business travel data key field after verifying the signature. Then, the business travel information content can be encrypted based on the extracted public key and the corresponding asymmetric encryption algorithm to obtain the business travel data key to be verified.

[0143] Step 304: Determine a verification result based on a consistency comparison result between the business travel data key to be verified and the business travel data key in the second business travel encryption information.

[0144] In the above embodiments, the cryptographic machine can be combined to realize the verification of business travel information, and the cryptographic machine can be more effectively combined with the management of business travel information to ensure the security of business travel information.

[0145] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data encryption system with business travel sensitive authority control and data, characterized in that: include: User terminals, data encryption gateways, business travel servers, business travel databases, and cryptographic machines; The user terminal and the business travel server are respectively connected to the business travel database through a data encryption gateway; The data encryption gateway receives business travel information access instructions from the user terminal and the business travel server respectively; The data encryption gateway is connected to the cryptographic machine for communication; the cryptographic machine stores a public-private key pair; The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database; The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

2. The data encryption system with business travel sensitive authority control and data according to claim 1 is characterized in that: Also includes: U-shield; The U-Shield communicates with the user's terminal and provides the user with a certificate signed by a private key; The certificate includes a signed public key used to encrypt business travel information and authenticate user identities; The user terminal decrypts the business travel information encrypted by the public key based on the private key of the U shield; Business travel information includes but is not limited to user name, password, ID number, mobile phone number, travel information and travel time.

3. The data encryption system with business travel sensitive authority control and data according to claim 1 or 2 is characterized in that: The data encryption gateway stores symmetric keys and asymmetric keys, which are used to encrypt the communication interface of the data encryption gateway and encrypt business travel information respectively; The data encryption gateway distinguishes symmetric keys based on the interface dimension, and different communication interfaces of the data encryption gateway use different keys for encryption processing.

4. The data encryption system with business travel sensitive authority control and data according to claim 1 or 2, characterized in that: The data encryption gateway stores the public key based on the database table field dimension mapping cipher machine index; The encrypted fields are individually assigned asymmetric public key indexes and there is no duplication between fields.

5. The data encryption system with business travel sensitive authority control and data according to claim 1 or 2, characterized in that: The data encryption gateway uses regular expression matching and keyword matching methods to match sensitive information in business travel information.

6. A data encryption method with business travel sensitive authority control and data, characterized in that: The method is implemented based on the data encryption system with business travel sensitive authority control and data as described in any one of claims 1 to 5; Methods include: The data encryption gateway receives business travel information access instructions from the user terminal and the business travel server respectively; The data encryption gateway obtains the business travel information sent by the user terminal and the business travel server respectively, encrypts the received business travel information based on the public key, and stores the encrypted business travel information in the business travel database; The data encryption gateway obtains the information retrieval instructions sent by the user terminal and the business travel server respectively, and retrieves the corresponding business travel information from the business travel database based on the information retrieval instructions, decrypts the business travel information, and then sends it to the user terminal and the business travel server.

7. The data encryption method with business travel sensitive authority control and data according to claim 6 is characterized in that: The method also includes: the data encryption gateway monitors the HTTP traffic generated by the system, identifies the HTTP traffic belonging to the Web application, and excludes the data traffic of non-HTTP protocol; The data encryption gateway sets packet capture conditions based on the source address, destination address, and destination port information, and collects traffic data that meets the preset requirements; The data encryption gateway restores the key components of the HTTP protocol, including but not limited to the POST request instruction, the requested URL address, the request header information, and the data body of the POST request.

8. The data encryption method with business travel sensitive authority control and data according to claim 6 is characterized in that: The method also includes: Generate a key pair based on the U-Shield, store the private key in the user terminal and the business travel server, and use the public key for subsequent certificate issuance; Submit the public key and personal information to the data encryption gateway. After identity authentication is passed, a digital certificate is issued; A digital certificate contains a public key, user information, and the CA’s digital signature; Send the issued digital certificate to the user terminal and business travel server; After the user logs in or successfully authenticates on the business travel server based on the user terminal, the business travel server generates authentication success identification information and returns it to the user terminal; The user terminal saves the authentication success identification information, and carries the authentication success identification information in the request header or request body when making subsequent requests to sensitive interfaces.

9. The data encryption method with business travel sensitive authority control and data according to claim 6 is characterized in that: The method also includes: Configure the corresponding public and private key pairs for the user terminal; Based on the public key in the public-private key pair, the data encryption gateway encrypts the business travel information sent by the user terminal to generate a business travel data key; configured to generate first business travel encrypted information based on the public key and the generated business travel data key; Submit the first business travel encrypted information after signing it to the cipher machine to obtain the business travel encrypted information hash value of the first business travel encrypted information; the signature of the first business travel encrypted information is used to identify that the first business travel encrypted information is constructed by the data encryption gateway; Return the business travel encrypted information hash value and the private key in the public-private key pair to the data encryption gateway, so that the data encryption gateway issues the business travel encrypted information hash value and the private key to the user terminal.

10. The data encryption method with business travel sensitive authority control and data according to claim 9 is characterized in that: The method also includes: Receive a verification request; the verification request carries the content of the business travel information to be verified and the business travel encrypted information hash value used to verify the business travel encrypted information; Verify whether the business travel encrypted information hash value in the request exists in the invalidation list on the cipher machine, and if not, query the cipher machine for the second business travel encrypted information corresponding to the business travel encrypted information hash value in the request; Encrypt the content of the business travel information to be verified based on the public key in the second business travel encrypted information to obtain the business travel data key to be verified; The verification result is determined according to a consistency comparison result between the business travel data key to be verified and the business travel data key in the second business travel encryption information.

Images