Data dictionary security component

Abstract

The invention relates to a data dictionary security component. The security component comprises an encryption and decryption component, a desensitization component and a tamper-proof component. The encryption and decryption code generation function, the desensitization code generation function and the tamper-proof function are respectively realized. According to the data dictionary security component, security measures of encryption and decryption, desensitization and tamper-proofing are combined with a data dictionary to form a unified data dictionary specification, including an encryption and decryption algorithm, a desensitization rule and a tamper-proofing algorithm. When a low-code development platform and other application systems are combined with the data dictionary for use, corresponding component application codes and configurations are generated by quoting the security component according to the data field configuration, so that the functions of encryption and decryption, desensitization, tampering prevention and the like of the data field can be realized. When the service runs, the related security attributes of the data dictionary fields can be dynamically modified and allocated, and the business application using the component can use the latest data dictionary strategy in real time, so that some business adjustment or security requirements can be quickly adjusted and take effect in real time.

Description

Technical Field

[0001] The present invention relates to the technical field of data security components, and in particular to a data dictionary security component. Background Art

[0002] The data dictionary item service is to standardize the definition of each data item of each application and development platform, including field naming, type, length, regularization, desensitization, encryption, etc. Since the data dictionary item management of each application system is currently decentralized, the overall operation and management are complex and difficult to control, and a set of fully functional data dictionary item services is urgently needed to be provided to each application and development platform.

[0003] At present, low-code development platforms and other application systems lack security configuration and function implementation when using data dictionary fields, which is mainly reflected in data encryption and decryption, desensitization, security requirements, and database tamper-proofing. Due to business needs and security requirements, when these functions need to be added, each system needs to develop its own functions and cannot be associated with the data dictionary specifications.

[0004] At the same time, the application system is independently developed and implemented in terms of encryption, desensitization, and tamper-proofing, and has no connection or application with the data dictionary standards and specifications. Summary of the invention

[0005] In order to overcome the above-mentioned defects in the existing data dictionary item service security configuration technology, the present invention proposes a new data dictionary security component.

[0006] The present invention adds security-related identifiers to the data dictionary specification, such as encryption and decryption, desensitization, anti-tampering, security and other configurations, to form a unified standard specification for the dictionary; the dictionary application part is divided into two parts: development state and operation state. In terms of development state, corresponding technical components (encryption and decryption, desensitization, anti-tampering, etc.) are provided. This part of the technical components is a microservice development component, which is plug-and-play. The component provides encryption and decryption annotations (configurable and extensible encryption algorithms), desensitization annotations (configurable and extensible desensitization rules), anti-tampering annotations (configurable and extensible algorithms) and implementation functions. The low-code development platform and application system can generate configuration codes corresponding to the components according to the data dictionary specification, so as to achieve the functional requirements of encryption and decryption and other security aspects. In terms of operation state, when the service is running, the data dictionary configuration can be dynamically deployed, such as modifying the security level, desensitization, etc., and the modified data can be published to the dictionary service cache middleware. The application using this component can read the cached data in real time and take effect according to the latest strategy, so as to achieve the effect of dynamically configuring the security attributes of the field.

[0007] In the data dictionary security component of the present invention, security requirements and encryption, decryption, and anti-tampering security measures are combined with the data dictionary to form a unified data standard specification, including encryption and decryption algorithms, desensitization rules, and anti-tampering algorithms. When the low-code development platform and other application systems are used in combination with the data dictionary, the technical components are referenced, and the corresponding component application code and configuration are generated according to the data field configuration to implement encryption, desensitization, and anti-tampering functions of the data field. When the service is running, the relevant security attributes of the data dictionary fields can be dynamically modified and deployed. Business applications using this component can use the latest data dictionary policies in real time to ensure that certain business adjustments or security requirements can be quickly adjusted and take effect in real time.

[0008] The data dictionary security component provided by the present invention is divided into development state and operation state. The development state is used in the development environment and is used in development. The operation state data is the data used in real time by various application systems in the production environment. The operation and maintenance function needs to manage this part of data so that the development data and production data can be well connected and used. The data dictionary security component of the present invention includes the following functions: Data packaging: Select the data dictionary data that has been put on the shelf, package it into the specified data format and download it for use in production.

[0009] Data production: Use the packaged data package to import and update database data and push it to the cache.

[0010] Data production records: record the data information of each production, including package information, specific production logs (including dictionary keyword information), production success and failure records.

[0011] Data publishing: Select the dictionary data that has been put on the shelves and push it back to the cache, that is, refresh the cached data. This part can be filtered by category.

[0012] Specifically, the present invention provides a data dictionary security component, such as Figure 5 As shown, the data dictionary security component includes: encryption and decryption component, desensitization component, and anti-tampering component; the above components are used to implement the following functions respectively: The encryption and decryption component implements the encryption and decryption code generation function: the developer selects the entity field with associated data dictionary information, and generates the corresponding encryption and decryption code based on the security and encryption and decryption information of the entity field; when the encryption and decryption function is applied to the entity field, its annotation is provided by the development framework component and can be used by the plug-in; The desensitizing component implements the desensitizing code generation function: a custom class annotation is added to the method of the desensitizing component in a similar way to AOP-oriented programming. The developer selects the entity field with associated data dictionary information, and generates the corresponding desensitizing code based on the security and desensitizing information of the entity field. When the desensitizing function is applied to the entity field, its annotation is provided by the development framework component and can be used by the plug-in. The anti-tampering component implements the anti-tampering function: The anti-tampering component corresponds to the anti-tampering identification field of the data dictionary. It performs anti-tampering processing according to the configuration information algorithm before entering the database, saves the data summary, and compares it with the data summary configured when entering the database during query. If there is a mismatch, it indicates that the data has been modified and needs to be re-entered or discarded according to the business.

[0013] Furthermore, in the data dictionary security component of the present invention, the processing flow of the encryption and decryption component includes: the front-end plaintext field is encrypted according to the configuration information before being put into storage, and is put into storage after the processing is completed. When querying, it is decrypted according to the configuration information, and is returned to the specific business process after the processing is completed.

[0014] Furthermore, in the data dictionary security component of the present invention, the processing flow of the desensitization component includes: (1) Define the types of desensitization; (2) Customize annotations of classes or methods and annotations of fields; (3) Define the format of returned data; (4) Rules for implementing desensitization; (5) Use annotations on fields and classes to declare desensitized fields; (6) Test the call interface and obtain the results.

[0015] Furthermore, in the data dictionary security component of the present invention, during the execution of the processing flow of the desensitizing component, desensitization processing is performed according to the configuration information when the log is printed. According to the national data security specifications, fields with a security level greater than or equal to level three must also be processed according to the desensitization requirements.

[0016] Furthermore, in the data dictionary security component of the present invention, the technology used in the processing flow of the anti-tampering component includes: (1) Digital signature technology; (2) Use hash algorithm to find the hash value; (3) Sign the hash value; (4) Public key verification.

[0017] Furthermore, the data dictionary security component of the present invention also includes data dictionary specifications with encryption, decryption, desensitization, and tamper-proof security identification added; The data dictionary security component includes a development state and a running state, wherein: The development state provides encryption and decryption components, desensitization components, and anti-tampering components. All of the above components are microservice development components. Each component provides encryption and decryption annotations (configurable and extendable encryption algorithms), desensitization annotations (configurable and extendable desensitization rules), anti-tampering annotations (configurable and extendable algorithms) and implementation functions. The low-code development platform and application system generate configuration codes corresponding to the components in accordance with the data dictionary specifications to implement the corresponding functions. The running state includes dynamically adjusting the data dictionary configuration when the service is running, modifying the encryption and decryption components, desensitizing components, and anti-tampering component configurations, and publishing the modified configuration information to the dictionary service cache middleware. Applications using this component read the cached data in real time and implement the latest policy to realize the function of dynamically configuring field security attributes.

[0018] Furthermore, the data dictionary security component of the present invention also includes the following functions: Data packaging: select the data dictionary data that has been put on the shelf, package it into the specified data format and download it for use in production; Data production: Use packaged data packages to import and update database data and push it to the cache; Data production record: record the data information of each production; Data publishing: Select the dictionary data that has been put on the shelves, push it back to the cache, and refresh the cached data.

[0019] Furthermore, in the data dictionary security component of the present invention, the data information recorded in the data commissioning record includes but is not limited to: package information, commissioning log (including dictionary keyword information), commissioning success and failure records.

[0020] In addition, the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the function of the above-mentioned data dictionary security component is realized.

[0021] In summary, the data dictionary security component of the present invention combines the security measures of encryption, desensitization, and tamper-proofing with the data dictionary to form a unified data dictionary specification, including encryption and decryption algorithms, desensitization rules, and tamper-proofing algorithms. When the low-code development platform and other application systems are used in conjunction with the data dictionary, by referencing the security component of the present invention and generating the corresponding component application code and configuration according to the data field configuration, the encryption, desensitization, and tamper-proofing functions of the data field can be realized. When the service is running, the relevant security attributes of the data dictionary fields can be dynamically modified and deployed. Business applications using this component can use the latest data dictionary policies in real time, ensuring that certain business adjustments or security requirements can be quickly adjusted and take effect in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the description of the present invention. Obviously, the following drawings are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 This is a functional processing flow chart of the encryption and decryption components of the data dictionary security component of the present invention.

[0024] Figure 2 This is a code example diagram of the data dictionary security component calling the dictionary encryption and decryption component method of the present invention.

[0025] Figure 3 This is a functional processing flow chart of the desensitizing component of the data dictionary security component of the present invention.

[0026] Figure 4 This is a functional processing flow chart of the tamper-proof component of the data dictionary security component of the present invention.

[0027] Figure 5 A schematic diagram of the composition architecture of the data dictionary security component of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and the present invention can also be implemented or applied through other different specific implementation methods. The details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0029] At the same time, it should be understood that the protection scope of the present invention is not limited to the specific embodiments described below; it should also be understood that the terms used in the embodiments of the present invention are for describing specific embodiments rather than for limiting the protection scope of the present invention.

[0030] Embodiment: A data dictionary security component Data dictionary data is divided into development state and operation state. The development state is used in the development environment and used in development. The operation state data is the data used in real time by various application systems in the production environment. The operation and maintenance function needs to manage this part of data so that the development data and production data can be well connected and used.

[0031] The encryption and decryption code generation function is to generate the corresponding entity code after the developer selects the corresponding entity field (which has been associated with the data dictionary information) according to the field's security and encryption and decryption information. The entity field applies the encryption and decryption function, and its annotations are provided by the development framework component, which can be used by the plug-in. The overall operation process is: select the entity field information, click Generate Code, and generate the corresponding encryption and decryption code.

[0032] The encryption and decryption component function processing flow is as follows Figure 1 shown. Call the dictionary encryption and decryption component method, the code example is as follows Figure 2 shown.

[0033] The processing flow mainly includes encrypting the front-end plaintext fields according to the configuration information before entering the warehouse, entering the warehouse after processing, and decrypting them according to the configuration information when querying, and returning them to the specific business process.

[0034] The desensitizing code generation function adopts a method similar to AOP-oriented programming. A custom class annotation is added to the method of the desensitizing component. After the developer selects the corresponding entity field (which has associated data dictionary information), the corresponding entity code is generated according to the security and desensitizing information of the field. The desensitizing function is applied to the entity field. The annotation is provided by the development framework component and can be used by the plug-in.

[0035] The processing flow diagram of the desensitization component function is as follows Figure 3 shown.

[0036] The main implementation steps include: (1) defining the type of desensitization; (2) customizing the annotations of classes or methods and fields; (3) defining the format of returned data; (4) implementing desensitization rules; (5) using annotations on fields and classes to declare desensitized fields; and (6) testing the calling interface to obtain results.

[0037] When processing the desensitization function, the desensitization is performed according to the configuration information when the log is printed. According to the national data security specification, fields with a security level greater than or equal to level 3 also need to be processed according to the desensitization requirements. The data desensitization function revolves around the vertical layer of the entire data, and this function is based on the unified log processing function.

[0038] The anti-tampering component is the anti-tampering identification field of the corresponding data dictionary. It is processed according to the configuration information algorithm before entering the database and the data summary is saved. When querying, it is compared with the calculated summary configured when entering the database. If there is a mismatch, the data has been modified and needs to be re-entered or discarded according to the business.

[0039] The processing flow of the tamper-proof component function is as follows Figure 4 shown.

[0040] The technical implementation involved in the anti-tampering component mainly includes: (1) digital signature technology; (2) hash algorithm to obtain hash value; (3) signing the hash value; (4) public key verification. Financial data security classification: Based on the affected objects and the degree of impact after the data security of financial institutions is compromised, the financial data security level is divided into Level 5, Level 4, Level 3, Level 2, and Level 1 from high to low.

[0041] When defining the security level of a field, the data dictionary defines the security level according to national standards. According to the data field configuration, the corresponding component application code and configuration are generated to meet the requirements of data security protection.

[0042] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any technician familiar with the profession can make some changes or modifications to the technical contents disclosed above without departing from the scope of the technical solution of the present invention to obtain equivalent embodiments of equivalent changes. However, any simple modification, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A data dictionary security component, characterized in that: The data dictionary security component includes: encryption and decryption component, desensitization component, and anti-tampering component; the above components are used to implement the following functions respectively: The encryption and decryption component implements the encryption and decryption code generation function: the developer selects the entity field with associated data dictionary information, and generates the corresponding encryption and decryption code based on the security and encryption and decryption information of the entity field; The desensitizing component implements the desensitizing code generation function: a custom class annotation is added to the method of the desensitizing component using the programming-oriented AOP method. The developer selects the entity field with associated data dictionary information and generates the corresponding desensitizing code based on the security and desensitizing information of the entity field. The anti-tampering component implements the anti-tampering function: The anti-tampering component corresponds to the anti-tampering identification field of the data dictionary. It performs anti-tampering processing according to the configuration information algorithm before entering the database, saves the data summary, and compares it with the data summary configured when entering the database during query. If there is a mismatch, it indicates that the data has been modified and needs to be re-entered or discarded according to the business.

2. The data dictionary security component according to claim 1, characterized in that: The processing flow of the encryption and decryption component includes: the front-end plaintext field is encrypted according to the configuration information before being put into storage, and is put into storage after the processing is completed. When querying, it is decrypted according to the configuration information, and is returned to the specific business process after the processing is completed.

3. The data dictionary security component according to claim 1, characterized in that: The processing flow of the desensitization component includes: (1) Define the types of desensitization; (2) Customize annotations of classes or methods and annotations of fields; (3) Define the format of returned data; (4) Rules for implementing desensitization; (5) Use annotations on fields and classes to declare desensitized fields; (6) Test the call interface and obtain the results.

4. The data dictionary security component according to claim 3, characterized in that: During the execution of the desensitizing component processing flow, desensitizing is performed according to the configuration information when the log is printed. According to the national data security specifications, fields with a security level greater than or equal to level three must also be processed according to the desensitizing requirements.

5. The data dictionary security component according to claim 1, characterized in that: The technologies used in the processing flow of the tamper-proof component include: (1) Digital signature technology; (2) Use hash algorithm to find the hash value; (3) Sign the hash value; (4) Public key verification.

6. The data dictionary security component according to claim 1, characterized in that: The data dictionary security component includes a data dictionary specification with encryption, desensitization, and anti-tampering security identification added; The data dictionary security component includes a development state and a running state, wherein: The development state provides encryption and decryption components, desensitization components, and anti-tampering components. All of the above components are microservice development components. Each component provides encryption and decryption annotations, desensitization annotations, anti-tampering annotations, and implementation functions. The low-code development platform and application system generate configuration codes corresponding to the components in accordance with the data dictionary specifications to implement the corresponding functions. The running state includes dynamically adjusting the data dictionary configuration when the service is running, modifying the encryption and decryption components, desensitizing components, and anti-tampering component configurations, and publishing the modified configuration information to the dictionary service cache middleware. Applications using this component read the cached data in real time and implement the latest policy to realize the function of dynamically configuring field security attributes.

7. The data dictionary security component according to claim 1, characterized in that: The data dictionary security component also includes the following functions: Data packaging: select the data dictionary data that has been put on the shelf, package it into the specified data format and download it for use in production; Data production: Use packaged data packages to import and update database data and push it to the cache; Data production record: record the data information of each production; Data publishing: Select the dictionary data that has been put on the shelves, push it back to the cache, and refresh the cached data.

8. The data dictionary security component according to claim 7, characterized in that: The data information recorded in the data production record includes: package information, production log, and production success and failure records.

9. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the function of the data dictionary security component described in any one of claims 1 to 8.

Images