Data processing method and system based on data security management

Abstract

The invention relates to the technical field of data processing, and particularly discloses a data processing method and system based on data security management, and the method comprises the steps: S1, obtaining a table name, a primary key value, a field value and a foreign key value in a database, and building an association line among the table name, the primary key value, the field value and the foreign key value; representing the elements by nodes to form a data association tree; s2, some nodes are preset as sensitive nodes, and the longest path from the sensitive nodes to the bottom end of the tree is found; s3, for each piece of data in the database, calculating the shortest path length from a node corresponding to the data to a sensitive node, and calculating a sensitive association index according to a preset coefficient; classifying the data into different security levels according to the sensitive association index; the invention aims to identify and manage the data security in the relational database by constructing the data association tree.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data processing method and system based on data security management. Background Art

[0002] Data security processing methods mainly include data collection security, data transmission security, data storage security and data processing security; these methods can effectively improve data security, reduce the risk of data leakage and other security incidents, and ensure the information security of organizations and users.

[0003] In data storage security, data is often divided into different security levels, and data of different security levels are stored in databases with different access permissions to ensure data security.

[0004] In the existing technology, due to the different data security standards of different industries and the different security standards of different enterprises, there are differences in data security classification strategies; therefore, the security level classification of data mainly relies on manual classification; but with the development of science and technology, the amount of data is increasing day by day. For the large amount of new data added every day, if manual classification is still used, it will greatly affect the efficiency of data security management. Summary of the invention

[0005] The purpose of the present invention is to provide a data processing method and system based on data security management to solve the above technical problems.

[0006] The purpose of the present invention can be achieved through the following technical solutions: A data processing method based on data security management comprises the following steps: Step S1: obtaining a table name in a relational database, and obtaining a primary key value of each piece of data in the table, and establishing an association line between the table name and the primary key value of each piece of data in the table; obtaining all field values ​​of the data, and establishing an association line between the primary key value of the data and each field value; obtaining all foreign key values ​​of the field value, and establishing an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; obtain a data association tree according to all nodes and association lines; Step S2: In the data association tree, the node at the bottom is recorded as the bottom node, and several nodes are preset as sensitive nodes; all tree paths from the sensitive node to the bottom node are obtained to obtain a tree path set, where the tree path is a connection obtained by connecting several association lines end to end; the longest tree path is selected from the tree path set, and the number of association lines on the longest tree path is recorded as Smax; Step S3: For any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); obtain the sensitive association index of the node to be tested ,in oh is the preset coefficient, and oh >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided.

[0007] As a further solution of the present invention: when the field value has more than one foreign key value, there are overlapping association lines between the field value and the foreign key value, and the overlapping association lines are merged to obtain a final association line.

[0008] As a further solution of the present invention: the primary key value includes specific data in the primary key composed of several fields.

[0009] As a further solution of the present invention: the sensitive nodes are nodes corresponding to several sensitive data preset by the user on the data association tree.

[0010] As a further solution of the present invention: the longest tree path is the tree path containing the largest number of association lines, and the shortest tree path is the tree path containing the least number of association lines.

[0011] As a further solution of the present invention: Min(J)∈[1, Smax], when Min(J)=0, the node to be tested is a sensitive node.

[0012] As a further solution of the present invention: the process of classifying the security level of the data corresponding to the node to be tested includes: Set m different index thresholds, and obtain m+1 sensitive association index intervals according to the index thresholds, each sensitive association index interval corresponding to a security level; obtain the sensitive association index of the node to be tested, and determine the security level of the data corresponding to the node to be tested according to the sensitive association index interval in which the sensitive association index of the node to be tested is located.

[0013] As a further solution of the present invention: a data processing system based on data security management, comprising: Association tree building module: obtains the table name in the relational database, obtains the primary key value of each piece of data in the table, and establishes an association line between the table name and the primary key value of each piece of data in the table; obtains all field values ​​of the data, and establishes an association line between the primary key value of the data and each field value; obtains all foreign key values ​​of the field value, and establishes an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; obtain a data association tree according to all nodes and association lines; The longest path analysis module: in the data association tree, the node at the bottom is recorded as the bottom node, and several nodes are preset as sensitive nodes; all tree paths from the sensitive node to the bottom node are obtained to obtain a tree path set, where the tree path is a line obtained by connecting several association lines end to end; the longest tree path is selected from the tree path set, and the number of association lines on the longest tree path is recorded as Smax; Security level classification module: For any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); obtain the sensitive association index of the node to be tested ,in oh is the preset coefficient, and oh >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided.

[0014] Beneficial effects of the present invention: The present invention displays the table name, primary key value, field value and foreign key value in the relational database in a tree structure by constructing a data association tree, so that the relationship between the data is more intuitive and clear. This systematic method helps to fully understand the hierarchy and association of data, and provides a solid foundation for subsequent data processing and analysis. Sensitive nodes are preset in the data association tree, and the longest path from the sensitive node to the bottom node is calculated, so that the sensitive path between the data can be effectively identified. This method can quickly locate potential sensitive data and its subsequent data derivative path, so as to take corresponding security measures for protection. By calculating the shortest tree path between the node to be tested and the sensitive node, and combining the preset coefficient, a sensitive association index is obtained; according to the sensitive association index, the security level of the data can be quantitatively divided, so as to achieve differentiated management and protection of data of different security levels; this quantitative evaluation method improves the accuracy and effectiveness of data security management. The present invention constructs a data association tree, identifies sensitive paths, calculates sensitive association indexes and divides security levels in an automated manner, which greatly reduces the errors of manual intervention and subjective judgment; this not only improves the efficiency of data security management, but also ensures the accuracy and reliability of the processing results. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present invention will be further described below in conjunction with the accompanying drawings.

[0016] Figure 1 It is a flow chart of a data processing method and system based on data security management of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 As shown, the present invention is a data processing method based on data security management, comprising the following steps: Step S1: obtaining a table name in a relational database, and obtaining a primary key value of each piece of data in the table, and establishing an association line between the table name and the primary key value of each piece of data in the table; obtaining all field values ​​of the data, and establishing an association line between the primary key value of the data and each field value; obtaining all foreign key values ​​of the field value, and establishing an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; obtain a data association tree according to all nodes and association lines; It should be noted that in the prior art, most enterprises use relational databases for data storage; the association between data in the relational data tables is mainly realized through primary keys and foreign keys, which ensure the data consistency and integrity between tables; the foreign key is a field (or column) in a table, and the foreign key is the primary key of another table, and the foreign key is used to establish a connection between the two tables; the primary key is a field or field combination used to uniquely identify each row of data in the table; each table can only have one primary key, because the main function of the primary key is to ensure that each row of data in the table is unique; It should be noted that the foreign key value refers to the specific data stored in each foreign key (column) in the data table, the primary key value refers to the specific data stored in the field that serves as the primary key in a table; the field value refers to the specific information stored in a specific field, which is the basic element that constitutes the data table; As a preferred embodiment of the present invention, when the field value has more than one foreign key value, there are overlapping association lines between the field value and the foreign key value, and the overlapping association lines are merged to obtain a final association line; It is worth noting that the association line is not directional. The association line represents that the primary data is associated with the upper or lower level data. Therefore, for the detected overlapping association lines, they are merged into a single association line to reduce data redundancy. As a preferred embodiment of the present invention, the primary key value includes specific data in the primary key composed of several fields; It is understandable that although a table can have only one primary key, this primary key can be composed of multiple fields, which is called a composite primary key; a composite primary key uses a combination of two or more fields to uniquely identify each row of data in the table; Step S2: In the data association tree, the node at the bottom is recorded as the bottom node, and several nodes are preset as sensitive nodes; all tree paths from the sensitive node to the bottom node are obtained to obtain a tree path set, where the tree path is a connection obtained by connecting several association lines end to end; the longest tree path is selected from the tree path set, and the number of association lines on the longest tree path is recorded as Smax; It can be understood that in the data association tree, the node at the bottom is defined as the bottom node; the bottom node is usually a leaf node in the data structure and does not extend downward; a number of nodes are preset as sensitive nodes, and the sensitive nodes represent data that require special attention in data security analysis, including sensitive information or important data; As a preferred embodiment of the present invention, the sensitive nodes are nodes corresponding to a number of sensitive data preset by the user on the data association tree; It is worth noting that the user only needs to preset sensitive data once before use and determine sensitive nodes. Subsequently, the present invention automatically divides the security levels of all remaining data and subsequently added data; Step S3: For any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); obtain the sensitive association index of the node to be tested ,in oh is the preset coefficient, and oh >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided; It is worth noting that, on the data association tree, the node to be tested is generally below the sensitive node. If the node to be tested is above the sensitive node, the security level of the node to be tested is directly recorded as being consistent with that of the sensitive node. It can be understood that the shortest tree path represents the most direct connection mode from the node to be tested to the sensitive node, reflecting the distance from the node to be tested to each sensitive node; the longer the distance, the lower the sensitivity of the node to be tested, that is, the smaller the sensitive association index; on the contrary, the closer the distance, the higher the sensitivity of the node to be tested, that is, the larger the sensitive association index; the sensitive association index reflects the relative proximity between the node to be tested and the sensitive node, and the higher the value of the sensitive association index, the closer the data is to the sensitive information, and therefore the security level is correspondingly higher; As a preferred embodiment of the present invention, the longest tree path is a tree path including the largest number of association lines, and the shortest tree path is a tree path including the smallest number of association lines; As a preferred embodiment of the present invention, Min(J)∈[1, Smax], when Min(J)=0, the node to be tested is a sensitive node; As a preferred embodiment of the present invention, the process of classifying the security level of the data corresponding to the node to be tested includes: m different index thresholds are set, and m+1 sensitive association index intervals are obtained according to the index thresholds, each sensitive association index interval corresponds to a security level; the sensitive association index of the node to be tested is obtained, and the security level of the data corresponding to the node to be tested is determined according to the sensitive association index interval in which the sensitive association index of the node to be tested is located; It can be understood that the index threshold is used to distinguish different levels of sensitivity or risk; the security level of the data item is determined according to the interval in which the sensitive association index of the node to be tested is located; each interval is pre-corresponding to a clear security level, so that the security level can be directly determined based on the interval in which the index is located.

[0019] A data processing system based on data security management, comprising: Association tree building module: obtains the table name in the relational database, obtains the primary key value of each piece of data in the table, and establishes an association line between the table name and the primary key value of each piece of data in the table; obtains all field values ​​of the data, and establishes an association line between the primary key value of the data and each field value; obtains all foreign key values ​​of the field value, and establishes an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; obtain a data association tree according to all nodes and association lines; The longest path analysis module: in the data association tree, the node at the bottom is recorded as the bottom node, and several nodes are preset as sensitive nodes; all tree paths from the sensitive node to the bottom node are obtained to obtain a tree path set, where the tree path is a line obtained by connecting several association lines end to end; the longest tree path is selected from the tree path set, and the number of association lines on the longest tree path is recorded as Smax; Security level classification module: For any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); obtain the sensitive association index of the node to be tested ,in oh is the preset coefficient, and oh >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided.

[0020] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A data processing method based on data security management, characterized in that: The following steps are involved: Step S1: obtaining a table name in a relational database, and obtaining a primary key value of each piece of data in the table, and establishing an association line between the table name and the primary key value of each piece of data in the table; obtaining all field values ​​of the data, and establishing an association line between the primary key value of the data and each field value; obtaining all foreign key values ​​of the field value, and establishing an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; According to all nodes and association lines, a data association tree is obtained; Step S2: In the data association tree, the node at the bottom is recorded as the bottom node, and a number of nodes are preset as sensitive nodes; Obtain all tree paths from the sensitive node to the bottom node to obtain a tree path set, where the tree path is a line obtained by connecting a number of association lines end to end; select the longest tree path from the tree path set, and record the number of association lines on the longest tree path as Smax; Step S3: for any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); Get the sensitive correlation index of the node to be tested ,in ω is the preset coefficient, and ω >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided.

2. A data processing method based on data security management according to claim 1, characterized in that: In step S1, when the field value has more than one foreign key value, there are overlapping association lines between the field value and the foreign key value, and the overlapping association lines are merged to obtain a final association line.

3. A data processing method based on data security management according to claim 1, characterized in that: In step S1, the primary key value includes specific data in the primary key composed of several fields.

4. A data processing method based on data security management according to claim 1, characterized in that: In step S2, the sensitive nodes are nodes corresponding to several sensitive data preset by the user on the data association tree.

5. A data processing method based on data security management according to claim 1, characterized in that: In step S3, the longest tree path is the tree path including the largest number of association lines, and the shortest tree path is the tree path including the smallest number of association lines.

6. A data processing method based on data security management according to claim 1, characterized in that: In step S3, Min(J)∈[1, Smax], when Min(J)=0, the node to be tested is a sensitive node.

7. A data processing method based on data security management according to claim 1, characterized in that: In step S3, the process of classifying the security level of the data corresponding to the node to be tested includes: Set m different index thresholds, and obtain m+1 sensitive association index intervals according to the index thresholds, each sensitive association index interval corresponding to a security level; obtain the sensitive association index of the node to be tested, and determine the security level of the data corresponding to the node to be tested according to the sensitive association index interval in which the sensitive association index of the node to be tested is located.

8. A data processing system based on data security management, characterized in that: include: Association tree building module: obtains the table name in the relational database, obtains the primary key value of each piece of data in the table, and establishes an association line between the table name and the primary key value of each piece of data in the table; obtains all field values ​​of the data, and establishes an association line between the primary key value of the data and each field value; obtains all foreign key values ​​of the field value, and establishes an association line between the field value and its foreign key values; Arrange the table name, primary key value, field value and foreign key value from top to bottom, and replace the table name, primary key value, field value and foreign key value with nodes; According to all nodes and association lines, a data association tree is obtained; Longest path analysis module: In the data association tree, the node at the bottom is recorded as the bottom node, and several nodes are preset as sensitive nodes; Obtain all tree paths from the sensitive node to the bottom node to obtain a tree path set, where the tree path is a line obtained by connecting a number of association lines end to end; select the longest tree path from the tree path set, and record the number of association lines on the longest tree path as Smax; Security level classification module: for any data in the relational database, determine the node corresponding to the data on the data association tree, record it as the node to be tested; obtain the shortest tree path between the node to be tested and each sensitive node, and obtain the number of association lines on each shortest tree path to obtain a set of association line numbers, and record the minimum value in the set of association line numbers as Min(J); Get the sensitive correlation index of the node to be tested ,in ω is the preset coefficient, and ω >1; according to the sensitive association index of the node to be tested, the security level of the data corresponding to the node to be tested is divided.

Images