Data access method and device, electronic equipment and storage medium
By implementing data access methods in a secure gateway device, the problem of data classification and grading tags in the prior art cannot be transferred is solved, and the security control in the data circulation process is realized, the process of repeated classification and grading is reduced, and the security of data circulation is improved. Sex and efficiency.
Patent Information
- Application Number
- CN202411526210.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-29
- Publication Date
- 2025-02-14
AI Technical Summary
The existing data security classification and grading strategies cannot retain classification and grading information during data flow, resulting in repeated classification and grading when data is transmitted between different systems and nodes, increasing management complexity and data leakage risks.
By implementing data access methods in a secure gateway device, the classification hierarchical tags and access control strategies of the fields to be accessed are determined according to the request of the data consumer, the content of the fields to be accessed is obtained from the data source and the access control operations are performed, and the operation results and classification are finally classified. The hierarchical tag is sent to the data consumer.
The data classification and grading label flow is realized, reducing the repetition of data classification and grading, and improving the security and efficiency of data circulation.
Smart Images
Figure CN119441223A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication technology, and in particular to a data access method, device, electronic device and storage medium. Background Art
[0002] In the era of big data, data security management is becoming increasingly important, especially in the medical industry, where the sensitivity and confidentiality of data are crucial to hospital operations and patient privacy protection. Currently, many medical institutions have begun to adopt data security classification and grading strategies to meet data governance needs and security compliance requirements. However, the existing classification and grading results are limited to static data and cannot retain their classification and grading information during data flow. This means that when data is transmitted between different systems and nodes, each link needs to be reclassified and graded, resulting in duplication of work and waste of resources, while increasing the complexity of management and the risk of data leakage.
[0003] In addition, it is relatively easy to implement native tags for unstructured data, because the data is in the form of files and can be watermarked on the files. However, it is more difficult to implement native tags for structured data, and it is difficult for traditional library table watermarks to achieve universal tags that flow with the flow of data. Summary of the invention
[0004] In order to overcome the problems existing in the related art, the present application provides a data access method, device, electronic device and storage medium.
[0005] According to a first aspect of an embodiment of the present application, a data access method is provided, the method being applied to a security gateway device, the method comprising:
[0006] Determine the field to be accessed according to the data access request sent by the data consumer;
[0007] Determine the classification and grading labels of the fields to be accessed, and determine the access control policy corresponding to the classification and grading labels;
[0008] Acquire the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy;
[0009] The operation result and the classification and grading label are sent to the data consumer as a data access result.
[0010] According to a second aspect of an embodiment of the present application, a data access device is provided, the device being applied to a security gateway device, the device comprising:
[0011] A field determination module, used to determine the field to be accessed according to the data access request sent by the data consumer;
[0012] A label strategy determination module, used to determine the classification and grading labels of the fields to be accessed, and to determine the access control strategy corresponding to the classification and grading labels;
[0013] A policy execution module, used to obtain the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy;
[0014] The result returning module is used to send the operation result and the classification and grading label as the data access result to the data consumer.
[0015] According to a third aspect of an embodiment of the present application, there is provided an electronic device, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described above.
[0016] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described above are implemented.
[0017] The technical solution provided by the embodiments of the present application may have the following beneficial effects:
[0018] The embodiment of the present application allows the data classification and grading labels to flow along with the data flow, and during the flow process, corresponding access control measures can be performed based on the data classification and grading labels, so as to improve the convenience and efficiency of security analysis of data flow and reduce the repetition of data classification and grading.
[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.
[0021] Figure 1 A flowchart of a data access method provided in an embodiment of the present application;
[0022] Figure 2 A process diagram of a data access method provided in an embodiment of the present application;
[0023] Figure 3 A schematic diagram of the structure of a data access device provided in an embodiment of the present application;
[0024] Figure 4A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0026] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.
[0027] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".
[0028] Next, the embodiments of the present application are described in detail.
[0029] The present application embodiment provides a data access method, which is applied to a security gateway device, such as Figure 1 As shown, the method comprises the following steps:
[0030] Step 110: Determine the field to be accessed according to the data access request sent by the data consumer;
[0031] Step 120: Determine the classification and grading labels of the fields to be accessed, and determine the access control policies corresponding to the classification and grading labels;
[0032] Step 130: Obtain the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy;
[0033] Step 140: Send the operation result and classification and grading label as the data access result to the data consumer.
[0034] In an embodiment of the present application, a data consumer initiates a data access request to structured data in a data source. A security gateway device is located between the data consumer and the data source and is used to manage and control the data content transmitted from the data source to the data consumer to ensure data security.
[0035] Specifically, based on the data access request sent by the data consumer, the security gateway device can determine the field that the data consumer wants to access, that is, determine the field to be accessed. In this embodiment, determining the field to be accessed means that the security gateway device can obtain the identification information of the field to be accessed based on the data access request, rather than the field content. It can be understood that in the actual data access process, the data consumer may access one or more fields at a time, and this embodiment does not limit the number of fields to be accessed.
[0036] In an embodiment of the present application, the security gateway device can obtain two correspondences from the local or external environment, namely, the correspondence between fields and classification and grading labels and the correspondence between classification and grading labels and access control policies. Therefore, after determining the field to be accessed, the security gateway device can determine the classification and grading labels corresponding to the field to be accessed and the access control policies corresponding to the classification and grading labels of the field to be accessed in turn by querying the above two correspondences.
[0037] As a specific implementation method, this embodiment specifically determines the classification and grading labels of the fields to be accessed in the following manner: according to preset classification and grading rules, each field of the target business data is classified and graded to obtain a data asset table of the target business data; by querying the data asset table, the classification and grading labels of the fields to be accessed are determined.
[0038] That is to say, this embodiment pre-sets classification and grading rules, and then sorts the target business data according to the classification and grading rules, that is, classifies and grades each field of the target business data, and obtains the corresponding relationship between each field and the classification and grading label, that is, the data asset table of the target business data. When determining the classification and grading label of the field to be accessed later, the classification and grading label corresponding to the field to be accessed can be obtained by querying the data asset table.
[0039] It is understandable that if there are multiple business requirements in the actual application, the data asset tables of each business can be sorted out separately. Accordingly, when the data consumer initiates a data access request, it not only needs to specify the field to be accessed, but also needs to specify the business to be accessed.
[0040] In addition, when determining the access control policy corresponding to the classification and grading labels, it can be implemented in any of the following ways:
[0041] Method 1: The classification and grading labels correspond to the access control policies one by one. After the classification and grading labels of the fields to be accessed are determined, the access control policy corresponding to the classification and grading labels can be uniquely determined.
[0042] Method 2: Determine the access control policy based on the classification and grading labels and other factors. For example, determine the access control policy based on the classification and grading labels of the fields to be accessed and the first information included in the data access request, where the first information is the IP address and / or database account information of the data consumer.
[0043] After determining the access control strategy, you can decide how to respond to the data access request of the data consumer according to the access control strategy. Specifically, first determine whether the access control strategy is blocking. If the access control strategy is blocking, the data requested by the data consumer will not be sent to the data consumer, and accordingly, there is no need to obtain the data content to be accessed from the data source; if it is determined that the access control strategy is not blocking, then obtain the content of the field to be accessed from the data source.
[0044] As a specific implementation method, the content of the field to be accessed is obtained in the following manner: determine whether the access control policy is blocking; if the determination result is yes, send a blocking message to the data consumer; if the determination result is no, obtain the content of the field to be accessed from the data source according to the second information included in the data access request, where the second information is the identification information of the target business data and the identification information of the field to be accessed in the target business data.
[0045] In addition to blocking, access control policies may also include auditing, desensitizing, watermarking, encryption, etc. Specifically, this embodiment performs access control operations on the contents of the field to be accessed according to the access control policy in the following manner: when the access control policy is auditing, an alarm message is generated, and the alarm message and the contents of the field to be accessed are used as the operation results of the access control operation; when the access control policy is desensitizing, watermarking or encryption, a data modification operation is performed on the contents of the field to be accessed according to the access control policy to obtain the operation results of the access control operation.
[0046] It is worth mentioning that after operating the contents of the fields to be accessed according to the access control policy, this embodiment not only sends the operation results to the data consumer, but also sends the classification and grading labels of the fields to be accessed to the data consumer. As a specific implementation method, the classification and grading labels of the fields to be accessed can be added to the operation results in the form of field description / field suffix as the data access result of this data access request, and the data access result is sent to the data consumer.
[0047] This embodiment sends the classification and grading labels of the fields to be accessed to the data consumer. Therefore, during the subsequent data transmission process, there is no need to classify and grade the transmitted data again. The data consumer can directly process the data accordingly based on the classification and grading labels, thereby achieving the purpose of allowing the classification and grading labels of structured data to flow with the data flow. Under the premise of ensuring the security of data transmission, unnecessary repeated data classification and grading processes are avoided.
[0048] The following uses actual applications as an example to further illustrate the data access method of this application. Figure 2 The native tag data security gateway system is shown, which mainly includes the following three parts:
[0049] The first part is to perform asset detection and classification on the target business data to obtain a data asset table.
[0050] First, set up the classification and grading templates, as shown in Table 1 and Table 2. Then configure the database access information required for the target business data, including IP address, port, database type, account password, etc. The native tag data security gateway system accesses the required information through the database, connects to the database, obtains data assets such as libraries, tables, and fields in the database, and implements classification and grading of fields based on the matching rules in the classification and grading templates. The classification and grading results are stored in the database of the native tag data security gateway system to form a data asset table.
[0051] Table 1
[0052] Major categories Medium Subclass Data Description Matching rules
[0053] Table 2
[0054]
[0055] The second part is to configure the access control policy of the native tag data security gateway system.
[0056] Specifically, based on the experience of data security experts and business needs, you can set access control rules as follows:
[0057] Blocking rules: Blocking rules can be set by the data consumer IP, database account, and classification and grading labels of the data to be accessed. For example, 192.168.0.3 and LIS accounts are not allowed to access level 5 data, nor are they allowed to access category A data.
[0058] Desensitization rules: Desensitization rules can be set by the data consumer IP, database account, and classification and grading labels of the data that needs to be accessed. For example, 192.168.0.3 and LIS (Laboratory Information System) accounts need to desensitize level 4 data and A-classified data.
[0059] Watermark rules: You can set watermark rules based on the data consumer IP, database account, and classification and grading labels for data that needs to be accessed. For example, 192.168.0.3 and LIS accounts need to add database table watermarks to level 4 data.
[0060] Encryption rules: Encryption rules can be set by the data consumer IP, database account, and classification and grading labels of the data that needs to be accessed. For example, 192.168.0.3 and LIS accounts need to use the strongest encryption algorithm to transmit level 4 data.
[0061] Audit rules: Audit rules can be set based on the IP address of the data consumer, the database account, and the classification and grading labels of the data that needs to be accessed. For example, if 192.168.0.3 and the LIS account access more than 10,000 sensitive data within 5 minutes, an alarm will be generated.
[0062] The third part is the data access process of the native tag data security gateway system.
[0063] Based on the pre-generated data asset table and pre-configured access control policy, the following data access process is implemented, including steps 1 to 6:
[0064] Step 1: Determine the field to be accessed.
[0065] Receive the data access request sent by the data consumer, that is, the query statement. By analyzing the query statement, the corresponding data to be accessed (including but not limited to the fields to be accessed) can be identified. For example, the query statement "Select aF1, aF2from business table A1" can identify the business table to be accessed and the fields to be accessed as shown in Table 3:
[0066] Table 3
[0067] Business table Fields Business Table A1 aF Business Table A1 aF2
[0068] Step 2: According to the data asset table of the native tag data security gateway system in the first part of the query, identify the classification and grading labels of the data to be accessed, as shown in Table 4.
[0069] Table 4
[0070] Business table Fields Classification Grading Business Table A1 aF C1 G1 Business Table A1 aF2 C2 G2
[0071] Step 3: forward the query statement to the database to obtain the query result, that is, the content of the field to be accessed mentioned above, as shown in Table 5.
[0072] Table 5
[0073] aF aF2 d01 d02 d11 d12
[0074] Step 4: Determine the access control policy corresponding to the classification and grading label of each field to be accessed, and execute the access control policy.
[0075] Access control strategies are matched according to the IP address, database account, classification and grading labels of the data consumer. If a blocking rule is matched, the request is directly interrupted and a response of query rejection is given, such as a blocking signal.
[0076] Access control strategies are matched according to the IP address, database account, classification and grading labels of the data consumer. If a desensitization rule is matched, the data is desensitized according to the desensitization rule.
[0077] Access control strategies are matched according to the IP address, database account, classification and grading labels of the data consumer. If a watermark rule is matched, a watermark is added to the data according to the watermark strategy.
[0078] Access control strategies are matched according to the IP address, database account, classification and grading labels of the data consumer. If encryption rules are matched, the encryption strength of the data is increased according to the encryption strategy.
[0079] Access control strategies are matched according to the data consumer's IP address, database account, classification and grading labels. If audit rules are matched, an alarm signal is generated to facilitate the fastest response to data security incidents.
[0080] Step 5: Modify the header of the operation result and return the result.
[0081] Modify the header of the returned data according to the classification and grading results, as shown in Table 6, to obtain the final data access result. Send the data access result to the data consumer.
[0082] Table 6
[0083] F1__C1_G1 aF2__C2_G2 d01 d02 d11 d12
[0084] Step 6: The data consumer receives the data access result and performs corresponding operations on the data according to business needs based on the classification and grading labels in the data access result.
[0085] It can be seen from the above technical scheme that this embodiment constructs a data security gateway system based on classification and grading labels. After the data is classified and graded, the classification and grading labels of the data will flow out together during the outflow of the data, which is convenient for the detection of data security threat behaviors and the configuration of management and control strategies in the outflow process, and effectively reduces the repetition of data classification and grading.
[0086] This embodiment keeps the classification and grading labels of data intact as it flows, just like a person carries his or her ID card with him or her, which can significantly improve the efficiency of data management, avoid the trouble of repeated classification, reduce resource consumption, and ensure that sensitive data can be identified and protected in a timely and accurate manner in different links. This not only helps to improve the level of data security management, but also provides more reliable data support for the allocation of medical resources, scientific research and innovation in hospitals.
[0087] Based on the same inventive concept, the present application also provides a data access device, which is applied to a security gateway device, and its structural diagram is shown in FIG. Figure 3 As shown, specifically including:
[0088] A field determination module 310 is used to determine a field to be accessed according to a data access request sent by a data consumer;
[0089] The tag policy determination module 320 is used to determine the classification and grading tags of the field to be accessed, and determine the access control policy corresponding to the classification and grading tags;
[0090] A policy execution module 330 is used to obtain the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy;
[0091] The result returning module 340 is used to send the operation result and the classification and grading label as the data access result to the data consumer.
[0092] As a specific implementation, the label strategy determination module 320 specifically determines the classification and grading labels of the to-be-accessed fields in the following manner:
[0093] According to the preset classification and grading rules, various fields of the target business data are classified and graded to obtain the data asset table of the target business data;
[0094] The classification and grading labels of the fields to be accessed are determined by querying the data asset table.
[0095] As a specific implementation, the result returning module 340 sends the data access result to the data consumer in the following manner:
[0096] The classification and grading labels are added to the operation results in the form of field descriptions as data access results, and the data access results are sent to the data consumer.
[0097] As a specific implementation, the tag policy determination module 320 determines the access control policy in the following manner:
[0098] The access control policy is determined according to the hierarchical classification label of the field to be accessed and the first information included in the data access request, where the first information is the IP address and / or database account information of the data consumer.
[0099] As a specific implementation, the policy execution module 330 obtains the content of the field to be accessed in the following manner:
[0100] Determine whether the access control policy is blocking;
[0101] If the judgment result is yes, a blocking message is sent to the data consumer;
[0102] If the judgment result is no, the content of the field to be accessed is obtained from the data source according to second information included in the data access request, where the second information is identification information of the target business data and identification information of the field to be accessed in the target business data.
[0103] As a specific implementation method, the policy execution module 330 performs access control operations on the content of the field to be accessed in the following manner:
[0104] When the access control policy is audit, a warning message is generated, and the warning message and the content of the field to be accessed are used as the operation result of the access control operation;
[0105] When the access control policy is desensitization, watermark or encryption, a data modification operation is performed on the content of the field to be accessed according to the access control policy to obtain an operation result of the access control operation.
[0106] The present application also provides an electronic device, such as Figure 4 As shown, it includes a processor 410 and a machine-readable storage medium 420, wherein the machine-readable storage medium 420 stores machine-executable instructions that can be executed by the processor 410, and the processor 410 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned data access methods.
[0107] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.
[0108] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
[0109] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned data access methods are implemented.
[0110] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. A data access method, characterized in that: The method is applied to a security gateway device, and the method comprises: Determine the field to be accessed according to the data access request sent by the data consumer; Determine the classification and grading labels of the fields to be accessed, and determine the access control policies corresponding to the classification and grading labels; Acquire the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy; The operation result and the classification and grading label are sent to the data consumer as a data access result.
2. The method according to claim 1, characterized in that Specifically, the classification and grading labels of the fields to be accessed are determined in the following manner: According to the preset classification and grading rules, each field of the target business data is classified and graded to obtain the data asset table of the target business data; The classification and grading labels of the fields to be accessed are determined by querying the data asset table.
3. The method according to claim 1, characterized in that Specifically, the data access result is sent to the data consumer in the following manner: The classification and grading labels are added to the operation results in the form of field descriptions as data access results, and the data access results are sent to the data consumer.
4. The method according to claim 1, characterized in that: The access control strategy is determined in the following ways: An access control policy is determined based on the hierarchical classification label of the field to be accessed and the first information included in the data access request, where the first information is the IP address and / or database account information of the data consumer.
5. The method according to claim 1, characterized in that: The content of the field to be accessed is obtained in the following ways: Determine whether the access control policy is blocking; If the judgment result is yes, a blocking message is sent to the data consumer; If the judgment result is no, the content of the field to be accessed is obtained from the data source according to second information included in the data access request, where the second information is identification information of the target business data and identification information of the field to be accessed in the target business data.
6. The method according to claim 1, characterized in that Specifically, the access control operation on the content of the field to be accessed is performed in the following manner: When the access control policy is audit, a warning message is generated, and the warning message and the content of the field to be accessed are used as the operation result of the access control operation; When the access control policy is desensitization, watermark or encryption, a data modification operation is performed on the content of the field to be accessed according to the access control policy to obtain an operation result of the access control operation.
7. A data access device, characterized in that: The device is applied to a security gateway device, and the device comprises: A field determination module, used to determine the field to be accessed according to the data access request sent by the data consumer; A label strategy determination module, used to determine the classification and grading labels of the fields to be accessed, and to determine the access control strategy corresponding to the classification and grading labels; A policy execution module, used to obtain the content of the field to be accessed from the data source, and perform access control operations on the content of the field to be accessed according to the access control policy; The result returning module is used to send the operation result and the classification and grading label as the data access result to the data consumer.
8. The device according to claim 7, characterized in that The label strategy determination module specifically determines the classification and grading labels of the to-be-accessed fields in the following manner: According to the preset classification and grading rules, various fields of the target business data are classified and graded to obtain the data asset table of the target business data; The classification and grading labels of the fields to be accessed are determined by querying the data asset table.
9. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 6.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 6 are implemented.