Service security policy generation method and device, equipment and storage medium

Abstract

The invention provides a service security policy generation method and device, equipment and a storage medium, which can be applied to the technical field of information security and the field of financial science and technology. The service security policy generation method comprises the following steps: in response to received service data, generating a security attribute table based on a data type of service sub-data included in the service data; determining target attribute data from multiple pieces of attribute data included in the security attribute table; a risk strategy corresponding to the target attribute data is determined from a preset risk database, and the preset risk database comprises the incidence relation between the target attribute data and the risk strategy; and determining a service security policy model based on the risk policy and a target processing policy corresponding to the risk policy.

Description

Technical Field

[0001] The present disclosure relates to the fields of information security technology and financial technology, and in particular to a method, device, equipment, medium and program product for generating a business security strategy. Background Art

[0002] With the rapid development of Internet technology, the business processing of many enterprises has gradually shifted from offline to online. Although online business processing has the advantage of convenience, it also generates a large number of security threats. For the business security threats found, security strategies are usually designed from the perspective of overall business processing.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following problems in the related technology: by determining the security policy from the perspective of overall business processing, it is impossible to determine the corresponding security policy for different business needs, and there is a mismatch between the security policy and the business needs in business processing. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a service security policy generation method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a business security policy generation method is provided, comprising: in response to receiving business data, generating a security attribute table based on the data type of business sub-data included in the above business data; determining target attribute data from multiple attribute data included in the above security attribute table; determining a risk strategy corresponding to the above target attribute data from the above preset risk database, wherein the above preset risk database includes an association relationship between the above target attribute data and the risk strategy; determining a business security policy model based on the above risk strategy and a target processing strategy corresponding to the above risk strategy.

[0006] According to an embodiment of the present disclosure, the security attribute table is generated based on the data type of the business sub-data included in the above-mentioned business data, including: determining the first target business sub-data based on the data type of the business sub-data included in the above-mentioned business data; determining the risk sub-data based on the data format of the above-mentioned first target business sub-data; generating a security attribute table based on the above-mentioned risk sub-data and the second target business sub-data, wherein the above-mentioned second target business sub-data is the business sub-data in the above-mentioned business sub-data excluding the above-mentioned first target business sub-data.

[0007] According to an embodiment of the present disclosure, the data format of the above-mentioned target business sub-data includes a file format, and the above-mentioned target business sub-data includes multiple data headers; the above-mentioned determination of risk sub-data based on the data format of the above-mentioned target business sub-data includes: when the data format of the above-mentioned target business sub-data is a file format, based on a preset data identifier, determining a target data title from the above-mentioned multiple data headers; based on the above-mentioned target data title, determining candidate risk data; based on a regular expression, determining target candidate risk data from the above-mentioned candidate risk data; based on a preset risk data table, determining risk sub-data from the above-mentioned multiple target candidate risk data.

[0008] According to an embodiment of the present disclosure, the data format of the above-mentioned target business sub-data includes a text format; the above-mentioned determination of the risk sub-data based on the data format of the above-mentioned target business sub-data includes: when the data format of the above-mentioned target business sub-data is a text format, segmenting the above-mentioned target business sub-data to obtain at least one sub-data word segmentation sequence; inputting the above-mentioned at least one sub-data word segmentation sequence into a trained language model respectively to obtain a probability value that the above-mentioned sub-data word segmentation sequence is the above-mentioned risk sub-data; when the above-mentioned probability value is greater than or equal to the target threshold, using the above-mentioned sub-data word segmentation sequence as the above-mentioned risk sub-data.

[0009] According to an embodiment of the present disclosure, the above-mentioned security attribute table includes a security type corresponding to the above-mentioned security attribute table; the above-mentioned determination of target attribute data from the multiple attribute data included in the above-mentioned security attribute table includes: based on the above-mentioned security type, determining a target title from the above-mentioned security data table; based on the above-mentioned target title, determining the above-mentioned target attribute data.

[0010] According to an embodiment of the present disclosure, there is at least one security attribute table, and the method further includes: determining a target security attribute table whose security type is a regional security type and an object security type; based on the target security attribute table, generating a security trust model so as to determine the trusted objects in the business processing process based on the security trust model.

[0011] According to an embodiment of the present disclosure, the above-mentioned determination of the risk strategy corresponding to the above-mentioned target attribute data from the above-mentioned preset risk database includes: matching the above-mentioned target attribute data with the above-mentioned preset risk database to obtain a matching result; in the case where the above-mentioned matching result represents that the target attribute data exists in the above-mentioned preset risk database, determining the risk category of the above-mentioned target attribute data; based on the above-mentioned risk category, determining the above-mentioned risk strategy, wherein the above-mentioned risk category includes sensitive information risk, identity authentication risk, resource abuse risk and transaction risk.

[0012] According to an embodiment of the present disclosure, the business security policy model is determined based on the risk strategy and the processing strategy corresponding to the risk strategy, including: generating a policy summary based on the risk strategy; matching in a preset policy table based on the policy summary to obtain a matching result; when the matching result indicates that the policy summary exists in the preset policy table, determining a target processing strategy corresponding to the policy summary, wherein the preset policy table includes an association relationship between multiple preset risk strategies and multiple preset processing strategies; generating the business security policy model based on the risk strategy and the target processing strategy.

[0013] The second aspect of the present disclosure provides a business security policy generation device, including: a security attribute generation module, which is used to generate a security attribute table in response to receiving business data based on the data type of the business sub-data included in the above business data; a target data determination module, which is used to determine the target attribute data from the multiple attribute data included in the above security attribute table; a risk strategy determination module, which is used to determine the risk strategy corresponding to the above target attribute data from the above preset risk database, wherein the above preset risk database includes the association relationship between the above target attribute data and the risk strategy; and a policy model determination module, which is used to determine the business security policy model based on the above risk strategy and the target processing strategy corresponding to the above risk strategy. The third aspect of the present disclosure provides an electronic device, including: one or more processors; a memory, which is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above business security policy generation method.

[0014] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned business security policy generation method.

[0015] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned business security policy generation method when executed by a processor.

[0016] According to an embodiment of the present disclosure, in response to receiving business data, a security attribute table is generated based on the data type of business sub-data included in the business data, and the target attribute data is determined from the multiple attribute data included in the security data table, and then the risk strategy corresponding to the target attribute data is determined from the preset risk database, and the business security policy model is determined based on the risk strategy and the processing strategy corresponding to the risk strategy, so that the business security policy model including the risk strategy and the processing strategy corresponding to the risk strategy can be determined. Since the security attribute table is generated by the data type of the business sub-data, the scattered business sub-data are classified and summarized, so that the target attribute data that may have security risks can be quickly confirmed from the security attribute table, and then the risk strategy corresponding to the target attribute data is matched from the preset risk database, and the final business security policy model is determined by the risk strategy and the target processing strategy corresponding to the risk strategy. Therefore, the technical problem of the mismatch between the security policy and the business demand is at least partially solved, and it is achieved that the possible security threats can be fully and accurately determined, and the security policy corresponding to the security threat can be accurately and comprehensively determined, so as to better ensure the security and stability of business processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the service security policy generation method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0019] Figure 2 The flowchart of the service security policy generating method according to the embodiment of the present disclosure is schematically shown.

[0020] Figure 3 The flowchart of generating a security attribute table according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 4 The flowchart of generating a security trust model according to an embodiment of the present disclosure is schematically shown.

[0022] Figure 5 A schematic diagram of a security trust model of an embodiment of the present disclosure is schematically shown.

[0023] Figure 6 A schematic diagram of a security trust model according to another embodiment of the present disclosure is schematically shown.

[0024] Figure 7 The structural block diagram of the service security policy generating device according to the embodiment of the present disclosure is schematically shown.

[0025] Figure 8 A block diagram of an electronic device suitable for implementing a service security policy generating method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0029] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0030] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] During the research process, it was found that many enterprises have the advantage of online business processing, but it also generates a large number of security threats. For the business security threats found, security policies are usually designed from the perspective of overall business processing. Instead of determining targeted security policies based on the possible security threats of business data corresponding to business scenarios, when the security policies are implemented, the security policy definitions of business processing systems or application systems that process business are relatively weak, and there may be a mismatch between security policies and business needs: for example, some security policies are missing or light; some business scenarios have insufficient security authentication, resulting in more business security vulnerabilities; or some business scenarios have too heavy security policies, which may cause the usability to be impaired or the cost to be too high due to the heavy security policies.

[0032] An embodiment of the present disclosure provides a method for generating a business security policy, comprising: in response to receiving business data, generating a security attribute table based on the data type of business sub-data included in the business data; determining target attribute data from multiple attribute data included in the security attribute table; determining a risk strategy corresponding to the target attribute data from the preset risk database, wherein the preset risk database includes an association relationship between the target attribute data and the risk strategy; and determining a business security policy model based on the risk strategy and a target processing strategy corresponding to the risk strategy.

[0033] Figure 1 The application scenario diagram of the service security policy generation method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0036] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0037] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the service security policy generation method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the service security policy generation device provided in the embodiment of the present disclosure can generally be set in the server 105. The service security policy generation method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the service security policy generation device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figure 2 to Figure 6 The service security policy generating method of the disclosed embodiment is described in detail.

[0041] Figure 2 The flowchart of the service security policy generating method according to the embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the service security policy generating method includes operations S210 to S240.

[0043] In operation S210, in response to receiving the business data, a security attribute table is generated based on a data type of business sub-data included in the business data.

[0044] According to an embodiment of the present disclosure, when business data is received, a security attribute table may be generated based on the data type of the business sub-data included in the business data. There is no limit on the number of security attribute tables generated, which may be multiple or one.

[0045] According to the embodiments of the present disclosure, the specific data type of the business data is not limited and can be any business-related data, for example: business architecture data, which is data used as a basis for system or program development.

[0046] According to the embodiments of the present disclosure, the data type of the business sub-data is not limited, and may include multiple data types or only one data type.

[0047] According to an embodiment of the present disclosure, the data types of business sub-data include: asset type, time type, region type, business type and object type, and the names of the business sub-data can correspond to system asset data, time information data, region information data, business process data and stakeholder data, etc.

[0048] According to an embodiment of the present disclosure, the system asset data may be object data that needs to be protected in a business scenario of business data, such as user funds, user data, and the like.

[0049] According to an embodiment of the present disclosure, the time information data may be time attribute data related to functions in a business scenario of the business data, such as system operating time, certificate validity period, etc.

[0050] According to an embodiment of the present disclosure, the regional information data may be data related to a region in a business scenario of business data, such as whether a system or business is published domestically or overseas, online or offline.

[0051] According to an embodiment of the present disclosure, the business process data is data of a business process that needs to be executed when processing a business in a business scenario of the business data.

[0052] According to an embodiment of the present disclosure, stakeholder data is information about each participant in a business scenario, such as individual customers, banks, operators, etc.

[0053] According to an embodiment of the present disclosure, the security types of security attribute tables generated for different types of business sub-data are different. For example, the security type of the security attribute table generated for time information data is the time security type, and the security type of the security attribute table generated for regional information data is the regional security type.

[0054] According to the embodiments of the present disclosure, the security attribute table generated based on the business sub-data of the business data can better realize the aggregation of the business sub-data and the business description, thereby more conveniently determining the security vulnerabilities that may exist in the business scenario.

[0055] In operation S220, target attribute data is determined from among a plurality of attribute data included in the security attribute table.

[0056] According to an embodiment of the present disclosure, a security attribute table generally includes a plurality of attribute data, and the attribute data are divided into different groups according to the characteristics of the attribute data, and each group includes a respective title.

[0057] According to an embodiment of the present disclosure, for security attribute tables of different security types, target data can be determined from a target title that matches the preset title data table based on a preset title data table, wherein the preset title data table is a table storing data titles corresponding to data that may have risk vulnerabilities in security attribute tables of different security types.

[0058] According to an embodiment of the present disclosure, target attribute data can be determined more quickly and accurately among a plurality of attribute data included in a security attribute table by determining a target title.

[0059] In operation S230, a risk strategy corresponding to the target attribute data is determined from a preset risk database, wherein the preset risk database includes an association relationship between the target attribute data and the risk strategy.

[0060] According to the embodiments of the present disclosure, by matching the target attribute data in a preset risk database, a risk strategy that may correspond to the target attribute data can be obtained.

[0061] According to an embodiment of the present disclosure, different target attribute data correspond to different risk categories, and different risk categories correspond to different risk strategies.

[0062] According to an embodiment of the present disclosure, after determining the risk category corresponding to the target attribute data, the candidate risk strategy corresponding to the risk category can be determined from a preset risk database, and the first attribute data associated with the target attribute data can be queried in the security attribute table based on the target attribute data, so as to re-screen the candidate risk strategies based on the first attribute data and obtain the risk strategy.

[0063] According to the embodiments of the present disclosure, by determining the risk strategy corresponding to the target attribute data from the preset risk database, the risk strategy that may exist in the target attribute data can be comprehensively determined, thereby further ensuring the determination of the risk strategy required in the business scenario and avoiding risk loopholes.

[0064] In operation S240 , a business security policy model is determined based on the risk policy and the target processing policy corresponding to the risk policy.

[0065] According to the embodiments of the present disclosure, based on the risk strategy, the processing strategy corresponding to the risk strategy can be determined from the preset strategy table, so that different risks or threats in the business security policy model have corresponding solutions, reducing the possibility of mismatch between the processing strategy and the risk strategy, and achieving guidance for subsequent security policy implementation based on business planning.

[0066] According to an embodiment of the present disclosure, in response to receiving business data, a security attribute table is generated based on the data type of business sub-data included in the business data, target attribute data is determined from multiple attribute data included in the security data table, and then the risk strategy corresponding to the target attribute data is determined from the preset risk database, and the business security policy model is determined based on the risk strategy and the processing strategy corresponding to the risk strategy, so that the business security policy model including the risk strategy and the processing strategy corresponding to the risk strategy can be determined. Since the security attribute table is generated by the data type of the business sub-data, the scattered business sub-data are classified and summarized, so that the target attribute data that may have security risks can be quickly confirmed from the security attribute table, and then the risk strategy corresponding to the target attribute data is matched from the preset risk database, and the final business security policy model is determined by the risk strategy and the target processing strategy corresponding to the risk strategy. Therefore, the technical problem of inaccurate design of the security policy is at least partially solved, and the technical effect of being able to comprehensively and accurately determine the possible security threats and being able to determine a comprehensive and accurate security policy for the possible security threats is achieved.

[0067] Figure 3 The flowchart of generating a security attribute table according to an embodiment of the present disclosure is schematically shown.

[0068] like Figure 3 As shown, generating the security attribute table includes operations S211 to S213.

[0069] In operation S211, first target business sub-data is determined based on a data type of business sub-data included in the business data.

[0070] In operation S212, risk sub-data is determined based on the data format of the first target business sub-data.

[0071] In operation S213, a security attribute table is generated based on the risk sub-data and the second target business sub-data, wherein the second target business sub-data is the business sub-data in the business sub-data except the first target business sub-data.

[0072] According to an embodiment of the present disclosure, the data type of the first target business sub-data may be business process data.

[0073] According to an embodiment of the present disclosure, the data format of the first target business sub-data may include a file format and a text format.

[0074] According to an embodiment of the present disclosure, different processing schemes may be determined based on the data format of the first target sub-data, and the risk sub-data may be determined by processing the first target sub-data based on the processing scheme.

[0075] According to an embodiment of the present disclosure, security attribute tables of different security types can be constructed based on risk sub-data and the second target business sub-data. There is no limitation on the construction method of the security attribute table. In order to extract the target business sub-data, the second target business sub-data or the risk sub-data can be matched with the preset attribute data table to determine the data associated with the second target business sub-data or the risk sub-data. For example: when the data type of the second target business sub-data is a time type, a security attribute table of a time security type is generated, as shown in Table 1; when the data type of the second target business sub-data is a regional type, a security attribute table of a regional security type is generated, as shown in Table 2; when the data type of the second target business sub-data is an object type request, a security attribute table of an object security type is generated, as shown in Table 3; when a security attribute table of an object risk type is generated from risk sub-data, as shown in Table 4.

[0076] Table 1

[0077] Time Type Business Type Certification basis Authorization Deadline Log in Certificate validity period Record retention period Query Storage duration

[0078] Table 2

[0079] channel area Access method Web page worldwide Extranet Mini Programs Domestic Extranet

[0080] Table 3

[0081] Stakeholders Classification Authentication Individual Customers Individual Customers Identity Authentication Third-party payment Payment Institutions Interface Authentication

[0082] Table 4

[0083] Risk Data Business Scenario Data Types Bank card number Withdrawal / Deposit / Transfer Sensitive Data ID number Identity confirmation Privacy Data

[0084] According to the embodiments of the present disclosure, Tables 1 to 3 are only for illustration, and there is no limitation on the data volume and title names of the attribute data in Tables 1 to 3. A security attribute table with different attribute data or title names can be obtained according to business requirements.

[0085] According to an embodiment of the present disclosure, taking the generation of a security attribute table as shown in Table 3 as an example: based on the second target business sub-data under the stakeholder title, matching with the preset attribute data table is performed to obtain classification data and authentication method data associated with individual customers, and classification data and authentication method data associated with third-party payments are obtained, and multiple data are classified and summarized to obtain a security attribute table as shown in Table 3.

[0086] According to the embodiments of the present disclosure, since the first target business sub-data may include risk sub-data that may pose risks in the business processing process, and the risk sub-data cannot be directly obtained based on the first target business sub-data, it is necessary to reprocess the first target business sub-data so as to directly obtain the risk sub-data, thereby achieving a comprehensive determination of the risk sub-data hidden in ordinary data, and generating a security attribute table based on the risk sub-data or business sub-data of other data types, thereby achieving a classified summary of possible threats or implicit risks, facilitating subsequent classification processing, and thus ensuring the security of business scenarios.

[0087] According to an embodiment of the present disclosure, the data format of the target business sub-data includes a file format, and the target business sub-data includes multiple data headers; determining the risk sub-data based on the data format of the target business sub-data may include the following operations.

[0088] When the data format of the target business sub-data is a file format, based on a preset data identifier, the target data title is determined from multiple data titles; based on the target data title, the candidate risk data is determined; based on a regular expression, the target candidate risk data is determined from the candidate risk data; based on a preset risk data table, the risk sub-data is determined from multiple target candidate risk data.

[0089] According to an embodiment of the present disclosure, when the data format of the target service sub-data is a file format, the target service sub-data includes a plurality of data headers, and the data queue in the target service sub-data can be read based on the data headers.

[0090] According to an embodiment of the present disclosure, based on a preset data identifier, a target data title can be determined from multiple data titles, and a coordinate value corresponding to the target data title can be determined from a file index of a target business sub-data, thereby obtaining the location of the target data title, wherein the file index includes multiple data titles and coordinate values ​​corresponding to each data title.

[0091] According to an embodiment of the present disclosure, based on the location of the target data title, the location of the target data title in the target business sub-data can be determined, thereby determining the data content included in the location and using the data content as candidate risk data.

[0092] According to an embodiment of the present disclosure, candidate risk data are matched with preset regular expressions, and multiple target candidate risk data can be determined from the acquired risk data, such as risk information such as bank card number, mobile phone number, and ID card number. The target candidate risk data are then filtered through a preset risk data table to remove data that meets the regular expression but does not pose a risk and data that has a matching error with the regular expression, thereby obtaining risk sub-data.

[0093] According to an embodiment of the present disclosure, when the target business sub-data is in a file format, the target data title is determined, and the candidate risk data under the target data title is determined, and the candidate risk data is screened based on regular expressions through regular matching to obtain target candidate risk data. In order to ensure the degree of integration with the business scenario and avoid the existence of target candidate risk data obtained due to errors, the target candidate risk data is screened through a preset risk data table, thereby obtaining risk sub-data that is more accurate and highly integrated with the business scenario.

[0094] According to an embodiment of the present disclosure, the data format of the target business sub-data includes a text format; determining the risk sub-data based on the data format of the target business sub-data may include the following operations.

[0095] When the data format of the target business sub-data is a text format, the target business sub-data is segmented to obtain at least one sub-data segmentation sequence; at least one sub-data segmentation sequence is respectively input into a trained language model to obtain a probability value of the sub-data segmentation sequence being risk sub-data; when the probability value is greater than or equal to a target threshold, the sub-data segmentation sequence is used as risk sub-data.

[0096] According to an embodiment of the present disclosure, when the data format of the target business sub-data is a text format, the target business sub-data is segmented. For example, if the target business sub-data is "please enter the SMS verification code", the target business sub-data may be segmented as follows: please | enter | SMS | verification code.

[0097] According to an embodiment of the present disclosure, a word segmentation sequence is constructed for the target business sub-data after word segmentation. There is no limit on the number of words included in each sequence, which can be determined based on the language model into which the sub-data word segmentation sequence is to be input.

[0098] According to an embodiment of the present disclosure, a sub-data word segmentation sequence is input into a trained language model, and the semantic similarity between the sub-data word segmentation sequence and the risk sub-data is calculated, so that the probability value of each sub-data word segmentation sequence being a risk sub-data can be obtained. There is no limitation on the language model, and any language model that can obtain the probability value of the sub-data word segmentation sequence being a risk sub-data can be used, such as: n-gram.

[0099] According to an embodiment of the present disclosure, the number of words in each sub-data word segmentation sequence can be determined by n. For example, if the language model is 2-gram, then for please|input|SMS|verification code, a sub-data word segmentation sequence that can be obtained is {please, input}, {SMS, verification code}.

[0100] According to an embodiment of the present disclosure, the trained language model is a language model obtained after fully training the sample sub-data word segmentation sequence and labels.

[0101] According to the embodiments of the present disclosure, there is no limitation on the target threshold, and a suitable target threshold can be set according to actual conditions.

[0102] According to an embodiment of the present disclosure, for target business sub-data in text format, risk sub-data can be quickly and accurately acquired by performing word segmentation and inputting a trained word segmentation model.

[0103] According to the embodiments of the present disclosure, for target business sub-data in different data formats, risk sub-data is extracted from the target business sub-data by adopting different extraction methods, thereby improving the accuracy and comprehensiveness of extracting risk sub-data from the target business sub-data.

[0104] According to an embodiment of the present disclosure, the security attribute table includes a security type corresponding to the security attribute table; determining target attribute data from a plurality of attribute data included in the security attribute table may include the following operations.

[0105] Based on the security type, the target title is determined from the security data sheet; based on the target title, the target attribute data is determined.

[0106] According to the embodiments of the present disclosure, since the target attribute data of security attribute tables of different security types are not the same, when determining the target attribute data, it is necessary to first determine the security type of the security data line table, and then determine the target title to which the useful data belongs through the preset title data table, so as to use the attribute data belonging to the target title as the target attribute data.

[0107] According to the embodiments of the present disclosure, the target attribute data can be determined conveniently, quickly and accurately through the above method.

[0108] Figure 4 The flowchart of generating a security trust model according to an embodiment of the present disclosure is schematically shown.

[0109] like Figure 4 As shown, there is at least one security attribute table, and the method may further include operations S410 to S420.

[0110] In operation S410, a target security attribute table whose security types are a regional security type and an object security type is determined.

[0111] In operation S420, a security trust model is generated based on the target security data table, so as to determine a trusted object in a business processing process based on the security trust model.

[0112] According to an embodiment of the present disclosure, through a target security attribute table whose security types are regional security type and object security type, the association relationships between stakeholders, between regions, and between stakeholders and regions, as well as the required authentication methods are determined, so that a security trust model can be generated.

[0113] Figure 5 A schematic diagram of a security trust model of an embodiment of the present disclosure is schematically shown.

[0114] like Figure 5 As shown, in actual business scenarios, individual customers may make payments through third-party payment platforms. When using third-party payment platforms to make payments, the third-party payment platform needs to determine whether the individual customer is authorized, whether the individual customer needs to be authenticated, whether the individual customer is the user corresponding to the user management information, and whether the UnionPay payment platform needs to authenticate the identity of the third-party payment platform. When there are no problems with the identification, authorization and authentication results, the trust relationship between the individual customer, the third-party payment platform and the UnionPay payment platform is considered to be credible. Among them, UnionPay is a network payment clearing platform for non-bank payment institutions.

[0115] According to the embodiments of the present disclosure, a transaction relationship may exist between an individual customer and a merchant. Before conducting a transaction, the merchant's information needs to be determined, and the individual customer needs to authenticate, authorize, and identify the merchant's credibility. Similarly, when a merchant establishes a transaction relationship with the UnionPay payment platform, the UnionPay payment platform needs to identify the merchant. When both the authentication and authorization are passed, it can be determined that the trust relationship between the individual customer, the merchant, and the UnionPay payment platform is credible.

[0116] According to the embodiments of the present disclosure, when individual customers use various Internet platforms, the same Internet platform also needs to perform user management and authentication behaviors such as logging in for the individual customers, and requires the user and the Internet platform to authorize and confirm their respective permissions. The Internet platform needs to trade with the operator to obtain network resources on the operator side. The operator side will identify the Internet platform to determine whether the Internet platform is a platform that can use network resources. At the same time, the risk monitor side will monitor the Internet platform to perform risk control and audit on the Internet platform, thereby determining whether each object is trustworthy based on the above process.

[0117] According to the embodiments of the present disclosure, individual customers can also conduct transactions or handle business through bank tellers. When conducting transactions, tellers need to perform user management, authorization, identity authentication, and identify other information for individual customers. Tellers can be authenticated by bank branches, and similarly, bank branch business ChinaNetPay payment platforms and UnionPay payment platforms perform authentication. Therefore, when there are no problems in the various authorization, authentication, and identification processes, all objects can be trusted.

[0118] According to the embodiments of the present disclosure, through the security trust model, it is possible to know whether each object in the business processing is trustworthy, and what kind of authentication is required to make the object trustworthy, thereby realizing the reminder effect on the trusted objects. In the actual business processing process, if there is a trust relationship between stakeholders that does not conform to the security information model, an early warning can be issued.

[0119] According to the embodiments of the present disclosure, based on the security trust model, it is possible to judge whether each stakeholder in each process node is trustworthy in the subsequent actual business processing process, thereby accelerating the security of business processing and avoiding business risks caused by incorrect trust relationships as much as possible.

[0120] According to an embodiment of the present disclosure, determining a risk strategy corresponding to target attribute data from a preset risk database may include the following operations.

[0121] Match the target attribute data with the preset risk database to obtain a matching result; when the matching result indicates that the target attribute data exists in the preset risk database, determine the risk category of the target attribute data; based on the risk category, determine the risk strategy, wherein the risk categories include sensitive information risk, identity authentication risk, resource abuse risk, and transaction risk.

[0122] According to an embodiment of the present disclosure, by matching the target attribute data in a preset risk database, the risk category corresponding to the target attribute data can be determined, and through the association between the risk category and the risk strategy included in the preset risk database, the risk strategy corresponding to the target attribute data can be directly determined.

[0123] According to an embodiment of the present disclosure, it is also possible to determine an initial risk strategy corresponding to the risk category from a preset risk database through the risk category corresponding to the target attribute data, and then determine the attribute data associated with the target attribute data through a security attribute table, and screen the initial risk strategy to obtain a more accurate risk strategy.

[0124] According to an embodiment of the present disclosure, different risk strategies correspond to different risk categories, and the risk categories include sensitive information risk, authentication risk, resource abuse risk, and transaction risk.

[0125] According to an embodiment of the present disclosure, sensitive information risks may include sensitive information leakage risks, sensitive information input risks, and privacy protection risks.

[0126] According to an embodiment of the present disclosure, the risk of sensitive information leakage refers to a situation where sensitive information leakage may exist. When the risk category of the target attribute data is sensitive information risk, the sensitivity level classification of the target attribute data can be determined, and different risk strategies should be adopted for target attribute data of different sensitivity levels. For example, when the sensitivity level of the target attribute data is high, the risk strategy may be to not display all the target attribute data.

[0127] According to an embodiment of the present disclosure, the sensitive information input risk may be a risk category corresponding to target attribute data related to user input, such as input information, write information, etc.

[0128] According to an embodiment of the present disclosure, the privacy protection risk may be a risk category corresponding to target attribute data related to user privacy data. The target attribute data may be privacy data such as name and age. The strategy corresponding to the privacy protection risk may be a prompt for where to perform privacy protection.

[0129] According to an embodiment of the present disclosure, identity authentication risk may also include different types of sub-identity authentication risks, such as facial recognition authentication risk, bank card account number and password authentication risk, etc. There are also different risk strategies for different sub-identity authentication risks.

[0130] According to an embodiment of the present disclosure, resource abuse risk may be a problem involving unnecessary waste of resources multiple times, such as repeated unbinding of cards, repeated queries of the same, etc. The target attribute data corresponding to the resource abuse risk may be unbinding, binding, etc.

[0131] According to an embodiment of the present disclosure, transaction risks may include situations where there is a risk of transaction denial, for example, a user may deny having handled a business or conducted a transaction. The target attribute data corresponding to the transaction authentication risk may be an electronic signature, SMS prompt, etc.

[0132] According to the embodiments of the present disclosure, by comparing the target attribute data with a preset database, the risk strategy that may be required in the business can be comprehensively and quickly determined, thereby comprehensively preventing possible security threats.

[0133] According to an embodiment of the present disclosure, determining a service security policy model based on a risk policy and a processing policy corresponding to the risk policy may include the following operations.

[0134] Based on the risk strategy, a policy summary is generated; based on the policy summary, a match is performed in the preset policy table to obtain a matching result; when the matching result indicates that there is a policy summary in the preset policy table, a target processing strategy corresponding to the policy summary is determined, wherein the preset policy table includes an association relationship between multiple preset risk strategies and multiple preset processing strategies; based on the risk strategy and the target processing strategy, a business security policy model is generated.

[0135] According to the embodiments of the present disclosure, there is no limitation on the method for generating the policy summary, and the method may be any method that can generate the policy summary, such as keyword extraction.

[0136] According to an embodiment of the present disclosure, after the risk strategy is determined, a policy summary is generated for each risk strategy, and the policy summary is matched in the preset policy table to obtain a matching result. When the matching result indicates that there is a policy summary in the preset policy table, the target processing strategy corresponding to the policy summary can be determined. By organizing the risk category, risk strategy and target processing strategy, a business security policy model is generated. The business security policy model can be as shown in Table 5.

[0137] Table 5

[0138]

[0139] According to the embodiments of the present disclosure, the business security policy model can be used to directly and comprehensively determine the risk strategies that should be used in business processing and how to handle the risk strategies, thereby avoiding the problem of mismatch between risk strategies and processing strategies and business needs, reducing the problem of business loopholes caused by insufficient security authentication in business processing due to the risk strategies and processing strategies being too light for business scenarios, or the problem of low ease of use or high cost in subsequent actual use due to overly heavy security strategies for business scenarios, thereby better improving the matching degree of risk strategies and processing strategies with business scenarios.

[0140] Figure 6 A schematic diagram schematically shows a method for generating a service security policy according to another embodiment of the present disclosure.

[0141] like Figure 6 As shown, based on the data type of the business sub-data 610 included in the business data, the first target business sub-data is determined, and then the first target business sub-data is processed according to the data format of the first target business sub-data to obtain the risk sub-data 620.

[0142] According to an embodiment of the present disclosure, a security attribute table 640 is obtained based on the risk sub-data 620 and the second target business sub-data 630 .

[0143] According to an embodiment of the present disclosure, target attribute data is determined from multiple attribute data included in the security attribute table 640, and then the risk strategy corresponding to the target attribute data is determined from the preset risk database; finally, based on the risk strategy, the target processing strategy corresponding to the risk strategy is determined from the preset policy table to determine the business security policy model 650.

[0144] According to an embodiment of the present disclosure, a target security attribute table whose security type is a regional security type and an object security type is determined from the security attribute table, and a security trust model 660 is generated through the target security attribute table.

[0145] Based on the above-mentioned service security policy generation method, the present disclosure also provides a service security policy generation device. Figure 7 The device is described in detail.

[0146] Figure 7 The structural block diagram of the service security policy generating device according to the embodiment of the present disclosure is schematically shown.

[0147] like Figure 7 As shown, the service security policy generating device 700 of this embodiment includes a security attribute generating module 710 , a target data determining module 720 , a risk policy determining module 730 and a policy model determining module 740 .

[0148] The security attribute generation module 710 is used to generate a security attribute table in response to receiving the business data and based on the data type of the business sub-data included in the business data.

[0149] The target data determination module 720 is used to determine target attribute data from the multiple attribute data included in the security attribute table.

[0150] The risk strategy determination module 730 is used to determine the risk strategy corresponding to the target attribute data from the preset risk database, wherein the preset risk database includes the association relationship between the target attribute data and the risk strategy.

[0151] The policy model determination module 740 is used to determine a business security policy model based on the risk policy and the target processing policy corresponding to the risk policy.

[0152] According to an embodiment of the present disclosure, the security attribute generation module 710 further includes a first determination submodule, a risk determination submodule, and a security attribute determination submodule.

[0153] The first determining submodule is configured to determine first target business sub-data based on a data type of the business sub-data included in the business data.

[0154] The risk determination submodule is used to determine the risk sub-data based on the data format of the first target business sub-data.

[0155] The security attribute determination submodule is used to generate a security attribute table based on the risk subdata and the second target business subdata, wherein the second target business subdata is the business subdata in the business subdata except the first target business subdata.

[0156] According to an embodiment of the present disclosure, the risk determination submodule further includes a title determination unit, a candidate data determination unit, a target data determination unit and a first risk determination unit.

[0157] The title determination unit is used to determine the target data title from the multiple data titles based on a preset data identifier when the data format of the target business sub-data is a file format.

[0158] The candidate data determining unit is used to determine the candidate risk data based on the target data title.

[0159] The target data determining unit is used to determine target candidate risk data from the candidate risk data based on a regular expression.

[0160] The first risk determination unit is used to determine risk sub-data from the plurality of target candidate risk data based on a preset risk data table.

[0161] According to an embodiment of the present disclosure, the risk determination submodule further includes a word segmentation unit, a probability determination unit and a second risk determination unit.

[0162] The word segmentation unit is used to segment the target business sub-data to obtain at least one sub-data word segmentation sequence.

[0163] The probability determination unit is used to input the at least one sub-data word segmentation sequence into the trained language model respectively to obtain the probability value of the sub-data word segmentation sequence being the risk sub-data.

[0164] The second risk determination unit is configured to use the sub-data word segmentation sequence as the risk sub-data when the probability value is greater than or equal to a target threshold.

[0165] According to an embodiment of the present disclosure, the target data module 720 further includes a title determination submodule and a target data determination submodule.

[0166] The title determination submodule is used to determine a target title from the safety data sheet based on the safety type.

[0167] The target data determination submodule is used to determine the target attribute data based on the target title.

[0168] According to an embodiment of the present disclosure, the target data module 720 further includes a security attribute determination submodule and a security model generation submodule.

[0169] The security attribute determination submodule is used to determine a target security attribute table whose security type is a regional security type and an object security type.

[0170] The security model generation submodule is used to generate a security trust model based on the target security attribute table, so as to determine the trusted object in the business processing process based on the security trust model.

[0171] According to an embodiment of the present disclosure, the risk strategy determination module 730 further includes a first matching submodule, a category determination submodule and a strategy determination submodule.

[0172] The first matching submodule is used to match the target attribute data with the preset risk database to obtain a matching result.

[0173] The category determination submodule is used to determine the risk category of the target attribute data when the matching result indicates that the target attribute data exists in the preset risk database.

[0174] The policy determination submodule is used to determine the risk policy based on the risk category, wherein the risk category includes sensitive information risk, identity authentication risk, resource abuse risk and transaction risk.

[0175] According to an embodiment of the present disclosure, the policy model determination module 740 further includes a summary generation submodule, a second matching submodule, a target policy determination submodule and a policy model generation submodule.

[0176] The summary generation submodule is used to generate a strategy summary based on the risk strategy.

[0177] The second matching submodule is used to perform matching in a preset policy table based on the policy summary to obtain a matching result.

[0178] The target strategy determination submodule is used to determine the target processing strategy corresponding to the strategy summary when the matching result indicates that the strategy summary exists in the preset strategy table, wherein the preset strategy table includes the association relationship between multiple preset risk strategies and multiple preset processing strategies.

[0179] The policy model generation submodule is used to generate the business security policy model based on the risk policy and the target processing policy.

[0180] According to an embodiment of the present disclosure, any multiple modules of the security attribute generation module 710, the target data determination module 720, the risk strategy determination module 730, and the policy model determination module 740 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the security attribute generation module 710, the target data determination module 720, the risk strategy determination module 730, and the policy model determination module 740 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the security attribute generation module 710, the target data determination module 720, the risk strategy determination module 730 and the strategy model determination module 740 may be at least partially implemented as a computer program module, which may perform a corresponding function when executed.

[0181] Figure 8 A block diagram of an electronic device suitable for implementing a service security policy generating method according to an embodiment of the present disclosure is schematically shown.

[0182] like Figure 8 As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include an onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0183] In RAM 803, various programs and data required for the operation of electronic device 800 are stored. Processor 801, ROM 802 and RAM 803 are connected to each other via bus 804. Processor 801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 802 and / or RAM 803. It should be noted that the program can also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0184] According to an embodiment of the present disclosure, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 may further include one or more of the following components connected to the input / output (I / O) interface 805: an input portion 806 including a keyboard, a mouse, etc.; an output portion 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 808 including a hard disk, etc.; and a communication portion 809 including a network interface card such as a LAN card, a modem, etc. The communication portion 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage portion 808 as needed.

[0185] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0186] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0187] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0188] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0189] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0190] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0191] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0192] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0193] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0194] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for generating a business security policy, comprising: In response to receiving the business data, generating a security attribute table based on the data type of the business sub-data included in the business data; Determining target attribute data from a plurality of attribute data included in the security attribute table; Determining a risk strategy corresponding to the target attribute data from the preset risk database, wherein the preset risk database includes an association relationship between the target attribute data and the risk strategy; A business security policy model is determined based on the risk policy and a target processing policy corresponding to the risk policy.

2. The method according to claim 1, wherein: The generating of the security attribute table based on the data type of the business sub-data included in the business data comprises: Determining first target business sub-data based on the data type of the business sub-data included in the business data; Determining risk sub-data based on the data format of the first target business sub-data; A security attribute table is generated based on the risk sub-data and the second target business sub-data, wherein the second target business sub-data is the business sub-data in the business sub-data except the first target business sub-data.

3. The method according to claim 2, wherein: The data format of the target service sub-data includes a file format, and the target service sub-data includes a plurality of data titles; The determining of the risk sub-data based on the data format of the target business sub-data includes: In a case where the data format of the target business sub-data is a file format, determining a target data title from the multiple data titles based on a preset data identifier; Based on the target data title, determining candidate risk data; Based on the regular expression, determining target candidate risk data from the candidate risk data; Based on a preset risk data table, risk sub-data are determined from the plurality of target candidate risk data.

4. The method according to claim 2, wherein: The data format of the target business sub-data includes a text format; The determining of the risk sub-data based on the data format of the target business sub-data includes: When the data format of the target business sub-data is a text format, segmenting the target business sub-data to obtain at least one sub-data segmentation sequence; Inputting the at least one sub-data word segmentation sequence into the trained language model respectively to obtain a probability value that the sub-data word segmentation sequence is the risk sub-data; When the probability value is greater than or equal to the target threshold, the sub-data word segmentation sequence is used as the risk sub-data.

5. The method according to claim 1, wherein: The security attribute table includes a security type corresponding to the security attribute table; The step of determining target attribute data from a plurality of attribute data included in the security attribute table comprises: determining a target title from the safety data sheet based on the safety type; Based on the target title, the target attribute data is determined.

6. The method according to claim 5, wherein the security attribute table is at least one, and the method further comprises: Determine a target security attribute table whose security type is a regional security type and an object security type; Based on the target security attribute table, a security trust model is generated, so as to determine a trusted object in a business processing process based on the security trust model.

7. The method according to claim 1, wherein: The step of determining the risk strategy corresponding to the target attribute data from the preset risk database includes: Matching the target attribute data with the preset risk database to obtain a matching result; In a case where the matching result indicates that the target attribute data exists in the preset risk database, determining the risk category of the target attribute data; The risk strategy is determined based on the risk categories, wherein the risk categories include sensitive information risk, identity authentication risk, resource abuse risk, and transaction risk.

8. The method according to claim 1, wherein: The determining of the business security policy model based on the risk policy and the processing policy corresponding to the risk policy includes: Based on the risk strategy, generating a strategy summary; Based on the policy summary, matching is performed in a preset policy table to obtain a matching result; In the case where the matching result indicates that the policy summary exists in the preset policy table, determining a target processing policy corresponding to the policy summary, wherein the preset policy table includes an association relationship between a plurality of preset risk policies and a plurality of preset processing policies; The business security policy model is generated based on the risk policy and the target processing policy.

9. A service security policy generating device, comprising: A security attribute generation module, configured to generate a security attribute table based on the data type of the business sub-data included in the business data in response to receiving the business data; A target data determination module, used to determine target attribute data from a plurality of attribute data included in the security attribute table; A risk strategy determination module, used to determine the risk strategy corresponding to the target attribute data from the preset risk database, wherein the preset risk database includes the association relationship between the target attribute data and the risk strategy; as well as The policy model determination module is used to determine the business security policy model based on the risk policy and the target processing policy corresponding to the risk policy.

10. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 8.

Images