Financial sensitive data access control method and system

Abstract

The invention relates to an access control method and system for financial sensitive data, and the method is applied to a cloud server, and comprises the steps: receiving a data access request sent by an access client, the data access request being used for requesting to obtain target sensitive data and at least carrying the attribute information of an access user; verifying whether the identity of the access user is legal based on the attribute information of the access user and a preset access control strategy; wherein the access control strategy is an access control strategy generated based on attribute-based encryption in advance, and the access control strategy comprises a constructed access control tree based on multiple attributes; and after the identity is verified to be legal, sending the decrypted target sensitive data to the access client.

Description

Technical Field

[0001] The disclosed embodiments relate to the technical field of financial data processing, and in particular, to a method and system for controlling access to financial sensitive data. Background Art

[0002] At present, the data storage and processing of financial institutions such as banks are usually within their control, and the role-based access control model can meet most data security needs. However, as data and applications migrate to the cloud, such as the public cloud, the trust relationship between data owners (such as banks) and storage service providers (such as cloud service providers) has changed. Specifically, data owners and storage servers are often no longer in the same trust domain, which makes the traditional access control model insufficient. Therefore, more detailed and strict security measures are urgently needed to ensure the security and privacy of data, especially sensitive data (such as electronic monthly statements). Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a method and system for controlling access to financial sensitive data.

[0004] In a first aspect, an embodiment of the present disclosure provides a method for controlling access to financial sensitive data, which is applied to a cloud server and includes:

[0005] Receiving a data access request sent by an access client, wherein the data access request is used to request to obtain target sensitive data and carries at least attribute information of the access user;

[0006] Verifying whether the identity of the access user is legitimate based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy generated in advance based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes;

[0007] After verifying the legitimacy of the identity, the decrypted target sensitive data is sent to the access client.

[0008] In one embodiment, the access control tree includes at least a root node and multiple leaf nodes, each leaf node corresponds to an attribute, and the access control tree includes a mapping relationship between the attributes of each leaf node and the corresponding secret value and the secret value of the root node initially calculated; the verification of whether the identity of the access user is legal based on the attribute information of the access user and the preset access control policy includes:

[0009] Based on the attribute information of the access user, if the secret value of the root node calculated by traversing the nodes of the access control tree through the mapping relationship is equal to the secret value of the root node obtained by the initial calculation, it means that the identity of the access user is legal.

[0010] In one embodiment, the method further comprises:

[0011] Receiving a first encryption key and a first ciphertext sent by the data owner through the access client; the first ciphertext is obtained by the data owner encrypting the target sensitive data using the symmetric key, and the first encryption key is obtained by the data owner encrypting the symmetric key using its own first public key;

[0012] After verifying the legitimacy of the identity, receiving a second encryption key, wherein the second encryption key is obtained by encrypting the first private key of the data owner using the second public key; the first private key and the first public key are pre-generated for the data owner;

[0013] The first encryption key is re-encrypted based on the second encryption key to generate a second ciphertext, and the second ciphertext and the first ciphertext are returned to the access client, so that the access client uses the second private key to decrypt the second ciphertext to obtain the symmetric key, and decrypts the first ciphertext based on the symmetric key to obtain the target sensitive data; wherein the second private key and the second public key are pre-generated for the data consumer, i.e., the access user.

[0014] In one embodiment, a designated identifier is set in one or more of the first public key, the first private key, the symmetric key, the second public key and the second private key.

[0015] In one embodiment, the attribute information of the accessing user includes a plurality of different attributes, and the plurality of different attributes can be pre-configured or adjusted and updated.

[0016] In one embodiment, the target sensitive data includes at least electronic monthly statements of bank customers.

[0017] In one embodiment, the cloud server comprises a public cloud server; and / or, the access control policy is executed by a binary package configured on the cloud server.

[0018] In a second aspect, an embodiment of the present disclosure provides an access control system for financial sensitive data, including:

[0019] A receiving module, used to receive a data access request sent by an access client, wherein the data access request is used to request to obtain target sensitive data and carries at least attribute information of the accessing user;

[0020] A judgment module, used to verify whether the identity of the access user is legal based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy pre-generated based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes;

[0021] The sending module is used to send the decrypted target sensitive data to the access client after verifying the legitimacy of the identity.

[0022] In a third aspect, an embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for controlling access to financial sensitive data described in any of the above embodiments.

[0023] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0024] Processor; and

[0025] Memory for storing computer programs;

[0026] The processor is configured to execute the method for controlling access to financial sensitive data described in any of the above embodiments by executing the computer program.

[0027] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0028] The access control method and system for financial sensitive data provided by the embodiment of the present disclosure, the cloud server receives a data access request sent by an access client, the data access request is used to request to obtain target sensitive data and carries at least attribute information of the access user; based on the attribute information of the access user and the preset access control policy, the identity of the access user is verified to be legal; wherein the access control policy is an access control policy generated in advance based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes; after verifying the legality of the identity, the decrypted target sensitive data is sent to the access client. In this way, identity authentication is performed by using the access control policy generated by attribute-based encryption to the access control tree, ensuring that sensitive data can maintain confidentiality even if stored on an untrusted cloud server, because the cloud server cannot decrypt the data and cannot obtain the user's access permission information. The data owner can implement access control of data confidentiality on an untrusted cloud server, thereby improving the security and privacy of financial sensitive data. And by adopting the attribute-based encryption method, the system can flexibly define and manage the access rights of different users without significantly increasing the computational complexity. The scheme can efficiently support large-scale user and data management because it entrusts computationally intensive tasks to the cloud server for execution. In addition, by delegating computing processing tasks to cloud servers, the computing burden of data owners such as banks is reduced, thereby reducing the cost of bank computing equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0031] Figure 1 This is a flow chart of a method for controlling access to financial sensitive data according to an embodiment of the present disclosure;

[0032] Figure 2 This is a flow chart of a method for controlling access to financial sensitive data according to another embodiment of the present disclosure;

[0033] Figure 3 This is a schematic diagram of an access control system for financial sensitive data according to an embodiment of the present disclosure;

[0034] Figure 4 Schematic diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0036] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0037] It should be understood that, in the following, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0038] Currently, sensitive data such as electronic monthly statements of financial institutions such as banks are usually stored on cloud servers operated by third-party commercial providers. These cloud servers are usually not within the direct control or trust domain of the data owner, which means that the cloud service provider may not be fully trusted by the data owner. Therefore, it is crucial to ensure that these sensitive data remain confidential on untrusted servers.

[0039] In modern banking systems, it is not just the users within the bank who need to access specific data, but also external entities such as third-party auditors and regulators. These external entities may need to access electronic monthly statements and other sensitive information stored on the public cloud. Since data owners and storage servers are usually not in the same trust domain, traditional access control models are no longer applicable. In a public cloud environment, for example, data is managed by a third-party service provider, which means that data owners cannot fully control their storage and management environment. In addition, the multi-tenant nature of the cloud platform and the access requirements of external entities make it difficult for traditional role-based access control models to ensure data security and the accuracy of access control. Therefore, a more detailed and flexible access control approach is needed to improve the security of sensitive data.

[0040] Figure 1The flowchart of the access control method for financial sensitive data shown in the embodiment of the present disclosure is applicable to a cloud server, which may be a public cloud server, but is not limited thereto. The method may specifically include the following steps:

[0041] Step S101: receiving a data access request sent by an access client, where the data access request is used to request to obtain target sensitive data and carries at least attribute information of an accessing user.

[0042] Exemplarily, in one embodiment, the attribute information of the accessing user may include a plurality of different attributes, such as the department to which the user belongs, the type of resource accessed, the time of the request, etc. These attribute information may be obtained before the accessing client sends a data access request, but is not limited thereto. The target sensitive data may be an electronic monthly statement of a bank customer, but is not limited thereto. The accessing client may be a financial client software or a web client installed on any or a specific computer used within the bank. The cloud server receives a data access request sent by the accessing client through the network. The data access request is used to request to obtain the target sensitive data, such as indicating to obtain the electronic monthly statement of the target customer, and carries at least the attribute information of the accessing user.

[0043] Step S102: verifying whether the identity of the access user is legal based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy pre-generated based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes.

[0044] It should be noted that attribute-based encryption (ABE) implements one-to-many encryption and decryption. Unlike identity encryption, it is not necessary to know the identity information of the recipient every time decryption is performed. In ABE, the identity identifier is regarded as a series of attributes. When the attributes possessed by the user exceed the preset threshold described by the encryptor, the user can decrypt. In this embodiment, access rights can be determined by defining and evaluating user attributes, resource attributes and environmental conditions. Unlike traditional role-based or identity-based access control, this solution can achieve more fine-grained permission management and support dynamic and complex access control policies. This method is suitable for systems that need to handle a large number of users and diverse resources, such as sensitive information protection in data management in modern banking systems based on cloud computing. In this embodiment, access control decisions are determined based on a combination of multiple attributes, such as the user's department, the type of resource accessed, the request time, etc. This method makes the formulation of security policies more flexible and can adapt to new requirements without changing the underlying system architecture. In addition, it can also support complex logical conditions, making access control more scalable and adaptable.

[0045] Specifically, in this embodiment, the access control structure tree, i.e., the access control tree, can be defined according to specific business requirements, and then the structure of the access control tree for attribute-based access control can be constructed based on the Lagrange interpolation algorithm and the bilinear pairing algorithm. Decryption can be successful only when the attribute set satisfies the access structure. The access control mechanism using attribute-based encryption makes the definition and management of access rights more flexible, and can dynamically adjust permissions according to user attributes to meet diverse security and privacy requirements.

[0046] Step S103: After verifying the legitimacy of the identity, the decrypted target sensitive data is sent to the access client.

[0047] Exemplarily, after the access control policy based on the attribute-based encryption access control tree verifies the legality of the identity of the accessing user, the decrypted target sensitive data such as the electronic monthly statement can be sent to the access client for the accessing user to view.

[0048] The above scheme in this embodiment uses attribute-based encryption to generate an access control tree for identity authentication, ensuring that sensitive data can maintain confidentiality even if it is stored on an untrusted cloud server, because the cloud server cannot decrypt the data and cannot obtain the user's access permission information. Data owners can implement access control for data confidentiality on untrusted cloud servers, thereby improving the security and privacy of financial sensitive data. And by adopting attribute-based encryption, the system can flexibly define and manage access rights for different users without causing a significant increase in computational complexity. This scheme can efficiently support large-scale user and data management because it delegates computationally intensive tasks to cloud servers for execution. In addition, by delegating computational processing tasks to cloud servers for execution, the computational burden of data owners such as banks is reduced, reducing the cost of bank computing equipment.

[0049] In one embodiment, the access control tree includes at least a root node and multiple leaf nodes, each leaf node corresponds to an attribute, and the access control tree contains a mapping relationship between the attributes of each leaf node and the corresponding secret value and the secret value of the root node initially calculated.

[0050] In the access control tree, each leaf node is essentially a point on a two-dimensional plane, and each threshold node is a function on a two-dimensional plane. In the process of permission verification, a function can be determined based on a few points to construct the power of the threshold function of the current node, and then the number of known attributes (the number of known points on the plane) is used to reversely determine whether the function can be restored to obtain the secret value of the corresponding node until the root node, so as to determine whether it meets the permission control requirements. The secret value of the root node obtained by the initial calculation is also obtained based on the secret values ​​of other nodes.

[0051] Exemplarily, in an access control tree, the secret value (secrtetNum) of each leaf node is the node value corresponding to the attribute calculated by the data owner through the Lagrange interpolation algorithm and the bilinear pairing algorithm when constructing the access control structure. Obtaining the specific secret value of each leaf point can be used to infer the threshold function value of the threshold node of the previous layer until the secret value of the root node is obtained. Correspondingly, in step S102, verifying whether the identity of the access user is legal based on the attribute information of the access user and the preset access control policy may specifically include: based on the attribute information of the access user, the secret value of the root node calculated by traversing the nodes of the access control tree through the mapping relationship is equal to the secret value of the root node obtained by the initial calculation, which indicates that the identity of the access user is legal.

[0052] For example, based on the attribute information of the current access user, if the secret value of the root node calculated by the mapping relationship is equal to the secret value of the root node calculated initially, it means that the identity of the access user is legal; if they are not equal, it means that the identity of the access user is illegal. When the identity is legal, the decrypted target sensitive data such as the electronic monthly statement can be sent to the access client.

[0053] As the scale of modern banking information systems continues to grow, access control becomes increasingly complex to implement, and is accompanied by rising computational costs. In particular, the challenge of managing access rights becomes more significant when supporting a large number of users and large data sets. Traditional access control methods are effective enough when dealing with a small number of users and data, but when the number of users and the amount of data increase significantly, the limitations of these methods become apparent. Specifically, traditional role-based access control (RBAC) and other static access control models usually rely on predefined roles and permissions. As the number of users and the amount of data increase, system administrators need to constantly maintain and update roles and their associated permissions, which not only increases the workload but also may lead to the complexity of permission management. At the same time, each permission change may require reconfiguration of the system, resulting in potential security risks and operational burdens. In addition, the dynamic and diverse nature of data further exacerbates this problem. In modern enterprise environments, data is diverse, frequently updated, and access requirements are constantly changing. For example, as new businesses are launched, access rights may need to be set for new user groups and applications. In this case, it is difficult for traditional access control models to flexibly respond to these changes. Therefore, in order to meet these challenges, an efficient and scalable access control solution is adopted in this embodiment, which includes an access control policy using attribute-based encryption (ABE) technology, which can support fine-grained permission management and dynamically adjust user access rights without frequent reconfiguration of the system. ABE allows data owners to set a set of flexible attributes for data and control access rights through these attributes, thereby maintaining efficient permission management while supporting large-scale users and data.

[0054] Based on any of the above embodiments, Figure 2 As shown, in one embodiment, the method may further include the following steps:

[0055] Step S201: receiving a first encryption key and a first ciphertext sent by the data owner through the access client; the first ciphertext is obtained by the data owner encrypting the target sensitive data using a symmetric key, and the first encryption key is obtained by the data owner encrypting the symmetric key using his own first public key;

[0056] Step S202: After the identity is verified to be legitimate, a second encryption key is received, where the second encryption key is obtained by the data owner encrypting his own first private key using the second public key; the first private key and the first public key are pre-generated for the data owner;

[0057] Step S203: Re-encrypt the first encryption key based on the second encryption key to generate a second ciphertext, and return the second ciphertext and the first ciphertext to the access client, so that the access client uses the second private key to decrypt the second ciphertext to obtain the symmetric key, and decrypts the first ciphertext based on the symmetric key to obtain the target sensitive data; wherein the second private key and the second public key are pre-generated for the data consumer, i.e., the access user.

[0058] Exemplarily, the Bank (data owner) generates a first public key PK(b), a first private key SK(b) and a symmetric key K; and at the same time generates a second public key PK(c) and a second private key SK(c) for the consumer (data consumer).

[0059] Bank encrypts K with PK(b) to generate ciphertextK, and encrypts plaintext (such as target sensitive data) with K to generate ciphertext ciphertext2. Then, ciphertextK and ciphertext2 are uploaded to the public cloud server server.

[0060] When a consumer requests, for example, sensitive target data, it sends its attribute information to the cloud server. After the server authenticates the consumer according to the access control policy of the access control tree (generated using attribute-based encryption), the bank encrypts its own SK(b) with PK(c) and generates delKey for the server.

[0061] The server encrypts ciphertextK with delkey ​​to generate new_ciphertextK, which is re-encryption. The consumer takes new_ciphertextK and ciphertext2, decrypts new_ciphertextK with its own SK(c), obtains the symmetric key K, and then decrypts ciphertext2 with K to obtain the original data such as the target sensitive data.

[0062] The above process uses the proxy re-encryption (PRE) technology. Proxy re-encryption is an encryption technology based on the convertible nature of asymmetric encryption, which allows the data owner to authorize the proxy server to convert the data from one encrypted state to another without exposing the plaintext data or the original decryption key.

[0063] PRE includes two core functions: delegation and transferability. In delegation, the data owner generates a special re-encryption key, which is a combination of the data owner's private key and the new recipient's public key. The proxy uses this key to re-encrypt the encrypted data so that only the new recipient can decrypt it. The advantage of PRE is that the proxy cannot access the plaintext of the data or the decryption key, ensuring data privacy. In addition, transferability allows data to be securely transferred between multiple recipients through multiple re-encryptions, simplifying the complexity of data sharing. Therefore, PRE is suitable for use in cloud computing environments, and can flexibly manage and control access rights without exposing data.

[0064] In this embodiment, after the identity authentication is passed, the cloud server uses the proxy re-encryption technology to re-encrypt the encrypted key into a form that the requester can decrypt without exposing the private key of the data owner. The data requester then uses his own private key to decrypt the re-encrypted key to obtain the symmetric key used to decrypt the file.

[0065] This embodiment combines technologies such as attribute-based encryption (ABE) and proxy re-encryption (PRE) to ensure the security and privacy of sensitive data during transmission and / or storage, so as to further ensure the confidentiality and integrity of sensitive data. This solution can achieve precise access control for different users and external entities, further ensuring the security of data in the public cloud.

[0066] This embodiment uses attribute-based encryption and proxy re-encryption. First, it ensures that the data can maintain confidentiality even if it is stored on an untrusted cloud server, and the solution can efficiently support large-scale users and data management because it delegates computationally intensive tasks to the cloud server and only performs re-encryption operations when necessary. And by delegating the identity authentication and re-encryption processing to the public cloud, the data owner does not need to frequently participate in the data access process, reducing the demand for its computing resources. Secondly, the entire encryption and decryption process only involves the operation of the key, and does not directly encrypt the file, that is, the sensitive data itself, multiple times, which significantly reduces the computing and storage overhead of the cloud server. This can reduce the encryption cost of the public cloud server, and the entire encryption and decryption process is targeted at the key, and no excessive encryption and decryption processing is performed on the file itself, such as the file only needs to be encrypted once with the encrypted key.

[0067] In this example, by delegating identity authentication to a third-party public cloud server and using attribute-based encryption (ABE) and proxy re-encryption (PRE) technologies, secure transmission of sensitive data and flexible access control mechanisms are achieved. In this process, data owners do not need to directly participate in each identity authentication and key management, reducing operational complexity and management costs.

[0068] In one embodiment, a designated identifier may be set in one or more of the first public key, the first private key, the symmetric key, the second public key, and the second private key. By introducing a specific identifier into the user key, the solution can track the responsible user in the event of a key leak, further improving the security and manageability of the system.

[0069] In one embodiment, the attribute information of the accessing user includes a plurality of different attributes, and the plurality of different attributes can be pre-configured or adjusted and updated.

[0070] That is to say, the solution of this embodiment can dynamically adjust the user's access rights without frequently reconfiguring the system. ABE allows data owners to set a set of flexible attributes for data such as sensitive data and control access rights through these attributes, thereby maintaining efficient permission management while supporting large-scale users and data.

[0071] In one embodiment, the access control policy is executed by a binary package configured on the cloud server. A binary package is a pre-compiled software package that users only need to download and install to use. Binary packages do not require users to compile and can be used directly after downloading. The cloud service determines whether the requester meets the access conditions by executing an independent binary package. While feeding back the verification result, the binary package does not expose the specific access control number structure and attribute information, thereby further improving the security of the system.

[0072] In summary, the solution in this embodiment can provide a new technical solution for secure, scalable and fine-grained storage and access to sensitive data such as electronic monthly statements in a public cloud environment. This technical solution focuses on how data owners can achieve data confidentiality, fine-grained and scalable access control on untrusted cloud servers. It uses an attribute-based encryption (ABE) technology to achieve fine-grained access control on data, combined with proxy re-encryption (PRE) technology to ensure the security and privacy of data during transmission and storage. In addition, this technology reduces the computing burden and equipment costs of data owners by delegating computationally intensive tasks to cloud servers for execution.

[0073] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc. In addition, it is also easy to understand that these steps may be, for example, executed synchronously or asynchronously in multiple modules / processes / threads.

[0074] like Figure 3 As shown, the embodiment of the present disclosure provides an access control system for financial sensitive data, including:

[0075] A receiving module, used to receive a data access request sent by an access client, wherein the data access request is used to request to obtain target sensitive data and carries at least attribute information of the accessing user;

[0076] A judgment module, used to verify whether the identity of the access user is legal based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy pre-generated based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes;

[0077] The sending module is used to send the decrypted target sensitive data to the access client after verifying the legitimacy of the identity.

[0078] In one embodiment, the access control tree includes at least a root node and multiple leaf nodes, each leaf node corresponds to an attribute, and the access control tree contains a mapping relationship between the attributes of each leaf node and the corresponding secret value and the secret value of the root node initially calculated; the judgment module verifies whether the identity of the accessing user is legal based on the attribute information of the accessing user and a preset access control policy, including: based on the attribute information of the accessing user, if the secret value of the root node calculated by traversing the nodes of the access control tree through the mapping relationship is equal to the secret value of the root node initially calculated, it indicates that the identity of the accessing user is legal.

[0079] In one embodiment, the system may further include a re-encryption processing module for:

[0080] Receiving a first encryption key and a first ciphertext sent by the data owner through the access client; the first ciphertext is obtained by the data owner encrypting the target sensitive data using the symmetric key, and the first encryption key is obtained by the data owner encrypting the symmetric key using its own first public key;

[0081] After verifying the legitimacy of the identity, receiving a second encryption key, wherein the second encryption key is obtained by encrypting the first private key of the data owner using the second public key; the first private key and the first public key are pre-generated for the data owner;

[0082] The first encryption key is re-encrypted based on the second encryption key to generate a second ciphertext, and the second ciphertext and the first ciphertext are returned to the access client, so that the access client uses the second private key to decrypt the second ciphertext to obtain the symmetric key, and decrypts the first ciphertext based on the symmetric key to obtain the target sensitive data; wherein the second private key and the second public key are pre-generated for the data consumer, i.e., the access user.

[0083] In one embodiment, a designated identifier is set in one or more of the first public key, the first private key, the symmetric key, the second public key and the second private key.

[0084] In one embodiment, the attribute information of the accessing user includes a plurality of different attributes, and the plurality of different attributes can be pre-configured or adjusted and updated.

[0085] In one embodiment, the target sensitive data includes at least electronic monthly statements of bank customers.

[0086] In one embodiment, the cloud server comprises a public cloud server; and / or, the access control policy is executed by a binary package configured on the cloud server.

[0087] Regarding the system in the above embodiment, the specific manner in which each module performs operations and the corresponding technical effects brought about have been described in detail in the embodiment of the method, and will not be elaborated here.

[0088] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of a module or unit described above can be further divided into multiple modules or units for concretization. The components displayed as modules or units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. Those of ordinary skill in the art can understand and implement it without paying creative work.

[0089] The embodiments of the present disclosure also provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for controlling access to financial sensitive data described in any one of the embodiments above is implemented.

[0090] Exemplarily, the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0091] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0092] The present disclosure also provides an electronic device, including a processor and a memory, wherein the memory is used to store a computer program, wherein the processor is configured to execute the access control method for financial sensitive data in any of the above embodiments by executing the computer program.

[0093] Refer to the following Figure 4 The electronic device 600 according to this embodiment of the present invention is described. Figure 4 The electronic device 600 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0094] like Figure 4 As shown, the electronic device 600 is represented in the form of a general computing device such as a cloud server. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0095] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps according to various exemplary embodiments of the present invention described in the above method embodiment section of this specification. For example, the processing unit 610 can perform the following steps: Figure 1 The steps of the method shown in .

[0096] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0097] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0098] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0099] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0100] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to perform the access control method for financial sensitive data according to the above-mentioned embodiments of the implementation of the present disclosure. Steps.

[0101] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0102] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for controlling access to financial sensitive data, characterized in that: The method is applied to a cloud server and includes: Receiving a data access request sent by an access client, wherein the data access request is used to request to obtain target sensitive data and carries at least attribute information of the access user; Verifying whether the identity of the access user is legitimate based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy generated in advance based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes; After verifying the legitimacy of the identity, the decrypted target sensitive data is sent to the access client.

2. The method according to claim 1, characterized in that The access control tree includes at least a root node and a plurality of leaf nodes, each leaf node corresponds to an attribute, and the access control tree includes a mapping relationship between the attribute of each leaf node and the corresponding secret value and the secret value of the root node obtained by initial calculation; The verifying whether the identity of the access user is legal based on the attribute information of the access user and the preset access control policy includes: Based on the attribute information of the access user, if the secret value of the root node calculated by traversing the nodes of the access control tree through the mapping relationship is equal to the secret value of the root node obtained by the initial calculation, it means that the identity of the access user is legal.

3. The method according to claim 1, characterized in that The method further includes: Receiving a first encryption key and a first ciphertext sent by the data owner through the access client; the first ciphertext is obtained by the data owner encrypting the target sensitive data using the symmetric key, and the first encryption key is obtained by the data owner encrypting the symmetric key using its own first public key; After verifying the legitimacy of the identity, receiving a second encryption key, wherein the second encryption key is obtained by encrypting the first private key of the data owner using the second public key; the first private key and the first public key are pre-generated for the data owner; The first encryption key is re-encrypted based on the second encryption key to generate a second ciphertext, and the second ciphertext and the first ciphertext are returned to the access client, so that the access client uses the second private key to decrypt the second ciphertext to obtain the symmetric key, and decrypts the first ciphertext based on the symmetric key to obtain the target sensitive data; wherein the second private key and the second public key are pre-generated for the data consumer, i.e., the access user.

4. The method according to claim 3, characterized in that: A designated identifier is set in one or more of the first public key, the first private key, the symmetric key, the second public key and the second private key.

5. The method according to any one of claims 1 to 4, characterized in that: The attribute information of the accessing user includes a plurality of different attributes, and the plurality of different attributes can be pre-configured or adjusted and updated.

6. The method according to any one of claims 1 to 4, characterized in that: The target sensitive data at least includes the electronic monthly statements of bank customers.

7. The method according to any one of claims 1 to 4, characterized in that: The cloud server includes a public cloud server; and / or the access control policy is executed by a binary package configured on the cloud server.

8. An access control system for financial sensitive data, characterized in that: include: A receiving module, used to receive a data access request sent by an access client, wherein the data access request is used to request to obtain target sensitive data and carries at least attribute information of the accessing user; A judgment module, used to verify whether the identity of the access user is legal based on the attribute information of the access user and a preset access control policy; wherein the access control policy is an access control policy pre-generated based on attribute-based encryption, and the access control policy includes a constructed access control tree based on multiple attributes; The sending module is used to send the decrypted target sensitive data to the access client after verifying the legitimacy of the identity.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access control method for financial sensitive data described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as Memory for storing computer programs; Wherein, the processor is configured to execute the access control method for financial sensitive data according to any one of claims 1 to 7 by executing the computer program.

Images