Data security management method and device, electronic equipment and computer readable medium

Abstract

The invention relates to a data security management method and device, electronic equipment and a computer readable medium. The method comprises the following steps: constructing a data identity record library, wherein the data identity record library is accessed to a cloud server in a local area range; respectively configuring identity tags for access equipment in a local area range, transmission data of the access equipment and storage data of the access equipment through the data identity record library to obtain a plurality of identity tags of the access equipment; and storing the plurality of identity tags of the access equipment and the storage data in the data identity record library. According to the method, the data identity record library is constructed to perform data management, and identity tags are configured in equipment access, data transmission and data storage, so that comprehensive information security guarantee is more favorably provided, and the problem of personal information security of users in a local area range is solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to data security management methods, devices, electronic devices and computer-readable media. Background Art

[0002] At present, in order to realize cloud control of various devices in building scenarios, cloud servers that centrally transmit information are needed to build a hub for transmitting information between devices and host computers. Today, the continuous upward trend of digitalization in the building field is significant, and data security involving building control faces greater challenges. Unlike the cloud products of the wide area Internet on the market, users prefer to store data in a miniaturized LAN cloud server dedicated to the building system. The main reason is that users have concerns about data storage security, data transmission security and access device security, and believe that data in a miniaturized LAN can be protected from many unnecessary security attacks. Now large buildings such as factories and office buildings have proposed the concept of data not leaving the factory.

[0003] Since the network boundary of the small-scale LAN cloud server is relatively closed, firewalls, TLS encryption and other protection technologies are mainly implemented. However, these protection technologies have the disadvantage of not being suitable for building control systems. For example, the firewall has the characteristic of limiting internal access to untrusted sources, which provides protection for the access layer, but this one-size-fits-all approach brings inconvenience to the building control system in frequently adding access devices. Another example: TLS encryption only protects information at the transmission layer, and does not protect data information at the access layer and storage layer. Moreover, after cracking the encryption of a single link, all transmission information of the link can be intercepted. It can be seen that the data security of the cloud server of the small-scale LAN needs to be improved during the process of device access, data storage, transmission and reading. Summary of the invention

[0004] The present application provides a data security management method, apparatus, electronic device and computer-readable medium to solve the technical problem of low data security in the device access, data transmission, storage and reading processes of the cloud server of the miniaturized local area network in the above-mentioned prior art.

[0005] According to one aspect of an embodiment of the present application, the present application provides a data security management method, the method comprising: constructing a data identity record library, the data identity record library being connected to a cloud server within a local area; configuring identity tags for access devices within the local area, the transmission data of the access devices, and the storage data of the access devices through the data identity record library, respectively, to obtain multiple identity tags for the access devices; and storing the multiple identity tags and the storage data of the access devices in the data identity record library.

[0006] Optionally, the data identity record library is used to configure identity tags for access devices within a local area, the transmission data of the access devices, and the storage data of the access devices, respectively, to obtain multiple identity tags for the access devices, including: performing a first identity calibration on each of the access devices within a local area through a preset encryption algorithm in the data identity record library to obtain a first identity tag for the access device; performing a second identity calibration on the transmission data of each of the access devices during data transmission through the preset encryption algorithm in the data identity record library to obtain a second identity tag for the access device; storing the transmission data in the data identity record library, and performing a third identity calibration on the storage data of each of the access devices through the preset encryption algorithm in the data identity record library to obtain a third identity tag for the access device.

[0007] Optionally, the first identity calibration is performed on each access device within the local area through the preset encryption algorithm in the data identity record library, including: obtaining a device access request for each access device within the local area to access the cloud server through the data identity record library; based on the device access request, performing an MD5 hash calculation on each access device according to the MD5 code generation rules set in the data identity record library, and configuring a first independent tag for each access device; based on the first independent tag, performing a first identity calibration on the corresponding access device to obtain the first identity tag of the access device.

[0008] Optionally, the transmission data of each access device during the data transmission process is subjected to a second identity calibration through the preset encryption algorithm in the data identity record library, including: obtaining the transmission data of each access device, and transmitting the transmission data of each access device in parallel based on a single-link multi-channel manner; performing MD5 hash calculation on each transmission data according to the MD5 code generation rules set in the data identity record library, and configuring a second independent label for each transmission data; and performing a second identity calibration on the transmission data of the corresponding access device based on the second independent label to obtain the second identity label of the access device.

[0009] Optionally, the transmission data is stored in the data identity record library, and the storage data of each access device is thirdly identified through a preset encryption algorithm in the data identity record library, including: storing the transmission data of each access device in a data storage table in the data identity record library to obtain the storage data; performing MD5 hash calculation on each storage data according to the MD5 code generation rules set in the data identity record library, and configuring a third independent tag for each storage data; and performing a third identity identification on the corresponding storage data based on the third independent tag to obtain the third identity tag of the access device.

[0010] Optionally, before performing the first identity calibration on the corresponding access device based on the first independent tag, the method also includes: performing a tag duplication check on the first independent tag of each access device through the data identity record library; if there are at least two access devices with the same first independent tag, reallocating the first independent tags of the access devices; if the first independent tags of each access device are different, performing the first identity calibration of each access device.

[0011] Optionally, the method also includes: obtaining a data reading request issued by the device to be accessed to the cloud server, and determining the identity tag and request data of the device to be accessed based on the data reading request; verifying the identity tag of the device to be accessed through the data identity record library, and detecting whether the identity tag of the device to be accessed is stored in the data identity record library; if the identity tag of the device to be accessed is already stored in the data identity record library, then passing the verification and sending multiple identity tags corresponding to the request data, and performing data reading based on the multiple identity tags of the request data; if the identity tag of the device to be accessed is not stored in the data identity record library, then the verification fails, and the device to be accessed is prohibited from performing data reading.

[0012] According to another aspect of an embodiment of the present application, the present application provides a data security management device, which includes: a construction module, used to construct a data identity record library, and the data identity record library is connected to a cloud server within a local area; a label configuration module, used to configure identity labels for access devices within the local area, transmission data of the access devices, and storage data of the access devices through the data identity record library, so as to obtain multiple identity labels of the access devices; a storage module, used to store the multiple identity labels and storage data of the access devices in the data identity record library.

[0013] According to another aspect of an embodiment of the present application, the present application provides an electronic device, including a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, the memory and the processor communicate through the communication bus and the communication interface, and the processor implements the steps of the data security management method when executing the computer program.

[0014] According to another aspect of an embodiment of the present application, the present application provides a computer-readable medium having a non-volatile program code executable by a processor, wherein the program code enables the processor to execute the steps of the data security management method.

[0015] The above technical solution provided by the embodiment of the present application has the following advantages compared with the related art:

[0016] A data security management method provided by the present application, by constructing a data identity record library for access to a cloud server within a local area, can not only realize the security management of identity tags and storage data of access devices, but also perform device verification based on identity tags when receiving data reading requests, which is more conducive to improving data security management capabilities; by configuring different identity tags for access devices, transmission data of access devices, and storage data stored by access devices in the data identity record library, a full-link data security protection is formed from the device layer to the cloud server, ensuring the security of access devices within the local area, ensuring that transmission data cannot be intercepted, and ensuring that storage data cannot be deciphered, so as to provide all-round information security protection, avoid attacks or data theft caused by unauthorized device access, and more safely and reliably protect user personal information within the local area. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A schematic diagram of a hardware environment for an optional data security management method provided according to an embodiment of the present application;

[0020] Figure 2 A schematic diagram of an optional data security management method flow chart provided according to an embodiment of the present application;

[0021] Figure 3 A schematic diagram of an optional access device accessing a digital base according to an embodiment of the present application;

[0022] Figure 4 An optional three-time identity calibration distribution diagram provided according to an embodiment of the present application;

[0023] Figure 5 An optional device access flow chart provided according to an embodiment of the present application;

[0024] Figure 6 An optional data reading flow chart provided according to an embodiment of the present application;

[0025] Figure 7 A structural diagram of an optional data security management device provided according to an embodiment of the present application;

[0026] Figure 8 A schematic diagram of an optional electronic device structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0028] In order to solve the problems mentioned in the background technology, according to one aspect of the embodiments of the present application, an embodiment of a data security management method is provided.

[0029] like Figure 1 As shown, the above data security management method can be applied to Figure 1 In the hardware environment shown. The system architecture 100 of the hardware environment includes a terminal device 101 and a server 103. The server 103 is connected to the terminal 101 through a network and can be used to provide services for the terminal or a client installed on the terminal. A database 105 can be set on the server or independently of the server to provide data storage services for the server 103. The network can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0030] The user can use the terminal device 101 to interact with the server 103 through the network to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, search applications, instant messaging tools, etc. Among them, the terminal device 101 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, dynamic image experts compression standard audio layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image experts compression standard audio layer 4) players, laptops and desktop computers, etc. The server 103 can be a server that provides various services, such as a background server that supports the pages displayed on the terminal device 101.

[0031] It should be noted that the data security management method provided in the embodiment of the present application is generally executed by a server and / or a terminal device, and accordingly, the data security management device is generally arranged in the server / terminal device. Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0032] like Figure 2 As shown, Figure 2 A flow chart of a data security management method provided by an embodiment of the present invention. Taking the data security management method executed by a server as an example, a data security management method includes the following steps:

[0033] Step S202: construct a data identity record library, wherein the data identity record library is connected to a cloud server within a local area.

[0034] In this embodiment, the data security management method provided is applicable to the scenario where devices in a local area access a cloud server for data security management, including devices between buildings such as factories and office buildings in the local area access a cloud server for data storage and data reading for security management. Among them, the local area of ​​the cloud server can be limited to the area where an office building is located in a district, etc. The specific range can be preset according to the actual scenario and is not limited here.

[0035] In this embodiment, combined with Figure 3As shown, the above-mentioned data identity record library can be constructed in the digital base of the cloud server, and the data identity record library can be connected to the cloud server by wireless or wired connection, wherein the digital base has the functions of access device access to the digital base protocol, parsing channel, data storage, data identity record library and data reading. Different access devices can correspond to different protocols, and the transmission data of different access devices are based on different parsing channels for data transmission. The parsing channel is responsible for parsing the received transmission data and transmitting it to the target location according to the protocol. In the data transmission process, the parsing channel plays the role of a bridge and a link, ensuring the accurate and efficient transmission of data. For example: Device A and Device B are connected to the digital base of the cloud server. Device A transmits data and communicates through parsing channel A based on protocol A, and Device B transmits data and communicates through parsing channel B based on protocol B. Parsing channel A and parsing channel B transmit data to the data identity record library for storage.

[0036] Furthermore, the above-mentioned protocol refers to all device protocols connected to the digital base, including but not limited to Modbus RTU, Modbus TCP and other access protocols. Of course, different devices can also communicate based on the same protocol, but use different resolution channels for data transmission. For example, both device A and device B use Modbus RTU communication, but device A uses resolution channel A for data transmission, and device B uses resolution channel B for data transmission. Among them, using different transmission channels for data transmission can ensure that data transmission does not interfere with each other.

[0037] In this embodiment, a data identity record library is established, which can be used to store and manage the transmission data of each access device and its corresponding identity calibration information, ensuring the security, reliability and efficiency of the database, so as to perform fast and accurate identity calibration during data transmission. The above-mentioned construction of the data identity record library can be designed in an overall architecture according to the target function. Among them, the target function of the data identity record library includes but is not limited to data storage, identity calibration, identity calibration information storage, device identity authentication, etc. Among them, identity calibration includes data encryption, so when constructing the data identity record library, it is necessary to determine the encryption technology, including hash algorithms such as MD5 and SHA-256. For data storage, it is necessary to determine the corresponding database management system, including but not limited to MySQL, PostgreSQL, etc. To construct the data identity record library, it is also necessary to construct database tables, including device information tables, data record tables, identity calibration record tables, etc., to store different types of information respectively.

[0038] Furthermore, the data identity record library accessing the cloud server within the local area also includes cloud server configuration: configuring the hardware and software environment of the cloud server according to requirements, ensuring the network connectivity between the cloud server and the data identity record library. Use a database connection tool or library to establish a connection between the data identity record library and the cloud server, and configure database connection parameters, such as IP address, port number, user name and password, etc.

[0039] In this embodiment, by constructing a data identity record library for access to a cloud server within a local area, not only can the security management of identity tags and storage data of access devices be achieved, but also device verification can be performed based on identity tags when receiving data reading requests, which is more conducive to improving data security management capabilities.

[0040] Step S204: identity tags are respectively configured for access devices within a local area, transmission data of the access devices, and storage data of the access devices through the data identity record library to obtain multiple identity tags for the access devices.

[0041] In this embodiment, when an access device within a local area accesses the cloud server, a different identity tag can be matched for each access device through the data identity record library when the device is accessed, so as to ensure that each access device has an independent identity. After the access device is officially connected, data will be transmitted through the parsing channel. When transmitting data, different identity tags are configured for the transmission data in each channel through the data identity record library again, so as to ensure that the data information during the transmission process cannot be intercepted. When the data transmission is completed and data is stored, different identity tags are configured for the storage data of each access device through the data identity record library, so as to ensure that the stored data cannot be deciphered, thereby improving the security of the stored data. In this way, the same access device will be calibrated in the three processes of access, data transmission and data storage, and three identity tags will be generated.

[0042] In some examples, before performing the next identity tag configuration, it can be determined whether the previous identity tag configuration was completed. When it is confirmed that the previous identity tag configuration was completed, the next identity tag configuration can be performed, otherwise a data anomaly can be reported. Through layer-by-layer detection before identity tag configuration, data security can be improved to ensure that the access device is within the local area, avoiding the situation where aggressive data intrusion causes system anomalies.

[0043] Step S206: Store the plurality of identity tags and the stored data of the access device in the data identity record library.

[0044] In this embodiment, the storage data and identity tags of the access device will be stored in different data tables of the data identity record library. The storage table names of the storage data and identity tags of the access device are different, and multiple data tables can be configured for the same type of data to achieve storage of more data. For example, the identity tag storage table includes identity tag A~C tables. In addition, a data mapping table can also be included to store the mapping relationship between the access device and the corresponding identity tag, so as to achieve fast search of the identity tag based on the access device.

[0045] In an embodiment of the present invention, by constructing a data identity record library for accessing a cloud server within a local area, not only can the security management of identity tags and storage data of access devices be achieved, but also device verification can be performed based on identity tags when receiving data reading requests, which is more conducive to improving data security management capabilities; by assigning different identity tags to access devices, transmission data of access devices, and storage data stored by access devices in the data identity record library, a full-link data security protection is formed from the device layer to the cloud server, ensuring the security of access devices within the local area, ensuring that transmission data cannot be intercepted, and ensuring that storage data cannot be deciphered, so as to provide all-round information security protection, avoid attacks or data theft caused by unauthorized device access, and more safely and reliably protect user personal information within the local area.

[0046] In an optional embodiment, the above step S204 specifically includes:

[0047] S2041, performing a first identity calibration on each access device within a local area by using a preset encryption algorithm in the data identity record library to obtain a first identity tag of the access device;

[0048] S2042, performing a second identity calibration on the transmission data of each access device during the data transmission process by using a preset encryption algorithm in the data identity record library to obtain a second identity tag of the access device;

[0049] S2043, storing the transmission data in the data identity record library, and performing a third identity calibration on the stored data of each access device through a preset encryption algorithm in the data identity record library to obtain a third identity tag of the access device.

[0050] Combination Figure 4As shown, in this embodiment, when the data identity record library detects that at least one access device in the local area requests to access the cloud server, the first identity calibration can be performed on each access device through a preset encryption algorithm to obtain a first identity tag of each access device. The first identity tag is used to encrypt each access device, and the first identity tag of each access device is different. The preset encryption algorithm includes but is not limited to MD5, SHA-256, TLS and other algorithms to achieve encryption and improve data security.

[0051] In some examples, after the access device is connected, each access device will perform data transmission, and an independent resolution channel will be allocated to each access device. The data transmission of each access device will form a single-link multi-channel access method, which is conducive to ensuring that the data are independent of each other and do not interfere with each other.

[0052] In this embodiment, when data is transmitted, the transmission data of each channel is again identified for the second time using the preset encryption algorithm in the data identity record library to obtain the second identity tag of the access device. The data transmission process is encrypted through identity identification, which helps to ensure that the data information during the transmission process cannot be intercepted.

[0053] In this embodiment, after the parsing channel completes the data transmission, the transmission data is transmitted to the data identity record library for storage. The stored data is actually the same as the transmission data, and the distinction is only to better describe the nodes of the three identity calibrations. Similarly, the storage data of each access device can be calibrated for the third time based on the preset encryption algorithm in the data identity record library to obtain the third identity tag of the access device and complete the encryption of the stored data. After layers of data identity calibration, it is helpful to ensure that the stored data cannot be deciphered.

[0054] In this embodiment, by providing a data identity record library with all-round security, from the device layer to the cloud server, identity calibration is performed layer by layer to achieve encryption, thereby improving all-round information security and effectively solving the problem of poor information security within the local area. In addition, data transmission using a single-link multi-channel data access method can ensure that data accessed to different devices are independent of each other.

[0055] In an optional embodiment, the above step S2041 specifically includes:

[0056] Obtaining, through the data identity record library, a device access request for each access device within a local area to access the cloud server;

[0057] Based on the device access request, perform MD5 hash calculation on each of the access devices according to the MD5 code generation rule set in the data identity record library, and configure a first independent tag for each of the access devices;

[0058] Based on the first independent tag, the corresponding access device is identified for the first time to obtain a first identity tag of the access device.

[0059] In some embodiments, the data encryption methods for access devices, transmission data, and storage data can be the same or different. To improve the efficiency and consistency of encryption, in this embodiment, the three encryption algorithms are described using MD5 (Message-Digest Algorithm 5) encryption. MD5 (Message-Digest Algorithm 5) is a widely used hash function that can generate a 128-bit (16-byte) hash value (usually expressed as a 32-bit hexadecimal number).

[0060] In this embodiment, if each access device within the local area wants to join the cloud server, it needs to send a device access request to the cloud server. After receiving the device access request sent by each access device, the data identity record library can extract the name of each device to distinguish different access devices. Then, a first independent tag is configured for each access device, and the first independent tag is calibrated by the MD5 code for the first identity calibration.

[0061] In some examples, when creating a data identity record library, MD5 code generation rules are pre-established to ensure that a unique and unpredictable MD5 code can be generated for each access device, each transmitted data, and each stored data, and the MD5 code generation rules can be formulated in combination with factors such as data integrity, security, and verifiability. In addition, the MD5 code can be used by the data identity record library to efficiently manage access devices. For example, the data identity record library maintains a list of MD5 hash values ​​of registered devices. When a new device attempts to access, it only needs to calculate the MD5 hash value of its identifier and compare it with the value in the list.

[0062] In this embodiment, within a local area, after obtaining a device access request from an access device, an MD5 hash calculation is performed based on the MD5 code generation rules preset in the data identity record library, and a first independent tag is configured for each access device. The first identity calibration is performed based on the assigned first independent tag, which can be used to verify the legitimacy of the device or user identity, and a unique first independent tag is generated for each access device, which helps the data identity record library to quickly identify and manage devices and improve the security of device management.

[0063] In an optional embodiment, in combination Figure 5 As shown, before the first identification of the corresponding access device is performed based on the first independent tag, the method further includes:

[0064] Performing tag duplication check on the first independent tag of each of the access devices through the data identity record library;

[0065] If there are at least two access devices having the same first independent tags, reallocating the first independent tags of the access devices;

[0066] If the first independent tags of the access devices are different, a first identity calibration is performed on the access devices.

[0067] In this embodiment, in order to ensure that the independent labels allocated to each access device are different, an independent label deduplication operation can be performed before the device is connected. Figure 5 As shown, when device A and device B request to access the digital base of the cloud server, the data identity record library in the digital base can configure the first independent tag for device A and device B respectively, and then the data identity record library will perform label duplication verification on the first independent tags of device A and device B, and determine whether there is already a label in the data identity record library that is the same as the currently assigned first independent tag, and then re-assign the first independent tag to device A or device B. Or if the data identity record library detects that the first independent tags assigned to device A and device B are the same, it will re-assign the first independent tags to device A and device B until there are no identical first independent tags, and then perform the first identity calibration of each access device. This can ensure that the data accessing different devices are independent of each other, do not interfere with each other, and the labels are unique, which facilitates the data identity record library to efficiently and accurately manage devices.

[0068] In this implementation, the first independent tag is checked for duplicates to ensure that the assigned first independent tag is unique, which can ensure that data accessed to different devices are independent of each other and do not interfere with each other, and the tags are unique, which facilitates the data identity record library to manage devices efficiently and accurately.

[0069] In an optional embodiment, the above step S2042 specifically includes:

[0070] Acquire the transmission data of each access device, wherein the transmission data of each access device is transmitted in parallel based on a single-link multi-channel mode;

[0071] Performing MD5 hash calculation on each of the transmission data according to the MD5 code generation rule set in the data identity record library, and configuring a second independent tag for each of the transmission data;

[0072] Based on the second independent tag, the transmission data of the corresponding access device is secondly identified to obtain a second identity tag of the access device.

[0073] In this embodiment, the transmission data of each access device is transmitted in parallel based on a single-link multi-channel mode, which can ensure that the data accessing different devices are independent of each other. When the access device is ready to enter the data transmission process, the device access request can be parsed to extract the transmission data of the access device. The data identity record library can perform MD5 hash calculation on the transmission data of each access device based on the set MD5 code generation rules, configure a second independent label for each transmission data, and then the data identity record library performs a second identity calibration on each transmission data according to the second independent label of each transmission data.

[0074] In some embodiments, the method of checking duplicate independent tags for the access device in the above embodiment can also be applied to checking duplicate second independent tags of transmitted data to ensure the uniqueness of the second independent tags assigned to each transmitted data, which facilitates storage and management of the data identity record library.

[0075] In this embodiment, after the first identity calibration, the transmission data of each access device is hashed based on the set MD5 code generation rules to configure a second independent tag, thereby achieving encryption during data transmission, enhancing data transmission security, and reducing the possibility of data being intercepted by intervening devices during data transmission.

[0076] In an optional embodiment, the above step S2043 specifically includes:

[0077] storing the transmission data of each of the access devices in the data storage table in the data identity record library to obtain the stored data;

[0078] Performing MD5 hash calculations on each of the stored data according to the MD5 code generation rules set in the data identity record library, and configuring a third independent tag for each of the stored data;

[0079] Based on the third independent tag, the corresponding stored data is thirdly identified to obtain a third identity tag of the access device.

[0080] In this embodiment, after the parsing channel transmits each transmission data to the data identity record library in the digital base, it will be stored in the data table corresponding to the data identity record library. At this time, the transmission data is converted into storage data in the data identity record library. The data storage can be stored in the order of the timestamps of the data received by the data identity record library. The data identity record library may include at least one data storage table, a device ID table, an identity tag storage table, an access device information storage table, etc. Different data tables are used to store different types of data. Among them, the data storage table is used for the transmission data of each access device within the local area; the device ID table is used to store the device information of each access device within the local area for distinction; the identity tag storage table is used to store the first identity tag, the second identity tag and the third identity tag; the access device information storage table is used to store the device information and reading information of the device to be accessed that sends a data read request to the cloud server.

[0081] Furthermore, after the second identity authentication, MD5 hash calculations can be performed on the storage data of each access device based on the MD5 code generation rules set in the data identity record library, and a third independent tag can be configured for each storage data. The data identity record library will perform a third identity authentication on the corresponding storage data based on each third independent tag.

[0082] In some examples, the method of checking duplicates of independent tags for access devices can also be applied to checking duplicates of third independent tags for storing data to ensure the uniqueness of the assigned third independent tags and facilitate efficient management and storage of the data identity record library.

[0083] In this embodiment, layer-by-layer data identity calibration is helpful to ensure that the stored data in the data identity record library cannot be deciphered, thereby improving data security and avoiding the possibility of malicious theft of the stored data in the data identity record library.

[0084] In an optional embodiment, the above step S206 specifically includes:

[0085] S2061, obtaining a data reading request sent by the device to be connected to the cloud server, and determining an identity tag and request data of the device to be connected based on the data reading request;

[0086] S2062, verifying the identity tag of the device to be connected through the data identity record library to detect whether the identity tag of the device to be connected is stored in the data identity record library;

[0087] S2063, if the identity tag of the device to be connected is already stored in the data identity record library, then pass the verification, send multiple identity tags corresponding to the request data, and read data based on the multiple identity tags of the request data;

[0088] S2064: If the identity tag of the device to be connected is not stored in the data identity record library, the verification fails, and the device to be connected is prohibited from reading data.

[0089] In this embodiment, the above-mentioned device to be accessed may be a device within the local area, or it may be an access device outside the local area. For access devices outside the local area, data reading will not be allowed. For data within the local area, the user's access rights, access level, etc. can also be determined based on the user's verification results to implement hierarchical management to determine the depth to which the user can read the data, so as to prevent the user from reading the data at will and causing the data to be stolen. For example: the general staff in the office building and the office building network management personnel have different corresponding network access rights and access levels, and the office building network management personnel have a deeper data reading depth.

[0090] Combination Figure 6 As shown, in this embodiment, the data identity record library stores information such as identity tags of all access devices within the local area. When other devices want to access information that has completed three identity calibrations, they need to perform identity authentication to determine whether the device to be accessed has access rights. Specifically, the data read request can be decoded to obtain the identity tag of the device to be accessed and the request data, where the identity tag can be the unique identification code, ID information, user name and login password of the device to be accessed. The identity tag of the device to be accessed can be further compared with the identity tags of each access device stored in the data identity record library to determine whether the identity tag of the device to be accessed has been stored in the data identity record library.

[0091] Furthermore, when the device is confirmed to be a legitimate device with security authorization, the data identity record library sends multiple identity tags of the requested data to be accessed to the device, and successfully accesses the storage layer of the data identity record library to read the data based on the multiple identity tags of the requested data obtained, and the depth of the read data corresponds to the user level; if the verification fails, the device to be accessed has no right to read the data. In some embodiments, the device to be accessed that is prohibited from reading data can also be marked, which is conducive to rapid identification when the device is accessed again next time.

[0092] In some examples, if the identity tag of the device to be connected is stored in the data identity record library, it means that the device to be connected is an access device within the local area and has been stored, so the device to be connected has passed the verification. The data identity record library will return the first identity tag, the second identity tag, and the third identity tag of the requested data of the device to be connected to the device to be connected. The device to be connected successfully accesses the storage layer of the data identity record library based on these three identity tags, determines the corresponding data table based on the type of the requested data, and then reads the data.

[0093] In other examples, if the identity tag of the device to be accessed is not stored in the data identity record library, it means that the device to be accessed may be risky or is an access device outside the local area, or it may be a new access device within the local area, etc. Among them, in the case where the device to be accessed is a newly added device within the local area, the device can be registered first, and the device information of the newly added device can be stored in the data identity record library before data reading. If it is detected that the identity tag of the device to be accessed is not stored in the data identity record library, it will indicate that the verification has failed, and the first identity tag, the second identity tag, and the third identity tag of the requested data will not be sent back to the device to be accessed, so data reading cannot be performed.

[0094] In this embodiment, the device to be connected to the cloud server can read the corresponding data in the data identity record library only after the data identity record library is verified, ensuring the accuracy of the data and ensuring that the stored data cannot be read at will, thereby improving the security of data storage within the local area and more securely protecting the user's personal information.

[0095] According to another aspect of the embodiment of the present application, Figure 7 As shown, corresponding to the data security management method in the above embodiment, this embodiment provides a data security management device, the device comprising:

[0096] A construction module 701 is used to construct a data identity record library, and the data identity record library is connected to a cloud server within a local area;

[0097] The label configuration module 703 is used to configure identity labels for access devices within a local area, transmission data of the access devices, and storage data of the access devices through the data identity record library, so as to obtain multiple identity labels of the access devices;

[0098] The storage module 705 is used to store the multiple identity tags and the storage data of the access device in the data identity record library.

[0099] Optionally, the label configuration module 703 includes: a first calibration submodule, which is used to perform a first identity calibration on each of the access devices within a local area through a preset encryption algorithm in the data identity record library, so as to obtain a first identity label of the access device; a second calibration submodule, which is used to perform a second identity calibration on the transmission data of each of the access devices during the data transmission process through a preset encryption algorithm in the data identity record library, so as to obtain a second identity label of the access device; and a third calibration submodule, which is used to store the transmission data in the data identity record library, and perform a third identity calibration on the storage data of each of the access devices through a preset encryption algorithm in the data identity record library, so as to obtain a third identity label of the access device.

[0100] Optionally, the first calibration submodule includes: a first acquisition subunit, used to obtain device access requests for each access device within a local area to access the cloud server through the data identity record library; a first calculation subunit, used to perform MD5 hash calculation on each access device based on the device access request and according to the MD5 code generation rules set in the data identity record library, and configure a first independent tag for each access device; the first calibration subunit is used to perform a first identity calibration on the corresponding access device based on the first independent tag to obtain the first identity tag of the access device.

[0101] Optionally, the second calibration unit includes: a second acquisition sub-unit, used to acquire the transmission data of each of the access devices, and the transmission data of each access device is transmitted in parallel based on a single-link multi-channel method; a second calculation sub-unit, used to perform MD5 hash calculation on each of the transmission data according to the MD5 code generation rules set in the data identity record library, and configure a second independent label for each of the transmission data; a second calibration sub-unit, used to perform a second identity calibration on the transmission data of the corresponding access device based on the second independent label to obtain the second identity label of the access device.

[0102] Optionally, the third calibration submodule includes: a data storage subunit, used to store the transmission data of each access device to the data storage table in the data identity record library to obtain the stored data; a third calculation subunit, used to perform MD5 hash calculation on each storage data according to the MD5 code generation rules set in the data identity record library, and configure a third independent label for each storage data; a third calibration subunit, used to perform a third identity calibration on the corresponding storage data based on the third independent label to obtain the third identity label of the access device.

[0103] Optionally, the device also includes a duplication checking module, which is used to perform a duplication check on the first independent label of each of the access devices through the data identity record library; if there are at least two of the access devices with the same first independent label, the first independent labels of the access devices are reallocated; if the first independent labels of each of the access devices are different, the first identity calibration of each of the access devices is performed.

[0104] Optionally, the device also includes: a data reading module, used to obtain a data reading request issued by the device to be accessed to the cloud server, and determine the identity tag and request data of the device to be accessed based on the data reading request; verify the identity tag of the device to be accessed through the data identity record library, and detect whether the identity tag of the device to be accessed is stored in the data identity record library; if the identity tag of the device to be accessed is already stored in the data identity record library, then pass the verification and send multiple identity tags corresponding to the request data, and read the data based on the multiple identity tags of the request data; if the identity tag of the device to be accessed is not stored in the data identity record library, then the verification fails, and the device to be accessed is prohibited from reading the data.

[0105] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware.

[0106] It should be noted here that the suffixes such as module, component, unit, sub-module, and sub-unit used to represent elements described in the above device are only for the convenience of description of this application and have no specific meaning in themselves. Therefore, they can be used in combination.

[0107] According to another aspect of the embodiments of the present application, the present application provides an electronic device, such as Figure 8 As shown, it includes a memory 801, a processor 803, a communication interface 805 and a communication bus 807. The memory 801 stores a computer program that can be run on the processor 803. The memory 801 and the processor 803 communicate through the communication interface 805 and the communication bus 807. When the processor 803 executes the computer program, the steps of the above-mentioned data security management method are implemented.

[0108] The memory and processor in the above electronic device communicate via a communication bus and a communication interface. The communication bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc.

[0109] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0110] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0111] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the steps of the data security management method in any of the above embodiments.

[0112] Optionally, in an embodiment of the present application, the computer-readable medium is configured to store a program code for the processor to execute the steps of the data security management method described below, and the data security management method includes the steps of:

[0113] Step S202, constructing a data identity record library, wherein the data identity record library is connected to a cloud server within a local area;

[0114] Step S204, configuring identity tags for access devices within a local area, transmission data of the access devices, and storage data of the access devices respectively through the data identity record library, to obtain multiple identity tags for the access devices;

[0115] Step S206: Store the plurality of identity tags and the stored data of the access device in the data identity record library.

[0116] Optionally, the specific examples in this embodiment can refer to the examples described in the above embodiments, and this embodiment will not be repeated here. And when the embodiments of this application are specifically implemented, they can refer to the above embodiments and have corresponding technical effects.

[0117] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0118] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0119] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0120] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0121] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0123] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0124] It should be noted that, in this article, relational terms such as first, second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0125] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A data security management method, characterized in that: The method comprises: Building a data identity record library, wherein the data identity record library is connected to a cloud server within a local area; By using the data identity record library, identity tags are respectively configured for access devices within a local area, transmission data of the access devices, and storage data of the access devices, thereby obtaining multiple identity tags for the access devices; The plurality of identity tags and the stored data of the access device are stored in the data identity record library.

2. The data security management method according to claim 1, characterized in that: The step of configuring identity tags for access devices within a local area, transmission data of the access devices, and storage data of the access devices through the data identity record library to obtain multiple identity tags for the access devices includes: Performing a first identity calibration on each of the access devices within a local area by using a preset encryption algorithm in the data identity record library to obtain a first identity tag of the access device; Performing a second identity calibration on the transmission data of each access device during the data transmission process by using a preset encryption algorithm in the data identity record library to obtain a second identity tag of the access device; The transmission data is stored in the data identity record library, and the storage data of each access device is thirdly identified by a preset encryption algorithm in the data identity record library to obtain a third identity tag of the access device.

3. The data security management method according to claim 2, characterized in that: The first identification of each access device within the local area is performed by using a preset encryption algorithm in the data identity record library, including: Obtaining, through the data identity record library, a device access request for each access device within a local area to access the cloud server; Based on the device access request, perform MD5 hash calculation on each of the access devices according to the MD5 code generation rule set in the data identity record library, and configure a first independent tag for each of the access devices; Based on the first independent tag, the corresponding access device is identified for the first time to obtain a first identity tag of the access device.

4. The data security management method according to claim 2, characterized in that: The second identification of the transmission data of each access device during the data transmission process is performed by using a preset encryption algorithm in the data identity record library, including: Acquire the transmission data of each access device, wherein the transmission data of each access device is transmitted in parallel based on a single-link multi-channel mode; Performing MD5 hash calculation on each of the transmission data according to the MD5 code generation rule set in the data identity record library, and configuring a second independent tag for each of the transmission data; Based on the second independent tag, the transmission data of the corresponding access device is secondly identified to obtain a second identity tag of the access device.

5. The data security management method according to claim 2, characterized in that: The storing of the transmission data in the data identity record library and performing a third identity calibration on the storage data of each access device by using a preset encryption algorithm in the data identity record library include: storing the transmission data of each of the access devices in the data storage table in the data identity record library to obtain the stored data; Performing MD5 hash calculations on each of the stored data according to the MD5 code generation rules set in the data identity record library, and configuring a third independent tag for each of the stored data; Based on the third independent tag, the corresponding stored data is thirdly identified to obtain a third identity tag of the access device.

6. The data security management method according to claim 3, characterized in that: Before performing a first identification on the corresponding access device based on the first independent tag, the method further includes: Performing tag duplication check on the first independent tag of each of the access devices through the data identity record library; If there are at least two access devices having the same first independent tags, reallocating the first independent tags of the access devices; If the first independent tags of the access devices are different, a first identity calibration is performed on the access devices.

7. The data security management method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtaining a data reading request sent by the device to be connected to the cloud server, and determining an identity tag and request data of the device to be connected based on the data reading request; Verifying the identity tag of the device to be connected through the data identity record library to detect whether the identity tag of the device to be connected is stored in the data identity record library; If the identity tag of the device to be connected is already stored in the data identity record library, then the multiple identity tags corresponding to the requested data are sent after verification, and data is read based on the multiple identity tags of the requested data; If the identity tag of the device to be connected is not stored in the data identity record library, the verification fails and the device to be connected is prohibited from reading data.

8. A data security management device, characterized in that: The device comprises: A construction module, used to construct a data identity record library, wherein the data identity record library is connected to a cloud server within a local area; A label configuration module, used to configure identity labels for access devices within a local area, transmission data of the access devices, and storage data of the access devices respectively through the data identity record library, so as to obtain multiple identity labels of the access devices; The storage module is used to store the multiple identity tags and the storage data of the access device in the data identity record library.

9. An electronic device, comprising a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, and the memory and the processor communicate through the communication bus and the communication interface, characterized in that: When the processor executes the computer program, the data security management method described in any one of claims 1 to 7 is implemented.

10. A computer readable medium having a non-volatile program code executable by a processor, characterized in that: The program code enables the processor to execute the data security management method described in any one of claims 1 to 7.

Images