Method and system for monitoring behavior of accessing confidential processing plug-in, medium and product

Abstract

The invention discloses a method, a system, a medium and a product for monitoring behaviors of accessing a confidential processing plug-in, and relates to the technical field of geographic information data. The method comprises the following steps: acquiring a data processing request sent by a data processing client to a confidential processing plug-in; performing unified parameter verification on the parameters of the data processing client; if the unified parameter verification result is not in the preset range, recording the unified parameter verification result in a log; and if the unified parameter verification result is within the preset range, processing the geographic information data according to the data processing request, performing unified exception processing on the processing process, sending an exception result in the unified exception processing process to the data processing client, and recording the exception result in a log according to the monitoring burying point. According to the invention, the behavior of accessing the confidential processing plug-in by the user can be monitored in real time, so that the security of the confidential processing plug-in in the application process is ensured.

Description

Technical Field

[0001] The present invention relates to the field of geographic information data technology, and in particular to a method, system, medium and product for monitoring the behavior of accessing a confidentiality processing plug-in. Background Art

[0002] Geographic information data is an important part of geographic data. Geographic information data contains high-precision spatial information. Therefore, there are great security risks in the sharing process of geographic data. Geographic information data has certain particularities. On the one hand, it involves high-precision location coordinates and a large amount of geographic information, which has high military value; on the other hand, as a common carrier of information in all walks of life, its sharing is conducive to the development of social economy. Unrestricted public use of geographic data will endanger national security and interests. Conversely, if the restrictions on geographic data are too strict, it will restrict economic development. In order to solve this contradiction, the existing technology protects geographic information data, processes the security-related content in the confidential surveying and mapping results to make it conform to the use of the public version of surveying and mapping results, adopts the national recognized geographic information confidentiality processing technology for processing and performs the corresponding review procedures. The confidentiality processing plug-in is a tool for online processing of thematic data developed based on the national recognized geographic information confidentiality processing technology. It is deployed and applied through the online service mode of the server. According to management requirements, it also adopts a variety of technical means such as commercial password protection and network security protection during use to ensure the security of geospatial data results. During the use of the confidentiality processing plug-in, behavior monitoring is required to ensure the security of the confidentiality processing plug-in during application. Summary of the invention

[0003] The purpose of the present invention is to provide a method, system, medium and product for monitoring the behavior of accessing a confidentiality processing plug-in, which can monitor the user's behavior of accessing the confidentiality processing plug-in in real time to ensure the security of the confidentiality processing plug-in during application.

[0004] To achieve the above-mentioned purpose, the present invention provides the following scheme: a method for monitoring the behavior of accessing a confidentiality processing plug-in, wherein the confidentiality processing plug-in executes the method for monitoring the behavior of accessing a confidentiality processing plug-in, and the method for monitoring the behavior of accessing a confidentiality processing plug-in includes: obtaining a data processing request sent by a data processing client to the confidentiality processing plug-in.

[0005] Perform unified parameter verification on the parameters of the data processing client.

[0006] If the unified parameter verification result is not within the preset range, the unified parameter verification result will be recorded in the log.

[0007] If the unified parameter verification result is within the preset range, the geographic information data is processed according to the data processing request, and unified exception handling is performed on the processing process. The exception results in the unified exception handling process are sent to the data processing client, and the exception results are recorded in the log according to the monitoring points.

[0008] Optionally, the method for monitoring the behavior of accessing the confidentiality processing plug-in further includes: obtaining an abnormal query request sent by the monitoring client to the confidentiality processing plug-in.

[0009] The log is searched and queried according to the abnormal query request and the search and query result is sent to the monitoring client.

[0010] Optionally, the abnormal query request is a preset query condition.

[0011] A system for monitoring the behavior of accessing a confidentiality processing plug-in comprises: a data processing client and a password server; the password server has a built-in confidentiality processing plug-in, and the confidentiality processing plug-in comprises a unified parameter verification unit, a logic execution unit, a unified exception processing unit and a unified monitoring point unit.

[0012] The data processing client is used to send a data processing request to the unified parameter verification unit.

[0013] The unified parameter verification unit is used to perform unified parameter verification on the parameters of the data processing client.

[0014] The logic execution unit is used to process the geographic information data according to the data processing request if the unified parameter verification result is within a preset range.

[0015] The unified exception handling unit is used to perform unified exception handling on the processing process and send the exception result in the unified exception handling process to the data processing client.

[0016] The unified monitoring tracking unit is used to set monitoring tracking points and record abnormal results in the log according to the monitoring tracking points.

[0017] Optionally, the system for monitoring the behavior of accessing the confidentiality processing plug-in further includes: a monitoring client, and the confidentiality processing plug-in further includes: a log query unit.

[0018] The monitoring client is used to send an abnormal query request to the log query unit.

[0019] The log query unit is used to perform a search query on the log according to the abnormal query request, and send the search query result to the monitoring client.

[0020] Optionally, the system for monitoring the behavior of access to a confidentiality processing plug-in further includes: a first interface, a second interface, a third interface and a fourth interface, wherein the output end of the data processing client is connected to the input end of the unified parameter verification unit via the first interface, the input end of the data processing client is connected to the output end of the unified exception handling unit via the second interface, the output end of the log query unit is connected to the input end of the monitoring client via the third interface, and the input end of the log query unit is connected to the output end of the monitoring client via the fourth interface.

[0021] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned method for monitoring the behavior of access to a confidentiality processing plug-in.

[0022] A computer program product includes a computer program, which implements the above-mentioned method for monitoring the behavior of access to confidentiality processing plug-ins when executed by a processor.

[0023] According to the specific embodiment provided by the present invention, the present invention discloses the following technical effects: the present invention obtains the data processing request sent by the data processing client to the confidentiality processing plug-in; performs unified parameter verification on the parameters of the data processing client; if the unified parameter verification result is not within the preset range, the unified parameter verification result is recorded in the log; if the unified parameter verification result is within the preset range, the geographic information data is processed according to the data processing request, and the processing process is uniformly handled, the exception result in the unified exception handling process is sent to the data processing client, and the exception result is recorded in the log according to the monitoring point, and the user's access to the confidentiality processing plug-in can be monitored in real time to ensure the security of the confidentiality processing plug-in during the application process. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0025] Figure 1 A system block diagram for monitoring the behavior of access to a confidentiality processing plug-in provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] The embodiment of the present invention provides a method for monitoring the behavior of accessing a confidentiality processing plug-in. The confidentiality processing plug-in is mainly used for nonlinear confidentiality processing of two-dimensional geographic information. The monitoring method is used to supervise the behavior of users accessing the confidentiality processing plug-in to avoid the use of the confidentiality processing plug-in beyond the scope. When the user wants to access the confidentiality processing plug-in through a data processing client, the method is executed to monitor the user's access to the confidentiality processing plug-in. The method includes: obtaining a data processing request sent by the data processing client to the confidentiality processing plug-in. The data processing request is some operations for processing geographic information data of a certain location, such as adding, deleting and modifying.

[0029] Perform unified parameter verification on the parameters of the data processing client. The specific steps of unified parameter verification may be: verify the validity and legality of the geographic information data (geographic coordinates) of the location accessed by the data processing client (i.e., a location mentioned above) and format it for subsequent operations; output the processed data in a format. Verify the validity and legality of the access frequency of the data processing client and verify the validity and legality of the access time of the data processing client.

[0030] If the unified parameter verification result is not within the preset range, the unified parameter verification result will be recorded in the log.

[0031] If the unified parameter verification result is within the preset range, the geographic information data is processed according to the data processing request, and unified exception handling is performed on the processing process. The exception results in the unified exception handling process are sent to the data processing client, and the exception results are recorded in the log according to the monitoring points.

[0032] In actual applications, the method for monitoring the access to the confidentiality processing plug-in behavior further includes: obtaining an abnormal query request sent by the monitoring client to the confidentiality processing plug-in.

[0033] The log is searched and queried according to the abnormal query request and the search and query result is sent to the monitoring client.

[0034] In practical applications, the exception query request is a preset query condition.

[0035] In practical applications, the confidentiality processing plug-in executes the above method for monitoring the behavior of accessing the confidentiality processing plug-in.

[0036] In practical applications, before executing the data processing request sent by the data processing client, it also includes: to ensure the compliance of the confidentiality processing plug-in's access and call, an access control model based on location and time characteristics is established to determine the behavior of users accessing the confidentiality processing plug-in, forming a monitoring method for the software system. The compliance of the user's access behavior is determined through the input parameters and the access compliance determination function, and the output parameters and error codes are uniformly defined and recorded in the log as the basis for the plug-in operation manager to perform subsequent management work. The access control model includes two parts: the user behavior attribute set and the access compliance determination function.

[0037] 1. Define the user behavior attribute set P = {pi|1 < i < n}, which is composed of n independent user access attributes based on location and time characteristics, namely the parameters of the above data processing client, such as the access location, access frequency, access time, etc. The user behavior attribute set forms the defined unified input parameters in the system. Using the access compliance determination function to analyze and judge the unified input parameters can determine whether the user's access behavior is compliant.

[0038] 2. Define the access compliance determination function f(P) to determine whether the user behavior in access control is compliant, that is, to perform unified parameter verification on the parameters of the data processing client. The unified parameter verification can be based on one or more attributes in the user behavior attribute set. For example: (1) The access time is not within the working range, which is abnormal; (2) The access location range exceeds 30%, which is abnormal; (3) The access frequency within one day exceeds 10,000 times, which is abnormal, etc.

[0039] The access control model most directly reflects the computer system security policy and can be used as a monitoring method for intrusion detection macroscopically. Therefore, the access compliance determination function can directly distinguish whether there is a behavior violating the access control policy in the system call sequence; when the user accesses the confidentiality processing plug-in, the access compliance determination function establishes an activity association graph based on the connection between the calls of the confidentiality processing plug-in, predicts the normal access profile of the system call sequence within a small range, and achieves the purpose of intrusion detection by calculating the deviation degree.

[0040] The judgment conditions for access exceptions can be one or more of the access frequency, access location, and access time. For the cases where the access location range exceeds the threshold and the access frequency to a certain area exceeds the threshold, they are regarded as abnormal situations and used as the basis for subsequent access control and alarm.

[0041] According to the access control model based on location and time characteristics, the following work is carried out before the method of monitoring the behavior of access confidentiality processing plug-ins is established.

[0042] (1) Set the parameters required for the access compliance judgment function based on the user behavior attribute set, and clarify the definition and type of the parameters, including the access location, access frequency, and access time.

[0043] (2) Define unified output parameters. Based on the analysis results of the access compliance judgment function, define the output parameters in a unified manner.

[0044] (3) Unified error codes. For violations of security access, the type of problem is recorded to provide a technical basis for plug-in administrators to carry out subsequent management work.

[0045] (4) Unified interface authorization categories. According to business needs, formulate authorized user categories for the use of confidentiality processing plug-ins, and initialize and record user category information in the system that monitors access to confidentiality processing plug-ins as a basis for subsequent judgment.

[0046] The embodiment of the present invention also provides a system for monitoring the behavior of accessing a confidentiality processing plug-in, such as Figure 1 As shown, it includes: a data processing client and a password server; the password server has a built-in confidentiality processing plug-in, and the confidentiality processing plug-in includes a unified parameter verification unit, a logic execution unit, a unified exception processing unit and a unified monitoring point unit.

[0047] The data processing client is used to send a data processing request to the unified parameter verification unit.

[0048] The unified parameter verification unit is used to perform unified parameter verification on the parameters of the data processing client.

[0049] The logic execution unit is used to process the geographic information data according to the data processing request if the unified parameter verification result is within a preset range.

[0050] The unified exception handling unit is used to perform unified exception handling on the processing process and send the exception result in the unified exception handling process to the data processing client.

[0051] The unified monitoring point unit is used to set monitoring points in the unified exception processing unit and record the abnormal results in the log according to the monitoring points (such as time abnormality, spatial coordinate abnormality, spatial coordinates exceeding the range, etc.). The unified monitoring point is to set monitoring points at specific locations of the system to obtain and record abnormal conditions in the system processing process, and the system records the abnormal conditions in the system operation log according to the monitoring points, which provides a basis for system operation and maintenance or early warning.

[0052] The confidentiality processing plug-in mainly performs confidentiality processing on coordinate data according to the decryption algorithm. The records of plug-in interface calls are recorded in logs, and confidentiality processing behavior monitoring is carried out based on the logs.

[0053] In actual application, the system for monitoring the access to the confidentiality processing plug-in behavior further includes: a monitoring client, and the confidentiality processing plug-in further includes: a log query unit; the monitoring client is used to send an abnormal query request to the log query unit.

[0054] The log query unit is used to perform a search query on the log according to the abnormal query request, and send the search query result to the monitoring client.

[0055] In actual application, the confidentiality processing plug-in also includes: a log output processing unit, which is used to output the above-mentioned log.

[0056] In actual applications, the system for monitoring the behavior of access to confidentiality processing plug-ins also includes: a first interface, a second interface, a third interface and a fourth interface. The output end of the data processing client is connected to the input end of the unified parameter verification unit through the first interface, the input end of the data processing client is connected to the output end of the unified exception handling unit through the second interface, the output end of the log query unit is connected to the input end of the monitoring client through the third interface, and the input end of the log query unit is connected to the output end of the monitoring client through the fourth interface.

[0057] The first interface, the second interface, the third interface and the fourth interface all comply with standard interface specifications and provide standard interfaces for third-party users or applications to call.

[0058] The original surveying and mapping data is confidential data, which needs to be processed by geographic information nonlinear confidentiality processing to reduce the plane position accuracy. In order to achieve the accurate superposition of original thematic data and surveying and mapping geographic information data in the application, it is necessary to provide various types of interface functions. The business system integrated with the confidentiality processing plug-in calls the functional interface provided by the plug-in to complete the online processing of the original thematic data. After data processing, it is used for data browsing, display, query and analysis of the business system integrated with the confidentiality processing plug-in.

[0059] The first interface and the second interface can be.

[0060] (1) Location change service interface based on HTTP / HTTPS protocol.

[0061] Function: Provides a development interface based on HTTP / HTTPS protocol, which can be called by Web services to achieve location change.

[0062] Input: Based on the data before nonlinear confidentiality processing, the business system with integrated confidentiality processing plug-in sends a single point pair coordinate or a series of coordinate strings, which are input in GeoJSON or other formats.

[0063] Implementation process: Based on the REST-style HTTP / HTTPS framework, the location transformation interface is called to implement the coordinate location transformation processing to form an HTTP / HTTPS service.

[0064] Output: The transformed coordinates or coordinate string, returned in GeoJSON or other formats.

[0065] (2) Position transformation function interface based on TCP / IP protocol.

[0066] Function: Provides a development interface based on TCP / IP protocol, supports C++, JAVA, C# and other development languages, and can be directly called by applications to achieve position change.

[0067] Input: A single point pair coordinate or a series of coordinate strings, input in WKB or coordinate array format.

[0068] Implementation process: Call the position transformation function interface to implement the position transformation processing of coordinates.

[0069] Output: The transformed coordinates or coordinate string are returned in WKB or coordinate array format.

[0070] In practical applications, parameter verification is one of the key links for the correct operation of the system. Reasonable parameter verification can avoid system crashes or data errors caused by parameter errors. When performing parameter verification, you usually need to consider the following aspects.

[0071] The first is the legality of the parameter: whether the value of the parameter meets the specified range or format requirements.

[0072] The input data should be within the scope of the built-in geofence of the application, the coordinates should provide longitude and latitude data, the coordinate system should be (CGCS2000 or WGS84), and the GeoJSON should comply with the format requirements.

[0073] The second is the completeness of the parameters: whether the parameters are missing or empty.

[0074] Check if the required parameters are empty or missing. The coordinate data should not be empty or 0. The called user key should not be empty and should be in the system's whitelist.

[0075] The third is the correlation of parameters: whether there is a dependency between different parameters.

[0076] Check the spatial distribution pattern of data over a period of time, and check whether there is concentrated and high-frequency call of data in a certain area.

[0077] The steps for implementing unified parameter verification in the present invention are prior art, and the general steps are as follows.

[0078] First: Define parameter verification rules: According to actual needs, define verification rules such as the legal value range and format requirements of the parameters.

[0079] Second: Write a parameter verification function: According to the defined verification rules, write a parameter verification function to verify the legality of the parameters.

[0080] Third: Unified processing of parameter verification failure: In the verification function, if parameter verification failure is found, the error information is uniformly processed and returned to the caller.

[0081] Fourth: Call the parameter verification function in the interface or function: Call the parameter verification function at the input of the interface or function to verify the parameters. The parameters of the data processing client include: access IP, identity record, spatial processing location, processing results and access time.

[0082] In practical applications, the unified exception handling of the present invention is carried out using existing technologies. First, some abnormal situations need to be defined, such as abnormal situations where the coordinate point range exceeds the standard range, the input coordinate point is non-numeric, or the coordinate point is negative. Secondly, the system sets an exception capture mechanism to capture the triggered abnormal situation. Finally, an exception handling mechanism is required to record or process the captured abnormal situation to prevent a chain reaction in the system and ensure the stability of the system. The captured abnormal situation will be sent to the data processing client and will be recorded in the log as a basis for subsequent tracking and processing.

[0083] The workflow of the system for monitoring the behavior of accessing a confidentiality processing plug-in provided by the embodiment of the present invention includes two parts.

[0084] 1) Data processing client.

[0085] Provide server-side support for data processing users. For authenticated users, the data processing client sends data processing requests to the password server. The server completes parameter verification, logic execution, and exception handling and returns the results to the data processing client. Next, the internal functions of monitoring points and log output processing are completed and written to the log as the basis for subsequent query management.

[0086] 2) Monitor the client.

[0087] The monitoring client provides a dedicated log query interface for managers. Based on the logs and monitoring point information recorded by ordinary user data processing, the logs can be queried according to the type of abnormal access to find problems.

[0088] The embodiments of the present invention have the following technical effects.

[0089] 1. Establish a unified interface access record method for multiple types of access.

[0090] We have developed various types of calling interfaces with various data processing granularities to provide support for various types of users and application scenarios. In order to unify the interface access record and statistics and avoid duplicate statistics, this method establishes an interface call record trigger mode based on the underlying confidentiality processing plug-in. All interface accesses are recorded and stored in a unified manner as a basis for subsequent supervision.

[0091] 2. Establish a security monitoring strategy for confidentiality processing plug-ins.

[0092] As the basic reference point for information security of computer systems, security monitoring strategies should be interpreted and executed by security mechanisms. Access control divides data entities in computer systems into subjects and objects, and controls access patterns between subjects and objects according to security strategies. Combine active and passive monitoring methods to formulate security monitoring strategies. Conduct access security analysis based on the user, frequency, and time of access.

[0093] 3. The behavior monitoring method of the confidentiality processing plug-in provided in the embodiment of the present invention provides a guarantee for the use of the confidentiality processing plug-in based on the spatial coordinate conversion algorithm within a reasonable range, and provides technical support for the analysis and discovery of unreasonable data access behavior by recording and statistically analyzing the time, IP address and spatial range of authorized users' access.

[0094] 4. The embodiment of the present invention combines the passive defense mechanism in the computer system, namely access control, and the active defense mechanism, namely intrusion detection, to give full play to their respective advantages in the macroscopic and microscopic aspects of computer system security, and overcomes the problem that access control cannot effectively solve the security problem of microscopic granularity access in the computer system due to the existence of granularity problems, and also solves the difficulty of finding an objective and a priori training data set to construct the normal mode profile of the system in abnormal intrusion detection. The system call data set is used as the intrusion detection event set, and the normal mode profile of the system call is established by adopting the idea of ​​breaking the whole into parts, which significantly reduces the high false alarm rate and high missed alarm rate in intrusion detection. According to the logs generated during the use of the confidentiality processing plug-in, the use and rationality of the confidentiality processing plug-in are analyzed to provide a basis for system operation and maintenance or early warning.

[0095] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned method embodiments are implemented.

[0096] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned method embodiments when executed by a processor.

[0097] It should be noted that the object information (including but not limited to object device information, object personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0098] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0099] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0100] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for monitoring the behavior of a plug-in for accessing confidentiality processing, characterized in that: The method for monitoring the behavior of accessing the confidentiality processing plug-in includes: Obtain the data processing request sent by the data processing client to the confidentiality processing plug-in; Performing unified parameter verification on the parameters of the data processing client; If the unified parameter verification result is not within the preset range, the unified parameter verification result is recorded in the log; If the unified parameter verification result is within the preset range, the geographic information data is processed according to the data processing request, and unified exception handling is performed on the processing process. The exception results in the unified exception handling process are sent to the data processing client, and the exception results are recorded in the log according to the monitoring points.

2. The method for monitoring the behavior of accessing a confidentiality processing plug-in according to claim 1, characterized in that: The method for monitoring the behavior of accessing the confidentiality processing plug-in also includes: Obtain the abnormal query request sent by the monitoring client to the confidentiality processing plug-in; The log is searched and queried according to the abnormal query request and the search and query result is sent to the monitoring client.

3. The method for monitoring the behavior of accessing a confidentiality processing plug-in according to claim 2, characterized in that: The abnormal query request is a preset query condition.

4. A system for monitoring the behavior of access to a confidentiality processing plug-in, characterized in that: include: Data processing client and password server; The password server has a built-in confidentiality processing plug-in, which includes a unified parameter verification unit, a logic execution unit, a unified exception processing unit and a unified monitoring point unit; The data processing client is used to send a data processing request to the unified parameter verification unit; The unified parameter verification unit is used to perform unified parameter verification on the parameters of the data processing client; The logic execution unit is used to process the geographic information data according to the data processing request if the unified parameter verification result is within a preset range; The unified exception handling unit is used to perform unified exception handling on the processing process and send the exception result in the unified exception handling process to the data processing client; The unified monitoring tracking unit is used to set monitoring tracking points and record abnormal results in the log according to the monitoring tracking points.

5. The system for monitoring the behavior of access to confidentiality processing plug-ins according to claim 4, characterized in that: The system for monitoring the access to the confidentiality processing plug-in behavior further includes: a monitoring client, and the confidentiality processing plug-in further includes: a log query unit; The monitoring client is used to send an abnormal query request to the log query unit; The log query unit is used to perform a search query on the log according to the abnormal query request, and send the search query result to the monitoring client.

6. The system for monitoring the behavior of access to confidentiality processing plug-ins according to claim 5, characterized in that: The system for monitoring the behavior of access to confidentiality processing plug-ins also includes: a first interface, a second interface, a third interface and a fourth interface. The output end of the data processing client is connected to the input end of the unified parameter verification unit through the first interface, the input end of the data processing client is connected to the output end of the unified exception processing unit through the second interface, the output end of the log query unit is connected to the input end of the monitoring client through the third interface, and the input end of the log query unit is connected to the output end of the monitoring client through the fourth interface.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the method for monitoring the behavior of accessing a confidentiality processing plug-in as described in any one of claims 1-3.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the method for monitoring the behavior of accessing a confidentiality processing plug-in as described in any one of claims 1-3.

Images