Container and encryption-based data behavior security management method

Abstract

The invention discloses a container and encryption-based data behavior security management method. The method comprises the steps of preparation, data asset creation and association, data storage, data asset behavior recording, data asset behavior management and control and data asset output. The data is encrypted and stored by adopting an encryption technology, and the original data is converted into the ciphertext, so that the data is prevented from being illegally acquired in the transmission and storage process; access authority is strictly limited through RBAC control, it is ensured that only authorized users or application programs can access and operate data, and data leakage and tampering are prevented; data injection is realized by utilizing a data volume of a containerized platform, so that an application program in a container accesses external data, the data can be shared in different environments conveniently, the data can be stored persistently, and the availability of the data is ensured; the containerization expandability is convenient for expansion and adjustment when the data scale is expanded; the binding of the data ID and the comprehensive behavior record flow ensure the unique identification of the data and improve the accuracy and traceability of the data.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular focuses on a data behavior security management method based on container and encryption technology, and is committed to solving problems exposed by existing data security management methods in terms of subject and object binding, data protection and use integration, and data behavior management. Background Art

[0002] In today's era of surging digitalization, data has become the most core and critical asset of enterprises and organizations, and its role in enterprise operations, decision-making, business development, and innovation-driven development has become increasingly important. With the rapid development and evolution of information technology, the amount of data has shown an exponential growth trend, and its source channels have become increasingly extensive and diverse, covering massive real-time data collected from various sensors, massive information generated by users on social media platforms, and structured and unstructured data accumulated by different business systems within the enterprise. At the same time, the application scenarios of data are also continuously expanding and extending, covering a wide range of key fields and industries such as risk assessment and transaction analysis in the financial field, disease diagnosis and health management in the medical industry, experimental data processing and results derivation in scientific research, and precision marketing and user experience optimization of e-commerce platforms.

[0003] However, in sharp contrast, the existing data security management methods have obvious deficiencies and defects in many key links. In terms of the binding of subjects and objects, due to the lack of an effective binding mechanism, it is difficult to clearly define the ownership and use rights of data. This is like a building without a solid foundation, which can easily lead to a series of thorny problems such as data ownership disputes. In some complex data sharing scenarios, multiple subjects have disputes over the ownership of the same data, resulting in the inability to reasonably circulate and effectively use data.

[0004] In terms of the integration of data protection and use, the existing security management methods have failed to achieve an organic integration of the two. Data protection measures are often isolated from the use process, which makes data easily exposed to various security threats during actual use, and security risks such as hacker attacks, data leakage, and malicious tampering continue to rise. At the same time, this fragmented state seriously affects the full utilization of data and also restricts the mining of data value, making it impossible to maximize its efficiency in business processes. For example, in order to strengthen data security, some companies have excessively restricted data access, resulting in the business department being unable to obtain data in a timely manner when it needs data for decision-making and innovation support, delaying business development opportunities.

[0005] In the field of data behavior security management, there are even more problems. The accuracy of data behavior identification is seriously insufficient. There are often deviations in the identification of the source of data access requests, which may be misjudged as legal or illegal requests, giving criminals an opportunity to take advantage of them; if the monitoring of power switching and environmental space conversion is not timely, the change of data permissions at key links cannot be effectively supervised; the management of the subject's power scope and object operation is relatively extensive and difficult to achieve a fine level, which makes the data have many potential risks during use; if the subject exceeds the authority to operate, improperly modify or disseminate the data, it will seriously affect the integrity and confidentiality of the data. These problems seriously hinder the security and effective use of data, and cannot meet the growing needs of current data security management. An innovative and effective data behavior security management method is urgently needed to break the deadlock. Summary of the invention

[0006] In order to effectively solve the above problems, this paper proposes an innovative data behavior security management solution, the core of which is to finely manage the entire life cycle of data from injection to use based on container and encryption technology to ensure the security, traceability and efficient use of data. It is specifically achieved through the following steps: The present invention discloses a data behavior security management method based on container and encryption, comprising the following steps: Step 1: Preparation Clarify the roles and responsibilities of data providers to prepare for the start of the data asset injection process. This step is at the forefront of the entire process. It determines the execution subject (data provider) and its scope of responsibilities for subsequent data processing work, which is similar to building an organizational framework for the entire data asset processing process to ensure that subsequent operations are carried out in an orderly manner.

[0007] Step 2: Data asset creation and association stage Data asset ID Create: The data provider creates a unique ID for the data asset to be injected, ensuring that the data asset can be accurately identified and tracked throughout the data life cycle. This is the first identification creation work after the data asset enters the system, similar to giving the data asset a unique "ID number" to facilitate subsequent accurate management and operation.

[0008] The created IDs are strictly recorded and managed to ensure their accuracy and stability. This step is a supplement to the ID creation work, ensuring the reliable storage and use of ID information, preventing problems such as ID errors or loss, and maintaining the integrity of data asset identification.

[0009] Data asset subject and object binding: Identify the subject of the data asset, including the owner, creator, etc., and clarify their rights and responsibilities. This part of the content is related to the owner ID injection and related rights confirmation concepts in the appendix, but it more broadly covers the possible subject roles and their rights and responsibilities, and further clarifies the overall situation of the subjects related to the data asset on the basis of rights confirmation.

[0010] Determine the object of the data asset, such as storage devices, application systems, etc., and clarify the storage location and usage scenarios of the data in different environments. This operation associates the data asset with the specific storage and usage environment, which is a detailed definition of the data asset object. It has a certain echo with the environmental association after the data is injected into the container in the attachment, but it more comprehensively describes the various possible forms and scenarios of the object.

[0011] Combined with policies and authorizations, the access rights and usage scope of data assets are determined, and encryption and confirmation information is clarified to ensure the security and ownership clarity of data assets. This step further improves the management rules of data assets, including access control and encryption confirmation, on the basis of the subject and object determination. It is an extension and refinement of the owner configuration container rules in the appendix, and sets rules from a broader data asset management perspective.

[0012] Step 3: Data storage stage Data encryption storage: Advanced encryption algorithms are used to encrypt data and convert raw data into ciphertext data. This is a key technical operation to ensure data security. It is related to the secure management of data in the container in the attachment. It is a specific measure to ensure data confidentiality during data storage and prevent data from being illegally obtained during storage.

[0013] Select a safe and reliable storage method to store the encrypted data in a data container to prevent unauthorized access, theft or tampering during the storage process. This step includes both the selection of a storage location (data container) that is consistent with the data injection container in the attachment and the emphasis on the security requirements of the storage method. It is a further deepening of the concept of data storage security in the attachment, ensuring data storage security from both encryption and storage methods.

[0014] Step 4: Data asset behavior recording stage Record the operation content of data assets in each link, including detailed information such as injection time, operator, operation type, etc. This step begins to focus on the dynamic behavior record of data assets throughout the life cycle. Unlike the appendix, which mainly focuses on the confirmation process, this step expands the scope of recording to each operation link of data assets, providing a comprehensive data source for subsequent auditing and tracking.

[0015] Record the behavior choices of data assets, such as access requests, modification requests, etc., and the corresponding processing results. Further refine the behavior record content to record not only the operation itself, but also the operation intention (behavior choice) and processing results, which helps to gain a deeper understanding of the use and processing logic of data assets.

[0016] Record relevant information about data assets, such as source, purpose, etc., to form a complete data asset behavior record flow for subsequent audit and tracking. This step is a summary of the behavior record stage, emphasizing the integrity and purpose of the recorded information (audit and tracking). It is different from the records and monitoring in the appendix, which mainly revolve around the confirmation of ownership, and focuses more on the behavior record management of the entire process of data assets.

[0017] Step 5: Data asset behavior control stage Monitor and manage the behavior of data assets in real time. When a data asset behavior request is received, it is judged according to the pre-set policies and authorizations. This step adds real-time monitoring and management functions based on behavior records. It is related to the access rule settings after the rights are confirmed in the attachment, but it emphasizes dynamic behavior control, makes policy judgments based on real-time requests, and ensures the security and compliance of data assets during use.

[0018] For authorized actions, the corresponding operations of data assets are allowed to continue; for unauthorized actions, relevant information is rejected and recorded, and the reasons for rejection are fed back to the data user. This is the specific implementation operation of behavior control, which clarifies the processing methods for different types of behavior requests, ensures that data asset operations comply with pre-set rules, and enhances the transparency and traceability of the entire control process through the recording and feedback mechanism.

[0019] If the data user's behavior is rejected, he or she can make adjustments based on the feedback information and re-initiate the data asset behavior request. This link provides data users with an opportunity to correct their erroneous behavior, helps to improve the flexibility and rationality of data asset use, and also reflects the dynamic and interactive nature of the entire behavior control process.

[0020] In the data asset behavior control stage, it also covers the effective management of data transactions, circulation and utilization behaviors. For transaction behaviors, digital certificates, signatures and blockchain technologies are used to ensure that the transfer of ownership is legal and traceable, and the right of use is allocated based on the RBAC mechanism to ensure the standardization and security of the data transaction process; in terms of circulation behaviors, identity authentication, encrypted transmission technology and RBAC mechanism are used to ensure that data is safe and orderly when it is converted in different environmental spaces, and adapt to the security and authority requirements of different environments; and in terms of utilization behaviors, strict authority checking mechanisms are used to prevent the subject from overstepping authority, and at the same time, the logging system is used to record data usage behaviors in detail, so as to standardize data usage and provide a basis for auditing and optimization. Through these measures, the security, compliance and effectiveness of data assets in various behaviors are fully ensured, and the reasonable management and value realization of data assets are promoted.

[0021] Step 6: Data asset output stage When the behavior of data assets is authorized and meets the output conditions, the data asset output operation is performed. This step is the link in which data assets are output to the outside world in compliance with regulations after a series of previous processing, management and monitoring. Unlike the annex, which mainly focuses on rights confirmation and internal management, this step involves the interaction (output) between data assets and the external environment.

[0022] Ensure the security and accuracy of the output process, and record the time, destination, and other information of the output. This is a further specification of the output operation, emphasizing the security and information recording of the output process, preventing data security issues during the output process, and providing output-related information basis for possible subsequent audits or tracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The figure is a flow chart of the data behavior security management method based on containers and encryption of the present invention.

[0024] Figure 2 This is a diagram showing the implementation principle and characteristics of the data behavior security management method based on containers and encryption in the present invention. DETAILED DESCRIPTION

[0025] See also Figure 1 The present invention discloses a data behavior security management method based on container and encryption, comprising the following steps: Step 1: Preparation Clarify the roles and responsibilities of data providers: As the source of data, data providers are responsible for preliminary review of data to ensure the accuracy and completeness of data. For example, in enterprise data management, data providers need to check whether the order information in sales data is accurate and whether the product information is complete. At the same time, the legitimacy of the data source must be ensured and relevant laws and regulations must be complied with. For example, the collection of personal data requires user authorization.

[0026] Start the preparation work for the data asset injection process: Evaluate the network environment required for data injection, ensure that the network bandwidth meets the data transmission requirements, and that network security protection measures (such as firewall configuration) are in place. Prepare the interface specifications for data injection to make it compatible with subsequent data containers. For example, when using a specific containerization platform, set the data injection port, protocol and other parameters according to the platform requirements to pave the way for smooth data injection.

[0027] Step 2: Data asset creation and association stage Data asset ID creation: ensuring data assets can be accurately tracked Unique ID generation mechanism: Use cryptographic hash functions (such as SHA-3) combined with key features of data (such as data generation time, data type, etc.) to generate a unique ID. For example, for medical data, the patient's visit time, disease type and other information can be combined with hash functions to obtain a unique ID, ensuring that the data asset can be accurately identified and tracked throughout the data life cycle, and can be quickly located even in massive medical data.

[0028] ID management and maintenance: The generated ID is stored in a distributed database (such as Cassandra), and its high availability and distributed characteristics are used to ensure the reliable storage of ID information. At the same time, blockchain technology is used to record ID changes in an unalterable manner to ensure the stability of ID management, so as to accurately obtain data asset-related information at all stages of data processing.

[0029] Data asset subject-object binding: Establishing data asset access and ownership rules The rights and responsibilities of the subject are clear: the subject of the data asset (including the owner, manager, etc.) is identified, and a certificate containing information such as the public key and scope of authority is issued to the subject using digital certificate technology, and the subject's identity and authority are verified through the public key infrastructure (PKI). For example, in enterprise data management, data administrators can use digital certificates to perform specific operations on data, while clarifying their responsibilities in terms of data security and compliance management.

[0030] Object environment association and definition: clarify the data asset object (such as storage device type, application system name, etc.), and add detailed metadata to the object through metadata description technology, including storage location path, access permission rules and other information. For example, in a cloud storage environment, add metadata to the data asset to indicate which cloud storage area it is stored in and which application systems can access it, to ensure that the data asset is closely associated with the storage and usage environment.

[0031] Improve management rules by combining strategies and authorizations: Based on the role-based access control (RBAC) model, formulate access rights rules in combination with enterprise business needs and implement them using access control lists (ACLs). For example, ordinary employees are allowed to have only read access to certain data assets, while senior managers have read and write access. At the same time, homomorphic encryption technology (such as lattice-based partial homomorphic encryption) is used to encrypt data assets to ensure that specific calculations (such as data statistical calculations) can be performed in an encrypted state to protect data confidentiality. In terms of property rights confirmation, digital watermarking technology is used to embed ownership information into data to ensure that ownership is clear and traceable.

[0032] Step 3: Data encryption and storage stage Application of data encryption technology: Use homomorphic encryption algorithms (such as fully homomorphic encryption algorithms based on ideal lattices) to encrypt data. During data injection and storage, use hardware security modules (such as hardware encryption chips) to perform efficient encryption operations to convert raw data into ciphertext data. Homomorphic encryption keys are securely managed through the key management system (KMS). KMS uses a hierarchical key management architecture to ensure the security of the keys. The stored ciphertext data can be operated without decryption in subsequent calculations (such as data aggregation calculations), effectively protecting data privacy.

[0033] Safe and reliable storage method selection: Choose data containers based on distributed storage systems (such as Ceph) for storage. Ceph has high reliability and scalability. Data is redundantly stored on multiple nodes, and data integrity is guaranteed through data consistency algorithms (such as the CRUSH algorithm). Utilize the isolation characteristics of containers (such as namespace and control group technology) to achieve data isolation, prevent data leakage and tampering, and provide a secure storage environment for data.

[0034] Step 4: Data asset behavior recording stage Detailed records of operation contents: Use a logging system (such as ELK Stack) to record the contents of data asset operations, including injection time with microsecond timestamps, the operator's digital identity (obtained through a digital certificate), operation type (such as detailed operations such as data reading, writing, and modifying), and the data range involved in the operation. At the same time, the source IP address of the operation, the unique identifier of the device used, etc. are recorded to provide a comprehensive data source for auditing and tracking. For example, in a financial transaction system, detailed records of the operation information of each transaction data are recorded to facilitate subsequent risk investigation and compliance audits.

[0035] Behavior selection and result recording: Record data asset behavior selection, such as access requests (including data resources requested for access, access mode, etc.), modification requests (reasons for modification, comparison of data before and after modification, etc.), and corresponding processing results (such as whether the request is authorized, reasons for rejection, etc.). By associating this information, you can gain a deeper understanding of data asset usage and processing logic. For example, when a user requests to modify sensitive data, recording the details of the modification request and the system processing results will help optimize data management strategies.

[0036] Relevant information integration records: Record relevant information about data assets, such as data source system identification, purpose (through business process tags), etc., to form a complete behavior record flow. Use data lake technology to integrate these records to facilitate large-scale data analysis. For example, in enterprise data management, data asset behavior records of different business systems are centrally stored in the data lake, and data flow rules are mined through data analysis to provide support for decision-making and facilitate audit tracking.

[0037] Step 5: Data asset behavior control stage Real-time monitoring of data asset behavior: Deploy a real-time monitoring system (such as Prometheus combined with Grafana visualization interface) to collect data asset behavior data from multiple sources such as data containers, application systems, and network devices, including real-time information such as data flow, operation frequency, and operation type distribution. For example, in an e-commerce platform, real-time monitoring of user operations on product data can be used to promptly detect abnormal traffic or frequent abnormal operations (such as malicious order-brushing behavior).

[0038] Behavior judgment based on policies and authorizations: When a data asset behavior request is received, it is judged based on the attribute-based access control (ABAC) policy and authorization mechanism. ABAC comprehensively considers subject attributes (such as user position, credit rating, etc.), object attributes (such as data sensitivity, business field, etc.), and environmental attributes (such as operation time, location, network environment, etc.) to determine authorization. For example, for access requests to highly sensitive data, if the user's credit rating is low and the request is made at an abnormal time or location, the request may be rejected even if the role authority is available. At the same time, multi-factor authentication (such as passwords, dynamic verification codes, biometrics, etc.) is used to verify the user's identity.

[0039] Behavior control operation execution: Authorized behavior is allowed to continue and the operation information is recorded in the audit log. Unauthorized behavior is rejected and detailed information (including request content, subject information, rejection reason, etc.) is recorded, and the rejection reason is fed back to the data user through the message push system (such as Kafka). If the user's behavior is rejected, it can be adjusted based on the feedback and re-requested. For example, in the internal system of an enterprise, if an employee is denied access to super-authorized data, he can check his own permissions or business needs based on the feedback and then request again, reflecting the dynamic interactivity of behavior control.

[0040] Step 6: Data asset output stage Authorization and condition judgment: Data asset behavior is authorized and output conditions are met (such as data format meets the requirements of the target system, output timing meets the business process, etc.). Output condition judgment is based on the business rule engine, taking into account factors such as data asset attributes, business process status, and target system requirements. For example, when an enterprise outputs data to a partner, it must ensure that the partner meets the conditions of the cooperation agreement (such as signing a confidentiality agreement, having data receiving qualifications, etc.) and that the data has been processed as required (such as data desensitization compliance).

[0041] Security output process guarantee: The output process uses a secure transmission protocol (such as SFTP or HTTPS), and uses encrypted envelope technology to encrypt sensitive data for transmission again, and the recipient uses a specific key to decrypt it. At the same time, data integrity verification (such as calculating hash values ​​and verifying them at the recipient's end) is performed to prevent transmission tampering. For example, when financial institutions report data to regulatory authorities, they transmit and verify hash values ​​via SFTP to ensure data integrity and security.

[0042] Output information recording and auditing: Record the output time with millisecond-level timestamp, destination (including target system IP address, name, etc.) and other information in the output audit database. Use data mining and analysis technology to regularly audit output information to check whether it complies with data security policies and business regulations. For example, enterprises regularly analyze output records, check for abnormal output destinations or times, prevent data security risks, and ensure that output is safe and accurate.

[0043] The basic principles, main features and advantages of the present invention are shown and described above. Figure 2 As shown. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and the specification only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention to be protected. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A data behavior security management method based on containers and encryption, characterized by: Step 1, preparation phase: clarify the roles and responsibilities of data providers and prepare for starting the data asset injection process; Step 2: Data asset creation and association phase: including data asset ID creation and data asset subject and object binding; The data asset ID creation: the data provider creates a unique ID for the data asset to be injected, ensuring that the data asset can be accurately identified and tracked throughout the data life cycle; The data asset subject-object binding: Combined with policies and authorizations, the access rights and usage scope rules of data assets are determined, and encryption and confirmation information is clarified to ensure the security and ownership clarity of data assets; Step 3, data encryption storage stage: select a safe and reliable storage method to store the ciphertext data in a data container to prevent the data from being accessed, stolen or tampered with without authorization during storage; Step 4, data asset behavior recording stage: record the operation content of data assets in each link, including injection time, operator, operation type details, expand the recording scope to each operation link of data assets, and provide a comprehensive data source for subsequent auditing and tracking; Step 5, Data asset behavior control stage: Monitor and manage the behavior of data assets in real time. When receiving a data asset behavior request, make a judgment based on the pre-set policies and authorizations. Step 6, data asset output phase: When the behavior of the data asset is authorized and meets the output conditions, the data asset output operation is performed.

2. The data behavior security management method based on container and encryption according to claim 1 is characterized by: The step 2 further includes the following contents: The data asset ID creation is the primary identification creation work after the data asset enters the data container. It is to give the data asset a unique "ID number" to facilitate subsequent accurate management and operation of it; the created ID is strictly recorded and managed to ensure its accuracy and stability; The data asset subject-object binding further includes the following contents: determining the subject of the data asset and clarifying its rights and responsibilities, covering the possible subject roles and their rights and responsibilities, and further clarifying the overall situation of the subjects related to the data asset on the basis of confirming the rights; Determining the object of data assets, clarifying the storage location and usage scenarios of data in different environments, and associating data assets with specific storage and usage environments are detailed definitions of data asset objects and more comprehensive descriptions of various possible forms and scenarios of the objects.

3. The data behavior security management method based on container and encryption according to claim 1 is characterized by: The step three further includes the following contents: the data storage uses an encryption algorithm to encrypt the data, converting the original data into ciphertext data to ensure the key technical operation of data security and prevent the data from being illegally obtained during storage.

4. The data behavior security management method based on container and encryption according to claim 1 is characterized by: The step four further includes the following contents: recording the behavior selection of data assets and the corresponding processing results, further refining the behavior record content, recording not only the operation itself, but also the operation intention and processing results, which helps to gain a deeper understanding of the usage and processing logic of data assets; recording the relevant information of data assets to form a complete data asset behavior record flow for subsequent auditing and tracking.

5. The data behavior security management method based on container and encryption according to claim 1 is characterized by: The step 5 further includes the following contents: for authorized actions, allowing the corresponding operation of the data asset to continue; for unauthorized actions, rejecting and recording relevant information, and at the same time feeding back the rejection reason to the data user; If the data user's behavior is rejected, he or she can make adjustments based on the feedback information and re-initiate the data asset behavior request, which provides the data user with an opportunity to correct the erroneous behavior, helps to improve the flexibility and rationality of data asset use, and also reflects the dynamic and interactive nature of the entire behavior management process.

Images