Data security control method and system

Abstract

The invention discloses a data security control method and system, and belongs to the technical field of data security, and the method comprises the steps: judging whether a permission account of a login node is matched with an operation data permission or not; if not, refusing; if yes, the operation data completes corresponding instruction operation, and the data identifier, the instruction operator, the timestamp, the grading identifier, the permission account login node identifier and the permission account are signed together by using the permission account to form a data file; judging whether the data operated by the instruction exists in advance or not; if the instruction operation does not exist, the instruction operation is data generation, a data file is stored, and an instruction operation data record is formed; if the data file exists, storing the data file, and after the last instruction operation data record of the data, storing the current instruction operation data record to the cloud; wherein a grading identifier is generated for the data according to a data grading rule; when corresponding data is subjected to instruction operation, data security can be protected in real time, data leakage is prevented, and data security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security control method and system. Background Art

[0002] Among the technical means of data security protection, network area isolation, application access control and data encryption management can all achieve real-time data security protection. In addition, these three protection mechanisms are all protection measures used when transmitting and interacting with the outside world. A careful analysis of existing major data leakage incidents shows that in addition to common virus attacks, network attacks and hacker attacks, data leakage incidents often occur during the data modification process. To solve this problem, internal data is often controlled through technical means that combine data encryption management and operation log auditing. However, this method is a post-event data protection method and cannot achieve real-time supervision and control of data security. Summary of the invention

[0003] 1. Technical problem to be solved by the invention

[0004] In order to overcome the above technical problems, the present invention provides a data security control method and system, which can protect data security in real time, prevent data leakage, and ensure data security when instruction operations are performed on corresponding data.

[0005] 2. Technical solution

[0006] To solve the above problems, the technical solution provided by the present invention is:

[0007] A data security control method comprises: judging whether the permission account of a login node matches the permission of operation data; if an instruction operation that does not match the operation data of the permission account is detected, then rejecting; if an instruction operation that matches the operation data of the permission account is detected, then: the operation data completes the corresponding instruction operation, and forms a data file by signing the data identifier, instruction operator, timestamp, classification identifier, permission account login node identifier, and permission account together with the permission account; judging whether the data of the instruction operation exists in advance; if the data of the instruction operation does not exist in advance, the instruction operation is to generate data, and then the data file is stored to form an instruction operation data record; if the data of the instruction operation exists in advance, then the data file is stored, and after the last instruction operation data record of the data, the current instruction operation data record is stored in the cloud; wherein, a classification identifier is generated for the data according to the data classification rule.

[0008] Optionally, the timestamp, hierarchical identification and authority account are combined to form a data file; further, the instruction operation, timestamp, hierarchical identification and authority account login node identifier are combined with the authority account signature to form a data file.

[0009] Optionally, the determining whether the permission account of the login node matches the operation data further includes: at least including determining whether the permission of the permission account matches the permission of the operation data based on a hierarchical identification of the data.

[0010] Optionally, if the data operated by the instruction does not exist previously, it also includes: forming a data file with the data source, timestamp, classification identification, permission account login node identifier and permission account.

[0011] Optionally, the data classification rules are determined based on national data security regulations, industry data regulations, organizational data confidentiality levels, and organizational data value levels.

[0012] Optionally, the instruction operation includes generating, storing, modifying, copying, deleting and destroying data.

[0013] Optionally, the stored data file is stored in a storage area divided according to the source and classification identification of the data, and the data file storage location is associated with the instruction operation data record.

[0014] Optionally, if the permission to operate the data needs to match multiple permission accounts at the same time, then: determine whether the permission account of the login node, the signatures of the other permission accounts received by the login node, and the operation data match; if so, combine the instruction operation, timestamp, hierarchical identification, and permission account login node identifier, and use the permission account of the login node and the signatures of the other permission accounts received by the login node to form a data file.

[0015] Optionally, after the operation data completes the corresponding instruction operation, the method further includes: encrypting the data after completing the corresponding instruction operation; or, the forming of the data file further includes: encrypting the data file.

[0016] Optionally, it also includes: sending the instruction operation data record to the internal nodes of the organization, the internal nodes of the organization reach a consensus on the instruction operation data record, and storing the instruction operation data record in the cloud.

[0017] A data security control system comprises: a hierarchical identification generating unit, used for generating hierarchical identification for data according to data hierarchical rules; an authority matching judgment unit, used for judging whether the authority account of the login node matches the operation data authority; an instruction operation executing unit, used for refusing to execute the instruction operation if the authority matching judgment unit detects an instruction operation that does not match the operation data of the authority account; if the authority matching judgment unit detects an instruction operation that matches the operation data of the authority account; then: the operation data completes the corresponding instruction operation; a data file generating unit, used for combining the data identification, instruction operator, timestamp, hierarchical identification, account-limited login node identifier and the authority account, using the authority account signature to form a data file; a storage unit, used for judging whether the data of the instruction operation exists in advance; if the data of the instruction operation does not exist in advance, the instruction operation is to generate data, then the data file is stored to form an instruction operation data record; if the data of the instruction operation exists in advance, the hash value of the encrypted instruction operation data record of the data last time is put into the instruction operation data record of this time, and after the instruction operation data record of the data last time, the instruction operation data record of this time is stored to the cloud.

[0018] A data security control method comprises: judging whether the authority account signature of a data file received from an authority account is decrypted; if the authority account signature cannot be decrypted, refusing to read the data file; if the authority account signature is successfully decrypted, interpreting the data file; judging whether the node authority account of successful decryption matches the hierarchical identifier of the data file; if they match, feeding back the node identifier of successful decryption to the node most recently logged in by the authority account, and storing the data file operation record formed by the hash value of the data file and the node identifier of successful decryption to the cloud.

[0019] Optionally, it also includes: the data file operation record storage location is associated with the data file storage location.

[0020] A data security control system comprises: a signature decryption unit, which is used to decrypt an authority account signature and determine whether the authority account signature of a data file sent by the authority account is decrypted; a file interpretation unit, which is used to refuse to decrypt the data file if the signature decryption unit cannot decrypt the authority account signature; if the signature decryption unit successfully decrypts the authority account signature, it is used to interpret the data file, and also comprises: a hierarchical identification judgment unit, which is used to judge whether the node authority account of the successful decryption matches the hierarchical identification of the data file; if they match, the node identifier of the successful decryption is fed back to the node most recently logged in by the authority account, and the data file operation record formed by the hash value of the data file and the node identifier of the successful decryption is stored in the cloud.

[0021] 3. Beneficial effects

[0022] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0023] In the systems or networks within an organization, there are often multiple functional applications involved. Data security control of these applications is of great significance to the organization. For example, in the information construction of production-oriented enterprises in the physical industry, there are often more than one functional application including the ERP system, such as logistics system, procurement system, financial system, production process management system, etc.; these systems are often not created by the same developer, which brings certain obstacles to their compatibility and interactivity with each other; especially when it comes to data security management between different application systems, there are also great challenges. With the technical solution of this embodiment, even if there are multiple functional application systems involved in the organization, there is no restriction. For the data generated by different applications, it can be processed and treated indiscriminately, so as to control the security of data in various application systems within the organization from the source; it is not limited by the type and number of applications. When the implementation scheme of the present invention is applied in the industrial Internet, the people (corresponding to the permission account), machines (corresponding to the login node identifier), objects (corresponding to the data of the instruction operation), and systems (corresponding to different business systems, or different database systems) connected in the industrial Internet are monitored in real time, and the whole life cycle of the data is recorded, and security control is performed to prevent data loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is one of the flow charts of a data security control method provided by an embodiment of the present invention.

[0025] Figure 2 This is one of the schematic diagrams of a data security control system provided by an embodiment of the present invention.

[0026] Figure 3 The present invention provides a second flow chart of a data security control method according to an embodiment of the present invention.

[0027] Figure 4 The second schematic diagram of a data security control system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments.

[0029] The present application will be further described in detail below in conjunction with the accompanying drawings and examples. It will be understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the invention are shown in the accompanying drawings. The first, second, etc. terms described in the present invention are provided for the convenience of describing the technical solution of the present invention, and have no specific limiting effect. They are all general terms and do not constitute a limiting effect on the technical solution of the present invention. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the examples.

[0030] This embodiment proposes a data security control method, such as Figure 1 As shown, any node in the internal system or network of an organization runs the method when sending organizational data to the internal node of the organization or the external network node of the organization; it is characterized in that it includes: judging whether the permission account of the login node matches the permission of the operation data; if an instruction operation that does not match the operation data of the permission account is detected; then reject it; if an instruction operation that matches the operation data of the permission account is detected; then: the operation data completes the corresponding instruction operation, and the data identifier, instruction operator, timestamp, classification identifier, permission account login node identifier, and permission account are used together with the permission account signature to form a data file; judging whether the data of the instruction operation exists first; if the data of the instruction operation does not exist first, the instruction operation is to generate data, and the data file is stored to form an instruction operation data record; if the data of the instruction operation exists first, the encrypted hash value of the last instruction operation data record of the data is put into the current instruction operation data record, and after the last instruction operation data record of the data, the current instruction operation data record is stored to the cloud; wherein, a classification identifier is generated for the data according to the data classification rule.

[0031] This permission account corresponds to the permission account used by the relevant personnel to log in and access the network or system of the service unit to which they belong, or the network or system of the work unit to which they belong. This permission account represents the position and rank of the relevant personnel in the service unit to which they belong, or the work unit to which they belong, and the data objects that can be generated, viewed, accessed, modified, updated, transferred and deleted, that is, a series of instruction operations that match the permission account operation data. This permission account is set when the relevant personnel joins the network or system of the service unit to which they belong, or the work unit to which they belong, and the account permission level can be modified by one or more parties involved in the manager of the relevant personnel, so as to match different data with the corresponding instruction operation permissions. Ensure that the data security of the enterprise or unit is controllable and avoid data leakage caused by daily business activities.

[0032] The permission account is set comprehensively based on the job responsibilities of relevant personnel, as well as the confidentiality level of data within the unit or enterprise, and the data security management rules corresponding to the value level. According to the data security management rules of the enterprise or unit, different permission accounts are matched with data of different levels and the scope of instruction operations on the data of the corresponding level. For example, the permission account is level 5, which can only view the incoming goods information in the logistics system, and cannot be copied, modified or transmitted to others. The incoming goods information in the logistics system belongs to the confidentiality level of level 6 and the value level of level 5. In addition, the importance and meaning of each level are determined by the data security management rules according to the actual situation of the enterprise or unit. Data security management rules can be set comprehensively based on national data security regulations, industry data security rules, and the basic requirements of internal data security compliance of the enterprise.

[0033] The timestamp refers to the current time when the data is instructed to operate, obtained from the National Time Service Center. The hierarchical identification includes the data confidentiality level and data value level identification that are set according to the data security management rules and meet the permission account level. The node identifier represents the unique identifier of the node. The purpose of asymmetric encryption data is to prevent data leakage.

[0034] The operation data completes the corresponding instruction operation, obtains the timestamp, and generates a classification mark for the data according to the data classification rules; the timestamp, classification mark, node identifier and permission account are combined to form a file; through the above operations, the instruction operation on the data is accompanied by a series of instruction operation processes such as data generation, modification, update, transmission and transfer, so that data security management can be realized in real time, online and automatically. In addition, for enterprises or units, it truly achieves "whoever uses is responsible for data security" and "whoever produces is responsible for data security", and the instruction operation on the data is bound to the whole process of the data life cycle to ensure the whole process monitoring of the data life cycle.

[0035] The systems or networks within an organization often involve multiple functional applications, and the data security control of these applications is of great significance to the organization. For example, in the construction of informatization, production-oriented enterprises in the physical industry often involve more than one functional application including an ERP system, such as a logistics system, a procurement system, a financial system, a production process management system, etc.; these systems are often not created by the same developer, which brings certain obstacles to their compatibility and interactivity with each other; especially when it comes to data security management between different application systems, it also faces great challenges. By adopting the technical solution of this embodiment, even if there are multiple functional application systems involved in the organization, there is no restriction. The data generated by different applications can be processed and treated indiscriminately, so as to control the security of data in various application systems within the organization from the source; it is not restricted by the type and number of applications.

[0036] The instruction operator corresponds to the mark, code or symbol of the instruction operation such as generation, modification, copy, deletion, etc. Determine whether the data of the instruction operation exists in advance; the method is: find the summarized instruction operation data record through the data identifier, such as the instruction operation data record file. If it cannot be found, it does not exist. The data identifier is formed according to one or a combination of the keywords, names, identification symbols, etc. of the data. In order to ensure data security and prevent leakage, asymmetric encryption can be performed to form a string of a certain length, such as through hash encryption.

[0037] If the data for the instruction operation does not exist before, and the instruction operation is to generate data, then the data file is stored to form an instruction operation data record; that is, newly generated data, such as newly generated financial statement data, the data is stored, and the financial statement data is identified to generate the corresponding instruction symbol, timestamp, the hierarchical identifier corresponding to the financial statement data, the identifier of the authorized account login node, and the instruction operation data record of the financial data report is formed using the authorized account signature.

[0038] If the data of the instruction operation exists before, the encrypted hash value of the last instruction operation data record of the data is put into the current instruction operation data record, and the current instruction operation data record is stored in the cloud after the last instruction operation data record of the data; wherein, a hierarchical identifier is generated for the data according to the data classification rule. If a storage data exists before, the instruction operation data record of the last storage data is encrypted to form a hash value, and the hash value, if the current operation is copying, the corresponding instruction operation identifier of the copy, the identifier of the storage data, the timestamp when copying, the hierarchical identifier of the storage data, the identifier of the account login node with the data copying permission, and the authorized account signature are used to form the instruction operation data record of this time. Through the hash value, the front and back links are increased, and the tampering cost is reduced, and the chance of arbitrary modification is reduced. The data life cycle record can be quickly viewed through the data identifier, and the data operation record is formed in real time while the data is operated, so as to facilitate the data life cycle management, control, traceability, viewing and analysis, etc. Account permissions determine the scope of data that can be viewed, modified, copied, deleted, etc., improving operational security within the data life cycle. The storage and recording method of instruction operation records further strengthens the security of data operations, and follows the operation process and steps throughout the data life cycle in real time, providing real-time security protection, and can be checked afterwards. As one of the implementation methods of this embodiment, the timestamp, hierarchical identification, and permission account are combined to form a data file; further: the instruction operation, timestamp, hierarchical identification, and permission account login node identifier are signed with the permission account to form a data file. The permission account login node identifier includes, but is not limited to, the IP address of the node, the physical address of the node, the location identifier of the node in the enterprise or unit network, etc.

[0039] By recording the node identifier of the authorized account login in the file, the location of the node that performs instruction operations on the data in the network can be accurately known, ensuring that the instruction operations of the entire process of the data life cycle are recorded and the location of the node where the corresponding instruction operation is completed can be accurately found; this facilitates the accurate and rapid positioning of the data file in the later data sorting stage.

[0040] As one of the implementation modes of this embodiment, the determination of whether the permission account of the login node matches the operation data further includes: at least including determining whether the permission of the permission account matches the permission of the operation data according to the classification identification of the data.

[0041] The hierarchical identification is generated by data security rules. According to the data security rules, the organization has established a corresponding matching relationship between the permission account and the hierarchical identification, which is directly matched with the data instruction operation permissions of the permission account and can be directly used to determine whether the two match. In addition, judgments can be made based on the source and content of the data; however, compared with the hierarchical identification of data directly associated with the permission account, these judgment methods may lead to problems such as slowing down the network speed and throughput because they need to read the source and content of the data itself.

[0042] As one of the implementation methods of this embodiment, if the data operated by the instruction does not exist before, it also includes: the source of the data, timestamp, classification identification, permission account login node identifier and permission account are combined to form a data file. From the source of data generation, the entire process of the data life cycle is recorded.

[0043] As one of the implementation methods of this embodiment, the data classification rules are determined based on national data security regulations, industry data regulations, organizational data confidentiality levels and organizational data value levels.

[0044] The data classification rules within the organization thus constructed comply with the needs of all parties, including national data security regulations, industry data regulations, organizational data confidentiality levels, and organizational data value levels. On the one hand, they meet the compliance requirements of all parties in order to be subject to supervision, and on the other hand, they facilitate data confidentiality, data value assessment, and its application.

[0045] As one of the implementation methods of this embodiment, the instruction operation includes generating, storing, modifying, copying, deleting and destroying data.

[0046] The entire process of data collection, generation, and destruction is recorded. On the one hand, it ensures that data is secure and controllable. On the other hand, the instruction operation process of data operations is recorded and evidence is preserved to ensure that the data life cycle is legal, compliant, and traceable.

[0047] As one of the implementation methods of this embodiment, the stored data file is stored in a storage area divided according to the source and classification identification of the data, and the data file storage location is associated with the instruction operation data record.

[0048] The data file storage locations are sorted out to facilitate quick and direct positioning of the data storage locations. At the same time, the data instruction operation records and the data file storage locations are associated to facilitate quick and direct finding of the data files and their corresponding instruction operation records, which is convenient for supervision and direct retrieval of the instruction operation records of the data files. The data security control method of this embodiment is optimized and will not bring excessive burden to the normal operation of the system or network within the organization, while ensuring the data security in the system or network within the organization.

[0049] As one of the implementation methods of this embodiment, if the authority of the operation data needs to match multiple authority accounts at the same time, then: determine whether the authority account of the login node, the signatures of the other authority accounts received by the login node match the operation data; if so, the instruction operation, timestamp, classification identification and the authority account login node identifier are combined, and the signatures of the authority account of the login node and the other authority accounts received by the login node are used to form a data file. According to the setting of data confidentiality level and data value level, the higher the confidentiality level or value level of the data, the more security control is often required during the circulation of the data life cycle, so as to avoid unnecessary trouble or loss of commercial interests to the organization. Therefore, for the security control of the data file life cycle, control is carried out from the authority, and multiple people need to participate in the signature before the corresponding instruction operation can be performed to form a data file. Then, during the circulation of the data file, its security can be controlled from the source to prevent leakage and protect the security of data assets.

[0050] As one of the implementation methods of this embodiment, after the operation data completes the corresponding instruction operation, it further includes: encrypting the data after completing the corresponding instruction operation; or, the forming of the data file further includes: encrypting the data file.

[0051] Encrypt the plaintext information of data or data files to further ensure data security. The encryption algorithm can be symmetric or asymmetric. The choice of algorithm can be considered in terms of convenience, security and difficulty in cracking. The difference between encrypting the data after completing the corresponding instruction operation and encrypting the data file is that the former does not need to decrypt when matching and judging the hierarchical identification of the data file, and can quickly determine whether it matches the corresponding hierarchical identification, so as to quickly confirm whether the next data instruction operation can be performed; while the latter needs to decrypt the data file first before reading the hierarchical identification, and then matching and judging the hierarchical identification. Because the decryption process takes time, and when the data itself is not encrypted, the data security is poor. The more ideal option is to encrypt the data after completing the corresponding instruction operation and encrypt the data file. Given that the decryption process takes time, when the data instruction operation within the organization is relatively frequent, the problem that may arise is sacrificing the response time of the system.

[0052] As one of the implementation methods of this embodiment, it also includes: sending the instruction operation data record to the internal nodes of the organization, the internal nodes of the organization reach a consensus on the instruction operation data record, and storing the instruction operation data record in the cloud.

[0053] The command operation data records that are agreed upon by multiple internal nodes of multiple organizations can prevent the possibility of the record being tampered with, ensure that the record is authentic and valid, facilitate the traceability and tracking of data, and facilitate further research on data security countermeasures; in addition, it also leaves evidence for the command operation of the data, which is convenient for traceability; thereby, the following technical effects can be achieved: on the one hand, as the data is subjected to relevant command operations, data security can be controlled in real time to prevent data leakage; on the other hand, through the command operation data records, the entire process of the data life cycle can be recorded, which can be traced afterwards.

[0054] A data security control system, such as Figure 2 As shown, it includes: a hierarchical identification generating unit, which is used to generate a hierarchical identification for data according to data hierarchical rules; an authority matching judgment unit, which is used to judge whether the authority account of the login node matches the operation data authority; an instruction operation execution unit, which is used to refuse to execute the instruction operation if the authority matching judgment unit detects an instruction operation that does not match the operation data of the authority account; if the authority matching judgment unit detects an instruction operation that matches the operation data of the authority account; then: the operation data completes the corresponding instruction operation; a data file generating unit, which is used to form a data file by using the authority account signature by combining the data identification, instruction operator, timestamp, hierarchical identification, account-limited login node identifier and authority account; a storage unit, which is used to judge whether the data of the instruction operation exists first; if the data of the instruction operation does not exist first, the instruction operation is to generate data, then the data file is stored to form an instruction operation data record; if the data of the instruction operation exists first, the encrypted hash value of the last instruction operation data record of the data is put into the current instruction operation data record, and after the last instruction operation data record of the data, the current instruction operation data record is stored to the cloud.

[0055] A data security control method is implemented by any node in an enterprise network when receiving data sent by an internal node or an external network node of the enterprise; Figure 3 As shown, it includes: judging whether the authority account signature of the data file sent by the authority account is decrypted; if the authority account signature cannot be decrypted, refusing to read the data file; if the authority account signature is successfully decrypted, interpreting the data file; judging whether the node authority account of the successful decryption matches the hierarchical identifier of the data file; if it matches, feeding back the node identifier of the successful decryption to the node most recently logged in by the authority account, and storing the data file operation record formed by the hash value of the data file and the node identifier of the successful decryption to the cloud. The method of this embodiment controls the safe reception of data, and to a certain extent, it can also resist network attacks, etc., further ensuring data security and preventing data leakage.

[0056] As one of the implementation modes of this embodiment, it also includes: the data file operation record storage location is associated with the data file storage location.

[0057] Whether from the data file operation record or from the data file, it is convenient to directly locate the data file storage location and the data file operation record storage location, and the locations of the two can be quickly found and located.

[0058] A data security control system, such as Figure 4 As shown, including:

[0059] The signature decryption unit is used to decrypt the authority account signature and determine whether the authority account signature of the data file sent by the authority account is decrypted;

[0060] The file interpretation unit is used to refuse to decrypt the data file if the signature decryption unit cannot decrypt the authorized account signature;

[0061] If the signature decryption unit successfully decrypts the authority account signature, it is used to interpret the data file, and also includes: a hierarchical identification judgment unit, which is used to judge whether the node authority account that has successfully decrypted matches the hierarchical identification of the data file;

[0062] If there is a match, the node identifier of the successfully decrypted node is fed back to the node that the authorized account has logged in to the most recently, and the data file operation record formed by the hash value of the data file and the successfully decrypted node identifier is stored in the cloud.

[0063] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a dedicated hardware-based system that performs a specified function or operation, or can be realized by a combination of dedicated hardware and computer instructions.

[0064] The units or modules involved in the embodiments described in the present application may be implemented by software or by hardware. The units or modules described may also be arranged in a processor. For example, each of the units may be a software program arranged in a computer or a mobile smart device, or may be a separately configured hardware device. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0065] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the present application. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) to form a technical solution.

Claims

1. A data security control method, characterized in that: include: Determine whether the permission account for logging into the node matches the permission for operating data; If an instruction operation is detected that does not match the operation data of the authorized account; then refuse; If an instruction operation matching the operation data of the authorized account is detected; but: The operation data completes the corresponding instruction operation, and the data identifier, instruction operator, timestamp, classification identifier, permission account login node identifier, and permission account are combined with the permission account signature to form a data file; Determine whether the data operated by the instruction exists previously; If the data operated by the instruction does not exist previously, the instruction operation is to generate data, and the data file is stored to form an instruction operation data record; If the data of the instruction operation exists before, the encrypted hash value of the data's last instruction operation data record is put into the current instruction operation data record, and the current instruction operation data record is stored in the cloud after the data's last instruction operation data record; wherein, a classification identifier is generated for the data according to the data classification rules.

2. A data security control method according to claim 1, characterized in that: The determining whether the permission account of the login node matches the operation data includes: determining whether the permission of the permission account matches the permission of the operation data according to the classification identification of the data.

3. A data security control method according to claim 1, characterized in that: If the data operated by the instruction does not exist before, it also includes: forming a data file with the source of the data, timestamp, classification identification, permission account login node identifier and permission account.

4. A data security control method according to claim 1, characterized in that: The data classification rules are determined based on national data security regulations, industry data regulations, organizational data confidentiality levels and organizational data value levels.

5. A data security control method according to claim 1, characterized in that: The instruction operations include generating, storing, modifying, copying, deleting and destroying data.

6. A data security control method according to claim 1, characterized in that: The stored data file is stored in a storage area divided according to the source and classification identification of the data, and the data file storage location is associated with the instruction operation data record.

7. A data security control method according to claim 1, characterized in that: If the permission to operate the data needs to match multiple permission accounts at the same time, then: determine whether the permission account of the login node and the signatures of the other permission accounts received by the login node match the operation data; If so, the instruction operation, timestamp, classification identification and authorization account login node identifier are combined with the authorization account of the login node and the signatures of other authorization accounts received by the login node to form a data file.

8. A data security control method according to any one of claims 1 to 7, characterized in that: After the operation data completes the corresponding instruction operation, it also includes: encrypting the data after completing the corresponding instruction operation; or, The forming of the data file further includes: encrypting the data file.

9. A data security control method according to any one of claims 1 to 7, characterized in that: Also includes: The instruction operation data records are sent to the internal nodes of the organization, the internal nodes of the organization reach a consensus on the instruction operation data records, and the instruction operation data records are stored in the cloud.

10. A data security control system, characterized in that: include: A classification identification generating unit, used to generate a classification identification for the data according to the data classification rules; The authority matching judgment unit is used to judge whether the authority account of the login node matches the operation data authority; The instruction operation execution unit is used to refuse to execute the instruction operation if the permission matching judgment unit detects an instruction operation that does not match the permission account operation data; If the permission matching judgment unit detects an instruction operation that matches the permission account operation data; Then: the operation data completes the corresponding instruction operation; A data file generating unit, used to form a data file by signing the data identifier, instruction operator, timestamp, classification identifier, account-limited login node identifier and permission account together with the permission account; A storage unit used to determine whether the data operated by the instruction exists previously; If the data operated by the instruction does not exist previously, the instruction operation is to generate data, and the data file is stored to form an instruction operation data record; If the data of the instruction operation exists before, the encrypted hash value of the data of the last instruction operation data record is put into the data record of this instruction operation, and the data record of this instruction operation is stored in the cloud after the data of the last instruction operation data record.

11. A data security control method, characterized in that: include: Determine whether the authorized account signature of the data file sent by the authorized account is decrypted; If the authorized account signature cannot be decrypted, the data file will be refused to be read; If the authorized account signature is successfully decrypted, the data file is interpreted; Determine whether the node authority account that successfully decrypts matches the hierarchical identifier of the data file; If there is a match, the node identifier of the successfully decrypted node is fed back to the node that the authorized account has logged in to the most recently, and the data file operation record formed by the hash value of the data file and the successfully decrypted node identifier is stored in the cloud.

12. A data security control method according to claim 11, characterized in that: Also includes: The data file operation record storage location is associated with the data file storage location.

13. A data security control system, characterized in that it includes: The signature decryption unit is used to decrypt the authority account signature and determine whether the authority account signature of the data file sent by the authority account is decrypted; The file interpretation unit is used to refuse to decrypt the data file if the signature decryption unit cannot decrypt the authorized account signature; If the signature decryption unit successfully decrypts the authority account signature, it is used to interpret the data file, and also includes: a hierarchical identification judgment unit, which is used to judge whether the node authority account that has successfully decrypted matches the hierarchical identification of the data file; If there is a match, the node identifier of the successfully decrypted node is fed back to the node that the authorized account has logged in to the most recently, and the data file operation record formed by the hash value of the data file and the successfully decrypted node identifier is stored in the cloud.

Images