Sensitive data protection method, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data security, and provides a sensitive data protection method, electronic equipment and a storage medium. According to the method, a data requester initiates an SPA authentication data packet to a data owner; after the data owning party completes the authentication and passes the authentication, the data service hidden by the data owning party is opened, and the accessible data service is set for the data requesting party; the data requester sends a data access request to the data owning party through the bidirectional encrypted data channel connection; the data owner obtains original data corresponding to the to-be-accessed data identifier in a database, and queries user identity information in a configured sensitive data protection strategy library and a sensitive data protection strategy corresponding to the original data; and performing sensitive data protection processing on the original data based on the data protection strategy, and then sending the original data to the data requester. According to the method, the security risks of unauthorized access of sensitive data, sensitive data leakage, sensitive data abuse and the like are solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a sensitive data protection method, electronic device, and storage medium. Background Art

[0002] In actual business systems, the protection of sensitive data faces many challenges, involving multiple links such as data storage, transmission and sharing. Once a security incident occurs, it may lead to serious security risks such as unauthorized access to sensitive data, leakage of sensitive data, and abuse of sensitive data.

[0003] The traditional security model is based on trust boundaries, assuming that the internal network environment is relatively safe, while the external network environment is full of threats. Therefore, traditional sensitive data protection solutions often rely on the security protection of network boundaries, mainly focusing on preventing external threats from entering the internal network, and assuming that once the data enters the internal network, it can be trusted to a certain extent.

[0004] Existing security models are usually based on trust boundaries when protecting sensitive data and rely on security protection at the network boundary. The data owner opens data services, usually providing services to the outside world in the form of APIs, to complete functions such as identity authentication, data call sharing, etc. The data requester initiates an identity authentication request, and the boundary security protection component verifies whether it is a legitimate request, and allows it to pass if it is a legitimate request. Then, the data owner performs identity authentication on it, and rejects the service request if the authentication fails. After the authentication is passed, the data requester can call the data service API to obtain the data. The data owner encrypts or desensitizes the sensitive data in advance or when calling, and then responds the data to the data requester. However, the traditional access model and processing process have many shortcomings, including: 1. Data services are usually exposed to the public network environment, which provides attackers with the premise and conditions for intrusion. Its attack surface will be infinitely magnified, increasing the vulnerability of the system. It is always facing port scanning, vulnerability exploitation, DoS, DDoS, etc., and further facing the risk of data leakage.

[0005] 2. It is difficult to deal with malicious requests from insiders when using boundary protection.

[0006] 3. The identity authentication of the data requester often adopts static username & password authentication, which is relatively simple and fragile.

[0007] 4. After sensitive data is obtained by the data requester, there is a lack of tracking and tracing mechanisms, which leads to risks such as abuse of sensitive data. Summary of the invention

[0008] The purpose of the embodiments of the present application is to provide a sensitive data protection method, electronic device and storage medium to address security risks such as unauthorized access to sensitive data, leakage of sensitive data, and abuse of sensitive data.

[0009] In a first aspect, a sensitive data protection method is provided, which is applied to a sensitive data protection system including a data requester and a data owner. The method may include: The data requester initiates a SPA authentication data packet to the data owner, wherein the SPA authentication data packet includes identification information of the data requester; After the data owner completes the authentication according to the identification information and passes the authentication, the data service hidden by the data owner is opened, and the data service accessible to the data requester is set; After the data requester establishes a bidirectional encrypted data channel connection with the data owner, the data requester sends a data access request to the data owner through the bidirectional encrypted data channel connection; the data access request includes user identity information and the identifier of the data to be accessed; The data owner obtains the original data corresponding to the data identifier to be accessed in the database, and queries the user identity information and the sensitive data protection policy corresponding to the original data in the configured sensitive data protection policy library; performs sensitive data protection processing on the original data based on the data protection policy to obtain the processed data, and sends the processed data to the data requester through a two-way encrypted data channel connection.

[0010] In one possible implementation, the configured sensitive data protection system includes the following deployment modes: Mode 1: The configured sensitive data protection system also includes a control node; The SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH in the SDP architecture system is deployed on the data owner, and the SDP controller in the SDP architecture system is deployed on the control node; wherein the SDP connection accepting host AH is used to protect data services; Mode 2: The configured sensitive data protection system also includes a control node; The SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH and the SDP connection initiating host IH in the SDP architecture system are deployed on the data owner, and the SDP controller and the SDP connection accepting host AH in the SDP architecture system are deployed on the control node; wherein the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller; Mode 3: deploy the SDP connection initiating host IH in the SDP architecture system on the data requester, and deploy the SDP controller and SDP connection accepting host AH in the SDP architecture system on the data owner; the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller; Mode 4: The SDP connection initiating host IH is deployed on the data requesting side, and the SDP controller and the SDP connection accepting host AH are deployed on the data owner side; among them, the SDP connection accepting host AH is used to protect data services.

[0011] In a possible implementation, before the data requester establishes a bidirectional encrypted data channel connection with the data owner, the method further includes: For mode 1, after the SDP connection accepting host AH in the data owner establishes two-way encrypted communication with the SDP controller in the control node, the SDP connection accepting host AH in the data owner requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection accepting host AH in the data owner; After the SDP connection initiating host IH in the data requester establishes two-way encrypted communication with the SDP controller in the control node, the SDP connection initiating host IH in the data requester requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection initiating host IH in the data requester; The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner, wherein the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, authorizes the data owner to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service; For mode 2, the SDP connection initiating host IH in the data owner initiates a SPA authentication data packet to the SDP connection accepting host AH in the control node, and the authentication data packet includes the identification information of the data owner; the SDP connection accepting host AH in the control node completes the authentication according to the identification information and after the authentication is passed, the data owner is authorized to access the control service of the SDP controller in the control node; the SDP connection initiating host IH in the data owner establishes a Socket connection and a bidirectional encrypted data channel connection with the SDP controller in the control node; The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the control node, wherein the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the control node completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the control node; thereafter, a Socket connection and a bidirectional encrypted data channel connection are established between the SDP connection initiating host IH in the data requester and the SDP controller in the control node; The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet to the SDP connection accepting host AH in the data owner, wherein the SPA authentication data packet includes the identification information of the data requester; The SDP connection accepting host AH in the data owner completes authentication according to the identification information and after the authentication is passed, the data owner is authorized to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service.

[0012] In one possible implementation, the method further includes: For mode 3, the SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the data owner; thereafter, a bidirectional encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the control service of the SDP controller in the data owner; The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet again to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner; thereafter, a bidirectional encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service; For mode 4, after the SDP connection initiating host IH in the data requester establishes a Socket connection with the SDP controller in the data owner, the SDP connection initiating host IH in the data requester initiates a SPA authentication data packet to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner; thereafter, a two-way encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service.

[0013] In a possible implementation, the configured sensitive data protection policy library includes different databases that are allowed to be accessed by different identity information, and a data protection algorithm corresponding to any data field in any of the different databases; Query the user identity information in the configured sensitive data protection policy library and the sensitive data protection policy corresponding to the original data, including: Querying the configured sensitive data protection policy library whether the database where the original data is located meets the access conditions of the user identity information; If it does, the data protection algorithm corresponding to the data field of the original data in the configured sensitive data protection policy library is queried, and the queried data protection algorithm is determined as the sensitive data protection policy corresponding to the original data.

[0014] In a possible implementation, the number of data protection algorithms corresponding to any data field in the configured sensitive data protection policy library is multiple; Query the data protection algorithm corresponding to the data field of the original data in the configured sensitive data protection policy library, including: If multiple data protection algorithms corresponding to the data field of the original data in the queried sensitive data protection policy library are found, a data protection algorithm is randomly selected as the queried data protection algorithm.

[0015] In a possible implementation, after performing sensitive data protection processing on the fields in the original data based on the data protection policy and obtaining the processed data, the method further includes: The data owner encapsulates the configured watermark data and the processed data to obtain the encapsulated data, and sends the encapsulated data to the data requester through a bidirectional encrypted data channel connection.

[0016] In a second aspect, an electronic device is provided, the electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; The processor is used to implement any method step described in the first aspect when executing the program stored in the memory.

[0017] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method step described in the first aspect is implemented.

[0018] The sensitive data protection method provided by the present application is applied to a sensitive data protection system including a data requester and a data owner, wherein the data requester initiates an SPA authentication data packet to the data owner, and the SPA authentication data packet includes the identification information of the data requester; after the data owner completes the authentication according to the identification information and the authentication is passed, the hidden data service of the data owner is opened, and the accessible data service is set for the data requester; after the data requester and the data owner establish a two-way encrypted data channel connection, the data requester sends a data access request to the data owner through the two-way encrypted data channel connection; the data access request includes user identity information and the identifier of the data to be accessed; the data owner obtains the original data corresponding to the identifier of the data to be accessed in the database, and queries the user identity information and the sensitive data protection policy corresponding to the original data in the configured sensitive data protection policy library; based on the data protection policy, the original data is subjected to sensitive data protection processing to obtain the processed data, and the processed data is sent to the data requester through the two-way encrypted data channel connection. This method solves the security risks such as unauthorized access to sensitive data, leakage of sensitive data, and abuse of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A schematic diagram of four deployment modes of a sensitive data protection system provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a data protection strategy tree provided in an embodiment of the present application; Figure 3 A flowchart of a sensitive data protection method provided in an embodiment of the present application; Figure 4 A flowchart of another sensitive data protection method provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used in this application should be the common meanings understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "including" and other similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connected", "coupled" or "connected" and other similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0022] For ease of understanding, the terms involved in the embodiments of the present application are explained below: Zero Trust: Zero Trust is a security model and concept that emphasizes the principle of "never trust, always verify". The core idea of ​​zero trust is that no internal or external user or device can be trusted by default, and each access request must be strictly verified and authorized.

[0023] SDP: Software-Defined Perimeter is a technical architecture that specifically implements the concept of zero trust. It aims to enhance network security by hiding internal resources (such as servers and applications). SDP protects network resources by achieving "invisibility", that is, by default, internal resources are invisible to the external network and can only be accessed by authenticated and authorized clients.

[0024] The core of SDP technology is SPA (Single Packet Authorization), a security technology used to implement zero trust and SDP. It is mainly used to verify the identity of the client and establish a secure channel, first authenticate and then connect. The implementation of SPA is divided into two parts: SPA Server and SPA Client.

[0025] The SPA Server is used to protect the services provided. It is configured with a DROP ALL (deny all access) firewall policy by default, so no request can access the service at this time, thereby achieving service hiding and isolation. When accessing the service, the SPA Client needs to send a SPA Packet to the SPA Server for port knocking. The SPA Packet contains the client information, the target service information to be accessed, and is an encrypted data packet encrypted using an algorithm negotiated by both parties. After receiving the SPA Packet, the SPA Server verifies and decrypts it. After the SPA Server authenticates the SPA Packet, the SPA Server configures a firewall policy for the SPA Client, dynamically opens the firewall port, and allows the SPA Client to access the services protected by the SPA Server. After the firewall policy expires, the SPA Server deletes the firewall policy and hides the service.

[0026] The SPA authentication process involves the SPA Client and the SPA Server. First, the SPA Client constructs the SPA data packet. Then, the SPA Client sends the SPA data packet. Then, the SPA Server receives and authenticates the UDP SPA data packet. Finally, if the authentication passes, the firewall policy is dynamically configured and the service is opened. Access is allowed within the authentication timeout period. After the timeout, the firewall policy is dynamically cleared. The specific process is as follows: 1. SPA Client constructs a message. The message contains the SPA Client's username, timestamp, version information, SPA type value, SPA Server's IP, service / port to be accessed, protocol, authentication timeout, etc., connected by ":".

[0027] 2. Calculate digest. SPA Client calculates the hash value of the message using the specified hash algorithm (or the default hash algorithm) to obtain the digest.

[0028] 3. Data encryption: SPA Client connects the message and digest, and uses the public key of SPA Server to encrypt them to obtain ciphertext data.

[0029] 4. Data signature. SPA Client uses its own private key to sign the ciphertext data and obtain a summary.

[0030] 5. SPA Client calculates the HMAC of the signed data and concatenates the ciphertext data and the HMAC data as a UDP SPA data packet.

[0031] 6. SPA Client sends UDP SPA data packet.

[0032] 7. SPA Server listens to the specified protocol and port to obtain the source and destination addresses of the message.

[0033] 8. The SPA Server takes out the HMAC digest from the data segment, recalculates the HMAC digest of the ciphertext, and verifies whether they are consistent.

[0034] 9. SPA Server uses the SPA Client's public key to verify its signature.

[0035] 10. SPA Server uses its own private key to decrypt the data and obtain the plaintext information.

[0036] 11. SPA Server verifies the SPA client username, SPA server IP, service / port to be accessed, protocol, authentication timeout, etc. in the plain text information.

[0037] 12. If the verification is successful, dynamically configure the firewall policy, open the corresponding service / port, and allow SPA Client to access. After the timeout, dynamically clear the firewall policy.

[0038] The SDP (Software Defined Perimeter) architecture consists of three major components: IH, AH, and Controller.

[0039] IH: Initiating Host, that is, the SDP connection initiating host, which is usually deployed with SDP client software. It first sends SPA to the Controller, and after being authenticated by the Controller, it establishes a two-way encrypted connection with the Controller, requests to update the key from the Controller, obtains the service list, etc. Then IH sends SPA to AH, establishes a two-way encrypted connection with AH, and accesses the data services protected by AH.

[0040] AH: Accepting Host, which is the SDP connection accepting host. It usually deploys the SDP gateway component to protect the target services located on it.

[0041] Controller: SDP controller, which maintains the information of all SDP members, service lists, etc., authenticates IH and AH and is responsible for updating their private keys and certificates.

[0042] Many major data breaches in recent years have shown that the perimeter-based trust model can no longer adapt to the current complex and changing network environment. Therefore, modern security strategies have turned more to the Zero Trust architecture, emphasizing the principle of "never trust, always verify", that is, whether the user is in the intranet or the extranet, they need to undergo strict identity authentication and permission verification before they can access system resources.

[0043] The sensitive data protection method provided in the present application can be applied to a sensitive data protection system, which may include a data requester and a data owner.

[0044] Data owner: refers to the owner of the data, who owns and manages the data, including sensitive data, and provides data sharing capabilities through data services. The data owner has a flexible deployment mode and can be deployed together with the SDP controller in the SDP architecture system or separately.

[0045] When deployed separately, the data owner deploys AH or deploys IH and AH at the same time. When deployed centrally, the data user deploys Controller and SDP connection receiving host AH at the same time. Controller maintains and manages the information of SDP connection receiving host AH, SDP connection initiating host IH, data services, etc., and is responsible for authenticating IH and AH and updating their private keys and certificates. AH is used to hide data services and implement data service protection.

[0046] Data requester: refers to the party who wants to obtain, access or use specific data. Data requesters have different roles, and they obtain data by calling the data service of the data owner. The data requester has the SDP connection initiator host IH in the built-in SDP architecture system, which mainly completes the authentication between the SDP controller and the SPA authentication between the SDP connection acceptor host AH in the data owner, and then requests the data service protected by the SDP connection acceptor host AH in the data owner to obtain data. The implementation method of the data requester can be very flexible, such as through the client, browser, mobile APP, WeChat applet, etc.

[0047] First of all, based on the principle and practice of SDP "never trust, always verify", this application proposes to build a new interaction process for data owners and data requesters in sensitive data protection systems. Regardless of whether the user is located in the intranet or the extranet, to access data services, they must undergo strict identity authentication and permission verification. When the data requester establishes a connection with the data owner, the SPA single-packet authentication process is used for request and verification. After the verification is passed, the two parties establish a two-way encrypted data channel connection mTLS for encrypted data transmission, and the data owner starts the data service.

[0048] Specifically, considering whether the SDP controller is deployed separately and whether the ports of the SDP controller are hidden, it can be divided into four deployment modes, such as Figure 1 The main difference between the four modes is the connection process between the data owner and the SDP controller, and between the data requester and the SDP controller. The connection process between the data requester and the data owner, and the process between the data requester and the data service are basically the same.

[0049] The SDP controller is deployed separately: Mode 1: The sensitive data protection system includes not only the data requester and the data owner, but also the control node.

[0050] In the sensitive data protection system, the SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH in the SDP architecture system is deployed on the data owner, and the SDP controller Controller in the SDP architecture system is deployed on the control node (Controller node); wherein the SDP connection accepting host AH is used to protect data services.

[0051] (1) The SDP connection accepting host AH in the data owner first establishes a Socket connection with the SDP controller Controller in the control node. After that, the SDP connection accepting host AH in the data owner performs an SSL handshake with the Controller to complete the key and algorithm negotiation to establish a two-way encrypted communication connection. After the SDP connection accepting host AH in the data owner establishes a two-way encrypted communication connection with the SDP controller in the control node, the SDP connection accepting host AH in the data owner requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection accepting host AH in the data owner, AH updates the local certificate and private key, and sends a confirmation message to the Controller; the Controller updates the configuration information of the data owner. The configuration information may include information such as a service list, which services the data owner opens, the SDP member group, and which member can access which service. After that, the SDP connection accepting host AH in the data owner maintains a communication connection with the SDP controller in the control node; (2) After the SDP connection initiator host IH in the data requester establishes a Socket connection with the SDP controller in the control node, the SDP connection initiator host IH in the data requester and the SDP controller in the control node perform an SSL handshake and complete the key and algorithm negotiation to establish a two-way encrypted communication connection. After the SDP connection initiator host IH in the data requester and the SDP controller in the control node establish a two-way encrypted communication connection, the SDP connection initiator host IH in the data requester requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection initiator host IH in the data requester, IH updates the local certificate and private key, and sends a confirmation message to the Controller; the Controller updates the configuration information of the data requester. Afterwards, the SDP connection initiator host IH in the data requester and the SDP controller in the control node close the communication connection; (3) The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner. The SPA authentication data packet includes the identification information of the data requester. The SDP connection accepting host AH in the data owner completes the authentication based on the identification information and after the authentication is passed, the data owner is authorized to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service. It can be seen that this mode includes three nodes and needs to execute a SPA single packet authentication process.

[0052] Mode 2: The sensitive data protection system includes not only the data requester and the data owner, but also the control node.

[0053] In the sensitive data protection system, the SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH and the SDP connection initiating host IH in the SDP architecture system are deployed on the data owner, and the SDP controller Controller and the SDP connection accepting host AH in the SDP architecture system are deployed on the control node (Controller node); wherein the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller.

[0054] (1) The SDP connection initiating host IH in the data owner initiates an SPA authentication data packet to the SDP connection accepting host AH in the control node. The SPA authentication data packet includes the identification information of the data owner. The SDP connection accepting host AH in the control node completes the authentication based on the identification information. After the authentication is passed, the data owner is authorized to access the control service of the SDP controller in the control node. A socket connection and a bidirectional encrypted data channel connection are established between the SDP connection initiating host IH in the data owner and the SDP controller in the control node. (2) The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the control node. The SPA authentication data packet includes the identification information of the data requester. The SDP connection accepting host AH in the control node completes the authentication based on the identification information. After the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the control node. After that, a bidirectional encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the SDP controller in the control node. (3) The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet to the SDP connection accepting host AH in the data owner. The SPA authentication data packet includes the identification information of the data requester. The SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data owner is authorized to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service.

[0055] It can be seen that this mode includes three nodes and needs to execute the SPA single package authentication process three times.

[0056] SDP controller is centrally deployed: Mode 3: The sensitive data protection system only includes the data requester and the data owner.

[0057] In the sensitive data protection system, the SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, and the SDP controller and SDP connection accepting host AH in the SDP architecture system are deployed on the data owner; wherein the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller.

[0058] (1) The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner. The SPA authentication data packet includes the identification information of the data requester. The SDP connection accepting host AH in the data owner completes the authentication based on the identification information and after the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the data owner. After that, a socket connection and a bidirectional encrypted data channel connection are established between the SDP connection initiating host IH in the data requester and the SDP controller in the data owner. (2) The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet again to the SDP connection accepting host AH in the data owner. The SPA authentication data packet includes the identification information of the data requester. The SDP connection accepting host AH in the data owner completes the authentication based on the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner. After that, a two-way encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service. It can be seen that this mode includes two nodes and needs to execute a secondary SPA single-packet authentication process.

[0059] Mode 4: The sensitive data protection system only includes the data requester and the data owner.

[0060] In the sensitive data protection system, the SDP connection initiating host IH is deployed on the data requester, and the SDP controller and the SDP connection accepting host AH are deployed on the data owner; wherein the SDP connection accepting host AH is used to protect data services.

[0061] (1) After the SDP connection initiating host IH in the data requester establishes a Socket connection with the SDP controller in the data owner, the SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner; thereafter, a two-way encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service.

[0062] It can be seen that this mode includes two nodes and needs to execute a SPA single packet authentication process.

[0063] Secondly, this application proposes that the data owner adopts SDP connection to accept the host AH protection data service, and configures a sensitive data protection policy library. The sensitive data protection policy library includes different databases (Database) that different identity information allows access to, and the data protection algorithm (Func) corresponding to any data field in any database (Database) in different databases, that is, different data protection algorithms are used for different sensitivity levels of data fields for different roles to meet the data protection of different sensitivity levels and the differentiated needs of different users for sensitive data. Among them, the storage information in the sensitive data protection policy library can be stored in the form of a data protection policy tree. The data protection policy tree defines a set of data protection algorithms (func) that can be used by a role (role) when accessing a data field (key) of a data table (table) of a database (database), such as Figure 2 As shown, the sensitive data protection policy library includes three different roles. Role 1 can access database 1 and database 2; role 2 can only access database 1. Among them, when role1 accesses the field key1 of the data table table1 in the database database1, the data protection algorithm func1 can be used. That is, when role1 accesses the field key1 of the table1 of the database1, the data protection algorithm func1 can be used to process key1. When role1 accesses the field key1 of table table2 in database database1, it can use data protection algorithms func2 and func3; when it accesses the field key2 of table table2, it can use data protection algorithms func1 and func2; When role2 accesses field key3 of table table1 in database database2, it can use data protection algorithms func4, func5, and func6. When role2 accesses field key4 of table table2 in database database2, it can use data protection algorithms func7 and func8.

[0064] Among them, each data protection algorithm can include one or multiple combined algorithms among character replacement, character shift, character replacement table, fixed value replacement, random number replacement, data encryption, data obfuscation, data fuzzification and data synthesis, and also supports custom algorithms.

[0065] It can be understood that, in practice, the data protection policy tree can be stored in the form of a dictionary.

[0066] Furthermore, the present application may introduce data watermarking technology. When the data owner responds to the data requester, the data owner may construct a data watermark, complete the processing of sensitive data based on the data protection strategy tree, encapsulate the data, and respond the encapsulated data to the data requester.

[0067] Therefore, the sensitive data protection method provided by this application realizes the secure interaction of data sharing process, the secure transmission of data, the flexible data protection strategy and the retrospective review of data, and effectively solves the security risks such as unauthorized access to sensitive data, leakage of sensitive data, and abuse of sensitive data.

[0068] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0069] Figure 3 A flowchart of a sensitive data protection method provided in an embodiment of the present application. Figure 3 As shown, the method may include: Step 31: The data requester initiates a SPA authentication data packet to the data owner.

[0070] The SPA authentication data packet includes identification information of the data requester.

[0071] Step 32: After the data owner completes authentication according to the identification information and passes the authentication, the data owner's hidden data service is opened, and an accessible data service is set for the data requester.

[0072] If the verification fails, the data owner discards the SPA; if the verification passes, the data owner sets an access policy for the data requester to allow the data requester to access the data service.

[0073] Step 33: After the data requester establishes a bidirectional encrypted data channel connection with the data owner, the data requester sends a data access request to the data owner through the bidirectional encrypted data channel connection.

[0074] The data requester IH and the data owner's data service conduct an SSL handshake to complete the key and algorithm negotiation. The data requester IH and the data owner's data service both verify each other's private key and certificate and establish two-way encrypted communication.

[0075] Afterwards, the data requester sends an identity authentication request including user identity information to the data owner through a two-way encrypted data channel connection, so that the data service can authenticate its identity. The identity information here can also use multi-factor authentication technology, which is related to the form of the data requester and is not limited here.

[0076] After the data service verifies the identity information of the data requester, if the verification result is that the identity authentication fails, a response of denying access to the data service will be fed back to the data requester; otherwise, a response of authorizing access to the data service will be fed back; Afterwards, the data requester sends a data access request to the data owner through a bidirectional encrypted data channel connection, and the data access request includes user identity information and an identifier of the data to be accessed.

[0077] Step 34: The data owner obtains the original data corresponding to the data identifier to be accessed in the database, and queries the configured sensitive data protection policy library for user identity information and the sensitive data protection policy corresponding to the original data.

[0078] The data owner receives the data access request and parses the user identity information and the data identifier to be accessed. The analysis of the user identity information here is mainly to determine the user's role, and the data identifier to be accessed is used to determine the database, data table and data field information requested by the user.

[0079] Querying the configured sensitive data protection policy library to see whether the database where the original data is located meets the access conditions of the user identity information; If it is in compliance, the data protection algorithm corresponding to the data field of the original data in the configured sensitive data protection policy library is queried, and the queried data protection algorithm is determined as the sensitive data protection policy corresponding to the original data. That is, the data owner queries the data protection policy tree to determine the data protection policy corresponding to the user of the role. The main purpose is to determine the set of data protection algorithms available to the role for sensitive data. The list of data protection algorithms can be determined based on the parsed roles, databases, data tables, and data fields.

[0080] Step 35: The data owner performs sensitive data protection processing on the original data based on the data protection policy to obtain processed data, and sends the processed data to the data requester via a two-way encrypted data channel connection.

[0081] Afterwards, the data owner closes the connection with the data requester.

[0082] In some embodiments, after obtaining the processed data, the data owner may encapsulate the configured watermark data and the processed data to obtain the encapsulated data, and send the encapsulated data to the data requester via a bidirectional encrypted data channel connection.

[0083] In some embodiments, when there are multiple data protection algorithms (Func) corresponding to any data field in the configured sensitive data protection policy library, if multiple data protection algorithms corresponding to the data field of the original data in the configured sensitive data protection policy library are queried, a data protection algorithm can be randomly selected as the queried data protection algorithm; Alternatively, the priority levels of multiple data protection algorithms may be preset. If the same user identity information (i.e., role) accesses the same original data within a preset time period, data protection algorithms with successively higher priorities may be queried as the number of accesses increases. For example, when the target role accesses the same original data for the first time, the first data protection algorithm queried is the algorithm with the lowest priority among the multiple data protection algorithms; when the target role accesses the same original data for the second time, the data protection algorithm queried is the algorithm with a higher priority than the first data protection algorithm among the multiple data protection algorithms, and so on. If the number of accesses involving the same user identity information (i.e., role) to the same original data within a preset time period is greater than the number of data protection algorithms corresponding to the data field of the original data, then at this time, you can first query out the data protection algorithms in increasing order of priority, and after traversing all data protection algorithms, re-query out the data protection algorithms in increasing order of priority. For example, the number of accesses is 4 times, and the data protection algorithm only includes 2 methods. Then, the first access queries out a data protection algorithm with a low priority, the second access queries out a data protection algorithm with a high priority, the third access queries out a data protection algorithm with a low priority, and the fourth access queries out a data protection algorithm with a high priority.

[0084] In some embodiments, the sensitive data protection policy library also includes the sensitivity level of user identity information (ie, roles), combined with Figure 2 , the sensitivity levels of role1, role2 and role3 can be set in increasing order, where the number of data protection algorithms for each data field involved in a higher sensitivity level is greater than the number of data protection algorithms for each data field involved in a lower sensitivity level, that is, different roles have different numbers of data protection algorithms for the same data field.

[0085] If the user identity information (i.e., role) of the data requester does not exist in the sensitive data protection policy library, the data owner can query the data protection algorithm involved in the role with the highest sensitivity level in the sensitive data protection policy library.

[0086] In an example, the following uses mode 2 as an example to explain its working process in detail. The Controller and AH are deployed separately on a single machine, which we call the Controller node for the convenience of description. The following explains the detailed process of interaction between the data requester, the data owner, and the Controller node. The detailed interaction process is as follows: Figure 4 As shown: 1. The AH of the Controller node runs. AH is used to protect the Controller service. By default, the Controller service is hidden and all requests are rejected. The requester needs to be authenticated by the SPA and the AH of the Controller node. After the authentication is passed, the AH configures the authorization policy and opens the Controller service to the requester.

[0087] 2. Controller node Controller runs.

[0088] 3. Data users run data services and AH services. AH services are used to protect data services. By default, data users use AH to hide data services. Requesters need to verify with data users AH through SPA. After verification, AH configures authorization policies and opens data services to requesters.

[0089] 4. The data owner IH sends SPA to the Controller node AH. SPA is used to verify with the Controller node AH.

[0090] 5. The Controller node AH accepts and performs SPA verification. If SPA verification is successful, the AH service on the Controller node configures the authorization policy and authorizes the data owner IH to connect.

[0091] 6. The data user IH establishes a Socket connection with the Controller, and establishes two-way encrypted communication.

[0092] The data owner IH and the Controller conduct an SSL handshake to complete the key and algorithm negotiation. The data owner IH and the Controller verify their respective private keys and certificates and establish two-way encrypted communication (mTLS). Encrypted communication refers to the communication process in which data is encrypted during communication. During the communication process, the data sender uses the receiver's public key to encrypt the data and uses its own private key to sign the data. The receiver uses the sender's public key to verify the signature and then uses its own private key to decrypt the data.

[0093] 7. The data owner IH requests the Controller to update its certificate and private key. The Controller receives the request and generates a certificate and private key for the data user IH. The certificate and private key here can be generated by the Controller or by connecting the Controller to an external IAM system.

[0094] 8. The Controller sends the certificate and private key to the data user IH.

[0095] 9. Data uses Youfang AH to update local private keys and certificates, and update them to local files and configuration files.

[0096] 10. The data owner IH sends an update completion confirmation message to the Controller.

[0097] 11. After receiving the confirmation message, the Controller updates the local configuration file.

[0098] 12. The data owner IH maintains a session connection with the Controller. The session here refers to the Socket session. Once the Socket session is established, it remains connected until the Socket server is closed and the Socket session is disconnected. Here, during the Socket session maintenance process, the main operations completed include requesting to update the certificate and private key, generating the certificate and private key, updating the certificate and private key, receiving the updated confirmation notification, the other party updating the generated certificate and private key, receiving the updated confirmation notification, etc.

[0099] 13. The data requester IH sends SPA to the AH of the Controller node.

[0100] 14. The Controller node AH receives the SPA and performs SPA verification. If the SPA verification is successful, the AH service on the Controller node configures the authorization policy and authorizes the data requester IH to connect.

[0101] 15. The data requester IH establishes a Socket connection with the Controller to establish two-way encrypted communication.

[0102] After the data requester IH establishes a Socket connection with the Controller, the data requester IH and the Controller perform an SSL handshake to complete the key and algorithm negotiation.

[0103] The data requester IH and the Controller verify their respective private keys and certificates and establish two-way encrypted communication (mTLS).

[0104] 16. The data owner IH requests the Controller to update its certificate and private key.

[0105] 17. The Controller receives the request from the data requester and generates a certificate and private key.

[0106] 18. The Controller sends the certificate and private key to the data requester IH.

[0107] 19. The data requester AH updates the local private key and certificate, etc., and updates them to the local files and configuration files.

[0108] 20. The data requester IH sends an update completion confirmation message to the Controller.

[0109] 21. After receiving the confirmation information, the Controller updates the configuration information of the data requester in the local configuration file.

[0110] 22. The data user AH requests the Controller to obtain the service list and confirms it.

[0111] The service list maintains the configuration relationship between the IH and its accessible services.

[0112] Afterwards, the data user AH sends a confirmation receipt message to the Controller.

[0113] 23. The session connection between the Controller and the data requester IH is closed.

[0114] The Controller closes the session connection with the data requester IH.

[0115] The data requester IH closes the session connection with the Controller.

[0116] 24. The data requester sends SPA to the data owner AH.

[0117] 25. The data owner AH verifies the SPA. If the verification fails, the data owner AH discards the SPA. If the verification passes, the data owner AH sets an access policy for the data requester, allowing the data requester to access the data service.

[0118] 26. Establish two-way encrypted communication with the data owner and request data service.

[0119] The data requester IH and the data owner's data service conduct an SSL handshake to complete the key and algorithm negotiation. The data requester IH and the data owner's data service both verify each other's private key and certificate and establish two-way encrypted communication.

[0120] The data requester requests the data service. The data requester sends an identity authentication request, and the data service authenticates its identity. The identity information here can also use multi-factor authentication technology, which is related to the form of the data requester and is not restricted here. If the identity information authentication fails, the service is rejected.

[0121] 27. The data service verifies the request from the data requester.

[0122] 28. After identity authentication, the data requester calls the data service request to obtain the data of the data owner.

[0123] 29. The data owner receives the data request, resolves the user identity and access information, and the data service queries the database to obtain the original data requested by the user. After obtaining the original data, the data is further processed and packaged.

[0124] The data owner receives the data request, analyzes the user's identity and access information, and queries the database through the data service to obtain the original data requested by the user. After obtaining the original data, the data is further processed and packaged.

[0125] The user identity here mainly determines the user's role, and the access information determines the database, data table, and table field information requested by the user.

[0126] The data owner queries the data protection policy tree to determine the data protection policy corresponding to the user of the role. This is mainly to determine the set of data protection algorithms available to the role for sensitive data. The list of data protection algorithms can be determined based on the role, database, table, and field.

[0127] The data owner selects an algorithm from a set of data protection algorithms for each field, either fixedly or randomly, to process the field and obtain processed data.

[0128] The data owner can construct the data watermark using a publicly available algorithm or a custom algorithm.

[0129] The data owner encapsulates the watermark data and the processed data.

[0130] 30. The data owner returns the encapsulated data to the data requester and closes the connection with the data requester.

[0131] The sensitive data protection method provided by this application can realize the secure interaction of data sharing process, secure data transmission, flexible data protection strategy and data traceability review. It effectively solves the security risks such as unauthorized access to sensitive data, leakage of sensitive data, and abuse of sensitive data. Specifically, it is manifested in: 1. The interaction process built based on SDP solves the shortcomings of the existing security model based on trust boundaries. Whether the user is in the intranet or the extranet, to access data services, they must undergo strict identity authentication and permission verification to protect unauthorized access to sensitive data. Authentication first, then authorization connection, to achieve service hiding, reduce exposure, effectively reduce attacks, reduce data leakage and other risks. The interaction process is carried out through two-way encrypted communication, effectively ensuring transmission security and data security during the communication process.

[0132] 2. Multi-factor authentication is proposed during the SPA construction process, combining dynamic multi-factor authentication technologies such as SMS verification code, face recognition, and voice to achieve identity enhancement authentication, solving the problem of traditional authentication being simple and fragile.

[0133] 3. The data protection strategy is flexible. Flexible data protection strategies are defined through the data protection policy tree. It can meet the data protection of different sensitivity levels and meet the differentiated needs of different users for sensitive data. The data protection policy tree presents and defines flexible data protection strategies in the form of a tree. In the actual implementation process, other forms of expression besides dictionaries can be used. Data watermarks are introduced in this application to achieve the traceability of sensitive data and prevent data abuse. Other technical means can also be used to achieve this. The data protection algorithm can also be implemented using the technical means of privacy computing.

[0134] 4. Introduce data watermark technology to achieve traceability of sensitive data and reduce the risk of abuse of sensitive data. [chofn1] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 510 , a communication interface 520 , a memory 530 and a communication bus 540 , wherein the processor 510 , the communication interface 520 , and the memory 530 communicate with each other via the communication bus 540 .

[0135] Memory 530, for storing computer programs; The processor 510 is used to execute the program stored in the memory 530 to implement the following steps: The data requester initiates a SPA authentication data packet to the data owner, wherein the SPA authentication data packet includes identification information of the data requester; After the data owner completes the authentication according to the identification information and passes the authentication, the data service hidden by the data owner is opened, and the data service accessible to the data requester is set; After the data requester establishes a bidirectional encrypted data channel connection with the data owner, the data requester sends a data access request to the data owner through the bidirectional encrypted data channel connection; the data access request includes user identity information and the identifier of the data to be accessed; The data owner obtains the original data corresponding to the data identifier to be accessed in the database, and queries the user identity information and the sensitive data protection policy corresponding to the original data in the configured sensitive data protection policy library; performs sensitive data protection processing on the original data based on the data protection policy to obtain the processed data, and sends the processed data to the data requester through a two-way encrypted data channel connection.

[0136] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0137] The communication interface is used for communication between the above electronic device and other devices.

[0138] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0139] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0140] The implementation methods and beneficial effects of the components of the electronic device in the above embodiments to solve the problems can be found in Figure 3 The various steps in the illustrated embodiment are implemented, therefore, the specific working process and beneficial effects of the electronic device provided by the embodiment of the present application are not repeated here.

[0141] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which instructions are stored. When the computer-readable storage medium is executed on a computer, the computer executes the sensitive data protection method described in any of the above embodiments.

[0142] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the sensitive data protection method described in any one of the above embodiments.

[0143] Those skilled in the art will appreciate that the embodiments in the present application can be provided as methods, systems, or computer program products. Therefore, the embodiments in the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments in the present application can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0144] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0147] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0148] Obviously, those skilled in the art can make various changes and modifications to the embodiments in the present application without departing from the spirit and scope of the embodiments in the present application. Thus, if these modifications and variations of the embodiments in the present application fall within the scope of the claims and their equivalents in the embodiments of the present application, the embodiments of the present application are also intended to include these modifications and variations.

Claims

1. A method for protecting sensitive data, characterized in that: Applied to a sensitive data protection system including a data requester and a data owner, the method comprises: The data requester initiates a SPA authentication data packet to the data owner, wherein the SPA authentication data packet includes identification information of the data requester; After the data owner completes the authentication according to the identification information and passes the authentication, the data service hidden by the data owner is opened, and the data service accessible to the data requester is set; After the data requester establishes a bidirectional encrypted data channel connection with the data owner, the data requester sends a data access request to the data owner through the bidirectional encrypted data channel connection; the data access request includes user identity information and the identifier of the data to be accessed; The data owner obtains the original data corresponding to the data identifier to be accessed in the database, and queries the user identity information and the sensitive data protection policy corresponding to the original data in the configured sensitive data protection policy library; performs sensitive data protection processing on the original data based on the data protection policy to obtain the processed data, and sends the processed data to the data requester through a two-way encrypted data channel connection.

2. The method according to claim 1, characterized in that The configured sensitive data protection system includes the following deployment modes: Mode 1: The configured sensitive data protection system also includes a control node; The SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH in the SDP architecture system is deployed on the data owner, and the SDP controller in the SDP architecture system is deployed on the control node; wherein the SDP connection accepting host AH is used to protect data services; Mode 2: The configured sensitive data protection system also includes a control node; The SDP connection initiating host IH in the SDP architecture system is deployed on the data requester, the SDP connection accepting host AH and the SDP connection initiating host IH in the SDP architecture system are deployed on the data owner, and the SDP controller and the SDP connection accepting host AH in the SDP architecture system are deployed on the control node; wherein the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller; Mode 3: deploy the SDP connection initiating host IH in the SDP architecture system on the data requester, and deploy the SDP controller and SDP connection accepting host AH in the SDP architecture system on the data owner; the SDP connection accepting host AH is used to protect the control service and data service of the SDP controller; Mode 4: The SDP connection initiating host IH is deployed on the data requesting side, and the SDP controller and the SDP connection accepting host AH are deployed on the data owner side; among them, the SDP connection accepting host AH is used to protect data services.

3. The method according to claim 2, characterized in that Before the data requester establishes a bidirectional encrypted data channel connection with the data owner, the method further includes: For mode 1, after the SDP connection accepting host AH in the data owner establishes two-way encrypted communication with the SDP controller in the control node, the SDP connection accepting host AH in the data owner requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection accepting host AH in the data owner; After the SDP connection initiating host IH in the data requester establishes two-way encrypted communication with the SDP controller in the control node, the SDP connection initiating host IH in the data requester requests the SDP controller in the control node to update its certificate and private key; the SDP controller in the control node sends the updated certificate and private key to the SDP connection initiating host IH in the data requester; The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner, wherein the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, authorizes the data owner to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service; For mode 2, the SDP connection initiating host IH in the data owner initiates a SPA authentication data packet to the SDP connection accepting host AH in the control node, and the authentication data packet includes the identification information of the data owner; the SDP connection accepting host AH in the control node completes the authentication according to the identification information and after the authentication is passed, the data owner is authorized to access the control service of the SDP controller in the control node; the SDP connection initiating host IH in the data owner establishes a Socket connection and a bidirectional encrypted data channel connection with the SDP controller in the control node; The SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the control node, wherein the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the control node completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the control node; thereafter, a Socket connection and a bidirectional encrypted data channel connection are established between the SDP connection initiating host IH in the data requester and the SDP controller in the control node; The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet to the SDP connection accepting host AH in the data owner, wherein the SPA authentication data packet includes the identification information of the data requester; The SDP connection accepting host AH in the data owner completes authentication according to the identification information and after the authentication is passed, the data owner is authorized to access the data service, so that a two-way encrypted communication connection is established between the SDP connection initiating host IH in the data requester and the data service.

4. The method according to claim 2, characterized in that The method further comprises: For mode 3, the SDP connection initiating host IH in the data requester initiates an SPA authentication data packet to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the control service of the SDP controller in the data owner; thereafter, a bidirectional encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the control service of the SDP controller in the data owner; The SDP connection initiating host IH in the data requester initiates a SPA authentication data packet again to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner; thereafter, a bidirectional encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service; For mode 4, after the SDP connection initiating host IH in the data requester establishes a Socket connection with the SDP controller in the data owner, the SDP connection initiating host IH in the data requester initiates a SPA authentication data packet to the SDP connection accepting host AH in the data owner, and the SPA authentication data packet includes the identification information of the data requester; the SDP connection accepting host AH in the data owner completes the authentication according to the identification information and after the authentication is passed, the data requester is authorized to access the data service in the data owner; thereafter, a two-way encrypted data channel connection is established between the SDP connection initiating host IH in the data requester and the data service.

5. The method according to claim 1, characterized in that The configured sensitive data protection policy library includes different databases that are allowed to be accessed by different identity information, and a data protection algorithm corresponding to any data field in any database of different databases; Query the user identity information in the configured sensitive data protection policy library and the sensitive data protection policy corresponding to the original data, including: Querying the configured sensitive data protection policy library whether the database where the original data is located meets the access conditions of the user identity information; If it does, the data protection algorithm corresponding to the data field of the original data in the configured sensitive data protection policy library is queried, and the queried data protection algorithm is determined as the sensitive data protection policy corresponding to the original data.

6. The method according to claim 5, characterized in that The number of data protection algorithms corresponding to any data field in the configured sensitive data protection policy library is multiple; Query the data protection algorithm corresponding to the data field of the original data in the configured sensitive data protection policy library, including: If multiple data protection algorithms corresponding to the data field of the original data in the queried sensitive data protection policy library are found, a data protection algorithm is randomly selected as the queried data protection algorithm.

7. The method according to claim 1, characterized in that After performing sensitive data protection processing on the fields in the original data based on the data protection policy and obtaining the processed data, the method further includes: The data owner encapsulates the configured watermark data and the processed data to obtain the encapsulated data, and sends the encapsulated data to the data requester through a bidirectional encrypted data channel connection.

8. An electronic device, characterized in that: The electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images