Data authority management method

Abstract

The invention discloses a data authority management method, which comprises the following steps of: classifying data according to data characteristics, acquiring the classified data, and acquiring the confidentiality level of the classified data; performing AES data encryption on the classified data according to the confidentiality level; respectively establishing an authority control table for each operation authority of the classified data, wherein the operation authority comprises an access operation, a modification operation, an addition operation and a deletion operation; extracting and analyzing a user request of a user, and obtaining a data target of a request operation; according to the authority control table and the operation counter of the data target, judging the operation authority of the user to the data target; performing data decryption on the data target according to the operation authority of the user on the data target, and endowing the user with a corresponding data operation authority; according to the method, the data are classified, the data are encrypted according to the confidentiality level of the classified data, and the data are decrypted after the user obtains the operation authority of the data, so that the confidentiality and the integrity of the data are guaranteed.

Description

Technical Field

[0001] The present invention relates to a technical field, and in particular to a data authority management method. Background Art

[0002] In recent years, with the rise of the digital economy, "data resourceization" has become the primary trend in the development of big data. The economic value of data has become increasingly prominent, and data has become a new strategic resource for economic development. Therefore, it is particularly important to store and manage data reasonably.

[0003] At present, the Chinese invention patent with application number 201610225858.7 discloses a data permission management method, a data permission management system and a business management system. Although it realizes the unified management of data permissions of various business systems and reduces the difficulty of management and maintenance, the data is not encrypted during the data management process, which can easily lead to data leakage. In addition, there is no limit on the number of times users can operate on the data, which can easily lead to frequent operations by users, affecting database performance. Summary of the invention

[0004] The technical problem solved by the present invention is that the prior art does not encrypt data during data management, which can easily lead to data leakage, and does not limit the number of times users can operate on data, which can easily lead to frequent user operations and affect database performance.

[0005] In order to solve the above technical problems, the present invention provides a data rights management method, comprising:

[0006] Step S1: classify the data according to the data characteristics, obtain the classified data and obtain the confidentiality level of the classified data;

[0007] Step S2: AES data encryption is performed on the classified data according to the confidentiality level;

[0008] Step S3: establishing a permission control table for each operation permission of the classified data, wherein the operation permission includes access operation, modification operation, addition operation and deletion operation;

[0009] Step S4: extract and parse the user's request to obtain the data target of the requested operation;

[0010] Step S5: judging the user's operation authority for the data target according to the authority control table and the operation counter of the data target;

[0011] Step S6: decrypt the data of the data target according to the user's operation authority on the data target and grant the user corresponding data operation authority;

[0012] As a preferred solution of the data rights management method described in the present invention, wherein:

[0013] The step S2 includes the following sub-steps:

[0014] Step S201: Divide the data plaintext into a group of data of the same length;

[0015] Step S202: using a replacement box to perform byte replacement on each group of data;

[0016] Step S203: performing a bit shift operation on each group of data after the byte replacement;

[0017] Step S204: performing a column obfuscation operation on the data after the row shift operation;

[0018] Step S205: performing a round key addition operation on the data after the column obfuscation operation, wherein the round key length is the same as the group length;

[0019] Step S206: performing corresponding rounds of AES encryption operations on data of different confidentiality levels;

[0020] As a preferred solution of the data rights management method described in the present invention, wherein:

[0021] The step S4 includes the following sub-steps:

[0022] Step S401: extracting a user request of a user, wherein the user request includes a user identifier and a data request;

[0023] Step S402: parsing the data request and obtaining data operation statements;

[0024] Step S403: acquiring the data target corresponding to the requested operation according to the data operation statement;

[0025] As a preferred solution of the data rights management method described in the present invention, wherein:

[0026] The step S5 includes the following sub-steps:

[0027] Step S501: Obtain the authority control table of the data target;

[0028] Step S502: judging whether the user has the operation authority of the data target according to the authority control table;

[0029] Step S503: judging whether the user has remaining operation times according to the operation counter;

[0030] As a preferred solution of the data rights management method described in the present invention, wherein:

[0031] The determining whether the user has remaining operation times according to the operation counter includes:

[0032] Checking the operation counter corresponding to the user, if the number of operations recorded by the operation counter is greater than an expected threshold, rejecting the user's operation request, sending a warning prompt to the user, and locking the user's operation on the data target;

[0033] If the number of operations in the operation counter is less than or equal to the expected threshold, the user is granted the corresponding operation authority according to the user's operation request, and the number of operations in the operation counter is increased by one;

[0034] As a preferred solution of the data rights management method described in the present invention, wherein:

[0035] The parsing data request includes:

[0036] Parsing the data request;

[0037] Obtaining an abstract syntax tree corresponding to the data request;

[0038] Compile and process the abstract syntax tree to obtain data target operation statements.

[0039] As a preferred solution of the data rights management method described in the present invention, wherein:

[0040] The step of judging whether the user has the operation authority of the data target according to the authority control table includes:

[0041] Acquire the data operation requested by the user according to the data target operation statement;

[0042] Determine whether the user has the data operation authority according to the authority control table;

[0043] If the user information of the user is not found in the permission control table, the user does not have the operation permission for the operation of the data target, a warning message is returned to the user, and the user's permission application is automatically sent to the permission management background;

[0044] If the user information of the user is found in the permission control table, the user has the operation permission for the operation on the data target, and the corresponding operation counter is retrieved to query the operation times;

[0045] As a preferred solution of the data rights management method described in the present invention, wherein:

[0046] The authority control table includes the identities of each user who has the authority to operate the data target;

[0047] As a preferred solution of the data rights management method described in the present invention, wherein:

[0048] The user identifier is a unique identifier corresponding to the user and is used to determine the user's identity;

[0049] An electronic device comprises a processor and a memory, wherein:

[0050] The memory stores a computer program that can be called by the processor;

[0051] The processor executes the above-mentioned data authority management method in the background by calling the computer program stored in the memory.

[0052] Beneficial effects of the present invention: The present invention classifies data, encrypts the classified data according to its confidentiality level, and then decrypts the data after the user obtains the operation authority of the data, thereby ensuring the confidentiality, integrity and security of the data.

[0053] The present invention records and limits the number of operations on data by users through an operation counter, closes the operation authority of the data target to users who have reached a certain number of operations, and avoids database performance instability and data loss caused by frequent operations on the database.

[0054] The present invention establishes permission control tables for data operations after classification, thereby achieving refined and unified management of data permissions, avoiding data leakage due to permission errors, and facilitating data management and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A basic flow chart of a data authority management method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0057] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a data authority management method, comprising:

[0058] Step S1: classify the data according to the data characteristics, obtain the classified data and obtain the confidentiality level of the classified data;

[0059] Step S2: AES data encryption is performed on the classified data according to the confidentiality level;

[0060] Step S3: establishing a permission control table for each operation permission of the classified data, wherein the operation permission includes access operation, modification operation, addition operation and deletion operation;

[0061] Step S4: extract and parse the user's request to obtain the data target of the requested operation;

[0062] Step S5: judging the user's operation authority for the data target according to the authority control table and the operation counter of the data target;

[0063] Step S6: decrypt the data of the data target according to the user's operation authority on the data target and grant the user corresponding data operation authority;

[0064] The AES data encryption is a symmetric encryption algorithm that divides the original plaintext into blocks of fixed length, usually 128 bits, and then encrypts it with a key to obtain ciphertext. The core of the AES encryption algorithm is the SPN structure adopted by the conversion, which contains four sub-steps: byte substitution, row shift, column confusion, and round key addition. The combination of these sub-steps can effectively implement the encryption process;

[0065] The decryption process is the inverse operation of the AES encryption process. The round key is generated using the same key expansion algorithm as the encryption process. The decryption operation is performed in reverse from the last round, including reverse row shift, reverse byte substitution, reverse column confusion, and round key addition steps to obtain the original plaintext data.

[0066] In this embodiment, by classifying data and establishing permission control tables for various operations on the classified data, data is encrypted and the number of operations on the data by users is limited, thereby achieving refined and unified management of data and ensuring data security and stability;

[0067] The step S2 includes the following sub-steps:

[0068] Step S201: Divide the data plaintext into a group of data of the same length;

[0069] Step S202: using a replacement box to perform byte replacement on each group of data;

[0070] Step S203: performing a bit shift operation on each group of data after the byte replacement;

[0071] Step S204: performing a column obfuscation operation on the data after the row shift operation;

[0072] Step S205: performing a round key addition operation on the data after the column obfuscation operation, wherein the round key length is the same as the group length;

[0073] Step S206: performing corresponding rounds of AES encryption operations on data of different confidentiality levels.

[0074] The byte replacement includes: the AES algorithm defines an S-box and an inverse S-box, and the S-box is used to replace the bytes of the group one by one. The S-box is a matrix defined by the AES algorithm, and the high 4 bits of each byte in the matrix are used as row values ​​and the low 4 bits are used as column values, and then the elements of the corresponding rows and columns in the S-box are taken out as output. The S-box is related to the finite field multiplication inverse element, has good nonlinear characteristics, and is constructed by combining the multiplication inverse element and the reversible affine transformation matrix;

[0075] The row shift operation includes: the row shift transformation is to input a matrix as plain text, then perform a series of row operations on it, and finally output a matrix of the same size as ciphertext. The expression formula of the row shift transformation is:

[0076] a[i][j]=a[i][(i+j)%4]

[0077] Among them, a [i][j] Represents the input plaintext matrix, a [i][(i+j)％4] Represents the output ciphertext matrix, i and j are standard values ​​respectively;

[0078] The column confusion operation is a replacement operation, which multiplies the state matrix after row shift by a fixed matrix to obtain a confused state matrix;

[0079] The round key addition operation includes obtaining the round key by key expansion, and performing an XOR operation on the round key and the state matrix according to bytes;

[0080] In this embodiment, data is encrypted according to encryption levels, thereby ensuring data security and confidentiality and preventing data leakage;

[0081] The step S4 includes the following sub-steps:

[0082] Step S401: extracting a user request of a user, wherein the user request includes a user identifier and a data request;

[0083] Step S402: parsing the data request and obtaining data operation statements;

[0084] Step S403: acquiring the data target corresponding to the requested operation according to the data operation statement;

[0085] In this embodiment, by extracting and parsing the user request, the data target of the user request operation is obtained, and the data target is provided for obtaining the permission control table, thereby realizing the unified management of data permissions;

[0086] The step S5 includes the following sub-steps:

[0087] Step S501: Obtain the authority control table of the data target;

[0088] Step S502: judging whether the user has the operation authority of the data target according to the authority control table;

[0089] Step S503: judging whether the user has remaining operation times according to the operation counter;

[0090] In this embodiment, the number of operations that users can perform on data objects is limited according to the authority control table and operation counter of the data object, thereby ensuring the stability and security of the data and guaranteeing the performance of the database;

[0091] The determining whether the user has remaining operation times according to the operation counter includes:

[0092] Checking the operation counter corresponding to the user, if the number of operations recorded by the operation counter is greater than an expected threshold, rejecting the user's operation request, sending a warning prompt to the user, and locking the user's operation on the data target;

[0093] If the number of operations in the operation counter is less than or equal to the expected threshold, the user is granted the corresponding operation authority according to the user's operation request, and the number of operations in the operation counter is increased by one;

[0094] In this embodiment, the number of times a user operates data is limited by an operation counter, thereby avoiding database performance instability and data loss caused by frequent operations;

[0095] The parsing data request includes:

[0096] Parsing the data request;

[0097] Obtaining an abstract syntax tree corresponding to the data request;

[0098] Compile and process the abstract syntax tree to obtain data target operation statements;

[0099] The abstract syntax tree is a tree representation of the abstract syntax structure of the source code, and is a data structure used to represent various structures in the source code, such as statements, expressions, functions, etc. Each node represents a structure in the source code, and the tree structure represents the relationship between these structures;

[0100] In this embodiment, the original data request is parsed to obtain the data target operation statement, thereby obtaining the data target requested by the user and the operation requested by the user, providing support for obtaining the permission control table and operation counter of the data target;

[0101] The step of judging whether the user has the operation authority of the data target according to the authority control table includes:

[0102] Acquire the data operation requested by the user according to the data target operation statement;

[0103] Determine whether the user has the data operation authority according to the authority control table;

[0104] If the user information of the user is not found in the permission control table, the user does not have the operation permission for the operation of the data target, a warning message is returned to the user, and the user's permission application is automatically sent to the permission management background;

[0105] If the user information of the user is found in the permission control table, the user has the operation permission for the operation on the data target, and the corresponding operation counter is retrieved to query the operation times;

[0106] In this embodiment, by querying the authority control table, it is determined whether the user has the operation authority of the data target, which provides a basis for whether to grant the user the operation authority of the data target;

[0107] The authority control table includes the identities of each user who has the authority to operate the data target;

[0108] In this embodiment, by establishing a permission control table, permission management is performed on each operation of the data, thereby achieving refined and unified data permission management;

[0109] The user identifier is a unique identifier corresponding to the user and is used to determine the user's identity;

[0110] In this embodiment, the user identity is identified by creating a user ID, and each user has only one unique user ID, thereby avoiding permission allocation errors and data leakage caused by user identity identification errors;

[0111] Embodiment 2 is another embodiment of the present invention, which provides an electronic device, including a processor and a memory, wherein:

[0112] The memory stores a computer program that can be called by the processor;

[0113] The processor executes the above-mentioned data authority management method in the background by calling the computer program stored in the memory.

[0114] The present invention classifies data, encrypts the classified data according to its confidentiality level, and performs decryption processing after the user obtains the operation authority of the data, thereby ensuring the confidentiality, integrity and security of the data.

[0115] The present invention records and limits the number of operations on data by users through an operation counter, closes the operation authority of the data target to users who have reached a certain number of operations, and avoids database performance instability and data loss caused by frequent operations on the database.

[0116] The present invention establishes permission control tables for data operations after classification, thereby achieving refined and unified management of data permissions, avoiding data leakage due to permission errors, and facilitating data management and maintenance.

[0117] It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, systems or computer program products. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Among them, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data rights management method, characterized in that: include: Step S1: classify the data according to the data characteristics, obtain the classified data and obtain the confidentiality level of the classified data; Step S2: AES data encryption is performed on the classified data according to the confidentiality level; Step S3: establishing a permission control table for each operation permission of the classified data, wherein the operation permission includes access operation, modification operation, addition operation and deletion operation; Step S4: extract and parse the user's request to obtain the data target of the requested operation; Step S5: judging the user's operation authority for the data target according to the authority control table and the operation counter of the data target; Step S6: Decrypt the data of the data target according to the user's operation authority on the data target and grant the user corresponding data operation authority.

2. A data rights management method according to claim 1, characterized in that: The step S2 includes the following sub-steps: Step S201: Divide the data plaintext into a group of data of the same length; Step S202: using a replacement box to perform byte replacement on each group of data; Step S203: performing a bit shift operation on each group of data after the byte replacement; Step S204: performing a column obfuscation operation on the data after the row shift operation; Step S205: performing a round key addition operation on the data after the column obfuscation operation, wherein the round key length is the same as the group length; Step S206: performing corresponding rounds of AES encryption operations on data of different confidentiality levels.

3. A data rights management method as claimed in claim 1, characterized in that: The step S4 includes the following sub-steps: Step S401: extracting a user request of a user, wherein the user request includes a user identifier and a data request; Step S402: parsing the data request and obtaining data operation statements; Step S403: Obtain the data target corresponding to the requested operation according to the data operation statement.

4. A data rights management method as claimed in claim 1, characterized in that: The step S5 comprises the following sub-steps: Step S501: Obtain the authority control table of the data target; Step S502: judging whether the user has the operation authority of the data target according to the authority control table; Step S503: Determine whether the user has remaining operation times according to the operation counter.

5. A data rights management method as claimed in claim 4, characterized in that: The determining whether the user has remaining operation times according to the operation counter includes: Checking the operation counter corresponding to the user, if the number of operations recorded by the operation counter is greater than an expected threshold, rejecting the user's operation request, sending a warning prompt to the user, and locking the user's operation on the data target; If the operation times of the operation counter are less than or equal to the expected threshold, the user is granted corresponding operation authority according to the user's operation request, and the operation counter is incremented by one.

6. A data rights management method as claimed in claim 3, characterized in that: The parsing data request includes: Parsing the data request; Obtaining an abstract syntax tree corresponding to the data request; Compile and process the abstract syntax tree to obtain data target operation statements.

7. A data rights management method as claimed in claim 4, characterized in that: The step of judging whether the user has the operation authority of the data target according to the authority control table includes: Acquire the data operation requested by the user according to the data target operation statement; Determine whether the user has the data operation authority according to the authority control table; If the user information of the user is not found in the permission control table, the user does not have the operation permission for the operation of the data target, a warning message is returned to the user, and the user's permission application is automatically sent to the permission management background; If the user information of the user is found in the authority control table, the user has the operation authority for the operation on the data target, and the corresponding operation counter is retrieved to query the operation times.

8. A data rights management method as claimed in claim 1, characterized in that: The authority control table includes the identities of each user who has the authority to operate the data target.

9. A data rights management method as claimed in claim 3, characterized in that: The user identifier is a unique identity identifier corresponding to the user and is used to determine the user identity.

10. An electronic device, characterized in that: include: A processor and a memory, wherein: The memory stores a computer program that can be called by the processor; The processor executes a data authority management method as described in any one of claims 1 to 9 in the background by calling the computer program stored in the memory.

Images