Data sharing retention prevention method, system and device and storage medium

Abstract

The invention discloses a data sharing retention prevention method, system and device and a storage medium. The method comprises the steps of formulating a security sharing strategy through a central management platform according to anti-retention data of a data providing end; the method comprises the following steps: when a first application probe recognizes that a data providing end receives a data sharing request sent by a data receiving end, performing first anti-retention verification on the data sharing request based on a security sharing strategy; the method comprises the following steps: sending target shared data to a data receiving end by a data providing end under the condition of identifying that first-time anti-retention verification is passed; when identifying that the data receiving end receives the target shared data sent by the data providing end through the second application probe, performing secondary anti-retention verification on the target shared data based on the security sharing strategy; and executing a write-in operation of the target shared data through the data receiving end under the condition that the data receiving end identifies that the secondary anti-retention verification is passed. According to the technical scheme, the security of data sharing can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, in particular to the field of data security technology, and specifically to a data sharing anti-retention method, system, device and storage medium. Background Art

[0002] As the division of labor in society becomes increasingly refined, it has become normal for companies to open many different API (Application Programming Interface) interfaces to third-party partners to support operations such as data processing and resource sharing.

[0003] At present, shared data providers usually use open interface APIs to provide data to shared data recipients. However, after receiving the data, whether the data recipient caches the data or not, the data provider is completely unable to perform effective monitoring, control, exception blocking and other operations. Summary of the invention

[0004] The present application provides a data sharing anti-retention method, system, device and storage medium to improve the security of data sharing.

[0005] According to one aspect of the present application, a data sharing and anti-retention method is provided, which is applied to a data sharing and anti-retention system; the system includes a central management platform, a data provider and a data receiving end; the data provider is deployed with a first application probe; the data receiving end is deployed with a second application probe; the data provider is communicatively connected to the data receiving end; the central management platform is communicatively connected to the data provider and the data receiving end respectively; the method includes:

[0006] Formulate a security sharing strategy based on the anti-retention data of the data provider through the central management platform, and send the security sharing strategy to the first application probe and the second application probe respectively;

[0007] When the first application probe identifies that the data provider receives the data sharing request sent by the data receiver, based on the security sharing policy, the first anti-retention check is performed on the data sharing request;

[0008] When the data providing end identifies that the first anti-retention check has passed, the target shared data is sent to the data receiving end;

[0009] When the second application probe identifies that the data receiving end has received the target shared data sent by the data providing end, a secondary anti-retention check is performed on the target shared data based on the security sharing policy;

[0010] When the data receiving end identifies that the secondary anti-retention check has passed, the write operation of the target shared data is performed.

[0011] According to another aspect of the present application, a data sharing and anti-retention system is provided, which includes a central management platform, a data providing end, and a data receiving end; the data providing end is deployed with a first application probe; the data receiving end is deployed with a second application probe; the data providing end is communicatively connected to the data receiving end; the central management platform is communicatively connected to the data providing end and the data receiving end respectively:

[0012] The central management platform is used to formulate a security sharing strategy based on the anti-retention data of the data provider, and send the security sharing strategy to the first application probe and the second application probe respectively;

[0013] The first application probe is used to perform a first anti-retention check on the data sharing request based on the security sharing policy when recognizing that the data providing end receives the data sharing request sent by the data receiving end;

[0014] The data providing end is used to send the target shared data to the data receiving end when recognizing that the first anti-retention check passes;

[0015] The second application probe is used to perform a secondary anti-retention check on the target shared data based on the security sharing policy when recognizing that the data receiving end has received the target shared data sent by the data providing end;

[0016] The data receiving end is used to execute the write operation of the target shared data when it is recognized that the secondary anti-retention check has passed.

[0017] According to another aspect of the present application, an electronic device is provided, the electronic device comprising:

[0018] one or more processors;

[0019] A memory for storing one or more programs;

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the data sharing anti-retention methods provided in the embodiments of the present application.

[0021] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, any one of the data sharing anti-retention methods provided in the embodiments of the present application is implemented.

[0022] This application formulates a security sharing strategy based on the anti-retention data of the data provider through the central management platform, and sends the security sharing strategy to the first application probe and the second application probe respectively; when the first application probe identifies that the data provider receives the data sharing request sent by the data receiving end, the data sharing request is firstly checked for anti-retention based on the security sharing strategy; when the data provider identifies that the first anti-retention check is passed, the target shared data is sent to the data receiving end; when the second application probe identifies that the data receiving end receives the target shared data sent by the data provider, the target shared data is secondly checked for anti-retention based on the security sharing strategy; when the data receiving end identifies that the second anti-retention check is passed, the target shared data is written. The above technical solution can monitor whether there is abnormal data retention behavior in the data sharing process in real time through the application probes configured on the data receiving end and the data provider, and realize data anti-retention without modifying the original business systems of the two parties of data sharing, which is helpful to improve the security of data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart of a data sharing and anti-retention method provided according to the first embodiment of the present application;

[0024] Figure 2 It is a flow chart of a data sharing and anti-retention method provided according to the second embodiment of the present application;

[0025] Figure 3 It is a structural diagram of a data sharing and anti-retention system provided according to Embodiment 3 of the present application;

[0026] Figure 4 It is a structural diagram of an electronic device that implements the data sharing anti-retention method of an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In addition, it should be noted that the collection, storage, use, processing, transmission, provision and disclosure of relevant data such as anti-retention data and security sharing strategies involved in the technical solution of this application are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0030] Embodiment 1

[0031] Figure 1 This is a flow chart of a data sharing anti-retention method provided according to the first embodiment of the present application. This embodiment can be applied to prevent abnormal data from being retained in real time during the data sharing process between the two parties of the data sharing, and can be executed by a data sharing anti-retention system. The data sharing anti-retention system includes a central management platform, a data provider and a data receiver; the data provider is deployed with a first application probe; the data receiver is deployed with a second application probe; the data provider is communicated with the data receiver; the central management platform is communicated with the data provider and the data receiver respectively; the system can be implemented in the form of hardware and / or software, and the data sharing anti-retention system can be configured in a computer device, such as a server. Figure 1 As shown, the method includes:

[0032] S110. Formulate a security sharing strategy based on the anti-retention data of the data provider through the central management platform, and send the security sharing strategy to the first application probe and the second application probe respectively.

[0033] Among them, the central management platform refers to a centralized system or tool for managing, monitoring and coordinating multiple applications and data sources; it can uniformly configure security policies, data sharing rules and monitoring activities. Anti-retention data refers to sensitive data that is prohibited from being stored or retained without authorization; for example, it can be user name, user gender, user age, etc. Security sharing strategy refers to a series of regulations and measures used to ensure the secure sharing of data between different systems or applications; these strategies may include permission control, data encryption, access auditing, etc. to protect the confidentiality and integrity of data. The first application probe refers to a component deployed on the application side of the data provider end for monitoring, collecting or transmitting data; it can obtain the behavior data of the application in real time to help analyze and optimize performance, or monitor data flow in a security context. The second application probe refers to a component deployed on the application side of the data receiver end for monitoring, collecting or transmitting data; it can obtain the behavior data of the application in real time to help analyze and optimize performance, or monitor data flow in a security context.

[0034] It should be noted that the central management platform adopts a B / S (Browser / Server) architecture and can provide a visual operation interface. Its main functions are to manage application probes, receive monitored data behavior data, analyze data cache risks, manage data sharing strategies, conduct post-audit tracing, and receive abnormal alarms from the recipient of shared data and synchronize them to the application probe of the shared data provider in a timely manner, so that the probe of the data provider can cut off the data transmission in time. The first application probe is deployed on the application side that provides the shared data API interface. Its main functions are to monitor the data request behavior, report the request behavior monitoring data to the central management platform, receive the security policy of the central management platform, and block the data transmission in time when anomalies are found. The second application probe is deployed on the application side that receives shared data. Its main functions are to monitor the data retention behavior after receiving the shared data, report the behavior monitoring data to the central management platform, receive the security policy issued by the central management platform, and block the data retention behavior in time.

[0035] Furthermore, the application probe is implemented based on the principle of Hook (Hook Function) technology, so there is no need to change any code of the original business system, and zero transformation is required to achieve shared data retention prevention. The operating principle of the application probe of the shared data provider is based on the interface API Hook (Application Programming Interface Hook) technology to monitor the behavior of data requests, and execute the security policy issued by the central management platform to block abnormal data request behaviors in time. The operating principle of the application probe of the shared data receiver is based on the operating system IO Hook (Input / Output Hook) technology. The application probe can monitor the IO (Input / Output) behavior of the data receiving application and block abnormal IO operations of retained data in time.

[0036] Optionally, when receiving the shared security policy, the central management platform sends the shared security policy to the first application probe and the second application probe respectively.

[0037] It is understandable that the shared security policy at this time is artificially preset based on actual conditions or experience values.

[0038] S120: When the first application probe identifies that the data provider receives a data sharing request sent by the data receiver, the first application probe performs an initial anti-retention check on the data sharing request based on a security sharing policy.

[0039] The data provider refers to the system or application that sends or shares data, which is responsible for processing data requests and passing the data to the receiver. The data receiver refers to the system or application that receives data requests from the data provider, which is usually responsible for processing and using the received data. A data sharing request refers to a request sent by the data receiver to the data provider to obtain specific data or information. The first anti-retention check refers to a check performed before a data sharing request is processed to verify whether the request complies with the data retention policy and ensure that sensitive data is not stored for a long time or misused.

[0040] It should be noted that in the embodiment of the present application, there may be at least one data receiving end; there may also be at least one data providing end corresponding to the data receiving end.

[0041] Optionally, the first anti-retention check may include at least one of an identification existence check and a blocking instruction existence check.

[0042] Among them, the identity existence check refers to checking whether the identity (such as user identity, data type, etc.) involved in the data sharing request exists and is valid; this check is intended to ensure that the requesting party has legal authority and identity to access the requested data. The blocking instruction existence check refers to confirming whether there are instructions or policies that hinder or restrict data sharing; this may include laws, regulations, internal policies or security protocols to ensure that relevant blocking rules are followed when processing data requests.

[0043] Exemplarily, taking the identification existence check as an example, when the first application probe identifies that the data provider receives a data sharing request sent by the data receiver, it performs an identification existence check on the data sharing request based on the security sharing strategy to determine whether the authentication identifier is written in the data sharing request; if it is carried, it is determined that the identification existence check passes; if it is not carried, it is determined that the identification existence check fails. At this time, the data sharing request is blocked and the subsequent steps are no longer executed.

[0044] S130: When the data providing end identifies that the first anti-retention check has passed, the target shared data is sent to the data receiving end.

[0045] S140. When the second application probe identifies that the data receiving end has received the target shared data sent by the data providing end, a second anti-retention check is performed on the target shared data based on the security sharing policy.

[0046] Among them, the secondary anti-retention check refers to a check performed on the application side of the data receiving end to verify whether the application complies with the data retention policy and ensure that sensitive data will not be stored for a long time or abused.

[0047] Exemplarily, when the second application probe identifies that the data receiving end has received the target shared data sent by the data providing end, it determines whether the application side of the data receiving end has retained the data in violation of regulations based on the security sharing policy; if so, it determines that the secondary anti-retention check has failed; if not, it determines that the secondary anti-retention check has passed.

[0048] S150 . When the data receiving end identifies that the secondary anti-retention check has passed, the write operation of the target shared data is executed.

[0049] In an optional implementation, when the second application probe identifies that the secondary anti-retention check has failed, the write operation of the target shared data is blocked and a data retention alarm is sent to the central management platform.

[0050] The data retention alarm refers to an alarm sent by the second application probe to the central management platform regarding illegal retention of target shared data by the data receiving end.

[0051] Furthermore, when the central management platform receives a data retention alarm, it generates a data blocking instruction and sends the data blocking instruction to the first application probe; when the first application probe receives the data blocking instruction, it blocks the data sharing request sent by the data receiving end in the future.

[0052] The data blocking instruction is a command generated by the central management platform to prevent the processing of specific data sharing requests; this instruction is mainly used to ensure that relevant data is not shared when there are risks or compliance issues. The blocking operation refers to the action of the first application probe to suspend or refuse to process specific data sharing requests from the data receiving end according to the data blocking instruction to prevent incorrect sharing or leakage of data.

[0053] In the embodiment of the present application, a central management platform formulates a security sharing strategy according to the anti-retention data of the data provider, and sends the security sharing strategy to the first application probe and the second application probe respectively; when the first application probe identifies that the data provider receives a data sharing request sent by the data receiving end, the data sharing request is firstly checked for anti-retention based on the security sharing strategy; when the data provider identifies that the first anti-retention check is passed, the target shared data is sent to the data receiving end; when the second application probe identifies that the data receiving end receives the target shared data sent by the data provider, the target shared data is secondly checked for anti-retention based on the security sharing strategy; when the data receiving end identifies that the second anti-retention check is passed, the target shared data is written. The above technical solution can monitor whether there is abnormal data retention behavior in the data sharing process in real time through the central management platform and the application probes configured on the data receiving end and the data provider end, and realize data anti-retention without modifying the original business systems of the two parties of data sharing, which helps to improve the security of data sharing.

[0054] Embodiment 2

[0055] Figure 2 It is a flow chart of a data sharing anti-retention method provided in accordance with the second embodiment of the present application. Based on the technical solutions of the above embodiments, this embodiment refines "based on the security sharing strategy, the data sharing request is firstly checked for anti-retention" into "based on the security sharing strategy, the authentication identifier of the data sharing request is checked for existence through the first application probe; when the first application probe recognizes that the identifier existence check passes, the data sharing request is checked for existence of a blocking instruction". It should be noted that for the parts not described in detail in the embodiments of the present application, please refer to the relevant descriptions of other embodiments.

[0056] like Figure 2 As shown, the method includes:

[0057] S210. Formulate a security sharing strategy based on the anti-retention data of the data provider through the central management platform, and send the security sharing strategy to the first application probe and the second application probe respectively.

[0058] S220: When the first application probe identifies that the data provider receives a data sharing request sent by the data receiver, based on the security sharing policy, perform an identity existence check on the authentication identity of the data sharing request.

[0059] Among them, the identity existence check refers to checking whether the identity (such as user identity, data type, etc.) involved in the data sharing request exists and is valid; this check is intended to ensure that the requesting party has legal authority and identity to access the requested data.

[0060] Optionally, before the data receiving end sends the data sharing request to the data providing end, an authentication identifier is added to the data sharing request based on a security sharing policy through a second application probe.

[0061] The authentication identifier is used to verify the legitimacy and source of the request. It can include user identity, access rights, timestamp, etc., to ensure that only authorized requests can obtain approval for data sharing.

[0062] Furthermore, when the first application probe identifies that the data provider receives a data sharing request sent by the data receiver, based on the security sharing policy, a verification of the existence of the authentication identifier in the data sharing request is performed; if it is identified that the data sharing request contains the authentication identifier, the verification of the existence of the identifier passes; if it is not identified that the data sharing request contains the authentication identifier, the verification of the existence of the identifier fails.

[0063] S230: When the first application probe identifies that the identifier existence check has passed, perform a blocking instruction existence check on the data sharing request.

[0064] Among them, the existence check of blocking instructions refers to confirming whether there are instructions or policies that hinder or restrict data sharing; this may include laws and regulations, internal policies or security agreements to ensure that relevant blocking rules are followed when processing data requests.

[0065] Exemplarily, when the first application probe identifies that the data provider receives a data sharing request sent by the data receiver, based on the security sharing policy, a blocking instruction existence check is performed to determine whether the data sharing request contains a data blocking instruction; if it is identified that the data sharing request contains a data blocking instruction, the blocking instruction existence check fails; if it is not identified that the data sharing request contains a data blocking instruction, the blocking instruction existence check passes.

[0066] S240 , when the data providing end identifies that the identification existence check and the blocking instruction existence check have passed, the target shared data is sent to the data receiving end.

[0067] Optionally, when the data providing end identifies that the identification existence check and the blocking instruction existence check have passed, the target shared data is encrypted and the encrypted target shared data is sent to the data receiving end.

[0068] In an optional implementation, the data sharing request is blocked when the first application probe identifies that the identifier existence check or the blocking instruction existence check fails.

[0069] S250. When the second application probe identifies that the data receiving end has received the target shared data sent by the data providing end, a second anti-retention check is performed on the target shared data based on the security sharing strategy.

[0070] Optionally, when receiving the target shared data sent by the data providing end, the data receiving end decrypts the target shared data; and based on the security sharing policy, the write operation of the target shared data is subjected to a secondary anti-retention check through the second application probe.

[0071] S260. When the data receiving end identifies that the secondary anti-retention check has passed, a write operation of the target shared data is executed.

[0072] In an optional implementation, taking a technical scenario in which an operator needs to provide specific user data to a customer service operator, and when the customer service receives a call from the user service hotline, the service provider can only query more detailed information of the user in the operator based on the personal information provided by the user, the execution steps of the embodiment of the present application are as follows:

[0073] 1) Deployment of devices. Deploy a central management platform P on a certain operator side, deploy an application probe S on a user information query application system on a certain operator side, and deploy an application probe A on a customer service application system of a customer service provider.

[0074] 2) Formulate a security sharing strategy to prevent retention. For example, the operator's user information query API only allows customer service system IP (Internet Protocol) queries, and does not allow sensitive information such as user ID number, mobile phone number, name, home address, etc. to be retained. If retention is found, an alarm will be issued and retention will be blocked; and the strategy will be sent to application probe S and application probe A simultaneously.

[0075] 3) The application probe loads the anti-retention security policy and takes effect. When the customer service application system queries the operator's user information, it will initiate an API request to the operator's application system. The application probe A located in the customer service system will automatically add an authentication Token (token / identification) to the original request; after the operator's application system receives the request, the newly added application probe S will verify whether the request is written to the Token and whether the Token is legal. If it is illegal, the request will be rejected. If it is legal, it will be accepted and the user information encrypted by the application probe S will be returned; the Token is exclusive to application probe A, and the encrypted information returned by application probe S can only be decrypted by application probe A. The purpose of this is to prevent customer service providers from forging query requests; after the customer service application system receives the encrypted user information returned by the operator's application API, application probe A will parse the ciphertext into plaintext and hand it over to the customer service system for further processing; application probe A of the customer service application system monitors in real time whether the customer service system caches user personal information.

[0076] Specifically, the application probe A of the customer service application system monitors in real time whether the customer service system caches user personal information. Application probe A will intercept the IO write request of the customer service system to identify whether it contains personal sensitive information such as ID number and mobile phone number. For example, whether the SQL request for connecting to write data to the database contains personal sensitive information; if the IO write request contains personal sensitive information, then application probe A will intercept this IO write request, for example, the SQL write request containing sensitive information cannot be executed; after application probe A discovers an abnormal retention action, it will also send an alarm message to the central management platform, and will also send a blocking instruction to the operator's application probe S. After receiving the blocking instruction, application probe S will reject all query requests from the customer service system.

[0077] In the embodiment of the present application, a central management platform formulates a security sharing strategy based on the anti-retention data of the data provider, and sends the security sharing strategy to the first application probe and the second application probe respectively; when the first application probe recognizes that the data provider receives a data sharing request sent by the data receiving end, the authentication identifier of the data sharing request is verified based on the security sharing strategy; when the first application probe recognizes that the identifier existence verification passes, the data sharing request is verified for the existence of a blocking instruction; when the data provider recognizes that the identifier existence verification and the blocking instruction existence verification pass, the target shared data is sent to the data receiving end; when the second application probe recognizes that the data receiving end receives the target shared data sent by the data provider, the target shared data is verified for a secondary anti-retention based on the security sharing strategy; when the data receiving end recognizes that the secondary anti-retention verification passes, the write operation of the target shared data is executed. The above technical solution, through the central management platform, issues a unified security sharing strategy, and through the application probes configured on the data receiving end and the data providing end, can monitor in real time whether there is any abnormal data retention behavior during the data sharing process. Without modifying the original business systems of the two parties to the data sharing, data retention prevention can be achieved imperceptibly, which helps to improve the security of data sharing.

[0078] Embodiment 3

[0079] Figure 3 This is a structural diagram of a data sharing anti-retention system provided according to the third embodiment of the present application, which can be applied to prevent abnormal data from being retained in real time during the data sharing process between the two parties of the data sharing. The data sharing anti-retention system can be implemented in the form of hardware and / or software. Figure 3 As shown, the data sharing and anti-retention system includes a central management platform 310, a data provider 320 and a data receiving end 330; the data provider 320 is deployed with a first application probe 321; the data receiving end 330 is deployed with a second application probe 331; the data provider 320 and the data receiving end 330 are communicated with each other; the central management platform 310 is communicated with the data provider 320 and the data receiving end 330 respectively; the system can be configured in a computer device, such as a server.

[0080] The central management platform 310 is used to formulate a security sharing strategy based on the anti-retention data of the data provider 320, and send the security sharing strategy to the first application probe 321 and the second application probe 331 respectively;

[0081] The first application probe 321 is used to perform a first anti-retention check on the data sharing request based on a security sharing policy when recognizing that the data provider 320 receives a data sharing request sent by the data receiver 330;

[0082] The data provider 320 is used to send the target shared data to the data receiver 330 when it is identified that the first anti-retention check has passed;

[0083] The second application probe 331 is used to perform a secondary anti-retention check on the target shared data based on the security sharing strategy when recognizing that the data receiving end 330 receives the target shared data sent by the data providing end 320;

[0084] The data receiving end 330 is used to execute a write operation of the target shared data when it is identified that the secondary anti-retention check has passed.

[0085] In the embodiment of the present application, a central management platform formulates a security sharing strategy according to the anti-retention data of the data provider, and sends the security sharing strategy to the first application probe and the second application probe respectively; when the first application probe identifies that the data provider receives a data sharing request sent by the data receiving end, the data sharing request is firstly checked for anti-retention based on the security sharing strategy; when the data provider identifies that the first anti-retention check is passed, the target shared data is sent to the data receiving end; when the second application probe identifies that the data receiving end receives the target shared data sent by the data provider, the target shared data is secondly checked for anti-retention based on the security sharing strategy; when the data receiving end identifies that the second anti-retention check is passed, the target shared data is written. The above technical solution can monitor whether there is abnormal data retention behavior in the data sharing process in real time through the central management platform and the application probes configured on the data receiving end and the data provider end, and realize data anti-retention without modifying the original business systems of the two parties of data sharing, which helps to improve the security of data sharing.

[0086] Optionally, the first anti-retention check includes a mark existence check and a blocking instruction existence check; accordingly, the first application probe 321 is specifically used to:

[0087] Based on the security sharing strategy, the authentication identifier of the data sharing request is verified for existence;

[0088] When it is identified that the identification existence check has passed, a blocking instruction existence check is performed on the data sharing request.

[0089] Optionally, the first application probe 321 is further used for:

[0090] When it is identified that the identification existence check or the blocking instruction existence check fails, the data sharing request is blocked.

[0091] Optionally, the second application probe 331 is specifically used for:

[0092] When it is identified that the secondary anti-retention check fails, the write operation of the target shared data is blocked and a data retention alarm is sent to the central management platform 310 .

[0093] Optionally, the central management platform 310 is also used for:

[0094] When a data retention alarm is received, a data blocking instruction is generated and sent to the first application probe 321.

[0095] Accordingly, the first application probe 321 is further used for:

[0096] When the data blocking instruction is received, a blocking operation is performed on the data sharing request sent by the data receiving end 330 in the future.

[0097] The data sharing anti-retention system provided in the embodiments of the present application can execute the data sharing anti-retention method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing each data sharing anti-retention method.

[0098] Embodiment 4

[0099] Figure 4 It is a structural diagram of an electronic device 410 that implements the data sharing anti-retention method of an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0100] like Figure 4As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In RAM413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, ROM412 and RAM413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0101] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0102] Processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Processor 411 performs the various methods and processes described above, such as the data sharing anti-retention method.

[0103] In some embodiments, the data sharing anti-retention method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the data sharing anti-retention method described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured as the data sharing anti-retention method in any other appropriate manner (e.g., by means of firmware).

[0104] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0105] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data sharing anti-retention device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0106] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0107] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0108] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0109] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0110] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0111] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A data sharing and anti-retention method, characterized in that: Applied to a data sharing and anti-retention system; the system comprises a central management platform, a data providing end and a data receiving end; the data providing end is deployed with a first application probe; the data receiving end is deployed with a second application probe; the data providing end and the data receiving end are connected in communication; The central management platform is respectively connected to the data providing end and the data receiving end in communication; the method comprises: Formulate a security sharing strategy based on the anti-retention data of the data provider through the central management platform, and send the security sharing strategy to the first application probe and the second application probe respectively; When the first application probe identifies that the data provider receives the data sharing request sent by the data receiver, based on the security sharing policy, the first anti-retention check is performed on the data sharing request; When the data providing end identifies that the first anti-retention check has passed, the target shared data is sent to the data receiving end; When the second application probe identifies that the data receiving end has received the target shared data sent by the data providing end, a secondary anti-retention check is performed on the target shared data based on the security sharing policy; When the data receiving end identifies that the secondary anti-retention check has passed, the write operation of the target shared data is performed.

2. The method according to claim 1, characterized in that The first anti-retention check includes an identification existence check and a blocking instruction existence check; accordingly, based on the secure sharing policy, the first anti-retention check is performed on the data sharing request, including: Performing an identity existence check on the authentication identity of the data sharing request based on the security sharing policy by the first application probe; When the first application probe identifies that the identification existence check has passed, a blocking instruction existence check is performed on the data sharing request.

3. The method according to claim 2, characterized in that The method further comprises: When the first application probe identifies that the identification existence check or the blocking instruction existence check fails, the data sharing request is blocked.

4. The method according to claim 1, characterized in that: When the second application probe identifies that the secondary anti-retention check fails, the method further includes: The write operation of the target shared data is blocked by the second application probe, and a data retention alarm is sent to the central management platform.

5. The method according to claim 4, characterized in that The method further comprises: When the data retention alarm is received, the central management platform generates a data blocking instruction, and sends the data blocking instruction to the first application probe; When receiving the data blocking instruction, the first application probe blocks the data sharing request sent by the data receiving end in the future.

6. A data sharing and anti-retention system, characterized in that: The system comprises a central management platform, a data provider and a data receiving end; the data provider is deployed with a first application probe; the data receiving end is deployed with a second application probe; the data provider is connected to the data receiving end in communication; the central management platform is connected to the data provider and the data receiving end in communication; The central management platform is used to formulate a security sharing strategy based on the anti-retention data of the data provider, and send the security sharing strategy to the first application probe and the second application probe respectively; The first application probe is used to perform a first anti-retention check on the data sharing request based on the security sharing policy when recognizing that the data providing end receives the data sharing request sent by the data receiving end; The data providing end is used to send the target shared data to the data receiving end when recognizing that the first anti-retention check passes; The second application probe is used to perform a secondary anti-retention check on the target shared data based on the security sharing policy when recognizing that the data receiving end has received the target shared data sent by the data providing end; The data receiving end is used to execute the write operation of the target shared data when it is recognized that the secondary anti-retention check has passed.

7. The system according to claim 6, characterized in that The first anti-retention check includes a mark existence check and a blocking instruction existence check; accordingly, the first application probe is specifically used to: Based on the security sharing policy, performing an identity existence check on the authentication identity of the data sharing request; When it is identified that the identification existence check passes, a blocking instruction existence check is performed on the data sharing request.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data sharing anti-retention method as described in any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data sharing and anti-retention method as described in any one of claims 1 to 5 is implemented.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the data sharing anti-retention method according to any one of claims 1 to 5.

Images