Local protection device and method for sensitive data and computer readable storage medium

Abstract

The embodiment of the invention relates to the technical field of data protection, and discloses a local protection device and method for sensitive data and a computer readable storage medium. The local protection device for the sensitive data comprises a business layer, a compliance adaptation layer, a security interface layer, a security operation layer and a data storage layer, the security interface layer is configured with a plug-in library, the plug-in library comprises multiple types of data processing plug-ins, and one type of data processing plug-in corresponds to one type of sensitive data. The compliance adaptation layer is configured to load the target data processing plug-in and request the target processing layer to execute the target interface operation on the target sensitive data. According to the embodiment of the invention, the data processing plug-ins can be configured according to the data types of the sensitive data, and different types of data processing plug-ins are mutually decoupled or independent, so that the sensitive data can be pertinently protected and processed under the condition that the supervision requirements of new industry standards or laws and regulations on different types of sensitive data are met, and the security of the sensitive data is improved. Therefore, the compatibility of adapting to different data protection scenes is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data protection technology, and specifically to a local protection device for sensitive data and a method thereof, and a computer-readable storage medium. Background Art

[0002] Electronic devices often come into contact with various types of sensitive data during the course of various types of business. Designers need to configure electronic devices according to industry standards or laws and regulations so that electronic devices can perform data protection processing on various types of sensitive data, thereby avoiding leakage of various types of sensitive data. The sensitive data protection methods provided by related technologies are relatively static, and are usually designed based on existing current industry standards or current laws and regulations. However, with the development of business, the types of sensitive data are more diverse, and industry standards or laws and regulations have different protection requirements for different categories of sensitive data. When related technologies need to cater to the needs of protecting different types of sensitive data, related technologies need to overturn previous data protection methods and rebuild data protection methods that match current industry standards or current laws and regulations. Therefore, the compatibility of data protection methods provided by related technologies is not high. Summary of the invention

[0003] One purpose of an embodiment of the present application is to provide a local protection device for sensitive data and a method thereof, and a computer-readable storage medium to solve the technical problem of low compatibility of related technologies.

[0004] In a first aspect, an embodiment of the present application provides a local protection device for sensitive data, including a business layer, a compliance adaptation layer, a security interface layer, a security operation layer and a data storage layer, wherein the security interface layer is configured with a plug-in library, the plug-in library includes multiple types of data processing plug-ins, one type of data processing plug-in corresponds to one type of sensitive data, and the security interface layer includes multiple types of application interfaces that implement different interface operations;

[0005] The compliance adaptation layer is configured to select a data processing plug-in corresponding to the target data type from multiple types of data processing plug-ins as a target data processing plug-in for loading according to a target data type of the target sensitive data, so that the target data processing plug-in selects an application interface matching the target interface operation from multiple types of application interfaces as a target application interface, and requests a target processing layer to perform a target interface operation corresponding to the target application interface on the target sensitive data, and the target processing layer is one or both of the security operation layer and the data storage layer.

[0006] Optionally, the business layer is configured to obtain a target business request, where the target business request is used to request to perform a target interface operation on target sensitive data, and determine a target data type of the target sensitive data according to the target business request.

[0007] Optionally, the target data processing plug-in is configured to: determine a target interface type of the target application interface, and determine an object layer matching the target interface type in the security operation layer and the data storage layer as a target processing layer.

[0008] Optionally, the target interface type includes a first class interface type or a second class interface type, and the target data processing plug-in is configured as follows: if the target interface type is the first class interface type, then the security operation layer and the data storage layer are both determined to be target processing layers; if the target interface type is the second class interface type, then the security operation layer is determined to be the target processing layer.

[0009] Optionally, the target data processing plug-in is configured to:

[0010] If the security operation layer and the data storage layer are both target processing layers, requesting the security operation layer and the data storage layer to perform the target interface operation respectively;

[0011] If the security operation layer is a target processing layer, the security operation layer is requested to perform the target interface operation.

[0012] Optionally, the target application interface includes a secure storage interface, and the target interface operation includes a data secure storage operation;

[0013] The target data processing plug-in is configured to: if the target application interface is a secure storage interface, request the security operation layer to perform a data security storage operation on the target sensitive data to obtain a target ciphertext;

[0014] The security operation layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the data storage layer based on the target application interface;

[0015] The data storage layer is configured to store the target ciphertext.

[0016] Optionally, the target application interface includes a raw data acquisition interface, and the target interface operation includes a raw data acquisition operation;

[0017] The target data processing plug-in is configured to: if the target application interface is the original data acquisition interface, request the data storage layer to perform an original data acquisition operation to obtain a target ciphertext corresponding to the target sensitive data;

[0018] The data storage layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the security operation layer based on the target application interface;

[0019] The security operation layer is configured to: perform restoration processing on the target ciphertext to obtain target sensitive data, and return the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transfers the target sensitive data to the business layer based on the compliance adaptation layer.

[0020] Optionally, the target application interface includes a data comparison interface, and the target interface operation includes a data comparison operation;

[0021] The target data processing plug-in is configured to: if the target application interface is the data comparison interface, request the security operation layer to perform a data security storage operation on the target sensitive data to obtain a ciphertext to be compared;

[0022] The security operation layer is configured to: return the ciphertext to be compared to the target data processing plug-in based on the target application interface;

[0023] The data storage layer is configured to: respond to a data retrieval request sent by the target data processing plug-in based on the target application interface, and return a target ciphertext corresponding to the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in generates comparison result information based on the ciphertext to be compared and the target ciphertext.

[0024] Optionally, the target application interface includes a data desensitization interface, and correspondingly, the target interface operation includes a data desensitization operation;

[0025] The target data processing plug-in is configured to: if the target application interface is a data desensitization interface, request the security operation layer to perform a data desensitization operation on the target sensitive data to obtain a desensitized ciphertext;

[0026] The security operation layer is configured to return the desensitized ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the desensitized ciphertext to the business layer based on the compliance adaptation layer.

[0027] Optionally, the compliance adaptation layer is configured with a plug-in configuration file, and each of the data processing plug-ins can be dynamically registered in the plug-in configuration file;

[0028] The compliance adaptation layer is configured to determine whether the data processing plug-in corresponding to the target data type is in an activated state according to the plug-in configuration file. If so, the data processing plug-in corresponding to the target data type is determined as the target data processing plug-in and the target data processing plug-in is loaded.

[0029] In a second aspect, an embodiment of the present application provides a local protection method for sensitive data, which is applied to the above-mentioned local protection device for sensitive data, including:

[0030] Obtain a plug-in library, the plug-in library including multiple types of data processing plug-ins, each type of the data processing plug-in corresponding to a type of sensitive data;

[0031] According to the target data type of the target sensitive data, a data processing plug-in corresponding to the target data type is selected in the plug-in library as a target data processing plug-in for loading, so that the target data processing plug-in selects an application interface matching the target interface operation from among the preset multiple types of application interfaces as the target application interface;

[0032] A target processing layer is requested to perform a target interface operation corresponding to the target application interface on the target sensitive data, and the target processing layer is one or both of the security operation layer and the data storage layer.

[0033] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor implements the functions of the local protection device for sensitive data described above.

[0034] The embodiments of the present application can achieve the following technical effects: the embodiments of the present application can configure data processing plug-ins according to the data type of sensitive data, one type of data processing plug-in corresponds to one type of sensitive data, and different types of data processing plug-ins are decoupled or independent from each other. This ensures that while complying with the new industry standards or laws and regulations on the supervision requirements of different types of sensitive data, sensitive data can be targeted for protection processing, thereby improving compatibility with different data protection scenarios, and ensuring that different types of data processing plug-ins do not affect each other, thereby avoiding the problem of low production efficiency caused by overturning the previous data protection method and rebuilding a new data protection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] Figure 1 A schematic diagram of the structure of a local protection device for sensitive data provided in an embodiment of the present application;

[0037] Figure 2 A data flow diagram for reading and writing target sensitive data provided by an embodiment of the present application;

[0038] Figure 3 A flowchart of a local protection method for sensitive data provided in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the structure of a controller provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0041] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other, all within the scope of protection of the present application. In addition, although the functional module division is performed in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a sequence different from the module division in the device or the flow chart. Furthermore, the words "first", "second", "third", etc. used in this application do not limit the data and execution order, but only distinguish the same items or similar items with basically the same functions and effects.

[0042] As mentioned in the background technology, charging piles, as a type of electronic equipment, can provide power for electric vehicles. Charging piles can interact with users to complete related charging services. According to relevant domestic and foreign safety regulations and industry standards, charging piles, as IoT devices, need to protect relevant sensitive data. In addition to the various passwords, keys, credentials, etc. required for network security, the sensitive data involved in the charging service of charging piles also involves financial payment information, personal privacy information, etc., depending on the specific functions.

[0043] Charging piles not only need to support the normal operation of the business, but also need to comply with the data protection requirements of various domestic and international safety regulations and industry standards. In addition, they must meet the normal use of data during system development, debugging, and operation and maintenance. In the above business processes, charging piles need to encrypt, desensitize and perform other processing on sensitive data.

[0044] The related technology configures the charging pile to encrypt or desensitize sensitive data at the business layer. As described in the background technology, the sensitive data protection method provided by the related technology is relatively static. With the development of the business, the types of sensitive data are more diversified. Industry standards or laws and regulations have different protection requirements for different categories of sensitive data. When the related technology needs to cater to the needs of protecting different categories of sensitive data, the related technology needs to reconfigure the charging pile to meet the requirements of the new industry standards or laws and regulations.

[0045] In addition, the way charging piles protect sensitive data belongs to local protection, and related technologies can also protect sensitive data in the cloud, which belongs to cloud protection. However, the protection scenarios faced by the cloud protection method are quite different from those faced by the local protection method. For example, the cloud protection method uses a database firewall method or a database waterproof dam method to protect sensitive data. For example, the database firewall determines whether to give users access to sensitive data based on access rights. This protection scenario is quite different from the sensitive data protection scenario faced by IoT devices (such as charging piles). Therefore, the cloud protection method is not applicable to charging piles.

[0046] The embodiments of the present application can provide local protection for sensitive data in a plug-in manner based on the sorting and identification of sensitive data, and support subsequent dynamic expansion, so as to meet the security compliance requirements of various laws and industry standards for the protection of relevant sensitive data that are constantly updated and improved.

[0047] See also Figure 1 , the embodiment of the present application provides a local protection device for sensitive data. Figure 1 As shown, the local protection device for sensitive data includes a business layer 200 , a compliance adaptation layer 300 , a security interface layer 400 , a security operation layer 500 and a data storage layer 600 .

[0048] The business layer 200 is configured with a variety of business modules, each of which can support corresponding business requests. Figure 1 As shown, the business layer 200 includes a charging module, a payment module, an operation and maintenance module, a log module and other business modules. The charging module can support various charging business requests and extract corresponding charging data from the charging business requests. The payment module can support various payment business requests associated with payment, and interact with the user to complete the payment operation. The operation and maintenance module can support various operation and maintenance business requests to complete various operation and maintenance operations. The log module can save various logs for subsequent viewing and calling. The functions of other business modules can be customized by the designer according to business needs.

[0049] The business layer 200 can store and display sensitive data. Sensitive data is data that needs to be protected according to industry standards or laws and regulations. The data type of sensitive data can be defined by the designer according to industry standards or laws and regulations. For example, sensitive data includes user credit card number, latitude and longitude coordinates or local management interface password, etc. Correspondingly, the data type of sensitive data includes transaction data type, location data type or password data type, etc. In the embodiment of the present application, PAN is used to represent the transaction data type, Location is used to represent the location data type, Password is used to represent the password data type, and Other is used to represent other data types.

[0050] The compliance adaptation layer 300 is used to classify and protect sensitive data according to its data type. The compliance adaptation layer 300 provides a protection entry for each type of sensitive data identified by the business layer 200. The compliance adaptation layer 300 is configured with multiple protection entries, one type of protection entry corresponds to one type of sensitive data, such as Figure 1 As shown, the compliance adaptation layer 300 includes a PCI-DSS entry, a PII entry, a Secret entry and an Other entry. The PCI-DSS entry corresponds to sensitive data of the transaction data type, the PII entry corresponds to sensitive data of the location data type, the Secret entry corresponds to sensitive data of the password data type, and the Other entry corresponds to sensitive data of other data types.

[0051] The security interface layer 400 includes multiple types of application interfaces that implement different interface operations, including a secure storage interface [SecureStoreData(key, value)], an original data acquisition interface [GetOriginalData(key)], a data desensitization interface [GetDesensitizedData(key)], or a data comparison interface [SecureVerifyData(key, value)], etc. Correspondingly, the interface operations include a data security storage operation that implements a secure storage function for sensitive data, an original data acquisition operation that implements a function of acquiring sensitive data locally, a data desensitization operation that implements a data desensitization function for sensitive data, or a data comparison operation that implements a data comparison function for sensitive data, etc.

[0052] The security interface layer 400 is configured with a plug-in library, which includes multiple types of data processing plug-ins 700. The data processing plug-ins 700 can be customized by the designer according to business needs. Customization means that the designer can develop plug-ins that are suitable for protecting corresponding sensitive data according to industry standards, laws and regulations, or their own needs. Each type of data processing plug-in can implement all interface functions in the security interface layer 400, such as Figure 1As shown, each type of data processing plug-in can realize the interface functions of secure storage interface, original data acquisition interface, data desensitization interface and data comparison interface.

[0053] One type of data processing plug-in corresponds to one type of sensitive data. Figure 1 As shown, the plug-in library includes transactional data processing plug-ins, locational data processing plug-ins or password data processing plug-ins, etc. The transactional data processing plug-in can implement the interface functions of secure storage interface, original data acquisition interface, data desensitization interface and data comparison interface for sensitive data of transactional data type. Similarly, the locational data processing plug-in can implement the interface functions of secure storage interface, original data acquisition interface, data desensitization interface and data comparison interface for sensitive data of locational data type. The password data processing plug-in can implement the interface functions of secure storage interface, original data acquisition interface, data desensitization interface and data comparison interface for sensitive data of password data type.

[0054] The security operation layer 500 is used to support the needs of the security interface layer 400 for processing sensitive data, wherein the security operation layer 500 can perform security operations such as secure encryption / decryption, hash operations, and data desensitization on sensitive data. The security operation layer 500 can shield the underlying security operation operations. For example, the underlying application can shield the following underlying security operation operations: TPM (Trusted Platform Module), HSM (Hardware Security Module), SecureElement, TEE (Trusted Execution Environment) or OpenSSL security software library. TPM is used to store encryption keys, perform identity authentication, and ensure the security features of the platform. HSM is used to protect and manage encryption keys and perform encryption operations. SecureElement is a secure chip or module for storing sensitive data and performing security operations. TEE is used to allow code to be executed in a protected area to prevent external interference and attacks. The OpenSSL security software library is used to provide comprehensive encryption functions, including the implementation of SSL / TLS protocols, encryption algorithms, and key management tools.

[0055] The data storage layer 600 is used to store sensitive data, wherein the data storage layer 600 supports the security interface layer 400 to add, delete, modify, query, etc. the sensitive data. The data storage layer 600 shields the underlying storage details, such as databases, files, system properties, etc.

[0056] The embodiments of the present application have described the architecture of the local protection device for sensitive data. Based on the local protection device for sensitive data provided by the above embodiments, the embodiments of the present application can implement corresponding protection operations for various types of sensitive data.

[0057] The business layer 200 is configured to obtain a target business request, where the target business request is used to request to perform a target interface operation on target sensitive data, and determine a target data type of the target sensitive data according to the target business request.

[0058] The target business request may be a business request sent by an upper-layer application, for example, the target business request is a charging business request, a payment business request, or an operation and maintenance business request, etc. It is understandable that the target business request may carry target sensitive data or may not carry target sensitive data depending on the operation type of the target business request. For example, in the payment business process, the charging pile needs to verify whether the payment password is correct, where the payment password is sensitive data. The upper-layer application sends a target business request to the business layer 200, where the target business request carries the payment password. For another example, when displaying sensitive data to the upper-layer application, the upper-layer application sends an original data acquisition request to the business layer 200, where the original data acquisition request does not need to carry the target sensitive data. The business layer 200 responds to the original acquisition request, obtains the original data, and sends the original data to the upper-layer application, where the original data is the target sensitive data.

[0059] The target sensitive data is sensitive data that needs to be protected, and the target data type is the data type of the target sensitive data. The target business request carries a data type identifier, and the business layer 200 parses the data type identifier from the target business request. The data type identifier points to the reference data, and determines whether the data type identifier matches the preset sensitive type identifier. If so, the reference data is determined to be the target sensitive data, and the target data type of the target sensitive data is determined according to the preset sensitive type identifier. If not, the reference data is determined not to be sensitive data.

[0060] The target interface operation is used to implement the interface function of the target sensitive data. Figure 1 As shown, the target interface operation is any interface operation among data security storage operation, original data acquisition operation, data desensitization operation and data comparison operation.

[0061] The compliance adaptation layer 300 is configured to select a data processing plug-in corresponding to the target data type from multiple types of data processing plug-ins as the target data processing plug-in for loading, so that the target data processing plug-in selects an application interface that matches the target interface operation from multiple types of application interfaces as the target application interface, and requests the target processing layer to perform operations on the target sensitive data in accordance with the target application interface. The embodiment of the present application can configure the data processing plug-in according to the data type of the sensitive data, one type of data processing plug-in corresponds to one type of sensitive data, and different types of data processing plug-ins are decoupled or independent from each other, thereby ensuring that in compliance with the new industry standards or laws and regulations on different types of sensitive data, targeted protection processing can be performed on sensitive data, thereby improving compatibility with different data protection scenarios, and ensuring that different types of data processing plug-ins do not affect each other, thereby avoiding the problem of low production efficiency caused by overturning the previous data protection method and rebuilding the new data protection method. The target processing layer is one or both of the security operation layer and the data storage layer, therefore,

[0062] The target data processing plug-in is configured to: determine the target interface type of the target application interface, and determine the object layer that matches the target interface type in the security operation layer and the data storage layer as the target processing layer. For example, the target sensitive data is sensitive data of the transaction data type. In the embodiment of the present application, the object layer that matches the transaction data type is determined as the target processing layer in the security operation layer and the data storage layer. Due to the complexity of business situations, the definitions and protection measures of sensitive data in industry standards or laws and regulations are variable. Some sensitive data require not only safe operations but also safe storage, some sensitive data only require safe operations, and some sensitive data only require safe storage. Therefore, the embodiment of the present application can combine the target interface type of the target application interface to determine the target processing layer in the security operation layer and the data storage layer, so as to adapt to the protection requirements of sensitive data in various scenarios.

[0063] The compliance adaptation layer is configured with a plug-in configuration file, and each data processing plug-in can be dynamically registered in the plug-in configuration file. The compliance adaptation layer is configured to determine whether the data processing plug-in corresponding to the target data type is in an activated state according to the plug-in configuration file. If it is, the data processing plug-in corresponding to the target data type is determined as the target data processing plug-in, and the target data processing plug-in is loaded. If it is not, a prompt message is transmitted to the business layer based on the compliance adaptation layer, and the prompt message is used to prompt that the response to the target business request fails. The data processing plug-in provided in the embodiment of the present application can be dynamically registered in the plug-in library, and different types of sensitive data correspond to different data processing plug-ins, and the data processing plug-in performs secure processing on sensitive data according to a special set of rules. When new industry standards or new laws and regulations or new sensitive data categories appear, the embodiment of the present application only needs to register the corresponding data processing plug-in in a targeted manner, so that it can flexibly support various new business scenarios and meet the security compliance requirements of new industry standards or new laws and regulations in a timely manner.

[0064] The target interface type includes the first type of interface type or the second type of interface type, such as Figure 1 As shown, the interface types of the secure storage interface, the original data acquisition interface and the data comparison interface belong to the first interface type, and the interface type of the data desensitizing interface belongs to the second interface type.

[0065] The target data processing plug-in is configured as follows: if the target interface type is the first type of interface, the security operation layer and the data storage layer are both determined as the target processing layer; if the target interface type is the second type of interface, the security operation layer is determined as the target processing layer.

[0066] The target data processing plug-in is configured as follows: if the security operation layer and the data storage layer are both target processing layers, the security operation layer and the data storage layer are respectively requested to perform target interface operations; if the security operation layer is the target processing layer, the security operation layer is requested to perform target interface operations.

[0067] In some embodiments, the target application interface includes a secure storage interface, and the target interface operation includes a data secure storage operation. The target data processing plug-in is configured to: if the target application interface is a secure storage interface, request the security operation layer to perform a data secure storage operation on the target sensitive data to obtain the target ciphertext. The security operation layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the data storage layer based on the target application interface. The data storage layer is configured to save the target ciphertext.

[0068] The embodiment of the present application can respond to the demand for secure storage of target sensitive data. According to the data type of the target sensitive data, a target data processing plug-in is loaded to implement the secure storage function of the secure storage interface for the target sensitive data. The target data processing plug-in requests the security operation layer to encrypt the target sensitive data based on the secure storage interface, and then requests the data storage layer to store the target ciphertext based on the secure storage interface, thereby avoiding the problem of easy exposure of the target sensitive data and improving the security of local storage of the target sensitive data.

[0069] In some embodiments, the target application interface includes an original data acquisition interface, and the target interface operation includes an original data acquisition operation. The target data processing plug-in is configured to: if the target application interface is an original data acquisition interface, request the data storage layer to perform an original data acquisition operation to obtain a target ciphertext corresponding to the target sensitive data. The data storage layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the security operation layer based on the target application interface. The security operation layer is configured to: perform a restore process on the target ciphertext to obtain the target sensitive data, and return the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target sensitive data to the business layer based on the compliance adaptation layer.

[0070] When the system or upper-level application needs to process the original target sensitive data, the embodiment of the present application can respond to the demand for obtaining the original target sensitive data. According to the data type of the target sensitive data, the target data processing plug-in is loaded to implement the data acquisition function of the original data acquisition interface for the target sensitive data. The target data processing plug-in requests the data storage layer to return the target ciphertext corresponding to the target sensitive data based on the original data acquisition interface, and then requests the security operation layer to restore the target ciphertext based on the original data acquisition interface, thereby obtaining the original target sensitive data. In this way, the original target sensitive data can be provided to the system or upper-level application safely and reliably.

[0071] In some embodiments, the target application interface includes a data comparison interface, and the target interface operation includes a data comparison operation. The target data processing plug-in is configured to: if the target application interface is a data comparison interface, request the security operation layer to perform a data security storage operation on the target sensitive data to obtain the ciphertext to be compared. The security operation layer is configured to: return the ciphertext to be compared to the target data processing plug-in based on the target application interface. The data storage layer is configured to: respond to the data retrieval request sent by the target data processing plug-in based on the target application interface, and return the target ciphertext corresponding to the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in generates comparison result information based on the ciphertext to be compared and the target ciphertext.

[0072] When a user needs to log in to a charging station or enter a password to make a payment, the embodiment of the present application can respond to login requirements or payment requirements, and according to the data type of the target sensitive data, load the target data processing plug-in to implement the data comparison function of the data comparison interface for the target sensitive data, wherein the target data processing plug-in requests the security operation layer to encrypt the target sensitive data based on the data comparison interface to obtain the ciphertext to be compared, thereby avoiding the problem of leakage caused by comparing the original password. Then, based on the data comparison interface, the data storage layer is requested to return the target ciphertext, and the target data processing plug-in generates comparison result information based on the ciphertext to be compared and the target ciphertext, thereby providing a secure comparison environment locally for the user to log in or pay.

[0073] In some embodiments, the target data processing plug-in transmits the comparison result information to the business layer through the compliance adaptation layer, and the business layer can generate business result information based on the comparison result information. The business result information includes business pass information and business failure information. If the comparison result information is used to indicate that the ciphertext to be compared is consistent with the target ciphertext, the business layer generates business pass information based on the comparison result information. The business pass information is used to indicate that the business pointed to by the target business request can pass. If the comparison result information is used to indicate that the ciphertext to be compared is inconsistent with the target ciphertext, the business layer generates business failure information based on the comparison result information. The business failure information is used to indicate that the business pointed to by the target business request cannot pass.

[0074] In some embodiments, the target application interface includes a data desensitization interface, and correspondingly, the target interface operation includes a data desensitization operation. The target data processing plug-in is configured to: if the target application interface is a data desensitization interface, request the security operation layer to perform a data desensitization operation on the target sensitive data to obtain a desensitized ciphertext. The security operation layer is configured to: return the desensitized ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the desensitized ciphertext to the business layer based on the compliance adaptation layer.

[0075] When the system or upper-layer application needs to display the target sensitive data, the embodiment of the present application can load the target data processing plug-in according to the data type of the target sensitive data to implement the data desensitization function of the data desensitization interface for the target sensitive data. The target data processing plug-in requests the security operation layer to perform data desensitization operations on the target sensitive data based on the data desensitization interface, and returns the desensitized ciphertext to the business layer, so as to avoid exposing the target sensitive data to the external environment during display, thereby improving the data security during the display process.

[0076] In the above-mentioned embodiments, the security operation layer and data storage layer provided by the embodiments of the present application shield the implementation details from other calling layers. In different platforms, it is only necessary to adapt the underlying security operation module and data storage module. The remaining compliance adaptation layers and security interface layers are not affected by the platform and are completely transparent to the business layer, thus ensuring the compatibility of the business layer code and greatly simplifying the workload required for compatibility with different platforms.

[0077] In order to understand in detail the local protection device for sensitive data provided by the above-mentioned embodiments, the working principle of the local protection device for sensitive data is described below in combination with three types of target sensitive data in the embodiments of the present application, as follows:

[0078] The three types of target sensitive data are as follows: 1. User credit card number. The data type of the user credit card number is identified as a transaction data type by the business layer. 2. Longitude and latitude coordinates. The data type of the longitude and latitude coordinates is identified as a location data type by the business layer. 3. Local management interface password. The data type of the local management interface password is identified as a password data type by the business layer.

[0079] The business layer interacts with the compliance adaptation layer based on the data type of the target sensitive data. Among them, various object layers below the compliance adaptation layer are all transparent and invisible to the business layer.

[0080] To store the user's credit card number locally, the key is "creditcardno.001" and the value is "4000 11111111 1111". The following is an example of calling the secure storage interface:

[0081] Adapter(PCI-DSS).Category(PAN).SecureStore("creditcardno.001","40001111 1111 1111").

[0082] Adapter(PCI-DSS).Category(PAN) is used to indicate that the transaction data processing plug-in (PCI-DSS) is the target data processing plug-in, and the data type of the target sensitive data is the transaction data type PAN.

[0083] If you want to store the latitude and longitude coordinates locally, the key is "devicelocation.001" and the value is "lat=51.47783N,lon=0.00139W". The following is an example of calling the secure storage interface:

[0084] Adapter(PII).Category(Location).SecureStore("devicelocation.001","lat=51.47783N,lon=0.00139W").

[0085] Adapter(PII).Category(Location) is used to indicate that a location data processing plug-in (PII) is a target data processing plug-in, and the data type of the target sensitive data is a location data type Location.

[0086] If you want to store the local management interface password locally, the key is "localsetting.001" and the value is "A1b2c3d4". The following is an example of calling the secure storage interface:

[0087] Adapter(Secret).Category(Password).SecureStore("localsetting.001","A1b2c3d4").

[0088] Among them, Adapter(Secret).Category(Password) is used to indicate that the password-type data processing plug-in (Secret) is the target data processing plug-in, and the data type of the target sensitive data is the password data type Password.

[0089] The compliance adaptation layer loads transaction data processing plug-ins, location data processing plug-ins, and password data processing plug-ins respectively. Each of the above data processing plug-ins implements a secure storage function based on a secure storage interface.

[0090] The target data processing plug-in calls the security operation layer to actually process the corresponding target sensitive data. The security operation layer encapsulates the details of the underlying security processing of the target sensitive data. The specific execution units of encryption, decryption, signing, hashing and other operations can be hardware security modules such as TPM, TEE, HSM, Secure Element or security software libraries such as OpenSSL, depending on the product and platform.

[0091] Different data processing plug-ins use corresponding rules to process target sensitive data according to corresponding compliance requirements. For example:

[0092] PAN: user credit card number, Adapter (PCI-DSS). Category (PAN). The processing rules (Rule) for PAN in the PCI-DSS plug-in are as follows: 1. The storage rule uses AES-256 encryption. 2. The desensitization rule uses masking, and the main part in the middle is replaced with *. 3. The comparison rule uses the method of comparing the original data after decryption.

[0093] LOCATION: longitude and latitude coordinates, Adapter (PII). Category (Location). The Location processing rules (Rule) of the PII plug-in are as follows: 1. The storage rule uses AES-256 encryption. 2. The desensitization rule uses generalization, and all parts after the decimal point are replaced with 0. 3. The comparison rule uses the method of comparing the original data after decryption.

[0094] PASSWORD: Local management interface password, Adapter (Secret). Category (Password). The password processing rules (Rule) of the Secret plug-in are as follows: 1. The storage rule uses Salt to calculate SHA256. 2. The desensitization rule uses masking, replacing all with *. 3. The comparison rule uses Salt to calculate SHA256 and then compare the hash values.

[0095] The target data processing plug-in calls the data storage layer to perform actual secure storage of the ciphertext processed by the security operation layer. The data storage layer will not store any plain text of sensitive data. The data storage layer encapsulates the details of the underlying data storage. The specific storage unit can be DataBase, ConfigFile, SystemProperty or other storage modules. The storage form of internal data is mainly (key, value) pairs. Among them, the key contains the splicing information of the data category to ensure that it is unique in the entire system. For example:

[0096] PAN: User's credit card number.

[0097] Adapter(PCI-DSS).Category(PAN).SecureStore("creditcardno.001","40001111 1111 1111"). The actual key value of the user's credit card number in the data storage layer is "PCI-DSS|PAN|creditcardno.001", which contains complete data category information. The actual value is the ciphertext after the AES-256 ("4000 1111 11111111") encryption operation.

[0098] LOCATION: longitude and latitude coordinates.

[0099] Adapter(PII).Category(Location).SecureStore("devicelocation.001", "lat=51.47783N, lon=0.00139W"). The actual key value of the longitude and latitude coordinates in the A-Quan storage layer is "PII|Location|devicelocation.001", which contains complete data category information, and the actual value is the ciphertext after the AES-256 ("lat=51.47783N, lon=0.00139W") encryption operation.

[0100] PASSWORD: Local management interface password.

[0101] Adapter(Secret).Category(Password).SecureStore("localsetting.001","A1b2c3d4"). The actual key value of the local management interface password in the data storage layer is "Secret|Password|localsetting.001", which contains complete data category information. The actual value is the ciphertext after SHA256("A1b2c3d4",SALT) is salted and hashed.

[0102] See also Figure 2 In the embodiment of the present application, the sensitive data flows through the process of secure storage and reading at each layer. Figure 2 Provides a simplified data interaction flow chart.

[0103] The data flow of the target sensitive data stored locally is shown in arrows 1 to 4, where business layer → compliance adaptation layer → security interface layer → security operation layer → security interface layer → data storage layer.

[0104] The data flow for reading the target sensitive data locally is shown in arrows 5 to 8, where data storage layer → security interface layer → security operation layer → security interface layer → compliance adaptation layer → business layer.

[0105] It can be understood that the embodiments of the present application not only support secure storage, data desensitization and secure comparison of target sensitive data, but also can delete target sensitive data or transmit target sensitive data and other functions not described in the above embodiments.

[0106] It can be understood that the local protection device for sensitive data provided in the embodiment of the present application can be applied not only to the business scenarios of charging piles, but also to the business scenarios of various types of Internet of Things devices.

[0107] It is understandable that the embodiments of the present application mainly list PCI-DSS, PII and Secret, but as the forms of IoT devices become more and more diverse, the functions become more and more abundant, the types of data collected become more and more, and the relevant regulatory laws and regulations become more and more stringent and detailed, the types of data and protection requirements for various security compliance will inevitably increase. The classification of sensitive data in the embodiments of the present application is not limited to the current enumerated items, and the data protection rules are not limited to the several algorithms, parameters and methods currently listed. The embodiments of the present application support the characteristics of functional expansion and dynamic registration, and this set of mechanisms can be used to support other unlisted security compliance requirements and new data protection algorithms, parameters and methods introduced as technology develops.

[0108] It can be understood that the business layer, compliance adaptation layer, security interface layer, security operation layer, data storage layer and data processing plug-in provided in the embodiments of the present application can be software modules, and the software modules include a number of instructions stored in a memory. The processor can access the memory and call the instructions for execution to complete the functions described in the above-mentioned embodiments.

[0109] It is understandable that the business layer, compliance adaptation layer, security interface layer, security operation layer, data storage layer and data processing plug-in provided in the embodiments of the present application can be built by hardware devices. For example, the business layer, compliance adaptation layer, security interface layer, security operation layer, data storage layer and data processing plug-in can be built by one or more chips, and each chip can work in coordination with each other to complete the functions described in the above embodiments. For another example, the business layer, compliance adaptation layer, security interface layer, security operation layer, data storage layer and data processing plug-in can also be built by various logic devices, such as general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), single-chip microcomputers, ARM (Acorn RISC Machine) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components or any combination of these components.

[0110] It can be understood that the business layer, compliance adaptation layer, security interface layer, security operation layer, data storage layer and data processing plug-in provided in the embodiments of the present application can be composed of software and hardware, and the specific module layering form is not limited to the method provided in the embodiments of the present application. There can be a fusion of module layers, or it can be split into smaller parts to meet actual needs.

[0111] As another aspect of the embodiments of the present application, the embodiments of the present application provide a local protection method for sensitive data, which is applied to the local protection device for sensitive data provided in the above embodiments. Figure 3,The local protection method for sensitive data includes the following steps:

[0112] S31: Obtain a plug-in library, where the plug-in library includes multiple types of data processing plug-ins, and each type of data processing plug-in corresponds to each type of sensitive data.

[0113] S32: According to the target data type of the target sensitive data, a data processing plug-in corresponding to the target data type is selected in the plug-in library as a target data processing plug-in for loading, so that the target data processing plug-in selects an application interface that matches the target interface operation from among the preset multiple types of application interfaces as the target application interface.

[0114] S33: Request the target processing layer to perform a target interface operation corresponding to the target application interface on the target sensitive data, the target processing layer being one or both of the security operation layer and the data storage layer.

[0115] The embodiment of the present application can configure data processing plug-ins according to the data type of sensitive data. One type of data processing plug-in corresponds to one type of sensitive data, and different types of data processing plug-ins are decoupled or independent from each other. This ensures that while complying with the new industry standards or laws and regulations on the supervision of different types of sensitive data, targeted protection processing can be performed on sensitive data, thereby improving compatibility with different data protection scenarios and ensuring that different types of data processing plug-ins do not affect each other, thereby avoiding the problem of low production efficiency caused by overturning the previous data protection method and rebuilding a new data protection method.

[0116] In some embodiments, before executing step S31, the local protection method of sensitive data also includes the following steps: obtaining a target business request, the target business request is used to request to perform a target interface operation on the target sensitive data, and determining the target data type of the target sensitive data according to the target business request.

[0117] In some embodiments, requesting the target processing layer to perform a target interface operation corresponding to the target application interface on the target sensitive data includes the following steps: determining the target interface type of the target application interface, determining in the security operation layer and the data storage layer that the object layer matching the target interface type is the target processing layer, and requesting the target processing layer to perform the target interface operation corresponding to the target application interface on the target sensitive data.

[0118] In some embodiments, the target interface type includes a first class interface type or a second class interface type, and determining the object layer matching the target interface type in the security operation layer and the data storage layer as the target processing layer includes: if the target interface type is the first class interface type, then determining that the security operation layer and the data storage layer are both the target processing layers; if the target interface type is the second class interface type, then determining that the security operation layer is the target processing layer.

[0119] In some embodiments, requesting the target processing layer to perform a target interface operation corresponding to the target application interface on the target sensitive data includes: if the security operation layer and the data storage layer are both target processing layers, then requesting the security operation layer and the data storage layer to perform the target interface operation respectively; if the security operation layer is the target processing layer, then requesting the security operation layer to perform the target interface operation.

[0120] In some embodiments, the target application interface includes a secure storage interface, the target interface operation includes a data security storage operation, and respectively requesting the security operation layer and the data storage layer to perform the target interface operation includes: if the target application interface is a secure storage interface, requesting the security operation layer to perform a data security storage operation on the target sensitive data to obtain the target ciphertext, requesting the security operation layer to return the target ciphertext based on the target application interface, and transmitting the target ciphertext to the data storage layer based on the target application interface so that the data storage layer saves the target ciphertext.

[0121] In some embodiments, the target application interface includes an original data acquisition interface, the target interface operation includes an original data acquisition operation, and respectively requesting the security operation layer and the data storage layer to perform the target interface operation includes: if the target application interface is an original data acquisition interface, requesting the data storage layer to perform the original data acquisition operation to obtain the target ciphertext corresponding to the target sensitive data, requesting the data storage layer to return the target ciphertext based on the target application interface, transmitting the target ciphertext to the security operation layer based on the target application interface so that the security operation layer restores the target ciphertext to obtain the target sensitive data, requesting the security operation layer to return the target sensitive data based on the target application interface, and transmitting the target sensitive data to the business layer based on the compliance adaptation layer.

[0122] In some embodiments, the target application interface includes a data comparison interface, the target interface operation includes a data comparison operation, and respectively requesting the security operation layer and the data storage layer to perform the target interface operation includes: if the target application interface is the data comparison interface, then requesting the security operation layer to perform a data security storage operation on the target sensitive data to obtain the ciphertext to be compared, requesting the security operation layer to return the ciphertext to be compared based on the target application interface, requesting the data storage to return the target ciphertext corresponding to the target sensitive data based on the target application interface, and generating comparison result information based on the ciphertext to be compared and the target ciphertext.

[0123] In some embodiments, the target application interface includes a data desensitization interface, and correspondingly, the target interface operation includes a data desensitization operation. Requesting the security operation layer to perform the target interface operation includes: if the target application interface is a data desensitization interface, requesting the security operation layer to perform a data desensitization operation on the target sensitive data to obtain a desensitized ciphertext, requesting the security operation layer to return the desensitized ciphertext based on the target application interface, and transmitting the desensitized ciphertext to the business layer based on the compliance adaptation layer.

[0124] In some embodiments, the compliance adaptation layer is configured with a plug-in configuration file, and each data processing plug-in can be dynamically registered in the plug-in configuration file. The method also includes: determining whether the data processing plug-in corresponding to the target data type is in an activated state according to the plug-in configuration file, and if so, determining the data processing plug-in corresponding to the target data type as a target data processing plug-in, and loading the target data processing plug-in.

[0125] It should be noted that, in each of the above-mentioned embodiments, there is not necessarily a certain order between the above-mentioned steps. A person skilled in the art can understand, based on the description of the embodiments of the present application, that in different embodiments, the above-mentioned steps may have different execution orders, that is, they may be executed in parallel, may be executed interchangeably, and so on.

[0126] See also Figure 4 , Figure 4 A schematic diagram of the structure of a controller provided in an embodiment of the present application. The controller 400 includes one or more processors 41 and a memory 42. The memory 42 is connected to the one or more processors 41, for example, connected to the processor 41 via a bus.

[0127] The processor 41 is configured to support the controller to perform the corresponding functions in the method in the above method embodiment. The processor can be a central processing unit (CPU), a network processor (NP), a hardware chip or any combination thereof. The above hardware chip can be an application specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0128] The memory 42 is used to store program codes, etc. The memory may include a volatile memory (VM), such as a random access memory (RAM); the memory may also include a non-volatile memory (NVM), such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); the memory may also include a combination of the above types of memory.

[0129] The memory 42 may be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the local protection method for sensitive data in the embodiment of the present application. The processor executes the local protection method for sensitive data and various functional applications and data processing of the local protection device for sensitive data by running the non-volatile software programs, instructions and modules stored in the memory, that is, realizes the functions of the local protection method for sensitive data and the local protection device for sensitive data provided in the above method embodiment.

[0130] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function. The data storage area may store data created based on the use of a local protection device for sensitive data, etc. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the local protection device for sensitive data via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0131] The one or more modules are stored in the memory, and when executed by the one or more processors, they execute the local protection method of sensitive data in any of the above-mentioned method embodiments, for example, execute the method steps described in the above-mentioned method embodiments, and realize the functions of the modules described in the above-mentioned device embodiments.

[0132] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a controller, the controller executes the method described in the above embodiment.

[0133] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0134] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A local protection device for sensitive data, characterized in that: It includes a business layer, a compliance adaptation layer, a security interface layer, a security operation layer and a data storage layer. The security interface layer is configured with a plug-in library, which includes multiple types of data processing plug-ins. One type of data processing plug-in corresponds to one type of sensitive data. The security interface layer includes multiple types of application interfaces that implement different interface operations. The compliance adaptation layer is configured to select a data processing plug-in corresponding to the target data type from multiple types of data processing plug-ins as a target data processing plug-in for loading according to a target data type of the target sensitive data, so that the target data processing plug-in selects an application interface matching the target interface operation from multiple types of application interfaces as a target application interface, and requests a target processing layer to perform a target interface operation corresponding to the target application interface on the target sensitive data, and the target processing layer is one or both of the security operation layer and the data storage layer.

2. The local protection device according to claim 1, characterized in that: The business layer is configured to obtain a target business request, where the target business request is used to request to perform a target interface operation on target sensitive data, and determine a target data type of the target sensitive data according to the target business request.

3. The local protection device according to claim 1, characterized in that: The target data processing plug-in is configured to: determine the target interface type of the target application interface, and determine the object layer matching the target interface type in the security operation layer and the data storage layer as the target processing layer.

4. The local protection device according to claim 3, characterized in that: The target interface type includes a first type of interface type or a second type of interface type, and the target data processing plug-in is configured as follows: if the target interface type is the first type of interface type, then the security operation layer and the data storage layer are both determined to be target processing layers; if the target interface type is the second type of interface type, then the security operation layer is determined to be the target processing layer.

5. The local protection device according to claim 4, characterized in that: The target data processing plug-in is configured to: If the security operation layer and the data storage layer are both target processing layers, requesting the security operation layer and the data storage layer to perform the target interface operation respectively; If the security operation layer is a target processing layer, the security operation layer is requested to perform the target interface operation.

6. The local protection device according to claim 4, characterized in that: The target application interface includes a secure storage interface, and the target interface operation includes a data secure storage operation; The target data processing plug-in is configured to: if the target application interface is a secure storage interface, request the security operation layer to perform a data security storage operation on the target sensitive data to obtain a target ciphertext; The security operation layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the data storage layer based on the target application interface; The data storage layer is configured to store the target ciphertext.

7. The local protection device according to claim 4, characterized in that: The target application interface includes a raw data acquisition interface, and the target interface operation includes a raw data acquisition operation; The target data processing plug-in is configured to: if the target application interface is the original data acquisition interface, request the data storage layer to perform an original data acquisition operation to obtain a target ciphertext corresponding to the target sensitive data; The data storage layer is configured to: return the target ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the target ciphertext to the security operation layer based on the target application interface; The security operation layer is configured to: perform restoration processing on the target ciphertext to obtain target sensitive data, and return the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transfers the target sensitive data to the business layer based on the compliance adaptation layer.

8. The local protection device according to claim 4, characterized in that: The target application interface includes a data comparison interface, and the target interface operation includes a data comparison operation; The target data processing plug-in is configured to: if the target application interface is the data comparison interface, request the security operation layer to perform a data security storage operation on the target sensitive data to obtain a ciphertext to be compared; The security operation layer is configured to: return the ciphertext to be compared to the target data processing plug-in based on the target application interface; The data storage layer is configured to: respond to a data retrieval request sent by the target data processing plug-in based on the target application interface, and return a target ciphertext corresponding to the target sensitive data to the target data processing plug-in based on the target application interface, so that the target data processing plug-in generates comparison result information based on the ciphertext to be compared and the target ciphertext.

9. The local protection device according to claim 4, characterized in that: The target application interface includes a data desensitization interface, and correspondingly, the target interface operation includes a data desensitization operation; The target data processing plug-in is configured to: if the target application interface is a data desensitization interface, request the security operation layer to perform a data desensitization operation on the target sensitive data to obtain a desensitized ciphertext; The security operation layer is configured to return the desensitized ciphertext to the target data processing plug-in based on the target application interface, so that the target data processing plug-in transmits the desensitized ciphertext to the business layer based on the compliance adaptation layer.

10. The local protection device according to any one of claims 1 to 9, characterized in that: The compliance adaptation layer is configured with a plug-in configuration file, and each of the data processing plug-ins can be dynamically registered in the plug-in configuration file; The compliance adaptation layer is configured to determine whether the data processing plug-in corresponding to the target data type is in an activated state according to the plug-in configuration file. If so, the data processing plug-in corresponding to the target data type is determined as the target data processing plug-in and the target data processing plug-in is loaded.

11. A method for local protection of sensitive data, characterized in that: A local protection device for sensitive data according to any one of claims 1 to 10, comprising: Obtain a plug-in library, the plug-in library including multiple types of data processing plug-ins, each type of the data processing plug-in corresponding to a type of sensitive data; According to the target data type of the target sensitive data, a data processing plug-in corresponding to the target data type is selected in the plug-in library as a target data processing plug-in for loading, so that the target data processing plug-in selects an application interface matching the target interface operation from among the preset multiple types of application interfaces as the target application interface; A target processing layer is requested to perform a target interface operation corresponding to the target application interface on the target sensitive data, and the target processing layer is one or both of the security operation layer and the data storage layer.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the processor implements the functions of the local protection device for sensitive data according to any one of claims 1 to 10.

Images