Data security control method, device and equipment, medium and program product

Abstract

The invention provides a data security control method, device and equipment, a medium and a program product, and relates to the technical field of data security. The data security control method is executed by first electronic equipment and comprises the steps that an identity authentication request is sent to an identity authentication platform, and the identity authentication request carries geographical location information of the first electronic equipment; and obtaining an identity authentication result fed back by the identity authentication platform according to the identity authentication request, wherein the identity authentication result comprises first data operation authorization information corresponding to the geographical location information. According to the scheme, the effect of controlling the data security based on the geographic position information can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security control method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of information technology, data has become the core asset in various fields, and data security issues have attracted much attention. However, existing security protection measures have many defects in complex and changing network environments, making it difficult to fully guarantee data security. Existing data security protection solutions focus on access control, encryption and other technologies, and pay insufficient attention to the legitimacy of the data's geographical location.

[0003] Therefore, a data security protection solution that focuses on the geographic location of the data is needed to meet the growing network security needs. Summary of the invention

[0004] The technical solution of the present invention aims to provide a data security control method, device, equipment, medium and program product to solve the problem of lack of data security protection solutions that pay attention to the geographical location of data in the prior art.

[0005] To achieve the above object, the present invention is achieved by:

[0006] In a first aspect, an embodiment of the present invention provides a data security control method, which is performed by a first electronic device, and the method includes:

[0007] Sending an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographic location information of the first electronic device;

[0008] An identity authentication result fed back by the identity authentication platform according to the identity authentication request is obtained, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0009] Optionally, in the data security control method, the identity authentication request further carries at least one of the following:

[0010] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0011] User identification;

[0012] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0013] Optionally, the data security control method further comprises:

[0014] The process of executing the data operation indicated by the first data operation authorization information.

[0015] Optionally, in the data security control method, the data operation includes at least one of a data transmission operation, a data generation operation, a data reading operation, a data modification operation, a data processing operation, a data encryption operation, a data decryption operation and a data deletion operation.

[0016] Optionally, in the data security control method, the data operation includes the data transmission operation;

[0017] The process of executing the data operation indicated by the first data operation authorization information includes:

[0018] In the case where it is necessary to perform a data transmission operation indicated by the first data operation authorization information on a second electronic device, obtaining second data operation authorization information of the second electronic device;

[0019] In a case where the data operation indicated by the second data operation authorization information includes a data transmission operation, a process of performing the data transmission operation indicated by the first data operation authorization information is performed.

[0020] Optionally, in the data security control method, after executing the data operation indicated by the first data operation authorization information, the method further comprises:

[0021] A data operation log is generated, wherein the data operation log includes the geographic location information.

[0022] Optionally, the data security control method further comprises:

[0023] Generate an identity authentication log, the identity authentication log including at least one of the following:

[0024] the identity authentication request;

[0025] The time of sending the identity authentication request to the identity authentication platform;

[0026] The identity authentication result.

[0027] In a second aspect, an embodiment of the present invention provides a data security control method, which is executed by an identity authentication platform, and the method includes:

[0028] Obtaining an identity authentication request sent by a first electronic device, where the identity authentication request carries geographic location information of the first electronic device;

[0029] In response to the identity authentication request, an identity authentication result is sent to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0030] Optionally, in the data security control method, the identity authentication request further carries at least one of the following:

[0031] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0032] User identification;

[0033] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0034] Optionally, in the data security control method, before responding to the identity authentication request and sending the identity authentication result to the first electronic device, the method further includes:

[0035] An identity authentication result of the first electronic device is determined according to the identity authentication request, the identity authentication policy, and the data operation authorization policy.

[0036] In a third aspect, an embodiment of the present invention provides a data security control device, applied to a first electronic device, the device comprising:

[0037] A first sending module, configured to send an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographical location information of the first electronic device;

[0038] The first acquisition module is used to obtain the identity authentication result fed back by the identity authentication platform according to the identity authentication request, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0039] In a fourth aspect, an embodiment of the present invention provides a data security control device, which is applied to an identity authentication platform, and the device includes:

[0040] A second acquisition module, configured to acquire an identity authentication request sent by a first electronic device, wherein the identity authentication request carries geographical location information of the first electronic device;

[0041] The second sending module is used to respond to the identity authentication request and send an identity authentication result to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0042] In the fifth aspect, an embodiment of the present invention provides a data security control device, a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the data security control method as described in the first aspect is implemented, or the data security control method as described in the second aspect is implemented.

[0043] In a sixth aspect, an embodiment of the present invention provides a readable storage medium having a program stored thereon, and when the program is executed by a processor, the program implements the data security control method as described in the first aspect, or implements the data security control method as described in the second aspect.

[0044] In a seventh aspect, an embodiment of the present invention provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the data security control method as described in the first aspect, or implement the data security control method as described in the second aspect.

[0045] The beneficial effects of the above technical solution of the present invention are as follows:

[0046] In an embodiment of the present invention, a first electronic device sends an identity authentication request to an identity authentication platform, the identity authentication request carries the geographic location information of the first electronic device; and obtains the identity authentication result fed back by the identity authentication platform according to the identity authentication request, the identity authentication result includes the first data operation authorization information corresponding to the geographic location information. In this way, through the geographic location information, data operations can be controlled, data security can be significantly improved, the problem of lack of data security protection solutions that pay attention to the geographic location of data can be solved, and data can be effectively prevented from being accessed or leaked in unauthorized geographic locations, greatly reducing data security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of a flow chart of a data security control method according to one embodiment of the present invention;

[0048] Figure 2 A schematic diagram of a flow chart of a data security control method according to another embodiment of the present invention;

[0049] Figure 3 A schematic diagram of the structure of one implementation of the data security control device according to an embodiment of the present invention;

[0050] Figure 4 A schematic diagram of the structure of another implementation of the data security control device according to an embodiment of the present invention;

[0051] Figure 5 The figure is a schematic diagram of the hardware structure of the data security control device described in the embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0053] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0054] The terms "first", "second", etc. in the specification and claims of the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0055] One embodiment of the present invention, as Figure 1 As shown, a data security control method is provided, which is executed by a first electronic device, and the method includes:

[0056] S101, sending an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographic location information of the first electronic device.

[0057] Optionally, the first electronic device includes a mobile terminal, an Internet of Things device, such as a camera, a monitor, a server, a firewall, a switch, and a gateway.

[0058] In an embodiment of the present invention, the first electronic device includes a geographic location acquisition module, which can acquire the geographic location information of the first electronic device in real time through positioning technologies such as satellite positioning systems (such as Beidou satellite positioning system, global positioning system, Galileo satellite navigation system, etc.), wireless local area network positioning, ultra-wideband positioning, communication base stations or Bluetooth positioning.

[0059] Optionally, the identity authentication request further carries at least one of the following:

[0060] A device identifier, wherein the device identifier is determined according to a built-in identifier of a trusted cryptography module (TCM) or a trusted platform module (TPM) in the first electronic device; specifically, a unique built-in identifier in the TCM or TPM is determined as the device identifier;

[0061] User identity, it should be noted that the user refers to one of the user of the operating system in the first electronic device, the user of external access, the system built-in user, and the user after the operator successfully logs in using the login account / password; the user identity is determined by the operating system built-in, account, password, or USB interface key;

[0062] The device trusted state is determined by performing trusted computing on the first electronic device through TCM or TPM; specifically, at least one of the hardware, firmware, operating system loader, operating system, and application of the first electronic device is determined by feasible computing through TCM or TPM; the device trusted state includes a trusted or untrusted state.

[0063] Therefore, the identity authentication request may include a four-tuple vector, which is expressed as <device identifier, device trusted state, user identifier, geographic location information>.

[0064] It should be noted that when the first electronic device is turned on or before a data operation needs to be performed, an identity authentication request is generated so that the identity authentication request can be sent to the identity authentication platform.

[0065] S102: Obtain an identity authentication result fed back by the identity authentication platform according to the identity authentication request, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0066] In an embodiment of the present invention, the first data operation authorization information includes user operation authorization information on data and / or first electronic device operation authorization information on data, which is used to indicate data operations authorized (i.e. allowed) to be performed by the user and / or first electronic device corresponding to the geographic location information.

[0067] In the embodiment of the present invention, optionally, after obtaining the identity authentication result fed back by the identity authentication platform according to the identity authentication request, the method further includes:

[0068] The process of executing the data operation indicated by the first data operation authorization information.

[0069] It should be noted that since the first data operation authorization information is related to the geographic location information of the first electronic device, the process of executing the data operation indicated by the first data operation authorization information can achieve the effect of controlling data security based on geographic location information, which solves the problem that the prior art lacks data security protection solutions that pay attention to the geographic location of data, and effectively prevents data from being accessed or leaked in unauthorized geographic locations, greatly reducing data security risks, thereby meeting the high standards for data security in the current complex network environment, and has broad application prospects and important practical value.

[0070] Optionally, the data operation includes at least one of a data transmission operation, a data generation operation, a data reading operation, a data modification operation, a data processing operation, a data encryption operation, a data decryption operation and a data deletion operation.

[0071] Further, the data operation includes the data transmission operation.

[0072] Optionally, the process of executing the data operation indicated by the first data operation authorization information includes:

[0073] In the case where it is necessary to perform a data transmission operation indicated by the first data operation authorization information on a second electronic device, obtaining second data operation authorization information of the second electronic device;

[0074] In a case where the data operation indicated by the second data operation authorization information includes a data transmission operation, a process of performing the data transmission operation indicated by the first data operation authorization information is performed.

[0075] Here, in the case where the first electronic device needs to perform the process of data transmission operation indicated by the first data operation authorization information to the second electronic device, it is necessary to request the identity authentication result of the second electronic device from the identity authentication platform to obtain the second data operation authorization information corresponding to the current geographic location information of the second electronic device; if the data operation indicated by the second data operation authorization information includes a data transmission operation, the first electronic device can perform the process of data transmission operation indicated by the first data operation authorization information to the second electronic device.

[0076] Optionally, when the data operation indicated by the first data operation authorization information includes the data generation operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0077] New data is generated on the first electronic device.

[0078] Optionally, when the data operation indicated by the first data operation authorization information includes the data read operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0079] Data is read on the first electronic device.

[0080] Optionally, when the data operation indicated by the first data operation authorization information includes the data modification operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0081] Data is modified on the first electronic device.

[0082] Optionally, when the data operation indicated by the first data operation authorization information includes the data processing operation, the process of executing the data operation indicated by the first data operation authorization information includes:

[0083] The content or meaning of the data is changed by an algorithm on the first electronic device.

[0084] Optionally, when the data operation indicated by the first data operation authorization information includes the data encryption operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0085] The data is encrypted at the first electronic device.

[0086] Optionally, when the data operation indicated by the first data operation authorization information includes the data decryption operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0087] The data is decrypted at the first electronic device.

[0088] Optionally, when the data operation indicated by the first data operation authorization information includes the data deletion operation, the process of performing the data operation indicated by the first data operation authorization information includes:

[0089] The first electronic device deletes the data.

[0090] In addition, the first data operation authorization information may also indicate a data operation on the target data. Therefore, the embodiment of the present invention may perform data security control on some sensitive target data.

[0091] In the embodiment of the present invention, optionally, after executing the data operation indicated by the first data operation authorization information, the method further includes:

[0092] A data operation log is generated, wherein the data operation log includes the geographic location information.

[0093] It is understandable that after the first electronic device performs the data operation indicated by the first data operation authorization information, a data operation log can be generated to record the data operation. The data operation log includes the current geographical location information of the first electronic device to associate the performed data operation with the geographical location information. In addition, the data operation log may also include at least one of the data operation time, the identity authentication information of the operating user, the application program for operating the data, the operation content, and the operation result.

[0094] In the embodiment of the present invention, optionally, after obtaining the identity authentication result fed back by the identity authentication platform according to the identity authentication request, the method further includes:

[0095] Generate an identity authentication log, the identity authentication log including at least one of the following:

[0096] the identity authentication request;

[0097] The time of sending the identity authentication request to the identity authentication platform;

[0098] The identity authentication result.

[0099] It should be noted that after the first electronic device obtains the identity authentication result, an identity authentication log can be generated to record the identity authentication operation. The identity authentication log may include the identity authentication request sent by the first electronic device to the identity authentication platform, the time when the first electronic device sends the identity authentication request to the identity authentication platform, and at least one of the identity authentication results fed back by the identity authentication platform to the first electronic device.

[0100] In the example of the present invention, optionally, after executing the data operation indicated by the first data operation authorization information, the method further includes:

[0101] Generate an audit report, which includes audit records generated based on dimensions such as identity authentication information, data, and equipment.

[0102] Below is a summary of the above data operation logs, identity authentication logs and audit reports.

[0103] The first data operation authorization information in the identity authentication result is used to indicate that the first electronic device is allowed to perform data operations, and after the data operation indicated by the first data operation authorization information is performed, a data operation log is generated.

[0104] After sending an identity authentication request to the identity authentication platform and obtaining the identity authentication result fed back by the identity authentication platform, an identity authentication log is generated.

[0105] The first data operation authorization information in the identity authentication result is used to indicate that the first electronic device is not allowed to perform data operations and generate an audit report.

[0106] Another embodiment of the present invention, as Figure 2 As shown, a data security control method is also provided, which is executed by the identity authentication platform, and the method includes:

[0107] S201, obtaining an identity authentication request sent by a first electronic device, where the identity authentication request carries geographic location information of the first electronic device.

[0108] Optionally, the identity authentication request further carries at least one of the following:

[0109] A device identifier, where the device identifier is determined according to a built-in identifier of a TCM or TPM in the first electronic device;

[0110] User identification;

[0111] The device trusted state is determined by performing trusted computing on the first electronic device through TCM or TPM.

[0112] It should be noted that the identity authentication platform can also obtain identity authentication requests sent by other electronic devices except the first electronic device, that is, the identity platform is a platform that can process multi-node requests.

[0113] S202, in response to the identity authentication request, sending an identity authentication result to the first electronic device, the identity authentication result including first data operation authorization information corresponding to the geographic location information.

[0114] In the embodiment of the present invention, optionally, before responding to the identity authentication request and sending the identity authentication result to the first electronic device, the method further includes:

[0115] An identity authentication result of the first electronic device is determined according to the identity authentication request, the identity authentication policy, and the data operation authorization policy.

[0116] It should be noted that the identity authentication platform pre-sets an identity authentication policy and sets a safe geographical location area for each electronic device based on the business needs, management requirements, etc. of the electronic device; in simple terms, the identity authentication policy includes the identity authentication levels corresponding to different geographical location information of the electronic device, for example, when the first electronic device is in geographical location information 1, it corresponds to identity authentication level 1, and when the first electronic device is in geographical location information 2, it corresponds to identity authentication level 2.

[0117] Furthermore, the identity authentication platform pre-sets a data operation policy to specify data operation permissions for each electronic device; in simple terms, the data operation authorization policy includes identity authentication results corresponding to different identity authentication levels of the electronic device, and the identity authentication results include data operation authorization information. For example, the identity authentication level 1 of the first electronic device corresponds to the identity authentication result 1, and the identity authentication result 1 includes data operation authorization information 1. The data operation authorization information 1 is used to indicate the data operation authorized to be performed by the first electronic device corresponding to the geographic location information 1.

[0118] Among them, the authorization level of data operation authorization information 1 corresponding to identity authentication level 1 is higher than the authorization level of data operation authorization information 2 corresponding to identity authentication level 2. A high authorization level means that the electronic device is authorized to perform more data operations.

[0119] Specifically, the identity authentication result may include a triple vector, and the triple vector is expressed as <identity authentication level, geographic location information, data operation authorization information>.

[0120] Taking the geographic location information 1 as a domestic area as an example, the geographic location information 1 of the first electronic device corresponds to identity authentication level 1, and the identity authentication level 1 corresponds to identity authentication result 1. The identity authentication result 1 includes data operation authorization information 1. The data operation authorization information 1 is used to indicate that the data operations authorized to be performed by the first electronic device corresponding to the geographic location information 1 include data transmission operations, data generation operations, data reading operations, data modification operations, data processing operations, data encryption operations, data decryption operations, and data deletion operations.

[0121] Taking the geographic location information 2 as a foreign area as an example, the geographic location information 2 of the first electronic device corresponds to the identity authentication level 2, the identity authentication level 2 corresponds to the identity authentication result 2, and the identity authentication result 2 includes data operation authorization information 2. The data operation authorization information 2 is used to indicate that the data operations authorized to be performed by the first electronic device corresponding to the geographic location information 2 include data reading operations.

[0122] In addition, the identity authentication policy preset by the identity authentication platform also includes the identity authentication level corresponding to the device trust state of the electronic device, for example, the device trust state 1 of the first electronic device corresponds to the identity authentication level 1, and the device trust state 1 is a trustworthy state.

[0123] Of course, the identity authentication policy preset by the identity authentication platform also includes the identity authentication level corresponding to the device identification of the electronic device or the user identification.

[0124] In summary, the data security control method described in the embodiment of the present invention integrates geographic location information and security protection technologies such as trusted computing to securely control data operations, significantly improve data security, effectively prevent data from being accessed or leaked in unauthorized geographic locations, and greatly reduce data security risks. In addition, a flexible identity authentication strategy and data operation authorization strategy are adopted to build a multi-level, all-round, real-time responsive security protection system, which can meet the high standards for data security in the current complex network environment and has broad application prospects and important practical value.

[0125] like Figure 3 As shown, an embodiment of the present invention further provides a data security control device, which is applied to a first electronic device, and the device includes:

[0126] A first sending module 301 is used to send an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographical location information of the first electronic device;

[0127] The first acquisition module 302 is used to obtain the identity authentication result fed back by the identity authentication platform according to the identity authentication request, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0128] Optionally, in the data security control device, the identity authentication request further carries at least one of the following:

[0129] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0130] User identification;

[0131] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0132] Optionally, the data security control device further comprises:

[0133] An execution module is used to execute the process of the data operation indicated by the first data operation authorization information.

[0134] Optionally, the data security control device, wherein the data operation includes at least one of a data transmission operation, a data generation operation, a data reading operation, a data modification operation, a data processing operation, a data encryption operation, a data decryption operation and a data deletion operation.

[0135] Optionally, in the data security control device, the data operation includes the data transmission operation;

[0136] The execution module is specifically used for:

[0137] In the case where it is necessary to perform a data transmission operation indicated by the first data operation authorization information on a second electronic device, obtaining second data operation authorization information of the second electronic device;

[0138] In a case where the data operation indicated by the second data operation authorization information includes a data transmission operation, a process of performing the data transmission operation indicated by the first data operation authorization information is performed.

[0139] Optionally, the data security control device further comprises:

[0140] The first generating module is used to generate a data operation log, wherein the data operation log includes the geographic location information.

[0141] Optionally, the data security control device further comprises:

[0142] The second generating module is used to generate an identity authentication log, wherein the identity authentication log includes at least one of the following:

[0143] the identity authentication request;

[0144] The time of sending the identity authentication request to the identity authentication platform;

[0145] The identity authentication result.

[0146] It should be noted that the data security control device provided in the embodiment of the present invention is a device capable of executing the above-mentioned data security control method. All embodiments of the above-mentioned data security control method are applicable to the device and can achieve the same or similar technical effects.

[0147] like Figure 4 As shown, an embodiment of the present invention further provides a data security control device, which is applied to an identity authentication platform, and the device includes:

[0148] A second acquisition module 401 is used to acquire an identity authentication request sent by a first electronic device, where the identity authentication request carries geographic location information of the first electronic device;

[0149] The second sending module 402 is used to respond to the identity authentication request and send an identity authentication result to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0150] Optionally, in the data security control device, the identity authentication request further carries at least one of the following:

[0151] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0152] User identification;

[0153] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0154] Optionally, the data security control device further comprises:

[0155] The determination module is used to determine the identity authentication result of the first electronic device according to the identity authentication request, the identity authentication policy and the data operation authorization policy.

[0156] It should be noted that the data security control device provided in the embodiment of the present invention is a device capable of executing the above-mentioned data security control method. All embodiments of the above-mentioned data security control method are applicable to the device and can achieve the same or similar technical effects.

[0157] like Figure 5 As shown, an embodiment of the present invention also provides a data security control device, including: a processor 501; and a memory 502 connected to the processor 501 through a bus interface, the memory 502 is used to store programs and data used by the processor 501 when performing operations, and the processor 501 calls and executes the programs and data stored in the memory 502.

[0158] The data security control device further includes a transceiver 503, which is connected to the bus interface and is used to perform the following process under the control of the processor 501:

[0159] Sending an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographic location information of the first electronic device;

[0160] An identity authentication result fed back by the identity authentication platform according to the identity authentication request is obtained, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0161] Among them, Figure 5 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 501 and memory represented by memory 502. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides a user interface 504. The transceiver 503 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 501 is responsible for managing the bus architecture and general processing, and the memory 502 may store data used by the processor 501 when performing operations.

[0162] The processor 501 is responsible for managing the bus architecture and general processing, and the memory 502 can store data used by the processor 501 when performing operations.

[0163] Optionally, the identity authentication request further carries at least one of the following:

[0164] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0165] User identification;

[0166] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0167] Optionally, the processor 501 is used to read the computer program and execute the following steps:

[0168] The process of executing the data operation indicated by the first data operation authorization information.

[0169] Optionally, the data operation includes at least one of a data transmission operation, a data generation operation, a data reading operation, a data modification operation, a data processing operation, a data encryption operation, a data decryption operation and a data deletion operation.

[0170] Optionally, the data operation includes the data transmission operation;

[0171] The processor 501 is specifically configured to read the computer program and execute the following steps:

[0172] In the case where it is necessary to perform a data transmission operation indicated by the first data operation authorization information on a second electronic device, obtaining second data operation authorization information of the second electronic device;

[0173] In a case where the data operation indicated by the second data operation authorization information includes a data transmission operation, a process of performing the data transmission operation indicated by the first data operation authorization information is performed.

[0174] Optionally, the processor 501 is further configured to read the computer program and execute the following steps:

[0175] A data operation log is generated, wherein the data operation log includes the geographic location information.

[0176] Optionally, the processor 501 is further configured to read the computer program and execute the following steps:

[0177] Generate an identity authentication log, the identity authentication log including at least one of the following:

[0178] the identity authentication request;

[0179] The time of sending the identity authentication request to the identity authentication platform;

[0180] The identity authentication result.

[0181] In addition, the embodiment of the present invention also provides a data security control device, whose structure is similar to Figure 5 The data security control device shown is the same, including: a processor; and a memory connected to the processor through a bus interface, the memory is used to store programs and data used by the processor when performing operations, and the processor calls and executes the programs and data stored in the memory.

[0182] The data security control device further includes a transceiver, which is connected to the bus interface and is used to perform the following process under the control of the processor:

[0183] Obtaining an identity authentication request sent by a first electronic device, where the identity authentication request carries geographic location information of the first electronic device;

[0184] In response to the identity authentication request, an identity authentication result is sent to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

[0185] Optionally, the identity authentication request further carries at least one of the following:

[0186] a device identifier, where the device identifier is determined according to a built-in identifier of a trusted cryptographic module or a trusted platform module in the first electronic device;

[0187] User identification;

[0188] The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

[0189] Optionally, the processor is used to read the computer program and execute the following steps:

[0190] An identity authentication result of the first electronic device is determined according to the identity authentication request, the identity authentication policy, and the data operation authorization policy.

[0191] A specific embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the above-mentioned data security control method are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0192] In addition, an embodiment of the present invention further provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 1 or Figure 2 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0193] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0194] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0195] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the sending and receiving methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0196] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data security control method, It is characterized in that The method is performed by a first electronic device and includes: Sending an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographic location information of the first electronic device; An identity authentication result fed back by the identity authentication platform according to the identity authentication request is obtained, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

2. The data security control method according to claim 1, It is characterized in that The identity authentication request also carries at least one of the following: a device identification, where the device identification is determined according to a built-in identification of a trusted cryptographic module or a trusted platform module in the first electronic device; User identification; The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

3. The data security control method according to claim 1, It is characterized in that The method further comprises: The process of executing the data operation indicated by the first data operation authorization information.

4. The data security control method according to claim 3, It is characterized in that The data operation includes at least one of a data transmission operation, a data generation operation, a data reading operation, a data modification operation, a data processing operation, a data encryption operation, a data decryption operation, and a data deletion operation.

5. The data security control method according to claim 4, It is characterized in that The data operation includes the data transmission operation; The process of executing the data operation indicated by the first data operation authorization information includes: In the case where it is necessary to perform a data transmission operation indicated by the first data operation authorization information on a second electronic device, obtaining second data operation authorization information of the second electronic device; In a case where the data operation indicated by the second data operation authorization information includes a data transmission operation, a process of performing the data transmission operation indicated by the first data operation authorization information is performed.

6. The data security control method according to claim 3, It is characterized in that After executing the data operation indicated by the first data operation authorization information, the method further includes: A data operation log is generated, wherein the data operation log includes the geographic location information.

7. The data security control method according to claim 1, It is characterized in that The method further comprises: Generate an identity authentication log, the identity authentication log including at least one of the following: the identity authentication request; The time of sending the identity authentication request to the identity authentication platform; The identity authentication result.

8. A data security control method, It is characterized in that Executed by the identity authentication platform, the method includes: Obtaining an identity authentication request sent by a first electronic device, where the identity authentication request carries geographic location information of the first electronic device; In response to the identity authentication request, an identity authentication result is sent to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

9. The data security control method according to claim 8, It is characterized in that The identity authentication request also carries at least one of the following: a device identification, where the device identification is determined according to a built-in identification of a trusted cryptographic module or a trusted platform module in the first electronic device; User identification; The trusted state of the device is determined by performing trusted computing on the first electronic device by the trusted cryptographic module or the trusted platform module.

10. The data security control method according to claim 8, It is characterized in that Before responding to the identity authentication request and sending the identity authentication result to the first electronic device, the method further includes: An identity authentication result of the first electronic device is determined according to the identity authentication request, the identity authentication policy, and the data operation authorization policy.

11. A data security control device, It is characterized in that Applied to a first electronic device, the device comprises: A first sending module, configured to send an identity authentication request to an identity authentication platform, wherein the identity authentication request carries geographical location information of the first electronic device; The first acquisition module is used to obtain the identity authentication result fed back by the identity authentication platform according to the identity authentication request, wherein the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

12. A data security control device, It is characterized in that Applied to an identity authentication platform, the device comprises: A second acquisition module, configured to acquire an identity authentication request sent by a first electronic device, wherein the identity authentication request carries geographical location information of the first electronic device; The second sending module is used to respond to the identity authentication request and send an identity authentication result to the first electronic device, where the identity authentication result includes first data operation authorization information corresponding to the geographic location information.

13. A data security control device, It is characterized in that A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the data security control method as described in any one of claims 1 to 7, or implements the data security control method as described in any one of claims 8 to 10.

14. A readable storage medium, It is characterized in that The readable storage medium stores a program, and when the program is executed by the processor, the program implements the data security control method as described in any one of claims 1 to 7, or implements the data security control method as described in any one of claims 8 to 10.

15. A computer program product, It is characterized in that It comprises computer instructions, which, when executed by a processor, implement the data security control method as claimed in any one of claims 1 to 7, or implement the data security control method as claimed in any one of claims 8 to 10.

Images