Data exchange method and device based on security mark

Abstract

The invention relates to the technical field of computer information security, and discloses a data exchange method and device based on security marks. The method comprises the following steps: S10, sending a first data resource request; s11, performing security mark check on the first data resource request, if a security mark exists, turning to S12, otherwise, terminating access; s12, acquiring a marking rule from a marking strategy center module, judging whether a data flow from the second data exchange main body to the first data exchange main body accords with a data flow direction, if so, turning to S13, and otherwise, terminating access; s13, sending a first read operation request; s14, a second marking strategy execution module performs security mark check on the first read operation request, if a security mark exists, the step S15 is executed, and otherwise, access is terminated; s15, acquiring a marking rule from a marking strategy center module, judging whether the first read operation is allowed or not, if yes, turning to S16, and otherwise, terminating access; and S16, the second data exchange subject sends the second object data resource to the first data exchange subject.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security, and in particular to a data exchange method and device based on security marking. Background Art

[0002] Data exchange is a process of sharing data resources between different information systems in order to meet the needs of data resource sharing and interaction. It adopts corresponding technologies based on specific principles. Due to the sensitivity of data, in some scenarios, especially those involving personal privacy or related confidential data, it is necessary to strictly control the scope of exchange during the data exchange process to prevent the leakage of sensitive data and cause serious impact or loss.

[0003] Currently, there are limited methods for security control in data exchange. If it is within a single operating system, the read and write properties of the data can be used to limit access by different subject users or processes, and encryption technology can be used to store the data securely. If it is in a network environment, the business protocol access control carried by the data can be used to achieve restricted data exchange and circulation. However, there are some limitations to the current methods, especially when it comes to network transmission.

[0004] During network transmission, network elements (such as IP addresses, ports, protocol features, etc.) can usually be used to control the flow of data. However, this method cannot perform fine-grained control and audit based on the security attributes of the data, and thus cannot effectively control the data propagation path, nor can it accurately prevent data from flowing to unauthorized network domains or hosts. Therefore, how to achieve fine-grained control of data exchange and effectively improve the security of exchange has become an urgent problem to be solved. Summary of the invention

[0005] The present invention provides a data exchange method and device based on security marking, which can solve the problems in the prior art.

[0006] The present invention provides a data exchange method based on security marking, wherein the method comprises:

[0007] S10, the first data exchange subject sends a first data resource request, where the first data resource request is used to request to obtain a second object data resource;

[0008] S11, the first tag policy execution module performs a security tag check on the first data resource request, and if the first data resource request has a security tag, the process goes to S12, otherwise the access is terminated, wherein the security tag includes the security attribute of the first data exchange subject;

[0009] S12, the first marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the data flow from the second data exchange subject to the first data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S13, otherwise terminate the access;

[0010] S13, the second data exchange subject sends a first read operation request, where the first read operation request is used to request to read a second object data resource;

[0011] S14, the second marking policy execution module performs a security marking check on the first read operation request, and if the first read operation request has a security marking, the process goes to S15, otherwise the access is terminated, wherein the security marking includes the security attribute of the second data exchange subject;

[0012] S15, the second marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the first read operation is allowed according to the security mark and the marking rule. If yes, go to S16, otherwise terminate the access;

[0013] S16: The second data exchange subject sends the second object data resource to the first data exchange subject.

[0014] The present invention also provides a data exchange method based on security marking, wherein the method comprises:

[0015] S20, the second data exchange subject sends a second data resource request, where the second data resource request is used to request to obtain the first object data resource;

[0016] S21, the first tag policy execution module performs a security tag check on the second data resource request, and if the second data resource request has a security tag, the process goes to S22, otherwise the access is terminated, wherein the security tag includes a security attribute of the second data exchange subject;

[0017] S22, the first marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S23, otherwise terminate the access;

[0018] S23, the first data exchange subject sends a second read operation request, where the second read operation request is used to request to read the first object data resource;

[0019] S24, the third marking policy execution module performs a security marking check on the second read operation request, and if the second read operation request has a security marking, the process goes to S25, otherwise the access is terminated, wherein the security marking includes the security attribute of the first data exchange subject;

[0020] S25, the third marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the second read operation is allowed according to the security mark and the marking rule. If yes, go to S26, otherwise terminate the access;

[0021] S26: The first data exchange subject sends the first object data resource to the second data exchange subject.

[0022] Preferably, the security attributes include a security level and a category of accessible resources.

[0023] Preferably, judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule in S12 includes:

[0024] If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met;

[0025] If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction;

[0026] In S22, judging whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the mark rule includes:

[0027] If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met;

[0028] If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

[0029] Preferably, judging whether the first read operation is allowed according to the security mark and the mark rule in S15 includes:

[0030] If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation;

[0031] If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed;

[0032] In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes:

[0033] If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation;

[0034] If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

[0035] The present invention also provides a data exchange device based on security tags, wherein the device includes a tag policy center module and a tag policy execution module, the tag policy execution module includes a first tag policy execution module and a second tag policy execution module, wherein:

[0036] The tag policy center module is used to configure security tags and tag rules;

[0037] The first marking policy execution module is used to perform a security tag check on a first data resource request sent by a first data exchange subject, where the first data resource request is used to request to obtain a second object data resource. If the first data resource request does not have a security tag, access is terminated. Otherwise, a tag rule is obtained from a tag policy center module, and a data flow from the second data exchange subject to the first data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, access is terminated, where the security tag includes a security attribute of the first data exchange subject.

[0038] The second marking policy execution module is used to perform a security tag check on the first read operation request sent by the second data exchange subject when it complies with the data flow direction. The first read operation request is used to request to read the second object data resource. If the first read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module. According to the security tag and the marking rule, it is determined whether the first read operation is allowed. If not, the access is terminated. If so, the second object data resource is sent to the first data exchange subject through the second data exchange subject, wherein the security tag includes the security attributes of the second data exchange subject.

[0039] The present invention also provides a data exchange device based on security marking, wherein the device includes a marking policy center module and a marking policy execution module, the marking policy execution module includes a first marking policy execution module and a third marking policy execution module, wherein:

[0040] The tag policy center module is used to configure security tags and tag rules;

[0041] The first marking policy execution module is used to perform a security tag check on the second data resource request sent by the second data exchange subject, where the second data resource request is used to request to obtain the first object data resource. If the second data resource request does not have a security tag, the access is terminated. Otherwise, a tag rule is obtained from the marking policy center module, and a data flow from the first data exchange subject to the second data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, the access is terminated, where the security tag includes the security attribute of the second data exchange subject.

[0042] The third marking policy execution module is used to perform a security tag check on the second read operation request sent by the first data exchange subject when it complies with the data flow direction. The second read operation request is used to request to read the first object data resource. If the second read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module, and whether the second read operation is allowed is determined based on the security tag and the marking rule. If not, the access is terminated. If so, the first object data resource is sent to the second data exchange subject through the first data exchange subject, wherein the security tag includes the security attributes of the first data exchange subject.

[0043] Preferably, the security attributes include a security level and a category of accessible resources.

[0044] Preferably, judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule includes:

[0045] If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met;

[0046] If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction;

[0047] Judging whether the data flow from the first data exchange subject to the second data exchange subject complies with the data flow direction according to the security mark and the mark rule includes:

[0048] If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met;

[0049] If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

[0050] Preferably, judging whether the first read operation is allowed according to the security mark and the mark rule in S15 includes:

[0051] If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation;

[0052] If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed;

[0053] In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes:

[0054] If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation;

[0055] If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

[0056] Through the above technical solution, a data exchange method and device based on security tags can be provided. The method and device can not only build a security tag operating environment based on a general operating system kernel, but also realize data exchange based on security tags during network data transmission, thereby effectively solving the problem of secure exchange of data within the system or during network transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The included drawings are used to provide a further understanding of the embodiments of the present invention, which constitute a part of the specification, are used to illustrate the embodiments of the present invention, and together with the text description, explain the principles of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 A flowchart of a data exchange method based on a security tag according to an embodiment of the present invention is shown;

[0059] Figure 2 An example diagram showing a security mark format according to an embodiment of the present invention;

[0060] Figure 3 An example diagram of a data access security model based on security tags according to an embodiment of the present invention is shown;

[0061] Figure 4 A schematic diagram of a data exchange device based on a security mark according to an embodiment of the present invention is shown;

[0062] Figure 5 A diagram showing an implementation diagram of a data exchange method based on a security mark at the operating system level according to an embodiment of the present invention;

[0063] Figure 6 A flowchart of a data exchange method based on a security mark at the operating system level according to an embodiment of the present invention is shown;

[0064] Figure 7 A diagram showing an implementation of a data exchange method based on a security tag at the network data transmission level according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0065] It should be noted that, in the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present invention and its application or use. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0067] Unless otherwise specifically stated, the relative arrangement of the parts and steps described in these embodiments, numerical expressions and numerical values ​​do not limit the scope of the present invention. At the same time, it should be understood that, for ease of description, the sizes of the various parts shown in the accompanying drawings are not drawn according to the actual proportional relationship. The technology, method and equipment known to ordinary technicians in the relevant field may not be discussed in detail, but in appropriate cases, the technology, method and equipment should be regarded as a part of the authorization specification. In all examples shown and discussed here, any specific value should be interpreted as being merely exemplary, rather than as a limitation. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once a certain item is defined in an accompanying drawing, it does not need to be further discussed in subsequent drawings.

[0068] Figure 1 A flow chart of a data exchange method based on a security tag according to an embodiment of the present invention is shown.

[0069] like Figure 1 As shown, an embodiment of the present invention provides a data exchange method based on a security tag, wherein the method includes:

[0070] S10, a first data exchange subject (data exchange subject 1) sends a first data resource request, where the first data resource request is used to request to obtain a second object data resource (object data resource 2);

[0071] That is, when data exchange subject 1 needs object data resource 2, a data resource request is initiated to data exchange subject 2.

[0072] S11, the first tag policy execution module performs a security tag check on the first data resource request. If the first data resource request has a security tag, the process goes to S12, otherwise the access is terminated (i.e., the data exchange subject 1 does not have a security tag, and the access is terminated), wherein the security tag (the security tag of the first data resource request) includes the security attribute of the first data exchange subject;

[0073] S12, the first marking policy execution module (marking policy execution module 3) obtains the marking rule from the marking policy center module, and determines whether the data flow from the second data exchange subject to the first data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S13, otherwise terminate the access;

[0074] Among them, the comparison strategy of the marking rule can be determined according to the marking security model.

[0075] S13, the second data exchange subject (data exchange subject 2) sends a first read operation request, where the first read operation request is used to request to read a second object data resource;

[0076] Specifically, when the data flow direction is met, the first data resource request reaches the second data exchange subject, and then the second data exchange subject sends a first read operation request.

[0077] S14, the second marking policy execution module (marking policy execution module 2) performs a security tag check on the first read operation request. If the first read operation request has a security tag, the process goes to S15, otherwise the access is terminated (i.e., the data exchange subject 2 has not set a security tag, and the read operation is terminated), wherein the security tag (the security tag of the first read operation request) includes the security attribute of the second data exchange subject;

[0078] S15, the second marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the first read operation is allowed according to the security mark and the marking rule. If yes, it goes to S16, otherwise it terminates the access (terminates the read operation);

[0079] S16: The second data exchange subject sends the second object data resource to the first data exchange subject.

[0080] In this way, the flow from the second object data resource 2 to the first data exchange subject 1 can be completed.

[0081] Through the above technical solution, a data exchange method and device based on security tags can be provided. The method and device can not only build a security tag operating environment based on a general operating system kernel, but also realize data exchange based on security tags during network data transmission, thereby effectively solving the problem of secure exchange of data within the system or during network transmission.

[0082] Continue to refer Figure 1 The embodiment of the present invention further provides a data exchange method based on a security tag, wherein the method comprises:

[0083] S20, the second data exchange subject (data exchange subject 2) sends a second data resource request, where the second data resource request is used to request to obtain the first object data resource (object data resource 1);

[0084] That is, when the data exchange subject 2 needs the object data resource 1, it will initiate a request for the data resource to the data exchange subject 1.

[0085] S21, the first tag policy execution module performs a security tag check on the second data resource request. If the second data resource request has a security tag, the process goes to S22, otherwise the access is terminated (i.e., the data exchange subject 2 does not have a security tag, and the access is terminated), wherein the security tag (the security tag of the second data resource request) includes the security attribute of the second data exchange subject;

[0086] S22, the first marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S23, otherwise terminate the access;

[0087] S23, the first data exchange subject sends a second read operation request, where the second read operation request is used to request to read the first object data resource;

[0088] Specifically, when the data flow direction is met, the second data resource request reaches the first data exchange subject, and then the first data exchange subject sends a second read operation request.

[0089] S24, the third marking policy execution module (marking policy execution module 1) performs a security tag check on the second read operation request. If the second read operation request has a security tag, the process goes to S25, otherwise the access is terminated (i.e., if the data exchange subject 1 does not have a security tag set, the read operation is terminated), wherein the security tag (the security tag of the second read operation request) includes the security attribute of the first data exchange subject;

[0090] S25, the third marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the second read operation is allowed according to the security mark and the marking rule. If yes, it goes to S26, otherwise it terminates the access (terminates the operation);

[0091] S26: The first data exchange subject sends the first object data resource to the second data exchange subject.

[0092] In this way, the flow from the first object data resource 1 to the second data exchange subject 2 can be completed.

[0093] Through the above technical solution, a data exchange method and device based on security tags can be provided. The method and device can not only build a security tag operating environment based on a general operating system kernel, but also realize data exchange based on security tags during network data transmission, thereby effectively solving the problem of secure exchange of data within the system or during network transmission.

[0094] According to an embodiment of the present invention, the security attributes include a security level and a category of accessible resources.

[0095] In the present invention, a security tag is a label bound to a data resource and a data exchange subject, which assigns the security attributes of the data resource and the data exchange subject. The security tag can represent the information sensitivity of a subject or object and the sum of related security information. The security tag definition of the present invention can be designed based on the FIPS188 type7 format, and the specific format is as follows: Figure 2 shown. Figure 2 The format of the safety mark shown in is shown in Table 1 below.

[0096] Table 1 Safety marking format description

[0097]

[0098] In the present invention, the tag-based general data access control model can be as follows Figure 3 shown.

[0099] The BLP (Bell-LaPadula) security model is a security model for information confidentiality protection, which aims to prevent information leakage. In this model, the subject requester usually refers to the entity that actively initiates the access operation request in the system, such as the user process; and the object usually refers to the static resources in the system, such as file data. In this model, entities with a high confidentiality level have a higher security level, while entities with a low confidentiality level have a lower security level. The BLP model stipulates that a subject with a high confidentiality level can only read objects with a lower confidentiality level than it, and can only write objects with a higher confidentiality level than it, that is, the data flow can only flow from low to high.

[0100] The BIBA security model is a security model for information integrity protection, which aims to prevent information from being tampered with. The subject requester and object definitions are similar to the BLP model. In this model, entities with higher integrity have higher credibility, that is, the higher the integrity level, the higher the reliability of the process subject's access request, the higher the accuracy of the object (such as file data), and the lower the possibility of infection. The BIBA model stipulates that subjects with high integrity can only write objects with low integrity to prevent high integrity data from being destroyed.

[0101] The data exchange security model involved in the present invention integrates the BLP model and the BIBA model. Both the subject requester and the object data resource are associated with a security tag attribute, which can include confidentiality and integrity identification at the same time. The tag policy managed by the tag policy center includes access rules for confidentiality and integrity. When a subject requester with both confidentiality and integrity accesses an object data resource with both confidentiality and integrity, the policy execution unit implemented according to this method will perform a policy comparison according to the BLP and BIBA security models. If there is a situation where the data flow direction requirements are not met, the access will be rejected.

[0102] The integration of this tag security model allows data to be protected by both the BLP model for confidentiality and the BIBA model for integrity when accessing and flowing. By comprehensively considering the security requirements of confidentiality and integrity, the model effectively prevents the risk of data leakage or tampering and improves the security of the data exchange process.

[0103] According to an embodiment of the present invention, judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule in S12 includes:

[0104] If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met;

[0105] If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction;

[0106] In S22, judging whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the mark rule includes:

[0107] If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met;

[0108] If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

[0109] According to an embodiment of the present invention, judging whether the first read operation is allowed according to the security mark and the mark rule in S15 includes:

[0110] If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation;

[0111] If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed;

[0112] In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes:

[0113] If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation;

[0114] If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

[0115] In the present invention, two basic entities, subject and object, are considered for data exchange behavior. The subject is the entity that initiates the data resource request, which can be a user, program process, etc., while the object is the data object, which can be a text file, picture, audio and video data, or a data field in a database, etc.

[0116] In the data exchange behavior involved in the present invention, the basis for deciding whether to exchange is based on the security tag. Therefore, in the present invention, the exchange subject and object resources are bound to the security tag in advance. In a system or network, all communicating subjects and object data resources can be bound according to the security tag format definition, and specific security tags can be assigned to them. This tag defines the security attributes of the subject or object, which may include information such as security level and category of accessible resources.

[0117] Through this binding, the system implemented by the present invention can clearly understand the security characteristics of each subject and object, so as to make decisions based on security tags when exchanging data to ensure the security and compliance of data. This method helps to establish strict control over data flow in the system or network to meet security requirements.

[0118] Furthermore, the tag security policy is the core part of the data exchange performed by the present invention, which is based on security tags, security models and policy design. The policy security model involved in the present invention supports BLP confidentiality and BIBA integrity. The security policy is described below:

[0119] Creation policy: When a user process creates a file, the file can inherit the security tag of the creation process. This means that the newly generated file will have the same security attributes as the creation process, ensuring the security of the new data and the consistency of the original data.

[0120] Infection strategy: When data (files) are intercepted, assembled, encrypted, etc., the newly generated data may be contaminated, that is, the modified data infects the subject's security mark, which may change the security mark of the object data resource. This emphasizes the changes and infections of security marks that may be caused during data operations.

[0121] Propagation strategy: Propagation strategy includes the propagation of capabilities or labels. The propagation of capabilities means that the subject adds or reduces the label data of the object data it generates, and the propagation of labels means the change of labels caused by the generation or execution process. This ensures that the security labels can be correctly propagated and maintained during the data generation and transmission process.

[0122] Access policy: Data access policies are divided into two types: confidentiality and integrity. For confidentiality, the subject can read the object data only when the subject's level is higher than the object data's level. If the conditions are not met, the access operation needs to be implemented by increasing the subject's confidentiality or reducing the object's confidentiality to ensure that data flows from low confidentiality to high confidentiality. For integrity, the subject can write to the object only when the subject's integrity level is lower than the object data's integrity level. If the conditions are not met, the access operation needs to be implemented by reducing the subject's integrity or increasing the object's integrity to ensure that data flows from high integrity to low integrity. This ensures the security of data access operations and complies with the security provisions of the BLP and BIBA models.

[0123] like Figure 4 As shown, an embodiment of the present invention provides a data exchange device based on security tags, wherein the device includes a tag policy center module and a tag policy execution module, the tag policy execution module includes a first tag policy execution module and a second tag policy execution module, wherein:

[0124] The tag policy center module is used to configure security tags and tag rules;

[0125] The first marking policy execution module is used to perform a security tag check on a first data resource request sent by a first data exchange subject, where the first data resource request is used to request to obtain a second object data resource. If the first data resource request does not have a security tag, access is terminated. Otherwise, a tag rule is obtained from a marking policy center module, and a data flow from the second data exchange subject to the first data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, access is terminated, where the security tag includes a security attribute of the first data exchange subject.

[0126] The second marking policy execution module is used to perform a security tag check on the first read operation request sent by the second data exchange subject when it complies with the data flow direction. The first read operation request is used to request to read the second object data resource. If the first read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module. According to the security tag and the marking rule, it is determined whether the first read operation is allowed. If not, the access is terminated. If so, the second object data resource is sent to the first data exchange subject through the second data exchange subject, wherein the security tag includes the security attributes of the second data exchange subject.

[0127] Specifically, the tag policy center module is used to uniformly manage and configure the security tags and policies of all data exchange subjects and objects. Its functions include managing and configuring security tags, tag policy management including all policies involved in the present invention, log processing and visualization. The tag policy execution module is used to read the tags of subjects and objects, perform policy comparison on data exchange behaviors according to the tag security model, and allow or deny according to the comparison results, record logs, and upload the tag log information to the tag policy center module.

[0128] Through the above technical solution, a data exchange method and device based on security tags can be provided. The method and device can not only build a security tag operating environment based on a general operating system kernel, but also realize data exchange based on security tags during network data transmission, thereby effectively solving the problem of secure exchange of data within the system or during network transmission.

[0129] The embodiment of the present invention also provides a data exchange device based on security marking, wherein the device includes a marking policy center module and a marking policy execution module, the marking policy execution module includes a first marking policy execution module and a third marking policy execution module, wherein:

[0130] The tag policy center module is used to configure security tags and tag rules;

[0131] The first marking policy execution module is used to perform a security tag check on the second data resource request sent by the second data exchange subject, where the second data resource request is used to request to obtain the first object data resource. If the second data resource request does not have a security tag, the access is terminated. Otherwise, a tag rule is obtained from the marking policy center module, and a data flow from the first data exchange subject to the second data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, the access is terminated, where the security tag includes the security attribute of the second data exchange subject.

[0132] The third marking policy execution module is used to perform a security tag check on the second read operation request sent by the first data exchange subject when it complies with the data flow direction. The second read operation request is used to request to read the first object data resource. If the second read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module, and whether the second read operation is allowed is determined based on the security tag and the marking rule. If not, the access is terminated. If so, the first object data resource is sent to the second data exchange subject through the first data exchange subject, wherein the security tag includes the security attributes of the first data exchange subject.

[0133] Through the above technical solution, a data exchange method and device based on security tags can be provided. The method and device can not only build a security tag operating environment based on a general operating system kernel, but also realize data exchange based on security tags during network data transmission, thereby effectively solving the problem of secure exchange of data within the system or during network transmission.

[0134] According to an embodiment of the present invention, the security attributes include a security level and a category of accessible resources.

[0135] According to an embodiment of the present invention, judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule includes:

[0136] If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met;

[0137] If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction;

[0138] Judging whether the data flow from the first data exchange subject to the second data exchange subject complies with the data flow direction according to the security mark and the mark rule includes:

[0139] If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met;

[0140] If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

[0141] According to an embodiment of the present invention, judging whether the first read operation is allowed according to the security mark and the mark rule in S15 includes:

[0142] If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation;

[0143] If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed;

[0144] In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes:

[0145] If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation;

[0146] If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

[0147] The data exchange method of the present invention is described below with reference to examples:

[0148] 1) Data exchange practice based on security tags at the operating system level

[0149] According to the data exchange method based on security tags of the present invention, a system-level example is as follows: Figure 5 As shown:

[0150] The data exchange based on security tags is realized in the operating system, which mainly includes two modules, the tag policy center module and the tag policy execution module. The tag policy center module includes the tag policy management component and the tag log processing component, both of which run in the system user space and are mainly responsible for tag policy management, preprocessing, tag log collection and processing, visualization, etc., and also includes some user-mode tag tool sets. The tag policy execution module runs in the kernel space and mainly includes three parts: IO tag processing component, tag policy processing component, and tag database component. The IO tag processing docks with the tag policy center module, receives the preprocessed tag data, and stores it in the tag database. At the same time, it dynamically interacts with the subject and object data of the operating system, binds the tag data, and can also collect the tag log output by the tag policy processing component in real time and send it to the tag policy center module. The tagging strategy processing component is responsible for interacting with the operating system kernel object data management through the LSM hook. When the system subject reads and writes customer data, after the relevant authority judgment, the logic interface of the tagging strategy processing component can be called through LSM. If it does not comply with the tagging strategy, access is denied, logs are generated, and output to the IO tagging processing component; if it complies with the tagging strategy, success is returned, and the subject's read and write operations on the object data resources are completed. The tag database component is mainly used to store pre-processed tag data.

[0151] At the operating system level, when two subjects need to exchange data object resources, it can be converted into a single subject's read and write access operation to a certain object data resource. The data object is subject to permission control and flow direction control based on security tags, security models, and other category comparison strategies. The following takes the read and write access request of subject 1 to object data resource 1 as an example to explain the process of access control based on security tags. Figure 6 As shown in the figure, the workflow of the data exchange method based on security tags at the operating system level includes:

[0152] S10: The management component of the marking policy center module configures security markings for the subject 1 and the object data resource 1 respectively through the IO processing component. The marking format complies with the format definition of the present invention. The category part can customize specific fields and comparison methods. The security model includes the BLP confidentiality model and the BIBA integrity model.

[0153] S11: The tag management component simultaneously formulates and configures the tag category and comparison strategy to the tag policy processing component of the tag policy execution module, and selects the confidentiality model or the integrity model or satisfies both models at the same time.

[0154] S20: Subject 1 initiates a read or write request for object data resource 1. The requested data can first undergo a relevant permission check at the operating system level, and then be sent to the marking policy processing component of the marking policy center module through the hook of the operating system LSM module.

[0155] S21: The tagging strategy processing component queries the security tags of subject 1 and object data resource 1 and the current comparison strategy configuration. If it is a read operation, when the security level of the verification subject 1 is lower than the security level of the object data resource 1, access is denied, a tagging log is generated, and the process goes to S22. If it is a write operation, when the security level of the verification subject 1 is higher than the security level of the object data resource 1, access is denied, a tagging log is generated, and the process goes to S22.

[0156] S22: If the security level complies with the security model, the categories of the subject and object are compared to see if they comply with the comparison policy requirements. If not, access is denied, a marking log is generated, and the process goes to S23.

[0157] S23: When the security level and security category of the subject and object data resources meet the security model and policy requirements, the marking policy processing component returns success to the LSM, completing the read and write operations of subject 1 on object data resource 1.

[0158] S30: The marking strategy processing component transmits the marking log to the marking log processing component of the marking strategy center module in real time through the IO marking processing component to complete the collection, analysis and visualization of the log.

[0159] 2) Data exchange practice based on security tags at the network data transmission level

[0160] The data exchange method based on the security tag of the present invention is described as follows in a network layer example. Figure 7 As shown:

[0161] Assume that there are two network subjects, respectively denoted as network subject 1 and network subject 2, which are actually business application processes that need to perform network data transmission, and can be subject entities such as client software, server software or browser that can perform data transmission. In addition, assume that there are two object data resources, respectively denoted as object data resource 1 and object data resource 2, object data resource 1 is located on the system side where network subject 1 is located, and object data resource 2 is located on the system side where network subject 2 is located. Alternatively, the two network subjects and the two object data resources can also exchange data in a system through network SOCKET communication. The practice of the present invention at the network data transmission level can also include two modules, namely, a marking policy center module and a marking policy execution module. The marking policy center module is responsible for the management and preprocessing of security tags, the collection and processing of marking logs, visualization, etc. The marking policy execution module includes a network service proxy component, a marking policy execution component, and a marking conversion and binding component. The network service proxy component mainly acts as an agent for the transmission of business application data on the network, and cooperates with the marking policy execution component to complete the marking policy comparison processing, log generation and transmission. The tagging strategy execution component is mainly used to identify the security tags in the network data, compare them with the security tags of the proxy service, and then complete the tagging strategy comparison between network subjects and between subjects and objects to determine whether they comply with the tag security model and category strategy. The tag conversion and binding component is to realize the mapping and binding of the security tags of the subject or object data resources on the network data. Specifically, it converts the relevant security tags into the network data tag format when necessary and attaches them to the network data packet, which flows in the network along with the access request data or object data resources. In a specific embodiment, the network service agent 1 and the network service agent 2 in the figure do not need to exist at the same time. Generally, it is sufficient to deploy a network service agent component on the object data resource side.

[0162] Specific processes may include:

[0163] S10: The marking policy center module configures security markings for network subject 1, network subject 2, object data resource 1 and object data resource 2 respectively. The marking format complies with the format requirements of the present invention. The category part can customize specific fields and comparison methods. The security model includes data BLP confidentiality security model and BIBA integrity security model.

[0164] S11: The tag policy center module formulates and configures the tag category and comparison strategy to the tag policy execution module according to the specific network data transmission requirements. The tag security model supports both BLP and BIBA parallel working modes.

[0165] The following is an example of the process of network subject 1 requesting to read object data resource 2 (the process of network subject 2 requesting to read object data resource 1 is the same and will not be repeated here):

[0166] S20: Network subject 1 initiates a request for object data resource 2. The request data arrives at the tag conversion and binding component, which converts the security tag of subject 1 into a network transmission format and writes it into the request data. For network IP data, the security tag data can be attached to the IP option header or to the business application protocol data (in this case, there will be some differences for TCP and UDP protocol transmission). If the network service agent 1 component is not deployed, go directly to S30, otherwise go to S21.

[0167] S21: The request data packet of subject 1 arrives at the network service agent 1 and the marking policy execution component 1, and then determines whether the request data can be sent according to the marking policy rules of the network service agent 1. If so, go to S22, otherwise discard the request packet and record the marking log.

[0168] S22: The request data packet of subject 1 is sent through the marked transmission channel. The marked transmission channel can be an actual physical network communication medium or a communication channel between different sockets in the operating system environment.

[0169] S30: The request data packet of subject 1 arrives at the network service agent 2, which parses the request data. The marking policy execution component 2 performs a policy comparison on the security tag of subject 1 and the security tag of subject 2. If they pass, it goes to S31, otherwise the request data is discarded and the marking log is recorded.

[0170] S31: The tag policy execution component 2 can further compare the security tag of the network subject 2 with the security tag of the object data resource 2. If it complies with the tag security model and category policy, the object data resource 2 is sent to the network service agent 2. Otherwise, the access request is rejected and the tag log is recorded.

[0171] S40: Network service agent 2 sends object data resource 2 to the tag transmission channel, and after transmission through the channel, it reaches network service agent 1. If network service agent 1 is not deployed in practice, object data resource 2 is directly sent to network subject 1, otherwise go to S41.

[0172] S41: The network service agent 1 transfers the object data resource 2 to the network subject 1 through the system IO or network interface, completing the flow of data based on the security tag to the exchange subject.

[0173] In general, the data exchange method based on security mark described in the present invention includes at least the following parts:

[0174] Configure security tags: Configure security tags for subject and object data resources. These tags can include information such as confidentiality level and integrity level to ensure that the security attributes of data resources are accurately defined and data exchange behaviors are reviewed and verified. This configuration process can be completed in advance before executing data exchange.

[0175] Tag security model policy comparison: Based on the predefined tag security model, a policy comparison is performed on whether the object data can flow to the subject. This means that the system can review and verify the data exchange behavior according to the confidentiality and integrity requirements specified in the security model.

[0176] Data exchange flow control: Data objects can only be securely exchanged to subjects if they comply with the tag security model and other designed policies. This ensures that the flow of data is carried out in accordance with pre-defined security rules and effectively controls the fine-grained flow of data.

[0177] Based on the method of binding data to security tags, the method described in the present invention realizes fine-grained control of data flow. The policy comparison method adds additional security guarantees during the data exchange process, ensures compliant data flow, and protects the confidentiality and integrity of the data. The method and device described in the present invention are particularly suitable for scenarios with high requirements for data protection security, and provide a more secure and controllable method for data exchange.

[0178] It can be seen from the above embodiments that the present invention can achieve fine-grained access control based on security tags through the definition of security tag attributes, security policy formulation, and security model selection. And the binding technology of security tags for subjects and objects at the system layer and network layer can achieve the compliant flow of object data between different subjects. In addition, the security tag technology is integrated with the data exchange technology. By assigning different security tag attribute values ​​to the subject and object during data exchange, the compliant access of the subject to the object and the compliant flow of data objects can be achieved.

[0179] In the description of the present invention, it is necessary to understand that the directions or positional relationships indicated by directional words such as "front, back, up, down, left, right", "lateral, vertical, perpendicular, horizontal" and "top, bottom" are usually based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description. Unless otherwise specified, these directional words do not indicate or imply that the devices or elements referred to must have a specific direction or be constructed and operated in a specific direction. Therefore, they cannot be understood as limiting the scope of protection of the present invention. The directional words "inside and outside" refer to the inside and outside relative to the contours of each component itself.

[0180] For ease of description, spatially relative terms such as "above", "above", "on the upper surface of", "above", etc. may be used here to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" can include both "above" and "below". The device can also be positioned in other different ways (rotated 90 degrees or in other orientations), and the spatially relative descriptions used here are interpreted accordingly.

[0181] In addition, it should be noted that the use of terms such as "first" and "second" to limit components is only for the convenience of distinguishing the corresponding components. If not otherwise stated, the above terms have no special meaning and therefore cannot be understood as limiting the scope of protection of the present invention.

[0182] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data exchange method based on security tags, characterized in that: The method includes: S10, the first data exchange subject sends a first data resource request, where the first data resource request is used to request to obtain a second object data resource; S11, the first tag policy execution module performs a security tag check on the first data resource request, and if the first data resource request has a security tag, the process goes to S12, otherwise the access is terminated, wherein the security tag includes a security attribute of the first data exchange subject; S12, the first marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the data flow from the second data exchange subject to the first data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S13, otherwise terminate the access; S13, the second data exchange subject sends a first read operation request, where the first read operation request is used to request to read a second object data resource; S14, the second marking policy execution module performs a security marking check on the first read operation request, and if the first read operation request has a security marking, the process goes to S15, otherwise the access is terminated, wherein the security marking includes the security attribute of the second data exchange subject; S15, the second marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the first read operation is allowed according to the security mark and the marking rule. If yes, go to S16, otherwise terminate the access; S16: The second data exchange subject sends the second object data resource to the first data exchange subject.

2. A data exchange method based on security tags, characterized in that: The method includes: S20, the second data exchange subject sends a second data resource request, where the second data resource request is used to request to obtain the first object data resource; S21, the first tag policy execution module performs a security tag check on the second data resource request, and if the second data resource request has a security tag, the process goes to S22, otherwise the access is terminated, wherein the security tag includes a security attribute of the second data exchange subject; S22, the first marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the marking rule. If yes, go to S23, otherwise terminate the access; S23, the first data exchange subject sends a second read operation request, where the second read operation request is used to request to read the first object data resource; S24, the third marking policy execution module performs a security marking check on the second read operation request, and if the second read operation request has a security marking, the process goes to S25, otherwise the access is terminated, wherein the security marking includes the security attribute of the first data exchange subject; S25, the third marking policy execution module obtains the marking rule from the marking policy center module, and determines whether the second read operation is allowed according to the security mark and the marking rule. If yes, go to S26, otherwise terminate the access; S26: The first data exchange subject sends the first object data resource to the second data exchange subject.

3. The method according to claim 1 or 2, characterized in that: Security attributes include the security level and the category of accessible resources.

4. The method according to claim 3, characterized in that In S12, judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule includes: If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met; If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction; In S22, judging whether the data flow from the first data exchange subject to the second data exchange subject conforms to the data flow direction according to the security mark and the mark rule includes: If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met; If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

5. The method according to claim 4, characterized in that In S15, judging whether the first read operation is allowed according to the security mark and the mark rule includes: If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation; If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed; In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes: If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation; If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

6. A data exchange device based on security tags, characterized in that: The device includes a marking strategy center module and a marking strategy execution module, wherein the marking strategy execution module includes a first marking strategy execution module and a second marking strategy execution module, wherein: The tag policy center module is used to configure security tags and tag rules; The first marking policy execution module is used to perform a security tag check on a first data resource request sent by a first data exchange subject, where the first data resource request is used to request to obtain a second object data resource. If the first data resource request does not have a security tag, access is terminated. Otherwise, a tag rule is obtained from a marking policy center module, and a data flow from the second data exchange subject to the first data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, access is terminated, where the security tag includes a security attribute of the first data exchange subject. The second marking policy execution module is used to perform a security tag check on the first read operation request sent by the second data exchange subject when it complies with the data flow direction. The first read operation request is used to request to read the second object data resource. If the first read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module. According to the security tag and the marking rule, it is determined whether the first read operation is allowed. If not, the access is terminated. If so, the second object data resource is sent to the first data exchange subject through the second data exchange subject, wherein the security tag includes the security attributes of the second data exchange subject.

7. A data exchange device based on security tags, characterized in that: The device comprises a marking strategy center module and a marking strategy execution module, wherein the marking strategy execution module comprises a first marking strategy execution module and a third marking strategy execution module, wherein: The tag policy center module is used to configure security tags and tag rules; The first marking policy execution module is used to perform a security tag check on the second data resource request sent by the second data exchange subject, where the second data resource request is used to request to obtain the first object data resource. If the second data resource request does not have a security tag, the access is terminated. Otherwise, a tag rule is obtained from the marking policy center module, and a data flow from the first data exchange subject to the second data exchange subject is determined according to the security tag and the tag rule to determine whether the data flow conforms to the data flow direction. If not, the access is terminated, where the security tag includes the security attribute of the second data exchange subject. The third marking policy execution module is used to perform a security tag check on the second read operation request sent by the first data exchange subject when it complies with the data flow direction. The second read operation request is used to request to read the first object data resource. If the second read operation request does not have a security tag, the access is terminated. Otherwise, the marking rule is obtained from the marking policy center module, and whether the second read operation is allowed is determined based on the security tag and the marking rule. If not, the access is terminated. If so, the first object data resource is sent to the second data exchange subject through the first data exchange subject, wherein the security tag includes the security attributes of the first data exchange subject.

8. The device according to claim 6 or 7, characterized in that Security attributes include the security level and the category of accessible resources.

9. The device according to claim 8, characterized in that Judging whether the data flow from the second data exchange subject to the first data exchange subject complies with the data flow direction according to the security mark and the mark rule includes: If the confidentiality of the first data exchange subject is higher than the confidentiality of the second object data resource, then the data flow direction is met; If the confidentiality of the first data exchange subject is not higher than the confidentiality of the second object data resource, it does not comply with the data flow direction; Judging whether the data flow from the first data exchange subject to the second data exchange subject complies with the data flow direction according to the security mark and the mark rule includes: If the confidentiality of the second data exchange subject is higher than the confidentiality of the first object data resource, then the data flow direction is met; If the confidentiality of the second data exchange subject is not higher than the confidentiality of the first object data resource, it does not comply with the data flow direction.

10. The device according to claim 9, characterized in that In S15, judging whether the first read operation is allowed according to the security mark and the mark rule includes: If the integrity of the first data exchange subject is lower than the integrity of the second object data resource, allowing the first read operation; If the integrity of the first data exchange subject is not less than the integrity of the second object data resource, the first read operation is not allowed; In S25, judging whether the second read operation is allowed according to the security mark and the mark rule includes: If the integrity of the second data exchange subject is lower than the integrity of the first object data resource, allowing the second read operation; If the integrity of the second data exchange subject is not less than the integrity of the first object data resource, the second read operation is not allowed.

Images