A sensitive data protection method, system and medium based on SaaS system

Abstract

The present application provides a sensitive data protection method, system and medium based on a SaaS system. The method includes: obtaining a sensitivity level coefficient of preset sensitive data, generating a corresponding initial data protection scheme based on a SaaS system, extracting access control feature data of the initial data protection scheme, processing to obtain an access control compliance index, obtaining data encryption feature data of the scheme, and processing to obtain a data encryption strength index, obtaining backup and recovery feature data of the SaaS system for sensitive data, processing to obtain a data recovery capability index, obtaining audit and monitoring feature data of the SaaS system, and performing a security assessment to obtain a system security index, and combining the access control compliance index, the data encryption strength index and the data recovery capability index to obtain a comprehensive data protection assessment index, and adjusting the initial data protection scheme accordingly to obtain an adapted data protection scheme.

Description

Technical Field

[0001] The present application relates to the field of sensitive data protection technology, and in particular, to a sensitive data protection method, system and medium based on a SaaS system. Background Art

[0002] In today's digital age, with the development of cloud computing technology, SaaS (Software as a Service) systems have been widely used. However, since multiple users share the same SaaS system, the protection of sensitive data faces huge challenges. Once sensitive data is leaked, it may cause serious losses to users, such as the theft of business secrets and exposure of personal privacy. Therefore, an effective sensitive data protection method is needed to ensure the security of SaaS systems.

[0003] In view of the above problems, effective technical solutions are urgently needed. Summary of the invention

[0004] The purpose of this application is to provide a sensitive data protection method, system and medium based on a SaaS system. The access control compliance index, data encryption strength index and data recovery capability index obtained by processing are combined with the system security index to obtain a comprehensive data protection assessment index, and the initial data protection plan is adjusted accordingly according to the comprehensive data protection assessment index to obtain an adapted data protection plan, thereby realizing a technology for sensitive data protection based on a SaaS system.

[0005] The present application also provides a sensitive data protection method based on a SaaS system, comprising the following steps:

[0006] Obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient;

[0007] Collecting access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index;

[0008] Acquire data encryption characteristic data of the initial data protection scheme, and process to obtain a data encryption strength index;

[0009] Monitor the data backup and recovery information of the sensitive data by the SaaS system, obtain backup and recovery characteristic data, and process to obtain a data recovery capability index;

[0010] Obtaining audit and monitoring feature data of the SaaS system, and conducting a security assessment to obtain a system security index;

[0011] According to the access control compliance index, data encryption strength index and data resilience index, combined with the system security index, a data protection comprehensive assessment index is obtained, and the initial data protection plan is adjusted accordingly according to the data protection comprehensive assessment index to obtain an adapted data protection plan.

[0012] Optionally, in the sensitive data protection method based on the SaaS system described in the present application, the step of obtaining a sensitivity level coefficient of preset sensitive data and generating a corresponding initial data protection scheme based on the SaaS system according to the sensitivity level coefficient includes:

[0013] Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data;

[0014] The characteristic data includes content characteristic data, value characteristic data and risk characteristic data;

[0015] The content characteristic data includes personal identity information content ratio data and financial information detail data;

[0016] The value feature data includes commercial value assessment data and data scarcity data;

[0017] The risk characteristic data includes leakage impact data and attack probability data;

[0018] Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data;

[0019] A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

[0020] Optionally, in the sensitive data protection method based on the SaaS system described in the present application, collecting the access control monitoring information of the initial data protection scheme, extracting the access control feature data, and processing to obtain the access control compliance index include:

[0021] Collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information, and login information;

[0022] Extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data;

[0023] The access control compliance index is obtained by processing the verification factor quantity data, the fault tolerance number data and the access frequency limit data.

[0024] Optionally, in the sensitive data protection method based on the SaaS system described in the present application, the step of obtaining the data encryption characteristic data of the initial data protection scheme and processing to obtain the data encryption strength index includes:

[0025] Acquiring data encryption characteristic data of the initial data protection scheme, including key length data, encryption performance overhead data, and encryption coverage ratio data;

[0026] The data encryption strength index is obtained by processing the key length data, the encryption performance overhead data and the encryption coverage ratio data.

[0027] Optionally, in the sensitive data protection method based on the SaaS system described in the present application, monitoring the data backup and recovery information of the sensitive data by the SaaS system, obtaining backup and recovery characteristic data, and processing to obtain the data resilience capability index include:

[0028] Monitor the SaaS system and obtain data backup requirement information and recovery requirement information of the sensitive data;

[0029] Extracting backup and recovery characteristic data according to the data backup requirement information and recovery requirement information, including backup frequency data, backup time window data, backup data integrity data and recovery time target data;

[0030] The data recovery capability index is obtained by processing the backup frequency data, the backup time window data, the backup data integrity data and the recovery time target data.

[0031] Optionally, in the sensitive data protection method based on the SaaS system described in the present application, the access control compliance index, the data encryption strength index and the data resilience index are processed in combination with the system security index to obtain a data protection comprehensive evaluation index, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme, including:

[0032] According to the access control compliance index, the data encryption strength index and the data recovery capability index, combined with the system security index, a data protection comprehensive assessment index is obtained;

[0033] Performing a threshold comparison between the data protection comprehensive assessment index and a preset data protection comprehensive assessment threshold to obtain a comparison result;

[0034] Determining whether the initial data protection solution meets the protection requirements of the sensitive data according to the comparison result;

[0035] If the initial data protection scheme cannot meet the protection requirements of the sensitive data, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

[0036] In a second aspect, the present application provides a sensitive data protection system based on a SaaS system, the system comprising: a memory and a processor, the memory comprising a program of a sensitive data protection method based on a SaaS system, and the program of the sensitive data protection method based on a SaaS system when executed by the processor implements the following steps:

[0037] Obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient;

[0038] Collecting access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index;

[0039] Acquire data encryption characteristic data of the initial data protection scheme, and process to obtain a data encryption strength index;

[0040] Monitor the data backup and recovery information of the sensitive data by the SaaS system, obtain backup and recovery characteristic data, and process to obtain a data recovery capability index;

[0041] Obtaining audit and monitoring feature data of the SaaS system, and conducting a security assessment to obtain a system security index;

[0042] According to the access control compliance index, data encryption strength index and data resilience index, combined with the system security index, a data protection comprehensive assessment index is obtained, and the initial data protection plan is adjusted accordingly according to the data protection comprehensive assessment index to obtain an adapted data protection plan.

[0043] Optionally, in the sensitive data protection system based on the SaaS system described in the present application, the step of obtaining a sensitivity level coefficient of preset sensitive data and generating a corresponding initial data protection scheme based on the SaaS system according to the sensitivity level coefficient includes:

[0044] Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data;

[0045] The characteristic data includes content characteristic data, value characteristic data and risk characteristic data;

[0046] The content characteristic data includes personal identity information content ratio data and financial information detail data;

[0047] The value feature data includes commercial value assessment data and data scarcity data;

[0048] The risk characteristic data includes leakage impact data and attack probability data;

[0049] Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data;

[0050] A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

[0051] Optionally, in the sensitive data protection system based on the SaaS system described in the present application, collecting the access control monitoring information of the initial data protection scheme, extracting the access control feature data, and processing to obtain the access control compliance index include:

[0052] Collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information, and login information;

[0053] Extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data;

[0054] The access control compliance index is obtained by processing the verification factor quantity data, the fault tolerance number data and the access frequency limit data.

[0055] In a third aspect, the present application also provides a computer-readable storage medium, which stores a sensitive data protection method program based on a SaaS system. When the sensitive data protection method program based on a SaaS system is executed by a processor, the steps of the sensitive data protection method based on a SaaS system as described in any one of the above items are implemented.

[0056] As can be seen from the above, the sensitive data protection method, system and medium based on the SaaS system provided by the present application obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient, collect the access control monitoring information of the initial data protection plan, and extract the access control feature data, process to obtain the access control compliance index, obtain the data encryption feature data of the initial data protection plan, and process to obtain the data encryption strength index, monitor the data backup and recovery information of the SaaS system for sensitive data, and obtain the backup and recovery feature data, process to obtain the data resilience index, obtain the audit and monitoring feature data of the SaaS system, and perform a security assessment to obtain the system security index, according to the access control compliance index, the data encryption strength index and the data resilience index, combined with the system security index, to obtain the data protection comprehensive assessment index, and make corresponding adjustments to the initial data protection plan according to the data protection comprehensive assessment index to obtain an adapted data protection plan, thereby realizing the technology of sensitive data protection based on the SaaS system.

[0057] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A flowchart of a sensitive data protection method based on a SaaS system provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of obtaining an access control compliance index for a sensitive data protection method based on a SaaS system provided in an embodiment of the present application;

[0061] Figure 3 A flow chart of obtaining a data encryption strength index for a sensitive data protection method based on a SaaS system provided in an embodiment of the present application;

[0062] Figure 4 A flow chart of obtaining a data resilience capability index for a sensitive data protection method based on a SaaS system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0064] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0065] Please refer to Figure 1 , Figure 1 1 is a flowchart of a sensitive data protection method based on a SaaS system in some embodiments of the present application. The sensitive data protection method based on a SaaS system is used in a terminal device, such as a computer, a mobile terminal, etc. The sensitive data protection method based on a SaaS system includes the following steps:

[0066] S11, obtaining a sensitivity level coefficient of preset sensitive data, and generating a corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient;

[0067] S12, collecting access control monitoring information of the initial data protection solution, extracting access control feature data, and processing to obtain an access control compliance index;

[0068] S13, obtaining data encryption characteristic data of the initial data protection scheme, and processing to obtain a data encryption strength index;

[0069] S14, monitoring the data backup and recovery information of the sensitive data by the SaaS system, obtaining backup and recovery characteristic data, and processing to obtain a data recovery capability index;

[0070] S15. Obtain audit and monitoring feature data of the SaaS system, perform security assessment, and obtain a system security index;

[0071] S16. According to the access control compliance index, data encryption strength index and data recovery capability index, combined with the system security index, a data protection comprehensive assessment index is obtained, and the initial data protection plan is adjusted accordingly according to the data protection comprehensive assessment index to obtain an adapted data protection plan.

[0072] It should be noted that in SaaS (Software as a Service) systems, it is extremely important to protect sensitive data. Since multiple users share the same SaaS system, the protection of sensitive data faces huge challenges. Once sensitive data is leaked, it may cause serious losses to users, such as the theft of business secrets and the exposure of personal privacy. Therefore, an effective sensitive data protection method is needed to ensure the security of SaaS. The security of the system is first evaluated by obtaining the sensitivity level coefficient of the preset sensitive data, and generating the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient, collecting the access control monitoring information of the initial data protection plan, and extracting the access control feature data, processing to obtain the access control compliance index, obtaining the data encryption feature data of the initial data protection plan, and processing to obtain the data encryption strength index, monitoring the data backup and recovery information of the SaaS system for sensitive data, and obtaining the backup and recovery feature data, processing to obtain the data recovery capability index, obtaining the audit and monitoring feature data of the SaaS system, and performing a security assessment to obtain the system security index, and processing according to the access control compliance index, the data encryption strength index and the data recovery capability index in combination with the system security index to obtain the data protection comprehensive assessment index, and adjusting the initial data protection plan accordingly according to the data protection comprehensive assessment index to obtain an adaptive data protection plan, thereby realizing the technology of sensitive data protection based on the SaaS system.

[0073] According to an embodiment of the present invention, the step of obtaining a sensitivity level coefficient of preset sensitive data and generating a corresponding initial data protection scheme based on a SaaS system according to the sensitivity level coefficient includes:

[0074] Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data;

[0075] The characteristic data includes content characteristic data, value characteristic data and risk characteristic data;

[0076] The content characteristic data includes personal identity information content ratio data and financial information detail data;

[0077] The value feature data includes commercial value assessment data and data scarcity data;

[0078] The risk characteristic data includes leakage impact data and attack probability data;

[0079] Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data;

[0080] A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

[0081] It should be noted that different sensitive data has different sensitivity levels, and different protection schemes need to be selected for data of different sensitivity levels. Therefore, feature data is extracted from the preset sensitive data, including content feature data, value feature data and risk feature data. Among them, content feature data includes personal identity information content ratio data and financial information detail data. Personal identity information content ratio data refers to the degree to which sensitive data contains personal information such as name, ID number, mobile phone number, home address, etc. High content means that the data is more sensitive. Financial information detail data refers to the degree of detail of financial data such as bank account number, credit card information, transaction records, etc. in sensitive data. Detailed financial data may cause direct economic losses, so it is more sensitive. Value feature data includes commercial value. The commercial value assessment data and data scarcity data, where the commercial value assessment data refers to the data with high commercial value such as business secrets, customer lists, and research and development results in the sensitive data, and the data scarcity data refers to the scarcity of sensitive data in the market, for example, professional technical data or exclusive market research data in a specific industry. In addition, the risk characteristic data includes leakage impact data and attack probability data, where the leakage impact data refers to the degree of impact on individuals, enterprises or society after the leakage of sensitive data, and the attack probability data refers to the probability of sensitive data being attacked by hackers, leaked by internal personnel or accidentally leaked. The above data are processed to obtain the sensitivity level coefficient of the sensitive data, and the corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient;

[0082] The calculation formula of the sensitivity level coefficient is:

[0083] ;

[0084] in, is the sensitivity level coefficient, , They are the personal identity information content ratio data and financial information detail data, , They are commercial value assessment data and data scarcity data. , They are respectively leakage impact data and attack probability data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0085] Please refer to Figure 2 , Figure 2 The flowchart of obtaining the access control compliance index of the sensitive data protection method based on the SaaS system in some embodiments of the present application. According to the embodiment of the present invention, the access control monitoring information of the initial data protection scheme is collected, and the access control feature data is extracted, and the access control compliance index is obtained by processing, including:

[0086] S21, collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information and login information;

[0087] S22, extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data;

[0088] S23. Process the verification factor quantity data, the fault tolerance number data, and the access frequency limit data to obtain an access control compliance index.

[0089] It should be noted that after selecting the initial data protection scheme corresponding to the sensitive data according to the sensitivity level, the access control monitoring information of the scheme of the system corresponding to the scheme is further collected, including identity authentication information, authorization information and login information, and the access control feature data is extracted and processed to obtain data, including the number of verification factors, the number of fault tolerances and the access frequency limit data, where the number of verification factors refers to the number of verification factors set for identity authentication when the user accesses, and the verification factors include passwords, SMS verification codes, fingerprints and dynamic passwords, etc. The number of fault tolerances refers to the number of errors that allow the user to log in to the system, and the access frequency limit data refers to data that limits the frequency of access to sensitive data, such as limiting the frequency of access to sensitive data to no more than five times per minute. The above data is then processed to obtain the access control compliance index;

[0090] The calculation formula of the access control compliance index is:

[0091] ;

[0092] in, is the access control compliance index, , , They are the verification factor quantity data, fault tolerance number data, and access frequency limit data. , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0093] Please refer to Figure 3 , Figure 3 The flowchart of obtaining the data encryption strength index of the sensitive data protection method based on the SaaS system in some embodiments of the present application. According to the embodiment of the present invention, the data encryption feature data of the initial data protection scheme is obtained, and the data encryption strength index is obtained by processing, including:

[0094] S31, obtaining data encryption feature data of the initial data protection scheme, including key length data, encryption performance overhead data, and encryption coverage ratio data;

[0095] S32. Process the key length data, encryption performance overhead data, and encryption coverage ratio data to obtain a data encryption strength index.

[0096] It should be noted that, at the same time, the data encryption characteristic data of the initial data protection scheme is obtained, including key length data, encryption performance overhead data and encryption coverage ratio data, wherein the encryption performance overhead data refers to the degree of influence of the data encryption and decryption process on the system performance, and the encryption coverage ratio data refers to the proportion of data covered by transmission encryption and storage encryption, and then the data encryption strength index is obtained by processing the above data;

[0097] The calculation formula of the data encryption strength index is:

[0098] ;

[0099] in, is the data encryption strength index, , , They are key length data, encryption performance overhead data, and encryption coverage ratio data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0100] Please refer to Figure 4 , Figure 4 The flowchart of obtaining the data resilience capability index of the sensitive data protection method based on the SaaS system in some embodiments of the present application. According to the embodiment of the present invention, the monitoring of the data backup and recovery information of the sensitive data by the SaaS system, and obtaining the backup and recovery characteristic data, and processing to obtain the data resilience capability index include:

[0101] S41, monitoring the SaaS system, and obtaining data backup requirement information and recovery requirement information of the sensitive data;

[0102] S42, extracting backup and recovery characteristic data according to the data backup requirement information and the recovery requirement information, including backup frequency data, backup time window data, backup data integrity data and recovery time target data;

[0103] S43: Process the backup frequency data, the backup time window data, the backup data integrity data, and the recovery time target data to obtain a data recovery capability index.

[0104] It should be noted that, in addition, the aaS system is monitored to obtain the data backup demand information and recovery demand information of sensitive data, and to extract the backup and recovery characteristic data, including backup frequency data, backup time window data, backup data integrity data and recovery time target data, where the backup time window data refers to the time required to complete a data backup, the backup data integrity data refers to the verification of the integrity of the backup data by means of checksums, etc., and the recovery time target data refers to the time required to restore the system and data after a disaster occurs, and then the above data is processed to obtain the data recovery capability index;

[0105] The calculation formula of the data resilience index is:

[0106] ;

[0107] in, is the data resilience index, , They are backup frequency data and backup data integrity data. , They are backup time window data and recovery time target data respectively. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0108] According to an embodiment of the present invention, the access control compliance index, the data encryption strength index, and the data resilience index are processed in combination with the system security index to obtain a data protection comprehensive evaluation index, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme, including:

[0109] According to the access control compliance index, the data encryption strength index and the data recovery capability index, combined with the system security index, a data protection comprehensive assessment index is obtained;

[0110] Performing a threshold comparison between the data protection comprehensive assessment index and a preset data protection comprehensive assessment threshold to obtain a comparison result;

[0111] Determining whether the initial data protection solution meets the protection requirements of the sensitive data according to the comparison result;

[0112] If the initial data protection scheme cannot meet the protection requirements of the sensitive data, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

[0113] It should be noted that in order to more comprehensively, efficiently and accurately evaluate the protection effect of the adapted data protection scheme on sensitive data, the obtained access control compliance index, data encryption strength index and data recovery capability index are processed in combination with the system security index to obtain a comprehensive data protection assessment index. Then, based on the comprehensive data protection assessment index, it is determined whether the initial data protection scheme meets the protection requirements of the sensitive data. If not, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

[0114] The calculation formula of the data protection comprehensive evaluation index is:

[0115] ;

[0116] in, It is the comprehensive evaluation index of data protection. , , , They are access control compliance index, data encryption strength index, data recovery capability index, and system security index. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0117] According to an embodiment of the present invention, it also includes:

[0118] The obtaining of the audit and monitoring characteristic data of the SaaS system and performing a security assessment to obtain a system security index includes:

[0119] Obtaining audit and monitoring feature data of the SaaS system, including audit log generation frequency data, abnormal event detection accuracy data, and response time data;

[0120] Perform security assessment based on the audit log generation frequency data, abnormal event detection accuracy data, and response time data to obtain a system security index;

[0121] The calculation formula of the system safety index is:

[0122] ;

[0123] in, is the system safety index, , , They are audit log generation frequency data, abnormal event detection accuracy data, and response time data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0124] It should be noted that, on the other hand, the audit and monitoring characteristic data of the SaaS system are obtained, including audit log generation frequency data, abnormal event detection accuracy data and response time data. Among them, audit log generation frequency data refers to the frequency of recording logs of user behavior and system activities, and response time data refers to the time interval from the discovery of a security incident to the taking of corresponding measures. A security assessment is then conducted based on the above data to obtain the system security index.

[0125] According to an embodiment of the present invention, it also includes:

[0126] Monitor the SaaS system corresponding to the sensitive data in real time and collect log feature data within a preset time period;

[0127] The log feature data includes abnormal login times data, access frequency data, system response delay increase data, data on data transmission volume, and resource utilization data;

[0128] Processing the abnormal login times data, access frequency data, system response delay increase data, data transmission volume data, and resource utilization rate data to obtain a system status abnormality index;

[0129] Compare the system status abnormality index with a preset system status abnormality threshold, and determine whether the SaaS system is abnormal according to the comparison result;

[0130] If an abnormality occurs, an alarm is immediately issued and the SaaS system is maintained;

[0131] The calculation formula of the system status abnormality index is:

[0132] ;

[0133] in, is the system status abnormality index, , , , , The abnormal login times data, access frequency data, system response delay increase data, data transmission volume data, and resource utilization data are processed respectively. , , , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0134] It should be noted that in order to respond to system anomalies in a timely manner, the SaaS system corresponding to the sensitive data is monitored in real time, and log feature data within a preset time period is collected, including abnormal login times data, access frequency data, system response delay increase data, data transmission volume data and resource utilization data. Among them, the system response delay increase data refers to the increase in the system response time relative to a certain benchmark state or reference time under specific conditions. The data transmission volume data refers to the transmission volume of sensitive data. If the transmission volume of sensitive data increases significantly within a specific time period, there is a risk of illegal copying or transmission of data. The above data is then processed to obtain the system status anomaly index, which is then compared with the preset system status anomaly threshold. Based on the comparison results, it is determined whether the SaaS system is abnormal. If an abnormality occurs, an alarm is immediately issued and the SaaS system is maintained to ensure the security of sensitive data.

[0135] In a second aspect, the present invention further discloses a sensitive data protection system based on a SaaS system, including a memory and a processor, wherein the memory includes a sensitive data protection method program based on a SaaS system, and when the sensitive data protection method program based on a SaaS system is executed by the processor, the following steps are implemented:

[0136] Obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient;

[0137] Collecting access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index;

[0138] Acquire data encryption characteristic data of the initial data protection scheme, and process to obtain a data encryption strength index;

[0139] Monitor the data backup and recovery information of the sensitive data by the SaaS system, obtain backup and recovery characteristic data, and process to obtain a data recovery capability index;

[0140] Obtaining audit and monitoring feature data of the SaaS system, and conducting a security assessment to obtain a system security index;

[0141] According to the access control compliance index, data encryption strength index and data resilience index, combined with the system security index, a data protection comprehensive assessment index is obtained, and the initial data protection plan is adjusted accordingly according to the data protection comprehensive assessment index to obtain an adapted data protection plan.

[0142] It should be noted that in SaaS (Software as a Service) systems, it is extremely important to protect sensitive data. Since multiple users share the same SaaS system, the protection of sensitive data faces huge challenges. Once sensitive data is leaked, it may cause serious losses to users, such as the theft of business secrets and the exposure of personal privacy. Therefore, an effective sensitive data protection method is needed to ensure the security of SaaS. The security of the system is first evaluated by obtaining the sensitivity level coefficient of the preset sensitive data, and generating the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient, collecting the access control monitoring information of the initial data protection plan, and extracting the access control feature data, processing to obtain the access control compliance index, obtaining the data encryption feature data of the initial data protection plan, and processing to obtain the data encryption strength index, monitoring the data backup and recovery information of the SaaS system for sensitive data, and obtaining the backup and recovery feature data, processing to obtain the data recovery capability index, obtaining the audit and monitoring feature data of the SaaS system, and performing a security assessment to obtain the system security index, and processing according to the access control compliance index, the data encryption strength index and the data recovery capability index in combination with the system security index to obtain the data protection comprehensive assessment index, and adjusting the initial data protection plan accordingly according to the data protection comprehensive assessment index to obtain an adaptive data protection plan, thereby realizing the technology of sensitive data protection based on the SaaS system.

[0143] According to an embodiment of the present invention, the step of obtaining a sensitivity level coefficient of preset sensitive data and generating a corresponding initial data protection scheme based on a SaaS system according to the sensitivity level coefficient includes:

[0144] Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data;

[0145] The characteristic data includes content characteristic data, value characteristic data and risk characteristic data;

[0146] The content characteristic data includes personal identity information content ratio data and financial information detail data;

[0147] The value feature data includes commercial value assessment data and data scarcity data;

[0148] The risk characteristic data includes leakage impact data and attack probability data;

[0149] Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data;

[0150] A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

[0151] It should be noted that different sensitive data has different sensitivity levels, and different protection schemes need to be selected for data of different sensitivity levels. Therefore, feature data is extracted from the preset sensitive data, including content feature data, value feature data and risk feature data. Among them, content feature data includes personal identity information content ratio data and financial information detail data. Personal identity information content ratio data refers to the degree to which sensitive data contains personal information such as name, ID number, mobile phone number, home address, etc. High content means that the data is more sensitive. Financial information detail data refers to the degree of detail of financial data such as bank account number, credit card information, transaction records, etc. in sensitive data. Detailed financial data may cause direct economic losses, so it is more sensitive. Value feature data includes commercial value. The commercial value assessment data and data scarcity data, where the commercial value assessment data refers to the data with high commercial value such as business secrets, customer lists, and research and development results in the sensitive data, and the data scarcity data refers to the scarcity of sensitive data in the market, for example, professional technical data or exclusive market research data in a specific industry. In addition, the risk characteristic data includes leakage impact data and attack probability data, where the leakage impact data refers to the degree of impact on individuals, enterprises or society after the leakage of sensitive data, and the attack probability data refers to the probability of sensitive data being attacked by hackers, leaked by internal personnel or accidentally leaked. The above data are processed to obtain the sensitivity level coefficient of the sensitive data, and the corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient;

[0152] The calculation formula of the sensitivity level coefficient is:

[0153] ;

[0154] in, is the sensitivity level coefficient, , They are the personal identity information content ratio data and financial information detail data, , They are commercial value assessment data and data scarcity data. , They are respectively leakage impact data and attack probability data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0155] According to an embodiment of the present invention, the collecting of access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index includes:

[0156] Collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information, and login information;

[0157] Extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data;

[0158] The access control compliance index is obtained by processing the verification factor quantity data, the fault tolerance number data and the access frequency limit data.

[0159] It should be noted that after selecting the initial data protection scheme corresponding to the sensitive data according to the sensitivity level, the access control monitoring information of the scheme of the system corresponding to the scheme is further collected, including identity authentication information, authorization information and login information, and the access control feature data is extracted and processed to obtain data, including the number of verification factors, the number of fault tolerances and the access frequency limit data, where the number of verification factors refers to the number of verification factors set for identity authentication when the user accesses, and the verification factors include passwords, SMS verification codes, fingerprints and dynamic passwords, etc. The number of fault tolerances refers to the number of errors that allow the user to log in to the system, and the access frequency limit data refers to data that limits the frequency of access to sensitive data, such as limiting the frequency of access to sensitive data to no more than five times per minute. The above data is then processed to obtain the access control compliance index;

[0160] The calculation formula of the access control compliance index is:

[0161] ;

[0162] in, is the access control compliance index, , , They are the verification factor quantity data, fault tolerance number data, and access frequency limit data. , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0163] According to an embodiment of the present invention, the step of obtaining the data encryption characteristic data of the initial data protection scheme and processing to obtain the data encryption strength index includes:

[0164] Acquiring data encryption characteristic data of the initial data protection scheme, including key length data, encryption performance overhead data, and encryption coverage ratio data;

[0165] The data encryption strength index is obtained by processing the key length data, the encryption performance overhead data and the encryption coverage ratio data.

[0166] It should be noted that, at the same time, the data encryption characteristic data of the initial data protection scheme is obtained, including key length data, encryption performance overhead data and encryption coverage ratio data, wherein the encryption performance overhead data refers to the degree of influence of the data encryption and decryption process on the system performance, and the encryption coverage ratio data refers to the proportion of data covered by transmission encryption and storage encryption, and then the data encryption strength index is obtained by processing the above data;

[0167] The calculation formula of the data encryption strength index is:

[0168] ;

[0169] in, is the data encryption strength index, , , They are key length data, encryption performance overhead data, and encryption coverage ratio data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0170] According to an embodiment of the present invention, monitoring the data backup and recovery information of the sensitive data by the SaaS system, acquiring backup and recovery characteristic data, and processing to obtain the data resilience capability index include:

[0171] Monitor the SaaS system and obtain data backup requirement information and recovery requirement information of the sensitive data;

[0172] Extracting backup and recovery characteristic data according to the data backup requirement information and recovery requirement information, including backup frequency data, backup time window data, backup data integrity data and recovery time target data;

[0173] The data recovery capability index is obtained by processing the backup frequency data, the backup time window data, the backup data integrity data and the recovery time target data.

[0174] It should be noted that, in addition, the aaS system is monitored to obtain the data backup demand information and recovery demand information of sensitive data, and to extract the backup and recovery characteristic data, including backup frequency data, backup time window data, backup data integrity data and recovery time target data, where the backup time window data refers to the time required to complete a data backup, the backup data integrity data refers to the verification of the integrity of the backup data by means of checksums, etc., and the recovery time target data refers to the time required to restore the system and data after a disaster occurs, and then the above data is processed to obtain the data recovery capability index;

[0175] The calculation formula of the data resilience index is:

[0176] ;

[0177] in, is the data resilience index, , They are backup frequency data and backup data integrity data. , They are backup time window data and recovery time target data respectively. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0178] According to an embodiment of the present invention, the access control compliance index, the data encryption strength index, and the data resilience index are processed in combination with the system security index to obtain a data protection comprehensive evaluation index, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme, including:

[0179] According to the access control compliance index, the data encryption strength index and the data recovery capability index, combined with the system security index, a data protection comprehensive assessment index is obtained;

[0180] Performing a threshold comparison between the data protection comprehensive assessment index and a preset data protection comprehensive assessment threshold to obtain a comparison result;

[0181] Determining whether the initial data protection solution meets the protection requirements of the sensitive data according to the comparison result;

[0182] If the initial data protection scheme cannot meet the protection requirements of the sensitive data, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

[0183] It should be noted that in order to more comprehensively, efficiently and accurately evaluate the protection effect of the adapted data protection scheme on sensitive data, the obtained access control compliance index, data encryption strength index and data recovery capability index are processed in combination with the system security index to obtain a comprehensive data protection assessment index. Then, based on the comprehensive data protection assessment index, it is determined whether the initial data protection scheme meets the protection requirements of the sensitive data. If not, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

[0184] The calculation formula of the data protection comprehensive evaluation index is:

[0185] ;

[0186] in, It is the comprehensive evaluation index of data protection. , , , They are access control compliance index, data encryption strength index, data recovery capability index, and system security index. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0187] According to an embodiment of the present invention, it also includes:

[0188] The obtaining of the audit and monitoring characteristic data of the SaaS system and performing a security assessment to obtain a system security index includes:

[0189] Obtaining audit and monitoring feature data of the SaaS system, including audit log generation frequency data, abnormal event detection accuracy data, and response time data;

[0190] Perform security assessment based on the audit log generation frequency data, abnormal event detection accuracy data, and response time data to obtain a system security index;

[0191] The calculation formula of the system safety index is:

[0192] ;

[0193] in, is the system safety index, , , They are audit log generation frequency data, abnormal event detection accuracy data, and response time data. , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0194] It should be noted that, on the other hand, the audit and monitoring characteristic data of the SaaS system are obtained, including audit log generation frequency data, abnormal event detection accuracy data and response time data. Among them, audit log generation frequency data refers to the frequency of recording logs of user behavior and system activities, and response time data refers to the time interval from the discovery of a security incident to the taking of corresponding measures. A security assessment is then conducted based on the above data to obtain the system security index.

[0195] According to an embodiment of the present invention, it also includes:

[0196] Monitor the SaaS system corresponding to the sensitive data in real time and collect log feature data within a preset time period;

[0197] The log feature data includes abnormal login times data, access frequency data, system response delay increase data, data on data transmission volume, and resource utilization data;

[0198] Processing the abnormal login times data, access frequency data, system response delay increase data, data transmission volume data, and resource utilization rate data to obtain a system status abnormality index;

[0199] Compare the system status abnormality index with a preset system status abnormality threshold, and determine whether the SaaS system is abnormal according to the comparison result;

[0200] If an abnormality occurs, an alarm is immediately issued and the SaaS system is maintained;

[0201] The calculation formula of the system status abnormality index is:

[0202] ;

[0203] in, is the system status abnormality index, , , , , The abnormal login times data, access frequency data, system response delay increase data, data transmission volume data, and resource utilization data are processed respectively. , , , , It is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset SaaS system monitoring platform database).

[0204] It should be noted that in order to respond to system anomalies in a timely manner, the SaaS system corresponding to the sensitive data is monitored in real time, and log feature data within a preset time period is collected, including abnormal login times data, access frequency data, system response delay increase data, data transmission volume data and resource utilization data. Among them, the system response delay increase data refers to the increase in the system response time relative to a certain benchmark state or reference time under specific conditions. The data transmission volume data refers to the transmission volume of sensitive data. If the transmission volume of sensitive data increases significantly within a specific time period, there is a risk of illegal copying or transmission of data. The above data is then processed to obtain the system status anomaly index, which is then compared with the preset system status anomaly threshold. Based on the comparison results, it is determined whether the SaaS system is abnormal. If an abnormality occurs, an alarm is immediately issued and the SaaS system is maintained to ensure the security of sensitive data.

[0205] A third aspect of the present invention provides a readable storage medium, which stores a sensitive data protection method program based on a SaaS system. When the sensitive data protection method program based on a SaaS system is executed by a processor, the steps of the sensitive data protection method based on a SaaS system as described in any one of the above items are implemented.

[0206] The sensitive data protection method, system and medium based on the SaaS system disclosed in the present invention obtain the sensitivity level coefficient of preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient, collect access control monitoring information of the initial data protection plan, extract access control feature data, process to obtain access control compliance index, obtain data encryption feature data of the initial data protection plan, and process to obtain data encryption strength index, monitor data backup and recovery information of sensitive data of the SaaS system, and obtain backup and recovery feature data, process to obtain data resilience index, obtain audit and monitoring feature data of the SaaS system, and perform security assessment to obtain system security index, process according to the access control compliance index, data encryption strength index and data resilience index in combination with the system security index to obtain data protection comprehensive evaluation index, and adjust the initial data protection plan accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection plan, thereby realizing the technology of sensitive data protection based on the SaaS system.

[0207] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0208] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0209] In addition, all functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0210] Those skilled in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, the aforementioned program can be stored in a readable storage medium, and when the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), disks or optical disks, and other media that can store program codes.

[0211] Alternatively, if the above-mentioned integrated unit of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention can be essentially or partly reflected in the form of a software product that contributes to the prior art. The software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

Claims

1. A sensitive data protection method based on a SaaS system, characterized in that: The following steps are involved: Obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient; Collecting access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index; Acquire data encryption characteristic data of the initial data protection scheme, and process to obtain a data encryption strength index; Monitor the data backup and recovery information of the sensitive data by the SaaS system, obtain backup and recovery characteristic data, and process to obtain a data recovery capability index; Obtaining audit and monitoring feature data of the SaaS system, and conducting a security assessment to obtain a system security index; According to the access control compliance index, the data encryption strength index and the data recovery capability index, in combination with the system security index, a data protection comprehensive evaluation index is obtained, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme; The collecting of access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index includes: Collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information, and login information; Extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data; Processing the verification factor quantity data, the fault tolerance number data, and the access frequency limit data to obtain an access control compliance index; The calculation formula of the access control compliance index is: ； in, is the access control compliance index, , , They are the verification factor quantity data, fault tolerance number data, and access frequency limit data. , is the preset characteristic coefficient; The step of obtaining the data encryption characteristic data of the initial data protection scheme and processing to obtain the data encryption strength index includes: Acquiring data encryption characteristic data of the initial data protection scheme, including key length data, encryption performance overhead data, and encryption coverage ratio data; Processing the key length data, the encryption performance overhead data, and the encryption coverage ratio data to obtain a data encryption strength index; The calculation formula of the data encryption strength index is: ； in, is the data encryption strength index, , , They are key length data, encryption performance overhead data, and encryption coverage ratio data. , , is the preset characteristic coefficient; The monitoring of the data backup and recovery information of the sensitive data by the SaaS system, obtaining the backup and recovery characteristic data, and processing to obtain the data recovery capability index includes: Monitor the SaaS system and obtain data backup requirement information and recovery requirement information of the sensitive data; Extracting backup and recovery characteristic data according to the data backup requirement information and recovery requirement information, including backup frequency data, backup time window data, backup data integrity data and recovery time target data; Processing the backup frequency data, the backup time window data, the backup data integrity data, and the recovery time target data to obtain a data recovery capability index; The calculation formula of the data resilience index is: ； in, is the data resilience index, , They are backup frequency data and backup data integrity data. , They are backup time window data and recovery time target data respectively. , , is the preset characteristic coefficient.

2. The sensitive data protection method based on the SaaS system according to claim 1 is characterized in that: The step of obtaining the sensitivity level coefficient of the preset sensitive data and generating a corresponding initial data protection scheme based on the SaaS system according to the sensitivity level coefficient includes: Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data; The characteristic data includes content characteristic data, value characteristic data and risk characteristic data; The content characteristic data includes personal identity information content ratio data and financial information detail data; The value feature data includes commercial value assessment data and data scarcity data; The risk characteristic data includes leakage impact data and attack probability data; Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data; A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

3. The sensitive data protection method based on the SaaS system according to claim 2 is characterized in that: The access control compliance index, the data encryption strength index, and the data resilience index are processed in combination with the system security index to obtain a data protection comprehensive evaluation index, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme, including: According to the access control compliance index, the data encryption strength index and the data recovery capability index, combined with the system security index, a data protection comprehensive assessment index is obtained; Performing a threshold comparison between the data protection comprehensive assessment index and a preset data protection comprehensive assessment threshold to obtain a comparison result; Determining whether the initial data protection solution meets the protection requirements of the sensitive data according to the comparison result; If the initial data protection scheme cannot meet the protection requirements of the sensitive data, the initial data protection scheme is adjusted accordingly to obtain an adjusted adapted data protection scheme.

4. A sensitive data protection system based on a SaaS system, characterized in that: The system includes: a memory and a processor, wherein the memory includes a program of a sensitive data protection method based on a SaaS system, and when the program of the sensitive data protection method based on a SaaS system is executed by the processor, the following steps are implemented: Obtain the sensitivity level coefficient of the preset sensitive data, and generate the corresponding initial data protection plan based on the SaaS system according to the sensitivity level coefficient; Collecting access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index; Acquire data encryption characteristic data of the initial data protection scheme, and process to obtain a data encryption strength index; Monitor the data backup and recovery information of the sensitive data by the SaaS system, obtain backup and recovery characteristic data, and process to obtain a data recovery capability index; Obtaining audit and monitoring feature data of the SaaS system, and conducting a security assessment to obtain a system security index; According to the access control compliance index, the data encryption strength index and the data recovery capability index, in combination with the system security index, a data protection comprehensive evaluation index is obtained, and the initial data protection scheme is adjusted accordingly according to the data protection comprehensive evaluation index to obtain an adapted data protection scheme; The collecting of access control monitoring information of the initial data protection scheme, extracting access control feature data, and processing to obtain an access control compliance index includes: Collecting access control monitoring information of the initial data protection scheme, including identity authentication information, authorization information, and login information; Extracting and processing the access control monitoring information to obtain access control feature data, including verification factor quantity data, fault tolerance number data, and access frequency limit data; Processing the verification factor quantity data, the fault tolerance number data, and the access frequency limit data to obtain an access control compliance index; The calculation formula of the access control compliance index is: ； in, is the access control compliance index, , , They are the verification factor quantity data, fault tolerance number data, and access frequency limit data. , is the preset characteristic coefficient; The step of obtaining the data encryption characteristic data of the initial data protection scheme and processing to obtain the data encryption strength index includes: Acquiring data encryption characteristic data of the initial data protection scheme, including key length data, encryption performance overhead data, and encryption coverage ratio data; Processing the key length data, the encryption performance overhead data, and the encryption coverage ratio data to obtain a data encryption strength index; The calculation formula of the data encryption strength index is: ； in, is the data encryption strength index, , , They are key length data, encryption performance overhead data, and encryption coverage ratio data. , , is the preset characteristic coefficient; The monitoring of the data backup and recovery information of the sensitive data by the SaaS system, obtaining the backup and recovery characteristic data, and processing to obtain the data recovery capability index includes: Monitor the SaaS system and obtain data backup requirement information and recovery requirement information of the sensitive data; Extracting backup and recovery characteristic data according to the data backup requirement information and recovery requirement information, including backup frequency data, backup time window data, backup data integrity data and recovery time target data; Processing the backup frequency data, the backup time window data, the backup data integrity data, and the recovery time target data to obtain a data recovery capability index; The calculation formula of the data resilience index is: ； in, is the data resilience index, , They are backup frequency data and backup data integrity data. , They are backup time window data and recovery time target data respectively. , , is the preset characteristic coefficient.

5. The sensitive data protection system based on SaaS system according to claim 4 is characterized in that: The step of obtaining the sensitivity level coefficient of the preset sensitive data and generating a corresponding initial data protection scheme based on the SaaS system according to the sensitivity level coefficient includes: Acquire preset sensitive data that needs to be protected, and extract feature data from the sensitive data; The characteristic data includes content characteristic data, value characteristic data and risk characteristic data; The content characteristic data includes personal identity information content ratio data and financial information detail data; The value feature data includes commercial value assessment data and data scarcity data; The risk characteristic data includes leakage impact data and attack probability data; Processing the content characteristic data, the value characteristic data and the risk characteristic data to obtain a sensitivity level coefficient of the sensitive data; A corresponding initial data protection plan based on the SaaS system is generated according to the sensitivity level coefficient.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a sensitive data protection method program based on a SaaS system. When the sensitive data protection method program based on a SaaS system is executed by a processor, the steps of the sensitive data protection method based on a SaaS system as described in any one of claims 1 to 3 are implemented.

Images