Enterprise data security architecture for advanced encryption and access control

Abstract

The invention discloses an enterprise data security architecture with advanced encryption and access control, and belongs to the technical field of information security. Comprising a system body, the system body comprises a data storage layer, an encryption layer, an access control layer, a user interface layer, a safety management center, a training unit and system maintenance, the data storage layer comprises a data storage module and a data modification and updating module, and the data storage module imports and stores existing data of an enterprise; the data storage module is used for importing data, classifying the data in the importing process and dividing the data into different levels according to the sensitivity and importance, and the data modifying and updating module is used for operating the data needing to be modified or updated according to the flow of the data storage module; the encryption layer comprises a symmetric encryption module and an asymmetric encryption module; according to the enterprise data security architecture, the security of the enterprise data security architecture can be effectively improved, and the enterprise data security architecture has relatively high practical value.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an enterprise data security architecture with advanced encryption and access control. Background Art

[0002] Enterprise data refers to all information and materials related to enterprise operations, including company profiles, product information, operating data, research results, etc., many of which involve commercial secrets. In today's digital age, the value of enterprise data is becoming increasingly prominent, but it is also facing increasingly severe security threats. Traditional data security measures often have problems such as insufficient encryption strength and lax access control, which makes it easy for internal commercial secrets to be leaked and affect the company. Therefore, a new type of enterprise data security architecture is needed to solve these problems. Summary of the invention

[0003] The purpose of the present invention is to provide an enterprise data security architecture with advanced encryption and access control to solve the problems raised in the above background technology.

[0004] By adopting the above technical solutions, the security of the enterprise data security framework is improved.

[0005] In view of the above problems, the technical solution proposed by the present invention is: An enterprise data security architecture with advanced encryption and access control, comprising a system body, wherein the system body comprises a data storage layer, an encryption layer, an access control layer, a user interface layer, a security management center, a training unit and system maintenance; The data storage layer includes a data storage module and a data modification and update module. The data storage module imports and stores the existing data of the enterprise, classifies the data during the import process, and classifies the data into different levels according to the sensitivity and importance. The data modification and update module operates on the data that needs to be modified or updated according to the process of the data storage module; The encryption layer includes a symmetric encryption module and an asymmetric encryption module, which automatically selects a suitable encryption method for encryption according to the classification of the stored data, and determines the files to be encrypted and the encryption strength according to the data classification; The security management center includes a security policy management module, a key management module, a security monitoring module and a security audit module. The security policy management module security management center is used to regularly review and update the enterprise's data security policy, and adjust the encryption algorithm, access control policy and security monitoring parameters according to changes in the enterprise's business needs and security risks. The key management module is used to regularly update and rotate encryption keys, and back up and store keys. The security monitoring module is used to monitor the operating status of the enterprise's data security architecture in real time. The security audit module is used to conduct regular security audits and review users' access records, operating behaviors and system logs.

[0006] As a preferred technical solution of the present invention, the access control layer includes an identity authentication module, an authorization management module and an access audit module, and the identity authentication module includes password authentication, fingerprint recognition and facial recognition.

[0007] As a preferred technical solution of the present invention, the authorization management module is used to assign corresponding permissions according to the user's role and to perform dynamic authorization according to the user's attributes, resource attributes and environmental conditions, and the access audit module is used to detect and alarm abnormal access behavior.

[0008] As a preferred technical solution of the present invention, the user interface layer includes an application program interface module and a web page interface module. The application program interface module provides a secure data access interface for internal enterprise applications and is used to perform identity authentication and authorization checks when the application program interface is called. The web page interface module is used to provide users with an interface for accessing enterprise data through a browser and adopts an encrypted communication protocol.

[0009] As a preferred technical solution of the present invention, the system maintenance includes a regular maintenance module and a system upgrade module. The regular maintenance module is used to regularly maintain and update the server, network equipment and software, and back up the data storage layer. The system upgrade module is used to regularly upgrade the system.

[0010] As a preferred technical solution of the present invention, the training unit includes a training outline and a personnel training module. The training outline is used to determine the sensitivity, importance and possible security risks of enterprise data, and determine the type and scope of data that need to be protected based on business needs and regulatory requirements. The personnel training module is used to provide data security awareness training for enterprise employees and online security technology training for employees in specific positions.

[0011] As a preferred technical solution of the present invention, the symmetric encryption module is an AES algorithm, and the asymmetric encryption module is an RSA algorithm.

[0012] As a preferred technical solution of the present invention, the encrypted communication protocol adopted by the web page interface module is the HTTPS protocol.

[0013] Compared with the prior art, the beneficial effects of the present invention are as follows: the enterprise data security architecture of advanced encryption and access control facilitates the import and storage of existing enterprise data by setting up a data storage module, and stores the data in a classified manner, so that the symmetric encryption module and the asymmetric encryption module can be used in the import process, and encryption can be selected according to the importance and sensitivity of the data. By setting up a data modification and update module, after the user modifies or updates the data, the new data is re-entered according to the storage process of the data storage module, and then the updated or modified data is re-classified and encrypted, thereby improving the security of the data. By setting up a security management center, the security policy management The management module can adjust the encryption algorithm, access control strategy and security monitoring parameters according to the changes in the business needs and security risks of the enterprise. The key management module is used to regularly review and update the data security strategy of the enterprise. It can adjust the encryption algorithm, access control strategy and security monitoring parameters according to the changes in the business needs and security risks of the enterprise. The security monitoring module can monitor network traffic, user access behavior and encryption status. The security audit module can generate security audit reports to provide a basis for the security decision-making of the enterprise. By setting the access control layer, the security of enterprise data can be further improved. The authentication record of the access personnel can be made to facilitate the traceability when problems occur later. By setting password authentication. Fingerprint recognition and facial recognition, users can authenticate their identity information when accessing. By setting the authorization management module, they can be authorized according to the identity information of the access personnel, so that the authorized person can only access the data information within the authorized scope, thereby improving the protection of the core secrets of the enterprise. By setting the access audit module, abnormal behavior can be detected and alarmed and timely measures can be taken. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A system ontology diagram of an enterprise data security architecture for advanced encryption and access control disclosed in an embodiment of the present invention; Figure 2 It is a block diagram of the user interface layer of the enterprise data security architecture of advanced encryption and access control disclosed in the embodiment of the present invention; Figure 3 A block diagram of a security management center of an enterprise data security architecture with advanced encryption and access control disclosed in an embodiment of the present invention; Figure 4 A system maintenance block diagram of an enterprise data security architecture for advanced encryption and access control disclosed in an embodiment of the present invention; Figure 5A training unit block diagram of an enterprise data security architecture with advanced encryption and access control disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] See also Figure 1 - Figure 5 ,The present invention provides a technical solution: an enterprise data security architecture with advanced encryption and access control, including a system body, wherein the system body includes a data storage layer, an encryption layer, an access control layer, a user interface layer, a security management center, a training unit and system maintenance; The data storage layer includes a data storage module and a data modification and update module. The data storage module imports and stores the existing data of the enterprise, classifies the data during the import process, and classifies the data into different levels according to the sensitivity and importance. The data modification and update module operates on the data that needs to be modified or updated according to the process of the data storage module; The encryption layer includes a symmetric encryption module and an asymmetric encryption module, which automatically selects a suitable encryption method for encryption according to the classification of the stored data, and determines the files to be encrypted and the encryption strength according to the data classification; The security management center includes a security policy management module, a key management module, a security monitoring module and a security audit module. The security policy management module security management center is used to regularly review and update the enterprise's data security policy, adjust the encryption algorithm, access control policy and security monitoring parameters according to the changes in the enterprise's business needs and security risks, the key management module is used to regularly update and rotate encryption keys, and back up and store keys, the security monitoring module is used to monitor the operating status of the enterprise's data security architecture in real time, and the security audit module is used to regularly perform security audits, review user access records, operation behaviors and system logs, and by setting up a data storage module, it is convenient to import and store the enterprise's existing data, and classify and store it, so that it can cooperate with the symmetric encryption module and the asymmetric encryption module during the import process, and can be based on the weight of the data. Choose whether to encrypt based on the importance and sensitivity. By setting up the data modification and update module, after the user modifies or updates the data, the new data will go through the storage process of the data storage module again, and then the updated or modified data will be classified and encrypted again to improve the security of the data. By setting up a security management center, the security policy management module can adjust the encryption algorithm, access control policy and security monitoring parameters according to the changes in the business needs and security risks of the enterprise. The key management module is used to regularly review and update the enterprise's data security policy. It can adjust the encryption algorithm, access control policy and security monitoring parameters according to the changes in the business needs and security risks of the enterprise. The security monitoring module can monitor network traffic, user access behavior and encryption status. The security audit module can generate a security audit report to provide a basis for the enterprise's security decision-making.

[0017] In one embodiment of the present invention, the access control layer further includes an identity authentication module, an authorization management module and an access audit module. The identity authentication module includes password authentication, fingerprint recognition and facial recognition. By setting the access control layer, the security of enterprise data can be further improved, and authentication records of access personnel can be made, so that it is convenient to trace back when problems occur later. By setting password authentication, fingerprint recognition and facial recognition, users can authenticate their identity information when accessing.

[0018] In one embodiment of the present invention, further, the authorization management module is used to assign corresponding permissions according to the user's role and to perform dynamic authorization according to the user's attributes, resource attributes and environmental conditions, and the access audit module is used to detect and alarm abnormal access behavior. By setting the authorization management module, the access personnel can be authorized according to their identity information, so that the authorized person can only access data information within the authorization scope, thereby improving the protection of the company's core secrets. By setting the access audit module, abnormal behavior can be detected and alarmed, and timely measures can be taken.

[0019] According to an embodiment of the present invention, further, the user interface layer includes an application program interface module and a web page interface module. The application program interface module provides a secure data access interface for internal enterprise applications, and is used for identity authentication and authorization checks when the application program interface is called. The web page interface module is used to provide an interface for users to access enterprise data through a browser, and an encrypted communication protocol is used. By setting up the application program interface module, it is convenient for users to access the data through the data access interface, and the identity authentication module and the authorization management module are used to identify the user. By setting up the web page interface module, it is convenient for users to access the enterprise data interface through a browser, and the web page module uses an encrypted communication protocol to ensure communication security.

[0020] In one embodiment of the present invention, further, the system maintenance includes a regular maintenance module and a system upgrade module. The regular maintenance module is used to regularly maintain and update servers, network equipment and software, and to back up the data storage layer. The system upgrade module is used to regularly upgrade the system. By setting the regular maintenance module, security patches can be installed to repair known vulnerabilities to ensure the security and stability of the system, and the data storage layer can be backed up to prevent data loss. By setting the system upgrade module, after the encryption algorithm, access control technology and security management software technology are upgraded, the system can be upgraded in time to improve the security and performance of the system.

[0021] In one embodiment of the present invention, further, the training unit includes a training outline and a personnel training module. The training outline is used to determine the sensitivity, importance and possible security risks of enterprise data, and determine the type and scope of data that need to be protected according to business needs and regulatory requirements. The personnel training module is used to conduct data security awareness training for enterprise employees and conduct online security technology training for employees in specific positions. By setting up a training outline, security needs can be clarified, the scope and type of protected data can be determined, and employee cognition can be facilitated. By setting up a personnel training module, employees can be trained online to make them familiar with the operating procedures.

[0022] According to an embodiment of the present invention, further, the symmetric encryption module is an AES algorithm, and the asymmetric encryption module is an RSA algorithm.

[0023] According to an embodiment of the present invention, further, the encrypted communication protocol adopted by the web page interface module is the HTTPS protocol.

[0024] Specifically, the working principle of this enterprise data security architecture with advanced encryption and access control is as follows: when using it, select appropriate servers and storage devices, place them in a secure data center environment, have appropriate fire prevention, anti-theft and waterproof measures, as well as backup power supplies, and set up firewalls and switches to improve the security of the network environment. Then, import the company's existing data into the data storage layer. During the import process, you can choose whether to encrypt the data based on its importance and sensitivity, create accounts for company employees and users, and initialize identity authentication information. Assign corresponding permissions based on the user's role and responsibilities. When new data needs to be stored, the data is first encrypted by the encryption layer. According to the type of data and security requirements, select the appropriate encryption algorithm and key. The user requests access to the data through the user interface layer, and the user interface layer first performs encryption on the user. Identity authentication is performed, requiring users to provide the correct password or fingerprint recognition and face recognition. After the identity authentication is passed, the access control layer performs authorization checks based on the user's permissions. Only users with corresponding permissions can access specific data resources. The user's access request is authorized, and the data is taken out of the data storage layer and provided to the user after decryption. Among them, the key management module regularly updates and rotates the encryption keys, and backs up and stores the keys to ensure that data can be restored in the event of key loss or damage. The security policy management module regularly reviews and updates the company's data security policy, and adjusts the encryption algorithm, access control policy and security monitoring parameters according to changes in the company's business needs and security risks. The security audit module regularly performs security audits to review user access records, operation behaviors and system logs to discover potential security vulnerabilities and violations. Generate security audit reports to provide a basis for the company's security decisions. The security monitoring module monitors the operating status of the company's data security architecture in real time. By setting up the access audit module, abnormal behaviors can be detected and alarmed and timely measures can be taken. By setting up the regular maintenance module and system upgrade module, the system can be upgraded and maintained to improve the security and performance of the system. By setting up the training unit, the type and scope of data protection can be clarified, and targeted online training can be provided to employees to make them familiar with system operations.

Claims

1. An enterprise data security architecture with advanced encryption and access control, characterized in that: The system includes a data storage layer, an encryption layer, an access control layer, a user interface layer, a security management center, a training unit and system maintenance; The data storage layer includes a data storage module and a data modification and update module. The data storage module imports and stores the existing data of the enterprise, classifies the data during the import process, and classifies the data into different levels according to the sensitivity and importance. The data modification and update module operates on the data that needs to be modified or updated according to the process of the data storage module; The encryption layer includes a symmetric encryption module and an asymmetric encryption module, which automatically selects a suitable encryption method for encryption according to the classification of the stored data, and determines the files to be encrypted and the encryption strength according to the data classification; The security management center includes a security policy management module, a key management module, a security monitoring module and a security audit module. The security policy management module security management center is used to regularly review and update the enterprise's data security policy, and adjust the encryption algorithm, access control policy and security monitoring parameters according to changes in the enterprise's business needs and security risks. The key management module is used to regularly update and rotate encryption keys, and back up and store keys. The security monitoring module is used to monitor the operating status of the enterprise's data security architecture in real time. The security audit module is used to conduct regular security audits and review users' access records, operating behaviors and system logs.

2. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The access control layer includes an identity authentication module, an authorization management module and an access audit module. The identity authentication module includes password authentication, fingerprint recognition and facial recognition.

3. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The authorization management module is used to assign corresponding permissions according to the user's role and to perform dynamic authorization according to the user's attributes, resource attributes and environmental conditions, etc. The access audit module is used to detect and alarm abnormal access behavior.

4. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The user interface layer includes an application program interface module and a web page interface module. The application program interface module provides a secure data access interface for internal enterprise applications and is used to perform identity authentication and authorization checks when the application program interface is called. The web page interface module is used to provide users with an interface for accessing enterprise data through a browser and uses an encrypted communication protocol.

5. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The system maintenance includes a regular maintenance module and a system upgrade module. The regular maintenance module is used to regularly maintain and update the server, network equipment and software, and back up the data storage layer. The system upgrade module is used to regularly upgrade the system.

6. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The training unit includes a training outline and a personnel training module. The training outline is used to determine the sensitivity, importance and possible security risks of enterprise data, and determine the type and scope of data that need to be protected based on business needs and regulatory requirements. The personnel training module is used to provide data security awareness training for enterprise employees and online security technology training for employees in specific positions.

7. The enterprise data security architecture of advanced encryption and access control according to claim 1, characterized in that: The symmetric encryption module is an AES algorithm, and the asymmetric encryption module is an RSA algorithm.

8. The enterprise data security architecture of advanced encryption and access control according to claim 4, characterized in that: The encrypted communication protocol adopted by the web page interface module is the HTTPS protocol.

Images