Data security management platform and business data processing method and device

Abstract

The invention relates to the technical field of big data, and provides a data security management platform and a business data processing method and device. Wherein a security group strategy management module in the data security management platform is used for configuring a security group rule of a cloud server, receiving a service request data stream sent by a client, and sending the service request data stream to a multi-level security defense module in the platform under the condition that the service request data stream is subjected to security detection; and the multi-level security defense module performs multi-level security detection on the service request data stream, and sends the filtered target service request data stream to the service processing module under the condition that the service request data stream is subjected to multi-level detection and data filtering is completed, so that the service processing module executes corresponding service processing operation. And the service processing result is fed back to the client through the multi-level security defense module and the security group strategy management module in sequence. By adopting the platform, the data security can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a data security management platform, as well as a business data processing method, device, computer equipment, storage medium and computer program product. Background Art

[0002] With the popularization of the Internet and the electronicization of financial services, financial institutions have higher and higher requirements for information security. Taking banks as an example, the bank management platform is an important system used by banks to manage internal business, which needs to have the characteristics of efficiency, stability and security.

[0003] In actual application, the bank management platform needs to process a large amount of sensitive information, such as customer information, transaction records, and financial data. Therefore, strict security measures such as data encryption, access control, and identity authentication need to be taken for the bank management platform to reduce the risk of data being accessed, stolen, or tampered with by unauthorized third parties.

[0004] At present, the security management of traditional financial institutions often adopts static security precautions, such as establishing firewalls, network isolation, and encrypted transmission to protect system security. However, the above methods still make the platform have the problem of low data security. Summary of the invention

[0005] Based on this, it is necessary to provide a data security management platform that can improve data security, as well as a business data processing method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a data security management platform. The platform includes: a security group policy management module, a multi-level security defense module, and a business processing module;

[0007] The security group policy management module is used to configure the security group rules of the cloud server, receive the business request data flow sent by the client, and send the business request data flow to the multi-level security defense module if the business request data flow passes the security detection. The security group rules are used to limit the access control and port of the cloud server;

[0008] A multi-level security defense module is used to perform multi-level security detection on the received business request data flow. When the business request data flow passes through multi-level detection, the business request data flow is filtered to obtain the target business request data flow, and the target business request data flow is sent to the business processing module;

[0009] The business processing module is used to respond to the target business request data flow, perform the corresponding business processing operation, obtain the business processing result, and feed back the business processing result to the client through the multi-level security defense module and the security group policy management module in sequence;

[0010] Among them, multi-level security detection includes physical security detection, network security detection, system security detection and application security detection. The business processing results are fed back to the client by the security group policy management module after passing through the multi-level security detection and data filtering of the multi-level security defense module and the security detection of the security group policy management module.

[0011] The above data security management platform includes a security group policy management module, a multi-level security defense module and a business processing module. The security group policy management module can reasonably configure the security group policy, perform precise access control on the business request data flow, and prevent unauthorized access and malicious attacks. The multi-level security defense module performs multi-level security detection and data filtering on the received business request data flow, including physical security detection, network security detection, system security detection and application security detection, which can improve the ability to identify potential security threats and malicious behaviors and enhance the security of the system and data. The corresponding business processing operation is executed through the business processing module, and the business processing results are fed back to the client through the multi-level security defense module and the security group policy management module in turn, so as to ensure that the business processing results are returned to the client after security detection, avoiding potential security risks. The entire solution comprehensively considers the multi-level security requirements such as physical security, network security, system security and application security, and provides a flexible security group policy management and security detection mechanism, so that the platform can adapt to different security requirements and business scenarios, effectively defend against various potential security threats and attacks, and enhance the security and reliability of the system.

[0012] In one embodiment, the platform also includes a cloud security integration module for screening and integrating multiple security components that match the platform based on platform demand data and risk assessment data, the security components including a cloud firewall, an attack defense component, and an intrusion detection security component.

[0013] In one of the embodiments, the platform further includes: a data encryption module, which is used to filter out target data from the data to be transmitted according to preset data privacy requirements, encrypt the target data, and transmit the encrypted target data.

[0014] In one of the embodiments, the platform also includes: a security audit module, which is used to record the access log, operation log and security events of the platform, and perform security analysis on the security events based on the access log and operation log to obtain security analysis results.

[0015] In one of the embodiments, the platform also includes a vulnerability management module for periodically scanning security vulnerabilities and generating vulnerability scanning reports.

[0016] In one of the embodiments, the platform further includes: a safety training module, which is used to determine safety training content based on safety training demand data and push the safety training content.

[0017] In a second aspect, the present application also provides a method for processing business data. The method comprises:

[0018] Receive the service request data stream sent by the client and perform initial security detection on the service request data stream;

[0019] If the service request data flow passes the initial security check, a multi-level security check is performed on the service request data flow;

[0020] If the business request data flows through multiple layers of detection, the business request data flow is filtered to obtain the target business request data flow;

[0021] Respond to the target business request data flow, execute the corresponding business processing operation, and obtain the business processing result;

[0022] Send the business processing results to the client through a secure communication protocol;

[0023] Among them, multi-level security testing includes physical security testing, network security testing, system security testing and application security testing.

[0024] In one embodiment, after the business processing result is sent to the client through the secure communication protocol, the method further includes:

[0025] Collect security record data generated during business data processing;

[0026] Generate safety analysis reports based on safety record data;

[0027] The security record data includes at least one of access logs, operation logs and security event records.

[0028] In a third aspect, the present application also provides a service data processing device. The device comprises:

[0029] The preliminary security detection module is used to receive the business request data stream sent by the client and perform initial security detection on the business request data stream.

[0030] The multi-level security detection module is used to perform multi-level security detection on the business request data flow if the business request data flow passes the initial security detection.

[0031] The data filtering module is used to filter the business request data flow if the business request data flows through multiple levels of detection to obtain the target business request data flow.

[0032] The data processing module is used to respond to the target business request data flow, execute the corresponding business processing operation, and obtain the business processing result.

[0033] The data sending module is used to send the business processing results to the client through a secure communication protocol.

[0034] Among them, multi-level security testing includes physical security testing, network security testing, system security testing and application security testing.

[0035] In a fourth aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps in the above-mentioned embodiments of the business data processing method are implemented.

[0036] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above-mentioned embodiments of the business data processing method are implemented.

[0037] In a sixth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned business data processing method embodiments are implemented.

[0038] The above-mentioned business data processing method, device, computer equipment, storage medium and computer program product, when receiving the business request data stream, first perform an initial security check on the business request data stream, which can alleviate the pressure of subsequent security inspection and processing, and then perform multi-level security checks on the business request data stream including physical security checks, network security checks, system security checks and application security checks, which can enhance the ability to identify potential security threats and malicious behaviors, improve the overall security of the system and data, and then filter the business request data stream to filter invalid or non-compliant data, which helps to improve the accuracy and efficiency of business processing. Finally, the business processing results are sent to the client through a secure communication protocol, which can improve the confidentiality and integrity of the data transmission process, effectively prevent data from being tampered with or stolen, and improve data security. In summary, the above-mentioned scheme can effectively improve the security of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A structural block diagram of a data security management platform in an embodiment;

[0040] Figure 2 It is a structural block diagram of a data security management platform in another embodiment;

[0041] Figure 3 It is a structural block diagram of a data security management platform in yet another embodiment;

[0042] Figure 4 A structural block diagram of a data security management platform in yet another embodiment;

[0043] FIG5 is an application environment diagram of a business data processing method in one embodiment;

[0044] Figure 6 A flowchart of a method for processing business data in one embodiment;

[0045] Figure 7 is a flowchart of a business data processing method in another embodiment;

[0046] Figure 8 is a structural block diagram of a business data processing device in an embodiment;

[0047] Fig. 9 is a structural block diagram of a business data processing device in an embodiment;

[0048] FIG. 10 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0051] At present, the data management mechanism of the data management platform in the financial field is not perfect enough, and there are defects in data storage, backup and recovery. In addition, data is easily lost, damaged or stolen, and the platform is vulnerable to malicious attacks or abuse by internal personnel. Based on the problem of low data security performance of the data management platform, this application organically combines cloud computing, big data analysis, artificial intelligence and other technologies to build a data security management platform with multiple security prevention modules.

[0052] In one embodiment, Figure 1 As shown, a data security management platform is provided, including: a security group policy management module 100, a multi-level security defense module 200 and a business processing module 300;

[0053] The security group policy management module 100 is used to configure the security group rules of the cloud server, receive the business request data stream sent by the client, and send the business request data stream to the multi-level security defense module when the business request data stream passes the security detection. The security group rules are used to limit the access control and ports of the cloud server.

[0054] The multi-level security defense module 200 is used to perform multi-level security detection on the received business request data flow. When the business request data flow undergoes multi-level detection, the business request data flow is filtered to obtain the target business request data flow, and the target business request data flow is sent to the business processing module.

[0055] The business processing module 300 is used to respond to the target business request data flow, perform the corresponding business processing operation, obtain the business processing result, and feed back the business processing result to the client through the multi-level security defense module and the security group policy management module in sequence;

[0056] Among them, the multi-level security detection includes physical security detection, network security detection, system security detection and application security detection. The business processing results are fed back to the client by the security group policy management module 100 after passing through the multi-level security detection and data filtering of the multi-level security defense module 200 and the security detection of the security group policy management module 100 in sequence.

[0057] In this embodiment, the security group rules can also be called security group policies, which are used to limit the access sources and ports of the cloud server. In other words, the security group is a virtual firewall that protects the server through network ACL (Network Access Control List) rules and port restrictions. The technicians need to set the allowed network traffic type, source IP address, destination IP address, port range, etc. in the security group policy module to ensure the network security of the bank management platform.

[0058] Specifically, the security group rules can also be executed in order of priority, and the order of the rules can be adjusted according to the needs so that more important rules are placed in front to prevent unnecessary traffic from entering the server. In actual applications, the security group policy management module 100 can also regularly review and update the security group rules, adjust them according to business needs and security risks, add new rules, delete no longer needed rules, and ensure the accuracy and compliance of the rules. The business request data flow may include data such as request method, request URL (Uniform Resource Locator), request header, request body, request parameters, and request cookies.

[0059] The multi-level security defense module 200 is used to configure and manage multi-level security defense measures, including physical security detection, network security detection, system security detection, and application security detection. Specifically, regarding physical security detection, it can be to deploy an intrusion detection system or an intrusion prevention system to detect and prevent unauthorized physical access. Regarding network security detection, it can be to configure firewalls, intrusion detection systems, and intrusion prevention systems to monitor and filter network traffic, use network scanning tools to perform vulnerability scanning, discover security vulnerabilities in network devices and applications, implement intrusion detection and event response mechanisms, and promptly detect and respond to potential network intrusion behaviors. Regarding system security detection, it can be to configure strong password policies, access control, and permission management to ensure that only authorized personnel can access system resources, use security auditing and logging mechanisms to record system events and activities for subsequent auditing and troubleshooting, etc. Regarding application security detection, it can be to conduct security code audits to check potential vulnerabilities and security risks in applications, and implement input validation and filtering to prevent common security vulnerabilities, such as cross-site scripting attacks and SQL (Structured Query Language) injections.

[0060] The business processing module 300 is used to respond to the business processing request initiated by the client, and to verify and authenticate the request, including checking the validity of the request, verifying the identity of the client, checking access rights, etc. After the authentication is passed, the business processing request is parsed, and the parameters and data in the request are extracted, including the URL, request body, query parameters, etc. of the parsed request. Then, according to the type and parameters of the request, the corresponding business logic component or service is called to perform specific business operations, specifically involving database operations, calling other services, executing business rules, etc., to obtain the corresponding business processing results, and then the business processing results are fed back to the client.

[0061] In specific implementation, when a client initiates a service request, first, the security group policy management module 100 receives the service request data stream (hereinafter referred to as the request data stream). Then, the security group policy management module 100 extracts the request parameters and tag data in the request data stream, performs an initial security check on the service request data stream, including verifying the format, length and encoding of the request data stream, etc. After the verification, the content in the request data stream is checked, including verifying the request parameters, whether the detector input contains malicious code or illegal characters, and whether the parameters in the request contain keywords or special characters of the SQL statement to prevent SQL injection attacks, to ensure that the request comes from a legitimate source, etc. When the request data stream passes the above preliminary security check, the request data stream is sent to the multi-level security defense module 200. If the request data stream fails the security check, the request is rejected and a request exception message is pushed to the client. The request exception message may carry the cause of the exception.

[0062] After receiving the request data stream, the multi-level security defense module 200 can perform multi-level detection on the request data stream according to the preset multi-level security policy, including physical security detection, network security detection, system security detection and application security detection in the above manner. In the case that the business request data flow has multi-level detection, the business request data stream is filtered to filter out potential illegal characters and malicious codes and other data, obtain the target business request data stream, and then send the target business request data stream to the business processing module 300. If the request data stream fails the multi-level security detection, the request is rejected and a request exception message is pushed to the client, and the request exception message can carry the exception reason.

[0063] The business processing module 300 responds to the target business request data flow and verifies the target business request data flow, including verifying its validity, verifying the client identity, checking access rights, etc. When the request data flow is authenticated, the business processing request is parsed, the parameters and request type in the request are extracted, and then, according to the type and parameters of the request, the corresponding business logic component or service is called to perform specific business operations, specifically involving database operations, calling other services, executing business rules, etc., to obtain the corresponding business processing results, and then the business processing results are passed to the multi-level security defense module 200, so that the multi-level security defense module 200 performs multi-level security detection on the business processing results. If the business processing results pass the multi-level security detection, the business processing results are fed back to the security group policy management module 100, so that the security group policy management module 100 performs security detection on the business processing results again. If the business processing results pass the security detection, the security group policy management module 100 feeds back the business processing results to the client. Specifically, the security group policy management module 100 can feed back the business processing results to the client through a secure communication protocol to ensure the security and reliability of data transmission.

[0064] The above data security management platform includes a security group policy management module, a multi-level security defense module and a business processing module. The security group policy management module can reasonably configure the security group policy, perform precise access control on the business request data flow, and prevent unauthorized access and malicious attacks. The multi-level security defense module performs multi-level security detection and data filtering on the received business request data flow, including physical security detection, network security detection, system security detection and application security detection, which can improve the ability to identify potential security threats and malicious behaviors and enhance the security of the system and data. The corresponding business processing operation is executed through the business processing module, and the business processing results are fed back to the client through the multi-level security defense module and the security group policy management module in turn, so as to ensure that the business processing results are returned to the client after security detection, avoiding potential security risks. The entire solution comprehensively considers the multi-level security requirements such as physical security, network security, system security and application security, and provides a flexible security group policy management and security detection mechanism, so that the platform can adapt to different security requirements and business scenarios, effectively defend against various potential security threats and attacks, and enhance the security and reliability of the system.

[0065] like Figure 2 As shown, in one embodiment, the platform also includes a cloud security integration module 400, which is used to screen and integrate multiple security components that match the platform based on platform demand data and risk assessment data, and the security components include a cloud firewall, an attack defense component, and an intrusion detection security component.

[0066] Platform demand data includes security goals, platform functions and requirements, for example, considering the platform's functions, performance, scalability, customizability, compatibility and price. Risk assessment data includes data on the risks and threats that the platform may face in the future.

[0067] In this embodiment, the cloud security integration module 400 is used to select and integrate cloud security solutions suitable for the management end platform. In practical applications, taking the bank management end platform as an example, the cloud security integration module 400 can obtain the security demand data and risk assessment data of the platform, evaluate and compare different cloud security solution suppliers and solutions based on the security demand data and risk assessment data, determine the most suitable cloud security solution, and formulate an integration plan based on the selected cloud security solution, including determining the scope of integration, time plan, resource requirements, technical requirements, etc. Then, according to the integration plan, deploy and configure the cloud security solution, specifically including screening and determining multiple security components, creating and configuring corresponding security components in the cloud environment, such as cloud firewalls, DDoS attack defense components, intrusion detection systems, etc., that is, making corresponding settings according to security requirements to ensure the effectiveness of security policies and rules. Further, a corresponding monitoring and operation and maintenance mechanism can also be established to monitor and manage the cloud security solution in real time. In addition, regularly evaluate and improve the cloud security solution, and update and upgrade it according to new threats, vulnerabilities and requirements. Maintain a close cooperative relationship with suppliers, obtain security updates and patches in a timely manner, and ensure that the security solution keeps pace with the latest security standards and technologies.

[0068] In this embodiment, multiple security components matching the platform are deployed through the cloud security integration module, which can meet the security requirements of the platform and improve the security performance of the platform.

[0069] like Figure 3 As shown, in one embodiment, the platform also includes: a data encryption module 500, which is used to filter out target data from the data to be transmitted according to preset data privacy requirements, encrypt the target data, and transmit the encrypted target data.

[0070] In this embodiment, the target data includes sensitive data. Among them, sensitive data includes user identity information, account information, and transaction data. The data encryption module 500 is used to specify and implement a data encryption scheme. Specifically, when the data encryption module 500 receives the data to be transmitted, it can be based on the preset data privacy requirements to screen out sensitive data in the data to be transmitted, and then, using a data encryption mechanism, the sensitive data is encrypted. Specifically, the TLS (Transport Layer Security) / SSL (Secure Sockets Layer) protocol can be used to encrypt network communications. For data storage, the AES (Advanced Encryption Standard) encryption algorithm can be used to encrypt the data to be transmitted and ensure the secure management of the encryption key. It is understandable that in other embodiments, other encryption algorithms such as the RSA (Rivest-Shamir-Adleman) encryption algorithm can also be used for encryption processing, depending on the actual situation.

[0071] In this embodiment, the data to be transmitted is encrypted by the data encryption module, which can improve the security of data transmission and reduce the risks of data leakage, tampering and theft.

[0072] like Figure 3 As shown, in one embodiment, the platform also includes: a security audit module 600, which is used to record the access log, operation log and security events of the platform, and perform security analysis on the security events based on the access log and operation log to obtain security analysis results.

[0073] Access logs include the user ID, timestamp, and IP (Internet Protocol) address of the user who accessed the platform. Operation logs include data such as the user ID, timestamp, operation object, operation type, operation result, and operation details of the operation. Security events include abnormal logins, malicious code propagation, and unauthorized access.

[0074] In this embodiment, the security audit module 600 is used to determine the audit requirements of the platform, including what types of access logs, operation logs and security events are recorded, and what security audit standards and regulatory requirements need to be met. Security events are analyzed based on access logs and operation logs. In actual applications, access logs, operation logs and security events are fully recorded, wherein the detected security events are recorded in detail, including information such as event type, timestamp, related users, event description, etc.

[0075] Then, based on the access records and operation logs, security analysis is performed on the security events, including detecting abnormal login behaviors, checking permission changes, identifying possible attack behaviors, etc. In addition, log analysis tools, security information and event management systems and other tools can be used to analyze security events and obtain security analysis results. Furthermore, a security analysis report can be generated based on the analysis results of the security events. The report can include classification of security events, cause analysis, risk assessment and recommended measures, etc. In addition, the security audit module 600 can be regularly updated and maintained to ensure that it is synchronized with other components of the platform and to repair possible security vulnerabilities.

[0076] In this embodiment, the security audit module records access logs and operation logs, analyzes security events, and can trace and investigate security events, providing important investigation basis when security events occur.

[0077] like Figure 4 As shown, in one embodiment, the platform also includes a vulnerability management module 700 for periodically scanning security vulnerabilities and generating vulnerability scanning reports.

[0078] In this embodiment, the vulnerability management module 700 is mainly used to detect and repair security vulnerabilities in the system, application or network. Specifically, it can be used to set the frequency and time of regular scanning, such as scanning once a week or a month, and determine the target scope of the scan, including the system, application, database, etc. Then, according to the set plan, the automated tool performs vulnerability scanning and vulnerability repair on the target.

[0079] In specific implementation, it can be to scan the operating system, application, database and network equipment for vulnerabilities through automated scanning tools at a set frequency and time to detect potential vulnerabilities and security weaknesses. Then, the scan results can be analyzed and identified to determine the type, hazard level and impact range of the vulnerability. According to the hazard level and impact range of the vulnerability, the vulnerability can be evaluated and a priority can be assigned to each vulnerability. Vulnerabilities with higher priorities may cause serious security risks and need to be repaired as soon as possible. Finally, a vulnerability scan report is generated based on the scan results. Further, the vulnerability scan report is pushed so that the security team or system administrator can repair the vulnerability. In other embodiments, it can also be that the vulnerability management module 700 responds to the vulnerability repair instruction, calls the automated vulnerability repair tool, and repairs the scanned vulnerabilities according to the priority. After the vulnerability repair is completed, a verification test is performed to ensure that the vulnerability has been successfully repaired. After that, the vulnerability status is updated, the vulnerability is marked as repaired or closed, and the detailed information of the repair, such as the repair time, repair method, etc., is recorded, and a vulnerability repair report is generated to record the number of repaired vulnerabilities, the repair progress and the effect of the vulnerability repair. At the same time, unrepaired vulnerabilities are tracked and ensured to be handled in a timely manner.

[0080] In this embodiment, the vulnerability management module can timely discover and repair security vulnerabilities, improve the security of the platform and application programs, and reduce potential security risks.

[0081] like Figure 4 As shown, in one embodiment, the platform further includes: a safety training module 800, which is used to determine the safety training content according to the safety training demand data and push the safety training content.

[0082] Security training demand data may include employees' security awareness levels, security training topic preferences, job-specific security requirements, etc., which can be collected through surveys, questionnaires, security awareness assessments, or communication with relevant departments. Security training content includes full awareness training, password management, network security, social engineering attack prevention, data privacy protection, and other training content.

[0083] The security training module 800 can be based on the security training demand data, analyze and organize the security training demand data, identify the areas of concern and specific training topics, and then extract the corresponding data from the database or data source according to the analysis results of the demand data to determine the security training content, security training plan and training methods. Among them, the training methods include but are not limited to face-to-face training, remote training, online training platform, video conferencing and other methods. Then, according to the training plan and the selected training method, push the security training content to the target personnel to ensure that the training content can be communicated to the participants in a timely manner, and provide necessary support and resources. Taking the bank management platform as an example, the security training module 800 can provide training on bank security best practices and security awareness to improve the security awareness and knowledge level of employees, thereby reducing the occurrence of security incidents caused by human factors.

[0084] In this embodiment, pushing security training content through the security training module can improve the user's security awareness and knowledge level and reduce the possibility of human-caused security incidents.

[0085] Based on the same inventive concept, the present application also provides a business data processing method. The business data processing method provided in the embodiment of the present application can be applied in an application environment as shown in Figure 5. Among them, the client 102 communicates with the server 104 through the network, and the server 104 can be a server of the data security management platform. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Specifically, it can be that the user sends a business request data stream to the server 104 through the client 102, and the server 104 receives the business request data stream sent by the client 102, and performs an initial security detection on the business request data stream. If the business request data stream passes the initial security detection, the business request data stream is subjected to multi-level security detection, and the multi-level security detection includes physical security detection, network security detection, system security detection and application security detection. If the business request data flows through multi-level detection, the business request data stream is filtered to obtain the target business request data stream, and then, the target business request data stream is responded to, and the corresponding business processing operation is performed to obtain the business processing result, and finally, the business processing result is sent to the client 102 through the secure communication protocol.

[0086] The client 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0087] In one embodiment, Figure 6 As shown, a business data processing method is provided, which is described by taking the method applied to the server 104 in FIG. 5 as an example, and includes the following steps:

[0088] S202, receiving a service request data stream sent by a client, and performing an initial security check on the service request data stream.

[0089] The service request data flow may include data such as request method, request URL, request header, request body, request parameters, and request cookies.

[0090] In specific implementation, the client initiates a business processing request to the server and sends a business request data stream to the server. After receiving the business request data stream, the server can extract the request parameters and tag data in the request data stream, and perform initial security checks on the business request data stream, including verifying the format, length and encoding of the request data stream. After the verification is passed, the content in the request data stream is checked, including verifying the request parameters, whether the detector input contains malicious code or illegal characters, checking whether the parameters in the request contain keywords or special characters of the SQL statement to prevent SQL injection attacks, and verifying the tags or tokens in the request to ensure that the request comes from a legitimate source.

[0091] S204: If the service request data flow passes the initial security check, a multi-level security check is performed on the service request data flow.

[0092] Continuing from the previous embodiment, if the request data stream passes the above-mentioned preliminary security detection, the request data stream may be further subjected to multi-level security detection. The multi-level security detection includes physical security detection, network security detection, system security detection, and application security detection. If the request data stream fails the security detection, the request is rejected and a request exception message is pushed to the client, and the request exception message may carry the cause of the exception.

[0093] Specifically, regarding physical security testing, it can be to deploy intrusion detection systems or intrusion prevention systems to detect and prevent unauthorized physical access. Regarding network security testing, it can be to configure firewalls, intrusion detection systems, and intrusion prevention systems to monitor and filter network traffic, use network scanning tools to perform vulnerability scanning, discover security vulnerabilities in network devices and applications, implement intrusion detection and incident response mechanisms, and promptly detect and respond to potential network intrusion behaviors. Regarding system security testing, it can be to configure strong password policies, access control, and permission management to ensure that only authorized personnel can access system resources, use security auditing and logging mechanisms to record system events and activities for subsequent auditing and troubleshooting, etc. Regarding application security testing, it can be to conduct security code audits to check for potential vulnerabilities and security risks in applications, as well as implement input validation and filtering to prevent common security vulnerabilities such as cross-site scripting attacks and SQL (Structured Query Language) injections.

[0094] S206: If the business request data flow passes through multiple layers of detection, the business request data flow is filtered to obtain a target business request data flow.

[0095] Continuing from the previous embodiment, if the service request data stream passes the above multi-level detection, the service request data stream is filtered to filter out potential illegal characters and malicious code data, and obtain the target service request data stream. If the request data stream fails the multi-level security detection, the request is rejected and a request exception message is pushed to the client, which may carry the cause of the exception.

[0096] S208, responding to the target business request data flow, executing the corresponding business processing operation, and obtaining the business processing result.

[0097] After obtaining the target business request data flow, you can respond to the target business request data flow, perform corresponding business processing operations, and obtain business processing results.

[0098] Specifically, it can be to verify the target business request data flow, including verifying its validity, verifying the client identity, checking access rights, etc. When the request data flow is authenticated, the business processing request is parsed, the parameters and request type in the request are extracted, and then, according to the type and parameters of the request, the corresponding business logic component or service is called to perform specific business operations, specifically involving database operations, calling other services, executing business rules, etc., to obtain the corresponding business processing results.

[0099] S210, sending the business processing result to the client via a secure communication protocol.

[0100] After obtaining the business processing result, in order to ensure communication security and data security, the business processing result can be sent to the client through a secure communication protocol. The secure communication protocol includes but is not limited to the SSL protocol and the SSH (Secure Shell) protocol.

[0101] In the above-mentioned business data processing method, when receiving the business request data stream, the business request data stream is first subjected to an initial security check, which can alleviate the pressure of subsequent security checks and processing, and then the business request data stream is subjected to a multi-level security check including physical security check, network security check, system security check and application security check, which can enhance the ability to identify potential security threats and malicious behaviors, and improve the overall security of the system and data. Then, by filtering the business request data stream, invalid or non-compliant data can be filtered, which helps to improve the accuracy and efficiency of business processing. Finally, the business processing results are sent to the client through a secure communication protocol, which can improve the confidentiality and integrity of the data transmission process, effectively prevent data from being tampered with or stolen, and improve data security. In summary, the above-mentioned scheme can effectively improve the security of data.

[0102] like Figure 7As shown, in one embodiment, after S210, it also includes: S212, collecting security record data generated during the business data processing, and generating a security analysis report based on the security record data, the security record data including at least one of access logs, operation logs and security event records.

[0103] The access log includes the user ID, timestamp, and IP address of the user who accessed the platform. The operation log includes data such as the user ID, timestamp, operation object, operation type, operation result, and operation details of the operation. Security events include abnormal logins, malicious code propagation, and unauthorized access.

[0104] In specific implementation, the server can record access logs, operation logs, security events and other security record data in real time. Then, security analysis is performed on the access logs, operation logs and security events, including detecting abnormal login behaviors, checking permission changes, identifying possible attack behaviors, etc., and generating a security analysis report. The security analysis report may include risk assessment, classification of security events, cause analysis, and recommended measures.

[0105] In this embodiment, by recording the security record data generated during the business data processing and performing security analysis on the security record data, it is possible to trace and investigate security incidents and provide important investigation basis when security incidents occur.

[0106] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0107] Based on the same inventive concept, the embodiment of the present application also provides a business data processing device for implementing the business data processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more business data processing device embodiments provided below can refer to the limitations on the business data processing method above, and will not be repeated here.

[0108] In one embodiment, Figure 8As shown, a business data processing device 800 is provided, including: a preliminary security detection module 810, a multi-level security detection module 820, a data filtering module 830, a data processing module 840 and a data sending module 850, wherein:

[0109] The preliminary security detection module 810 is used to receive the service request data stream sent by the client and perform an initial security detection on the service request data stream.

[0110] The multi-level security detection module 820 is used to perform a multi-level security detection on the service request data flow if the service request data flow passes the initial security detection.

[0111] The data filtering module 830 is used to filter the business request data flow if the business request data flows through multiple layers of detection to obtain a target business request data flow.

[0112] The data processing module 840 is used to respond to the target business request data flow, execute the corresponding business processing operation, and obtain the business processing result.

[0113] The data sending module 850 is used to send the business processing results to the client through a secure communication protocol.

[0114] Among them, multi-level security testing includes physical security testing, network security testing, system security testing and application security testing.

[0115] like Fig. 9 As shown, in one embodiment, the device also includes a security analysis report generation module 860, which is used to collect security record data generated during business data processing, and generate a security analysis report based on the security record data, wherein the security record data includes at least one of an access log, an operation log, and a security event record.

[0116] Each module in the above-mentioned business data processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0117] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG10. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as security record data and business processing results. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business data processing method is implemented.

[0118] Those skilled in the art will understand that the structure shown in FIG. 10 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In one of the embodiments, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps in the above-mentioned business data processing method embodiments are implemented.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned business data processing method embodiments are implemented.

[0121] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above-mentioned business data processing method embodiments when executed by a processor.

[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data security management platform, characterized in that: The platform includes: a security group policy management module, a multi-level security defense module and a business processing module; The security group policy management module is used to configure the security group rules of the cloud server, receive the service request data stream sent by the client, and send the service request data stream to the multi-level security defense module if the service request data stream passes the security detection. The security group rules are used to limit the access control and port of the cloud server; The multi-level security defense module is used to perform multi-level security detection on the received business request data flow. When the business request data flows through the multi-level detection, the business request data flow is filtered to obtain the target business request data flow, and the target business request data flow is sent to the business processing module; The business processing module is used to respond to the target business request data flow, perform corresponding business processing operations, obtain business processing results, and feed back the business processing results to the client through the multi-level security defense module and the security group policy management module in sequence; Among them, the multi-level security detection includes physical security detection, network security detection, system security detection and application security detection. The business processing result is fed back to the client by the security group policy management module after passing the multi-level security detection and data filtering of the multi-level security defense module and the security detection of the security group policy management module in sequence.

2. The data security management platform according to claim 1, characterized in that: The platform also includes a cloud security integration module for screening and integrating multiple security components that match the platform based on platform demand data and risk assessment data. The security components include a cloud firewall, an attack defense component, and an intrusion detection security component.

3. The data security management platform according to claim 1, characterized in that: The platform also includes: a data encryption module, which is used to screen out target data from the data to be transmitted according to preset data privacy requirements, encrypt the target data, and transmit the encrypted target data.

4. The data security management platform according to any one of claims 1 to 3, characterized in that: The platform also includes: a security audit module, which is used to record the access log, operation log and security events of the platform, and perform security analysis on the security events based on the access log and the operation log to obtain security analysis results.

5. The data security management platform according to claim 4, characterized in that: The platform also includes a vulnerability management module for regularly scanning security vulnerabilities and generating vulnerability scanning reports.

6. The data security management platform according to claim 5, characterized in that: The platform also includes: a safety training module, which is used to determine the safety training content according to the safety training demand data and push the safety training content.

7. A business data processing method, characterized in that: The method comprises: Receive a service request data stream sent by a client, and perform an initial security check on the service request data stream; If the service request data flow passes the initial security check, then a multi-level security check is performed on the service request data flow; If the business request data flows through multiple layers of detection, filtering the business request data flow to obtain a target business request data flow; Responding to the service request data flow, executing corresponding service processing operations, and obtaining service processing results; Sending the business processing result to the client via a secure communication protocol; Among them, the multi-level security detection includes physical security detection, network security detection, system security detection and application security detection.

8. The method according to claim 7, characterized in that After the business processing result is sent to the client through the secure communication protocol, the method further includes: Collect security record data generated during business data processing; Generate a safety analysis report based on the safety record data; The security record data includes at least one of an access log, an operation log and a security event record.

9. A business data processing device, characterized in that: The device comprises: A preliminary security detection module is used to receive a service request data stream sent by a client and perform an initial security detection on the service request data stream; A multi-level security detection module, used for performing a multi-level security detection on the service request data flow if the service request data flow passes the initial security detection; A data filtering module, used for filtering the business request data flow to obtain a target business request data flow if the business request data flows through multiple layers of detection; A data processing module is used to respond to the service request data flow, perform corresponding service processing operations, and obtain service processing results; A data sending module, used to send the business processing results to the client through a secure communication protocol; Among them, the multi-level security detection includes physical security detection, network security detection, system security detection and application security detection.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 7 to 8 are implemented.

Images